# What changed in npm-packlist

> 18 changes in npm-packlist 4 to 11 from its official release notes, upgrade guides and advisories: 12 breaking, 1 new APIs and options. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/npm/npm-packlist/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## npm-packlist 11

### Breaking changes

- Patch files referenced by patchedDependencies are excluded from the package tarball. (11.2.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v11.2.0)
- bun.lock is now excluded from package contents by default; add it to the package.json files array to include it. (11.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v11.0.0)
- npm-packlist now supports Node.js ^22.22.2 || ^24.15.0 || >=26.0.0. (11.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v11.0.0)
- npm-shrinkwrap.json is no longer included in published tarballs by default; use bundleDependencies to ship a locked dependency tree. (11.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v11.0.0)
- Entries are now root-anchored glob patterns with no special-case overrides; slashless negations match only at the root, and nested .npmignore exclusions and default-ignored files are no longer overridden. (11.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v11.0.0)

### New APIs and options

- Supports a user-level ignore file via globalIgnoreFile, allowing users to specify ignore rules at the user level. (11.1.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v11.1.0)

### Behavior and default changes

- Root .npm-extension.mjs and .cjs files are excluded from package tarballs. (11.3.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v11.3.0)
- Root .npm-extension.mjs and .cjs files are excluded from package tarballs. (11.3.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v11.3.0)

## npm-packlist 10

### Breaking changes

- bun.lockb is now included in the strict ignorelist, affecting which files npm-packlist includes. (10.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v10.0.0)
- The supported Node.js versions are now ^20.17.0 || >=22.9.0. (10.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v10.0.0)

### Fixes and other changes

- Warnings about gitignore fallback are now emitted only at the package root, not in subdirectories. (10.0.4) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v10.0.4)

## npm-packlist 9

### Breaking changes

- The supported Node.js range is now ^18.17.0 || >=20.5.0, so developers must use a compatible Node.js version. (9.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v9.0.0)

## npm-packlist 8

### Behavior and default changes

- The files array can now exclude non-root readme, license, licence, and copying files. (8.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v8.0.0)

## npm-packlist 6

### Breaking changes

- The supported Node.js semver range is ^14.17.0 || ^16.13.0 || >=18.0.0. (6.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v6.0.0)
- When a files array is present, root .gitignore and .npmignore rules are ignored under the strict order of operations for applying ignore rules. (6.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v6.0.0)

## npm-packlist 5

### Breaking changes

- Synchronous usage is no longer supported; developers must use the asynchronous interface. (5.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v5.0.0)

## npm-packlist 4

### Breaking changes

- Support for node10 and non-LTS versions of node12 and node14 was dropped. (4.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v4.0.0)

### Fixes and other changes

- pnpm-lock.yaml is now always ignored. (4.0.0) — [release notes](https://github.com/npm/npm-packlist/releases/tag/v4.0.0)