npm / pacote
pacote
What changed in pacote 13 to 22, from its official release notes, upgrade guides and advisories. Also covers @types/pacote. Sources checked 2026-11-14.
12 breaking2 security8 new APIs and options2 behavior and defaults7 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpacote 229 changes
Breaking changes 3
Git specs using https or git+https now resolve to git+https URLs instead of being switched to git+ssh.
pacote now requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0.
patchedDependencies is stripped from the package.json included in packed packages.
Security 2
Fixes verification of registry manifest identity.
pacote is vulnerable to Denial of Service (DoS) via the addGitSha function
Behavior and default changes 1
The globalIgnoreFile option is now forwarded to npm-packlist.
Fixes and other changes 3
Git dependencies are prepared with --global=false.
Pacote falls back to git clone when a tarball response is not a valid archive.
The ignoreScripts option is now respected for git dependencies.
pacote 2113 changes
Breaking changes 2
bun.lockb files are now included in the strict ignore list during packing.
This module is compatible with Node.js ^20.17.0 || >=22.9.0.
New APIs and options 7
Fetched attestation bundles are exposed on the manifest.
Adds the allowRegistry option.
Adds the allowDirectory option.
Adds the allowFile option.
Adds the allowRemote option.
Adds gitSubdir support according to the npa spec.
Adds the allowGit option.
Behavior and default changes 1
Adds support for git-256 SHA lengths.
Fixes and other changes 3
Prevents path duplication in attestation URLs for registries with paths.
Skips the registry key check for keyless Sigstore/Fulcio attestations.
Ensures the resolved git ref matches the expected SHA.
pacote 201 changes
Fixes and other changes 1
Pacote now honors the ignoreScripts option to prevent the prepare lifecycle script.
pacote 191 changes
Breaking changes 1
pacote now supports Node.js ^18.17.0 || >=20.5.0, aligning its engine range with npm 10.
pacote 181 changes
Breaking changes 1
The silent option was removed; output is now emitted via process.emit('output').
pacote 171 changes
Breaking changes 1
Support for Node.js versions <=16.13 has been removed.
pacote 161 changes
Breaking changes 1
Support for Node.js 14 has been removed.
pacote 151 changes
Breaking changes 1
Pacote no longer attempts to change file ownership automatically.
pacote 133 changes
Breaking changes 2
Pacote drops support for the log property and uses proc-log.
A boolean silent value replaces the use of npmlog.level and suppresses @npmcli/run-script banners.
New APIs and options 1
Adds the fullReadJson option.