# What changed in pacote > 31 changes in pacote 13 to 22 from its official release notes, upgrade guides and advisories: 12 breaking, 2 security, 8 new APIs and options. Each one cited. Sources checked 2026-11-14. HTML: https://unstale.sh/npm/pacote/ To see which of these apply to a repository, run `npx @unstale/cli init` in it. ## pacote 22 ### Breaking changes - Git specs using https or git+https now resolve to git+https URLs instead of being switched to git+ssh. (22.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v22.0.0) - pacote now requires Node.js ^22.22.2 || ^24.15.0 || >=26.0.0. (22.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v22.0.0) - patchedDependencies is stripped from the package.json included in packed packages. (22.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v22.0.0) ### Security - Fixes verification of registry manifest identity. (19.0.3, 21.5.2, 22.0.1) — [release notes](https://github.com/npm/pacote/releases/tag/v21.5.2), [release notes](https://github.com/npm/pacote/releases/tag/v19.0.3), [release notes](https://github.com/npm/pacote/releases/tag/v22.0.1) - pacote is vulnerable to Denial of Service (DoS) via the addGitSha function (21.5.1, 22.0.0) — [security advisory](https://github.com/advisories/GHSA-W4PP-8PJF-RMXW), [release notes](https://github.com/npm/pacote/releases/tag/v22.0.0), [release notes](https://github.com/npm/pacote/releases/tag/v21.5.1) ### Behavior and default changes - The globalIgnoreFile option is now forwarded to npm-packlist. (22.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v22.0.0) ### Fixes and other changes - Git dependencies are prepared with --global=false. (22.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v22.0.0) - Pacote falls back to git clone when a tarball response is not a valid archive. (22.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v22.0.0) - The ignoreScripts option is now respected for git dependencies. (21.5.3, 22.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.5.3), [release notes](https://github.com/npm/pacote/releases/tag/v22.0.0) ## pacote 21 ### Breaking changes - bun.lockb files are now included in the strict ignore list during packing. (21.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.0.0) - This module is compatible with Node.js ^20.17.0 || >=22.9.0. (21.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.0.0) ### New APIs and options - Fetched attestation bundles are exposed on the manifest. (21.5.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.5.0) - Adds the allowRegistry option. (21.4.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.4.0) - Adds the allowDirectory option. (21.2.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.2.0) - Adds the allowFile option. (21.2.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.2.0) - Adds the allowRemote option. (21.2.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.2.0) - Adds gitSubdir support according to the npa spec. (21.2.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.2.0) - Adds the allowGit option. (21.1.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.1.0) ### Behavior and default changes - Adds support for git-256 SHA lengths. (21.3.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.3.0) ### Fixes and other changes - Prevents path duplication in attestation URLs for registries with paths. (21.4.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.4.0) - Skips the registry key check for keyless Sigstore/Fulcio attestations. (21.4.0) — [release notes](https://github.com/npm/pacote/releases/tag/v21.4.0) - Ensures the resolved git ref matches the expected SHA. (21.3.1) — [release notes](https://github.com/npm/pacote/releases/tag/v21.3.1) ## pacote 20 ### Fixes and other changes - Pacote now honors the ignoreScripts option to prevent the prepare lifecycle script. (20.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v20.0.0) ## pacote 19 ### Breaking changes - pacote now supports Node.js ^18.17.0 || >=20.5.0, aligning its engine range with npm 10. (19.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v19.0.0) ## pacote 18 ### Breaking changes - The silent option was removed; output is now emitted via process.emit('output'). (18.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v18.0.0) ## pacote 17 ### Breaking changes - Support for Node.js versions <=16.13 has been removed. (17.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v17.0.0) ## pacote 16 ### Breaking changes - Support for Node.js 14 has been removed. (16.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v16.0.0) ## pacote 15 ### Breaking changes - Pacote no longer attempts to change file ownership automatically. (15.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v15.0.0) ## pacote 13 ### Breaking changes - Pacote drops support for the log property and uses proc-log. (13.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v13.0.0) - A boolean silent value replaces the use of npmlog.level and suppresses @npmcli/run-script banners. (13.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v13.0.0) ### New APIs and options - Adds the fullReadJson option. (13.0.0) — [release notes](https://github.com/npm/pacote/releases/tag/v13.0.0)