v21.4.0

21.4.0 (2026-02-24)

Features

• 6912f24 #451 add allowRegistry option (#451) (@wraithgar)

Bug Fixes

• ab37bc1 #452 prevent path duplication in attestation URL for registries with … (#452) (@ajayk)
• ab37bc1 #452 prevent path duplication in attestation URL for registries with (@ajayk)
• 8b8ea3b #454 skip registry key check for keyless (Sigstore/Fulcio) attestations (#454) (@ajayk)
• 8b8ea3b #454 skip registry key check for keyless (Sigstore/Fulcio) attestations (@ajayk)

Chores

• 0dfd1cd #456 remove git config from tests (#456) (@wraithgar)

v21.3.1

21.3.1 (2026-02-10)

Bug Fixes

• 96e571a #439 ensure that resolved git ref matches expected sha (#439) (@klassiker, pacotedev)

Chores

• 91847c4 #447 fix test for ssri ignoring invalid hashes (#447) (@wraithgar)

v21.3.0

21.3.0 (2026-02-09)

Features

• 8f5091d #445 add support for git-256 sha lengths (#445) (@wraithgar)

v21.2.0

21.2.0 (2026-02-06)

Features

• db21624 #442 implement gitSubdir according to npa spec (#442) (@Kakadus)
• c2a4217 #443 add allowRemote, allowFile, allowDirectory (#443) (@wraithgar)

v21.1.0

21.1.0 (2026-01-28)

Features

• 258e5fd #440 add allowGit option (#440) (@wraithgar)

v21.0.4

21.0.4 (2025-11-13)

Dependencies

• edbcc02 #436 proc-log@6.0.0
• 8dc1f22 #436 @npmcli/installed-package-contents@4.0.0
• 505c3b0 #436 ssri@13.0.0
• a23fb17 #436 @npmcli/promise-spawn@9.0.0

Chores

• ff261aa #436 @npmcli/eslint-config@6.0.0 (@wraithgar)
• 2bba862 #436 @npmcli/template-oss@4.28.0 (@wraithgar)

v21.0.3

21.0.3 (2025-09-17)

Dependencies

• eed1bd5 #431 @npmcli/git@7.0.0 (#431)

v21.0.2

21.0.2 (2025-09-17)

Dependencies

• 32cb6d1 #429 npm-pick-manifest@11.0.1 (#429)

v21.0.1

21.0.1 (2025-09-02)

Dependencies

• aae7798 #428 @npmcli/run-script@10.0.0
• 1b233e3 #428 @npmcli/package-json@7.0.0
• d4b97ec #428 sigstore@4.0.0
• cf27487 #428 npm-registry-fetch@19.0.0
• 3e89235 #428 npm-packlist@10.0.1
• d46fc27 #428 npm-package-arg@13.0.0
• 2a6a9f0 #428 hosted-git-info@9.0.0
• bbb72cf #428 cacache@20.0.0
• 8a642c0 #426 tar@7.4.3 (#426)

Chores

• f81d8ed #417 bump @npmcli/arborist from 8.0.0 to 9.0.0 (#417) (@dependabot[bot])
• 0310b7b #422 tests should not inherit --ignore-scripts flag from `npm run t… (#422) (@owlstronaut)

v21.0.0

21.0.0 (2024-11-25)

⚠️ BREAKING CHANGES

• bun.lockb files are now included in the strict ignore list during packing
• this module is now compatible with the following node versions: ^20.17.0 || >=22.9.0

Bug Fixes

• 844dc08 update node engines to ^20.17.0 || >=22.9.0 (#414) (@wraithgar)

Dependencies

• 2cb6fa7 #415 npm-packlist@10.0.0 (#415)
• 47b928c #412 replace node builtin rmSync with rimraf (#412) (@mbtools)

Chores

• b6f35a2 #402 bump @npmcli/arborist from 7.5.4 to 8.0.0 (#402) (@dependabot[bot])
• 1ef54ba #408 support tests on win32 (#408) (@mbtools)
• 555b000 #401 bump @npmcli/template-oss from 4.23.3 to 4.23.4 (#401) (@dependabot[bot], @npm-cli-bot)