CHANGELOG.md

Changelog

11.3.0 (2026-06-22)

Features

• ec0f6c4 #294 exclude root .npm-extension.mjs/.cjs from package tarballs (#294) (@manzoorwanijk)

Chores

• d5ab08c #293 bump @npmcli/template-oss from 5.1.0 to 5.1.1 (#293) (@dependabot[bot], @npm-cli-bot)

11.2.0 (2026-06-05)

Features

• 7e2513d #291 exclude patchedDependencies patch files from the package tarball (#291) (@manzoorwanijk)

11.1.0 (2026-05-22)

Features

• 1369ec3 #287 support a user level ignore file via globalIgnoreFile (#287) (@ljharb)

Chores

• e1f3d11 #289 bump @npmcli/eslint-config from 6.0.1 to 7.0.0 (#289) (@dependabot[bot])

11.0.0 (2026-05-15)

⚠️ BREAKING CHANGES

• npm-packlist now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
• template-oss-apply
• Entries in files[] are now interpreted as glob patterns anchored to the package root, with no special-case overrides. Slashless negations like !readme.md only match at the root — use !**/readme.md to remove at every depth. An exact file path in files[] no longer overrides a nested .npmignore rule that excludes it; remove the rule from .npmignore if you need such a file to ship. Listing a default-ignored file (e.g. .npmignore, .npmrc) in files[] no longer forces it to be packed.
• npm-shrinkwrap.json is no longer included in published tarballs by default. Publishers who need to ship a locked dependency tree should use bundleDependencies; publishers with a legitimate reason to include a file literally named npm-shrinkwrap.json can still opt back in with a negated files entry.
• bun.lock is now excluded from package contents by default. If you need to include it, add "bun.lock" to the "files" array in your package.json.

Features

• da9502e #286 bump to new node engine range (@owlstronaut)
• 943b8ec #286 template-oss-apply (@owlstronaut)
• 2ec1c00 #281 exclude npm-shrinkwrap.json from package contents (@owlstronaut)
• 59a8d0f #279 exclude bun.lock from package contents (@owlstronaut)

Bug Fixes

• 8e8d6ee #282 use real glob semantics for package.json files array (@owlstronaut)

Dependencies

• cda441f #286 proc-log@7.0.0
• 356d0b6 #286 ignore-walk@9.0.0

Chores

• e768b3a #286 template-oss-apply (@owlstronaut)
• b1c2c16 #286 bumping @npmcli/template-oss from 4.30.0 to 5.1.0 (@owlstronaut)
• 13f4e2b #279 template-oss-apply (@owlstronaut)
• 261224f #278 bump @npmcli/template-oss from 4.29.0 to 4.30.0 (#278) (@dependabot[bot], @npm-cli-bot)

10.0.4 (2026-02-20)

Bug Fixes

• ae8cbee #276 only warn about gitignore fallback at package root, not subdirectories (#276) (@umeshmore45)

Chores

• de1e875 #272 bump @npmcli/eslint-config from 5.1.0 to 6.0.0 (#272) (@dependabot[bot])
• 04102d9 #275 bump @npmcli/template-oss from 4.28.1 to 4.29.0 (#275) (@dependabot[bot], @npm-cli-bot, @owlstronaut)

10.0.3 (2025-10-22)

Dependencies

• 7b4c677 #270 bump proc-log from 5.0.0 to 6.0.0 (#270) (@dependabot[bot])

Chores

• c23dea8 #269 bump @npmcli/template-oss from 4.26.0 to 4.27.1 (#269) (@dependabot[bot], @npm-cli-bot)

10.0.2 (2025-09-22)

Bug Fixes

• 566ffc2 #265 log warning for .gitignore versus .npmignore logic (#265) (@simwai)

Chores

• 5d905ef #266 bump @npmcli/template-oss from 4.25.0 to 4.25.1 (#266) (@dependabot[bot], @npm-cli-bot)

10.0.1 (2025-07-24)

Dependencies

• 4bd0838 #262 ignore-walk@8.0.0

Chores

• 7e5f43b #256 bump @npmcli/arborist from 8.0.0 to 9.0.0 (#256) (@dependabot[bot])
• 7e3cd57 #261 bump @npmcli/template-oss from 4.24.4 to 4.25.0 (#261) (@dependabot[bot], @owlstronaut)

10.0.0 (2024-11-25)

⚠️ BREAKING CHANGES

• this module is now compatible with the following node versions: ^20.17.0 || >=22.9.0
• bun.lockb is now included in the strict ignorelist

Features

• 9f74fd3 #168 add bun.lockb to ignorelist (#168) (@antongolub)

Bug Fixes

• 67fef03 update engines to ^20.17.0 || >=22.9.0 (#254) (@wraithgar)

Chores

• fd425fa bump @npmcli/eslint-config from 4.0.5 to 5.0.1 (#250) (@dependabot[bot])
• 3b66b5a #252 bump @npmcli/arborist from 7.5.4 to 8.0.0 (#252) (@dependabot[bot])
• e688d26 bump @npmcli/template-oss from 4.23.3 to 4.23.4 (#251) (@dependabot[bot], @npm-cli-bot)

9.0.0 (2024-09-25)

⚠️ BREAKING CHANGES

• npm-packlist now supports node ^18.17.0 || >=20.5.0

Bug Fixes

• 4679b12 #247 align to npm 10 node engine range (@hashtagchris)

Dependencies

• b0500f4 #247 ignore-walk@7.0.0

Chores

• 46ed801 #245 bump @npmcli/eslint-config from 4.0.5 to 5.0.0 (#245) (@dependabot[bot])
• 625ddca #240 bump @npmcli/arborist from 6.5.1 to 7.5.4 (#240) (@dependabot[bot])
• e2eb28d #247 run template-oss-apply (@hashtagchris)
• 3c27bb3 #230 bump @npmcli/template-oss to 4.22.0 (@lukekarrys)
• fa9e80d #242 bump @npmcli/template-oss from 4.22.0 to 4.23.3 (#242) (@dependabot[bot])
• cb4a823 #230 postinstall for dependabot template-oss PR (@lukekarrys)

8.0.2 (2024-01-03)

Bug Fixes

• 728d68a #214 handling of directory glob (#214) (@mohd-akram)
• 837af58 #210 avoid modifying singleton variable (#210) (@mohd-akram)

8.0.1 (2023-12-06)

Bug Fixes

• 8fc4df1 #204 always ignore .npmrc files at every level (@wraithgar)
• cd5ddbd #205 preserve slashes in specified files (#205) (@mohd-akram)

Dependencies

• 6058cc5 #204 ignore-walk@6.0.4

Chores

• 20fe0cd #207 bump @npmcli/template-oss from 4.21.1 to 4.21.2 (#207) (@dependabot[bot], @lukekarrys)
• f8be7bd #202 bump @npmcli/template-oss from 4.19.0 to 4.21.1 (#202) (@dependabot[bot], @lukekarrys)
• 8e1d900 #204 tests reflect fixed ignore-walk rules (@wraithgar)
• 6d7cbe9 #181 postinstall for dependabot template-oss PR (@lukekarrys)
• 80ec501 #181 bump @npmcli/template-oss from 4.18.1 to 4.19.0 (@dependabot[bot])
• f327738 #179 postinstall for dependabot template-oss PR (@lukekarrys)
• a770a96 #179 bump @npmcli/template-oss from 4.18.0 to 4.18.1 (@dependabot[bot])

8.0.0 (2023-08-24)

⚠️ BREAKING CHANGES

• The files array can now be used to exclude non-root readme, license, licence, and copying files.

Bug Fixes

• 24344a2 #173 exclude non-root README.md/LICENSE files (#173) (@AaronHamilton965, @rahulio96)

7.0.4 (2022-12-07)

Bug Fixes

• e5256de #149 skip missing optional deps when bundling, closes npm/cli#5924 (#149) (@nlf)

7.0.3 (2022-12-07)

Bug Fixes

• c6f2b69 #147 treat glob the same as globstar (#147) (@lukekarrys)

7.0.2 (2022-10-26)

Bug Fixes

• d5b653c #140 account for directories and files prefixed with ./ (#140) (@wraithgar)

7.0.1 (2022-10-17)

Dependencies

• 250d589 #136 bump ignore-walk from 5.0.1 to 6.0.0

7.0.0 (2022-10-04)

Features

• b83e0aa #133 set as release (@fritzy)

7.0.0-pre.1 (2022-10-03)

⚠️ BREAKING CHANGES

• if npm-shrinkwrap.json is included in your .npmignore, the shrinkwrap will now be excluded from your packlist.

Features

• 5e80968 #131 npm-shrinkwrap.json files can now be ignored (#131) (@fritzy)

7.0.0-pre.0 (2022-09-26)

⚠️ BREAKING CHANGES

• tree is now the first parameter
• the arborist tree must now be provided in the options and will not be generated for you. the npm-packlist bin has also been removed.

Features

• 87c778e make the required tree the first parameter (@lukekarrys)
• 123875a remove dependency on arborist, require tree to be passed in (@nlf)

6.0.1 (2022-09-23)

Dependencies

• f823be6 #125 arborist@5||6||6.pre

6.0.0 (2022-09-21)

⚠️ BREAKING CHANGES

• this module now follows a strict order of operations when applying ignore rules. if a files array is present in the package.json, then rules in .gitignore and .npmignore files from the root will be ignored.
• npm-packlist is now compatible with the following semver range for node: ^14.17.0 || ^16.13.0 || >=18.0.0

Features

• c37371b #88 change interactions between files array and ignore files to be more consistent (#88) (@nlf)
• a2c96ef #123 postinstall for dependabot template-oss PR (@lukekarrys)

5.1.3 (2022-08-25)

Dependencies

• bump npm-bundled from 1.1.2 to 2.0.0 (#113) (de5e96b)

5.1.2 (2022-08-23)

Dependencies

• bump npm-normalize-package-bin from 1.0.1 to 2.0.0 (#110) (c97d1a8)

5.1.1 (2022-05-31)

Bug Fixes

• correctly ignore .gitignore when a .npmignore is present (#108) (da1ba4a)

5.1.0 (2022-05-25)

Features

• correctly handle workspace roots (#104) (d74bdd1)

5.0.4 (2022-05-19)

Bug Fixes

• do not pack workspaces by default (0f31f71)
• respect gitignore and npmignore files in workspace roots (839e6e8)

5.0.3 (2022-05-04)

Bug Fixes

• strip leading ./ from files array entries (#97) (9f519b7)

5.0.2 (2022-04-21)

Bug Fixes

• normalize win32 paths before globbing (16f1343)

5.0.1 (2022-04-20)

Dependencies

• bump glob from 7.2.0 to 8.0.1 (#90) (dc3d40a)

5.0.0 (2022-04-06)

⚠ BREAKING CHANGES

• this module no longer supports synchronous usage

Features

• remove synchronous interface (#80) (eb68f64)

Bug Fixes

• remove polynomial regex (b2e2f7b)
• replace deprecated String.prototype.substr() (#85) (79d6f7e)

Dependencies

• bump ignore-walk from 4.0.1 to 5.0.1 (#87) (0e241f5)

4.0.0 (2022-03-03)

⚠ BREAKING CHANGES

• This drops support for node10 and non-LTS versions of node12 and node14

Bug Fixes

• always ignore pnpm-lock.yaml (#72) (f56a4cf)

• @npmcli/template-oss@2.9.1 (0401893)

Dependencies

• update glob requirement from ^7.1.6 to ^7.2.0 (#70) (d6b34ac)
• update npm-bundled requirement from ^1.1.1 to ^1.1.2 (#71) (2a5e140)