npm CLI v11.10.0 introduces two generally available features. First, bulk OIDC trusted publishing configuration lets maintainers configure multiple packages at once via the `npm trust` command. Second, a new `--allow-git` flag provides explicit control over git dependencies during `npm install`, closing a security gap where git dependencies could override the git executable path and execute arbitrary code even when `--ignore-scripts` was set. The flag currently defaults to `all` for backward compatibility, but `--allow-git=none` is strongly recommended and will become the default in npm CLI v12.
222 Impressions