feat: native dependency patching (npm patch add/commit/update/ls/rm) by manzoorwanijk · Pull Request #9439 · npm/cli

feat(arborist): apply patchedDependencies during reify

manzoorwanijk

committed

feat(config): add patches-dir and patch relax flags

manzoorwanijk

committed

feat(arborist): re-extract on patch change and validate patch hash in npm ci

manzoorwanijk

committed

feat(patch): add npm patch command (add/commit/ls/rm)

manzoorwanijk

committed

test(arborist): unit tests for patch apply and selector matching

manzoorwanijk

committed

fix(arborist): clear stale patch records when a selector is removed

manzoorwanijk

committed

test(patch): integration tests for command, reify apply, and selectors

manzoorwanijk

committed

fix(patch): harden apply pipeline and tighten selector handling

manzoorwanijk

committed

fix(patch): contain patches-dir writes, reject non-registry version matches, surface ls ambiguity

manzoorwanijk

committed

fix(patch): clear node.patched on ignored failure, contain rm deletes, scope ls ambiguity to ranges

manzoorwanijk

committed

test(patch): make full arborist suite pass at 100% coverage

manzoorwanijk

committed

fix(arborist): revalidate patch file existence and integrity in reify

manzoorwanijk

committed

fix(arborist): fail loudly on optional patch errors and reject patches under install-strategy=linked

manzoorwanijk

committed

fix(arborist): seal linked-strategy patch guard at reify and re-code raw patch FS errors

manzoorwanijk

committed

feat(publish): strip patchedDependencies from the published registry manifest

manzoorwanijk

committed

feat(ls): annotate patched dependencies in npm ls output

manzoorwanijk

committed

feat(patch): enforce allow-unused-patches and ignore-patch-failures as cli-only and reject them in npm ci

manzoorwanijk

committed

feat(arborist): apply patches under install-strategy=linked via a content-addressed side-store

manzoorwanijk

committed

fix(patch): honor relax flags across all reify commands, fail loudly on skipped linked patches, and exclude store nodes from the registry check

manzoorwanijk

committed

refactor(patch): drop unused diffDirs exclude option and dedupe the project-root containment check

manzoorwanijk

committed

fix(arborist): re-extract a dependency when its patch is removed so the patched files are reverted

manzoorwanijk

committed

test(arborist): cover patch removal under install-strategy=linked

manzoorwanijk

committed

fix(patch): patch a registry dep even when a consumer node is edgeless (linked store, extraneous)

manzoorwanijk

committed

feat(arborist): warn when patchedDependencies upgrades the lockfile to version 4

manzoorwanijk

committed

fix(arborist): use the edge-based registry check on the install path too and cover the mixed registry/file: case

manzoorwanijk

committed

test(smoke): add patch to the no-args command-list snapshot

manzoorwanijk

committed

feat(patch): exclude package.json from the diff and warn when an edit only touches it

manzoorwanijk

committed

feat(patch): add npm patch update to rebase a patch onto a new version

manzoorwanijk

committed

fix(patch): discard the temp edit dir if a conflicted update's copy or marker write fails

manzoorwanijk

committed

fix(patch): finalize a conflicted range/name-only update without EPATCHUNUSED

manzoorwanijk

committed

fix(patch): clearer stale errors distinguishing an unreadable lockfile from no matching version

manzoorwanijk

committed

fix(patch): reject a malformed removeKey in the update marker

manzoorwanijk

committed

fix(patch): stop a spurious lockfileVersion upgrade warning from the hidden lockfile

manzoorwanijk

committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: native dependency patching (npm patch add/commit/update/ls/rm)#9439

feat: native dependency patching (npm patch add/commit/update/ls/rm)#9439
owlstronaut merged 33 commits into
npm:latestfrom
manzoorwanijk:feat/native-dependency-patching

Commits on Jun 18, 2026

feat(arborist): apply patchedDependencies during reify

feat(config): add patches-dir and patch relax flags

feat(arborist): re-extract on patch change and validate patch hash in npm ci

feat(patch): add npm patch command (add/commit/ls/rm)

test(arborist): unit tests for patch apply and selector matching

fix(arborist): clear stale patch records when a selector is removed

test(patch): integration tests for command, reify apply, and selectors

fix(patch): harden apply pipeline and tighten selector handling

fix(patch): contain patches-dir writes, reject non-registry version matches, surface ls ambiguity

fix(patch): clear node.patched on ignored failure, contain rm deletes, scope ls ambiguity to ranges

test(patch): make full arborist suite pass at 100% coverage

fix(arborist): revalidate patch file existence and integrity in reify

fix(arborist): fail loudly on optional patch errors and reject patches under install-strategy=linked

fix(arborist): seal linked-strategy patch guard at reify and re-code raw patch FS errors

feat(publish): strip patchedDependencies from the published registry manifest

feat(ls): annotate patched dependencies in npm ls output

feat(patch): enforce allow-unused-patches and ignore-patch-failures as cli-only and reject them in npm ci

feat(arborist): apply patches under install-strategy=linked via a content-addressed side-store

fix(patch): honor relax flags across all reify commands, fail loudly on skipped linked patches, and exclude store nodes from the registry check

refactor(patch): drop unused diffDirs exclude option and dedupe the project-root containment check

fix(arborist): re-extract a dependency when its patch is removed so the patched files are reverted

test(arborist): cover patch removal under install-strategy=linked

fix(patch): patch a registry dep even when a consumer node is edgeless (linked store, extraneous)

feat(arborist): warn when patchedDependencies upgrades the lockfile to version 4

fix(arborist): use the edge-based registry check on the install path too and cover the mixed registry/file: case

test(smoke): add patch to the no-args command-list snapshot

feat(patch): exclude package.json from the diff and warn when an edit only touches it

feat(patch): add npm patch update to rebase a patch onto a new version

fix(patch): discard the temp edit dir if a conflicted update's copy or marker write fails

fix(patch): finalize a conflicted range/name-only update without EPATCHUNUSED

fix(patch): clearer stale errors distinguishing an unreadable lockfile from no matching version

fix(patch): reject a malformed removeKey in the update marker

fix(patch): stop a spurious lockfileVersion upgrade warning from the hidden lockfile