[pull] latest from npm:latest#167

Merged

pull[bot] merged 3 commits into

DavidLacombe46:latestfrom

May 28, 2026

Commits on May 28, 2026

fix: block forbidden keys in Queryable setter to prevent prototype pollution

authored and
owlstronaut
committed
fix!: default opts.access to null to preserve registry behavior
owlstronaut
committed
fix(arborist): read install scripts from disk on lockfile installs instead of a sentinel

JamieMagee
authored and
owlstronaut
committed