diff --git a/docs/lib/content/commands/npm-publish.md b/docs/lib/content/commands/npm-publish.md
index 7c97401440670..78f5d5bdfc846 100644
--- a/docs/lib/content/commands/npm-publish.md
+++ b/docs/lib/content/commands/npm-publish.md
@@ -83,6 +83,9 @@ See [`developers`](/using-npm/developers) for full details on what's
 included in the published package, as well as details on how the package is
 built.
 
+See [`package.json`](/configuring-npm/package-json) for more info on
+what can and can't be ignored.
+
 ### Configuration
 
 <!-- AUTOGENERATED CONFIG DESCRIPTIONS -->
diff --git a/docs/lib/content/configuring-npm/package-json.md b/docs/lib/content/configuring-npm/package-json.md
index 58b10d92ec6bb..e09d50f02b635 100644
--- a/docs/lib/content/configuring-npm/package-json.md
+++ b/docs/lib/content/configuring-npm/package-json.md
@@ -324,6 +324,7 @@ Some files are always ignored by default:
   if you wish it to be published)
 * `pnpm-lock.yaml`
 * `yarn.lock`
+* `bun.lockb`
 
 Most of these ignored files can be included specifically if included in
 the `files` globs.  Exceptions to this are:
@@ -334,6 +335,7 @@ the `files` globs.  Exceptions to this are:
 * `package-lock.json`
 * `pnpm-lock.yaml`
 * `yarn.lock`
+* `bun.lockb`
 
 These can not be included.
 
diff --git a/docs/lib/content/using-npm/developers.md b/docs/lib/content/using-npm/developers.md
index 5fc2e5876e3dd..b97ca038b4a4b 100644
--- a/docs/lib/content/using-npm/developers.md
+++ b/docs/lib/content/using-npm/developers.md
@@ -112,8 +112,8 @@ as `.gitignore` files:
 * You can end patterns with a forward slash `/` to specify a directory.
 * You can negate a pattern by starting it with an exclamation point `!`.
 
-By default, the following paths and files are ignored, so there's no
-need to add them to `.npmignore` explicitly:
+By default, some paths and files are ignored, so there's no
+need to add them to `.npmignore` explicitly. Some examples are:
 
 * `.*.swp`
 * `._*`
@@ -148,6 +148,9 @@ property of `package.json`, which is an array of file or directory names
 that should be included in your package. Sometimes manually picking
 which items to allow is easier to manage than building a block list.
 
+See [`package.json`](/configuring-npm/package-json) for more info on
+what can and can't be ignored.
+
 #### Testing whether your `.npmignore` or `files` config works
 
 If you want to double check that your package will include only the files
diff --git a/mock-registry/package.json b/mock-registry/package.json
index e3a53bc28bb38..bc9ae6ac503a7 100644
--- a/mock-registry/package.json
+++ b/mock-registry/package.json
@@ -52,7 +52,7 @@
     "json-stringify-safe": "^5.0.1",
     "nock": "^13.3.3",
     "npm-package-arg": "^12.0.0",
-    "pacote": "^20.0.0",
+    "pacote": "^21.0.0",
     "tap": "^16.3.8"
   }
 }
diff --git a/node_modules/@npmcli/metavuln-calculator/package.json b/node_modules/@npmcli/metavuln-calculator/package.json
index df0b8f2f4faf1..1343b37427304 100644
--- a/node_modules/@npmcli/metavuln-calculator/package.json
+++ b/node_modules/@npmcli/metavuln-calculator/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/metavuln-calculator",
-  "version": "8.0.1",
+  "version": "9.0.0",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -34,23 +34,23 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "4.23.3",
+    "@npmcli/template-oss": "4.23.4",
     "require-inject": "^1.4.4",
     "tap": "^16.0.1"
   },
   "dependencies": {
     "cacache": "^19.0.0",
     "json-parse-even-better-errors": "^4.0.0",
-    "pacote": "^20.0.0",
+    "pacote": "^21.0.0",
     "proc-log": "^5.0.0",
     "semver": "^7.3.5"
   },
   "engines": {
-    "node": "^18.17.0 || >=20.5.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.23.3",
+    "version": "4.23.4",
     "publish": "true",
     "ciVersions": [
       "16.14.0",
diff --git a/node_modules/@npmcli/package-json/lib/index.js b/node_modules/@npmcli/package-json/lib/index.js
index f165ee23b75ab..23f326dd59359 100644
--- a/node_modules/@npmcli/package-json/lib/index.js
+++ b/node_modules/@npmcli/package-json/lib/index.js
@@ -7,6 +7,7 @@ const updateScripts = require('./update-scripts.js')
 const updateWorkspaces = require('./update-workspaces.js')
 const normalize = require('./normalize.js')
 const { read, parse } = require('./read-package.js')
+const { packageSort } = require('./sort.js')
 
 // a list of handy specialized helper functions that take
 // care of special cases that are handled by the npm cli
@@ -230,19 +231,23 @@ class PackageJson {
     return this
   }
 
-  async save () {
+  async save ({ sort } = {}) {
     if (!this.#canSave) {
       throw new Error('No package.json to save to')
     }
     const {
       [Symbol.for('indent')]: indent,
       [Symbol.for('newline')]: newline,
+      ...rest
     } = this.content
 
     const format = indent === undefined ? '  ' : indent
     const eol = newline === undefined ? '\n' : newline
+
+    const content = sort ? packageSort(rest) : rest
+
     const fileContent = `${
-      JSON.stringify(this.content, null, format)
+      JSON.stringify(content, null, format)
     }\n`
       .replace(/\n/g, eol)
 
diff --git a/node_modules/@npmcli/package-json/lib/sort.js b/node_modules/@npmcli/package-json/lib/sort.js
new file mode 100644
index 0000000000000..0bd0d5199da58
--- /dev/null
+++ b/node_modules/@npmcli/package-json/lib/sort.js
@@ -0,0 +1,101 @@
+/**
+ * arbitrary sort order for package.json largely pulled from:
+ * https://github.com/keithamus/sort-package-json/blob/main/defaultRules.md
+ *
+ * cross checked with:
+ * https://github.com/npm/types/blob/main/types/index.d.ts#L104
+ * https://docs.npmjs.com/cli/configuring-npm/package-json
+ */
+function packageSort (json) {
+  const {
+    name,
+    version,
+    private: isPrivate,
+    description,
+    keywords,
+    homepage,
+    bugs,
+    repository,
+    funding,
+    license,
+    author,
+    maintainers,
+    contributors,
+    type,
+    imports,
+    exports,
+    main,
+    browser,
+    types,
+    bin,
+    man,
+    directories,
+    files,
+    workspaces,
+    scripts,
+    config,
+    dependencies,
+    devDependencies,
+    peerDependencies,
+    peerDependenciesMeta,
+    optionalDependencies,
+    bundledDependencies,
+    bundleDependencies,
+    engines,
+    os,
+    cpu,
+    publishConfig,
+    devEngines,
+    licenses,
+    overrides,
+    ...rest
+  } = json
+
+  return {
+    ...(typeof name !== 'undefined' ? { name } : {}),
+    ...(typeof version !== 'undefined' ? { version } : {}),
+    ...(typeof isPrivate !== 'undefined' ? { private: isPrivate } : {}),
+    ...(typeof description !== 'undefined' ? { description } : {}),
+    ...(typeof keywords !== 'undefined' ? { keywords } : {}),
+    ...(typeof homepage !== 'undefined' ? { homepage } : {}),
+    ...(typeof bugs !== 'undefined' ? { bugs } : {}),
+    ...(typeof repository !== 'undefined' ? { repository } : {}),
+    ...(typeof funding !== 'undefined' ? { funding } : {}),
+    ...(typeof license !== 'undefined' ? { license } : {}),
+    ...(typeof author !== 'undefined' ? { author } : {}),
+    ...(typeof maintainers !== 'undefined' ? { maintainers } : {}),
+    ...(typeof contributors !== 'undefined' ? { contributors } : {}),
+    ...(typeof type !== 'undefined' ? { type } : {}),
+    ...(typeof imports !== 'undefined' ? { imports } : {}),
+    ...(typeof exports !== 'undefined' ? { exports } : {}),
+    ...(typeof main !== 'undefined' ? { main } : {}),
+    ...(typeof browser !== 'undefined' ? { browser } : {}),
+    ...(typeof types !== 'undefined' ? { types } : {}),
+    ...(typeof bin !== 'undefined' ? { bin } : {}),
+    ...(typeof man !== 'undefined' ? { man } : {}),
+    ...(typeof directories !== 'undefined' ? { directories } : {}),
+    ...(typeof files !== 'undefined' ? { files } : {}),
+    ...(typeof workspaces !== 'undefined' ? { workspaces } : {}),
+    ...(typeof scripts !== 'undefined' ? { scripts } : {}),
+    ...(typeof config !== 'undefined' ? { config } : {}),
+    ...(typeof dependencies !== 'undefined' ? { dependencies } : {}),
+    ...(typeof devDependencies !== 'undefined' ? { devDependencies } : {}),
+    ...(typeof peerDependencies !== 'undefined' ? { peerDependencies } : {}),
+    ...(typeof peerDependenciesMeta !== 'undefined' ? { peerDependenciesMeta } : {}),
+    ...(typeof optionalDependencies !== 'undefined' ? { optionalDependencies } : {}),
+    ...(typeof bundledDependencies !== 'undefined' ? { bundledDependencies } : {}),
+    ...(typeof bundleDependencies !== 'undefined' ? { bundleDependencies } : {}),
+    ...(typeof engines !== 'undefined' ? { engines } : {}),
+    ...(typeof os !== 'undefined' ? { os } : {}),
+    ...(typeof cpu !== 'undefined' ? { cpu } : {}),
+    ...(typeof publishConfig !== 'undefined' ? { publishConfig } : {}),
+    ...(typeof devEngines !== 'undefined' ? { devEngines } : {}),
+    ...(typeof licenses !== 'undefined' ? { licenses } : {}),
+    ...(typeof overrides !== 'undefined' ? { overrides } : {}),
+    ...rest,
+  }
+}
+
+module.exports = {
+  packageSort,
+}
diff --git a/node_modules/@npmcli/package-json/package.json b/node_modules/@npmcli/package-json/package.json
index e766e8ccb4bbf..97070e27d0d22 100644
--- a/node_modules/@npmcli/package-json/package.json
+++ b/node_modules/@npmcli/package-json/package.json
@@ -1,7 +1,17 @@
 {
   "name": "@npmcli/package-json",
-  "version": "6.0.1",
+  "version": "6.1.0",
   "description": "Programmatic API to update package.json",
+  "keywords": [
+    "npm",
+    "oss"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/npm/package-json.git"
+  },
+  "license": "ISC",
+  "author": "GitHub Inc.",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -18,19 +28,6 @@
     "template-oss-apply": "template-oss-apply --force",
     "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
-  "keywords": [
-    "npm",
-    "oss"
-  ],
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "devDependencies": {
-    "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "4.23.3",
-    "read-package-json": "^7.0.0",
-    "read-package-json-fast": "^4.0.0",
-    "tap": "^16.0.1"
-  },
   "dependencies": {
     "@npmcli/git": "^6.0.0",
     "glob": "^10.2.2",
@@ -40,16 +37,19 @@
     "proc-log": "^5.0.0",
     "semver": "^7.5.3"
   },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/npm/package-json.git"
+  "devDependencies": {
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.23.5",
+    "read-package-json": "^7.0.0",
+    "read-package-json-fast": "^4.0.0",
+    "tap": "^16.0.1"
   },
   "engines": {
     "node": "^18.17.0 || >=20.5.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.23.3",
+    "version": "4.23.5",
     "publish": "true"
   },
   "tap": {
diff --git a/node_modules/npm-packlist/lib/index.js b/node_modules/npm-packlist/lib/index.js
index 985f11ee3f738..9e4e7db07c01c 100644
--- a/node_modules/npm-packlist/lib/index.js
+++ b/node_modules/npm-packlist/lib/index.js
@@ -290,6 +290,7 @@ class PackWalker extends IgnoreWalker {
       '/package-lock.json',
       '/yarn.lock',
       '/pnpm-lock.yaml',
+      '/bun.lockb',
     ]
 
     // if we have a files array in our package, we need to pull rules from it
diff --git a/node_modules/npm-packlist/package.json b/node_modules/npm-packlist/package.json
index d7e0a4fd5a845..b25864612030f 100644
--- a/node_modules/npm-packlist/package.json
+++ b/node_modules/npm-packlist/package.json
@@ -1,6 +1,6 @@
 {
   "name": "npm-packlist",
-  "version": "9.0.0",
+  "version": "10.0.0",
   "description": "Get a list of the files to add from a folder into an npm package",
   "directories": {
     "test": "test"
@@ -16,9 +16,9 @@
     "lib/"
   ],
   "devDependencies": {
-    "@npmcli/arborist": "^7.5.4",
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.23.3",
+    "@npmcli/arborist": "^8.0.0",
+    "@npmcli/eslint-config": "^5.0.1",
+    "@npmcli/template-oss": "4.23.4",
     "mutate-fs": "^2.1.1",
     "tap": "^16.0.1"
   },
@@ -51,11 +51,11 @@
     ]
   },
   "engines": {
-    "node": "^18.17.0 || >=20.5.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.23.3",
+    "version": "4.23.4",
     "publish": true
   }
 }
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
index 335c7a6c87bd3..422be5f5452dc 100644
--- a/node_modules/pacote/package.json
+++ b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "20.0.0",
+  "version": "21.0.0",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -26,13 +26,14 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/arborist": "^7.1.0",
+    "@npmcli/arborist": "^8.0.0",
     "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "4.23.3",
+    "@npmcli/template-oss": "4.23.4",
     "hosted-git-info": "^8.0.0",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
     "npm-registry-mock": "^1.3.2",
+    "rimraf": "^6.0.1",
     "tap": "^16.0.1"
   },
   "files": [
@@ -54,7 +55,7 @@
     "fs-minipass": "^3.0.0",
     "minipass": "^7.0.2",
     "npm-package-arg": "^12.0.0",
-    "npm-packlist": "^9.0.0",
+    "npm-packlist": "^10.0.0",
     "npm-pick-manifest": "^10.0.0",
     "npm-registry-fetch": "^18.0.0",
     "proc-log": "^5.0.0",
@@ -64,7 +65,7 @@
     "tar": "^6.1.11"
   },
   "engines": {
-    "node": "^18.17.0 || >=20.5.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "repository": {
     "type": "git",
@@ -72,7 +73,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.23.3",
+    "version": "4.23.4",
     "windowsCI": false,
     "publish": "true"
   }
diff --git a/package-lock.json b/package-lock.json
index 2a5fabb33c13f..9b24254e007a8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -89,7 +89,7 @@
         "@npmcli/config": "^10.0.0-pre.0",
         "@npmcli/fs": "^4.0.0",
         "@npmcli/map-workspaces": "^4.0.2",
-        "@npmcli/package-json": "^6.0.1",
+        "@npmcli/package-json": "^6.1.0",
         "@npmcli/promise-spawn": "^8.0.2",
         "@npmcli/redact": "^3.0.0",
         "@npmcli/run-script": "^9.0.1",
@@ -135,7 +135,7 @@
         "npm-registry-fetch": "^18.0.2",
         "npm-user-validate": "^3.0.0",
         "p-map": "^4.0.0",
-        "pacote": "^20.0.0",
+        "pacote": "^21.0.0",
         "parse-conflict-json": "^4.0.0",
         "proc-log": "^5.0.0",
         "qrcode-terminal": "^0.12.0",
@@ -169,7 +169,7 @@
         "cli-table3": "^0.6.4",
         "diff": "^5.2.0",
         "nock": "^13.4.0",
-        "npm-packlist": "^9.0.0",
+        "npm-packlist": "^10.0.0",
         "remark": "^14.0.2",
         "remark-gfm": "^3.0.1",
         "remark-github": "^11.2.4",
@@ -2013,7 +2013,7 @@
         "json-stringify-safe": "^5.0.1",
         "nock": "^13.3.3",
         "npm-package-arg": "^12.0.0",
-        "pacote": "^20.0.0",
+        "pacote": "^21.0.0",
         "tap": "^16.3.8"
       },
       "engines": {
@@ -2102,6 +2102,68 @@
         "node": "^18.17.0 || >=20.5.0"
       }
     },
+    "mock-registry/node_modules/@npmcli/metavuln-calculator": {
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-8.0.1.tgz",
+      "integrity": "sha512-WXlJx9cz3CfHSt9W9Opi1PTFc4WZLFomm5O8wekxQZmkyljrBRwATwDxfC9iOXJwYVmfiW1C1dUe0W2aN0UrSg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "cacache": "^19.0.0",
+        "json-parse-even-better-errors": "^4.0.0",
+        "pacote": "^20.0.0",
+        "proc-log": "^5.0.0",
+        "semver": "^7.3.5"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "mock-registry/node_modules/@npmcli/metavuln-calculator/node_modules/pacote": {
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-20.0.0.tgz",
+      "integrity": "sha512-pRjC5UFwZCgx9kUFDVM9YEahv4guZ1nSLqwmWiLUnDbGsjs+U5w7z6Uc8HNR1a6x8qnu5y9xtGE6D1uAuYz+0A==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "@npmcli/git": "^6.0.0",
+        "@npmcli/installed-package-contents": "^3.0.0",
+        "@npmcli/package-json": "^6.0.0",
+        "@npmcli/promise-spawn": "^8.0.0",
+        "@npmcli/run-script": "^9.0.0",
+        "cacache": "^19.0.0",
+        "fs-minipass": "^3.0.0",
+        "minipass": "^7.0.2",
+        "npm-package-arg": "^12.0.0",
+        "npm-packlist": "^9.0.0",
+        "npm-pick-manifest": "^10.0.0",
+        "npm-registry-fetch": "^18.0.0",
+        "proc-log": "^5.0.0",
+        "promise-retry": "^2.0.1",
+        "sigstore": "^3.0.0",
+        "ssri": "^12.0.0",
+        "tar": "^6.1.11"
+      },
+      "bin": {
+        "pacote": "bin/index.js"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
+    "mock-registry/node_modules/npm-packlist": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-9.0.0.tgz",
+      "integrity": "sha512-8qSayfmHJQTx3nJWYbbUmflpyarbLMBc6LCAjYsiGtXxDB68HaZpb8re6zeaLGxZzDuMdhsg70jryJe+RrItVQ==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "ignore-walk": "^7.0.0"
+      },
+      "engines": {
+        "node": "^18.17.0 || >=20.5.0"
+      }
+    },
     "node_modules/@actions/core": {
       "version": "1.11.1",
       "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
@@ -3431,19 +3493,19 @@
       }
     },
     "node_modules/@npmcli/metavuln-calculator": {
-      "version": "8.0.1",
-      "resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-8.0.1.tgz",
-      "integrity": "sha512-WXlJx9cz3CfHSt9W9Opi1PTFc4WZLFomm5O8wekxQZmkyljrBRwATwDxfC9iOXJwYVmfiW1C1dUe0W2aN0UrSg==",
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-9.0.0.tgz",
+      "integrity": "sha512-znLKqdy1ZEGNK3VB9j/RzGyb/P0BJb3fGpvEbHIAyBAXsps2l1ce8SVHfsGAFLl9s8072PxafqTn7RC8wSnQPg==",
       "license": "ISC",
       "dependencies": {
         "cacache": "^19.0.0",
         "json-parse-even-better-errors": "^4.0.0",
-        "pacote": "^20.0.0",
+        "pacote": "^21.0.0",
         "proc-log": "^5.0.0",
         "semver": "^7.3.5"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/@npmcli/mock-globals": {
@@ -3475,9 +3537,9 @@
       }
     },
     "node_modules/@npmcli/package-json": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@npmcli/package-json/-/package-json-6.0.1.tgz",
-      "integrity": "sha512-YW6PZ99sc1Q4DINEY2td5z9Z3rwbbsx7CyCnOc7UXUUdePXh5gPi1UeaoQVmKQMVbIU7aOwX2l1OG5ZfjgGi5g==",
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/package-json/-/package-json-6.1.0.tgz",
+      "integrity": "sha512-t6G+6ZInT4X+tqj2i+wlLIeCKnKOTuz9/VFYDtj+TGTur5q7sp/OYrQA19LdBbWfXDOi0Y4jtedV6xtB8zQ9ug==",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
@@ -12194,16 +12256,16 @@
       }
     },
     "node_modules/npm-packlist": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-9.0.0.tgz",
-      "integrity": "sha512-8qSayfmHJQTx3nJWYbbUmflpyarbLMBc6LCAjYsiGtXxDB68HaZpb8re6zeaLGxZzDuMdhsg70jryJe+RrItVQ==",
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-10.0.0.tgz",
+      "integrity": "sha512-rht9U6nS8WOBDc53eipZNPo5qkAV4X2rhKE2Oj1DYUQ3DieXfj0mKkVmjnf3iuNdtMd8WfLdi2L6ASkD/8a+Kg==",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
         "ignore-walk": "^7.0.0"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/npm-pick-manifest": {
@@ -12830,9 +12892,9 @@
       "license": "BlueOak-1.0.0"
     },
     "node_modules/pacote": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-20.0.0.tgz",
-      "integrity": "sha512-pRjC5UFwZCgx9kUFDVM9YEahv4guZ1nSLqwmWiLUnDbGsjs+U5w7z6Uc8HNR1a6x8qnu5y9xtGE6D1uAuYz+0A==",
+      "version": "21.0.0",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-21.0.0.tgz",
+      "integrity": "sha512-lcqexq73AMv6QNLo7SOpz0JJoaGdS3rBFgF122NZVl1bApo2mfu+XzUBU/X/XsiJu+iUmKpekRayqQYAs+PhkA==",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
@@ -12845,7 +12907,7 @@
         "fs-minipass": "^3.0.0",
         "minipass": "^7.0.2",
         "npm-package-arg": "^12.0.0",
-        "npm-packlist": "^9.0.0",
+        "npm-packlist": "^10.0.0",
         "npm-pick-manifest": "^10.0.0",
         "npm-registry-fetch": "^18.0.0",
         "proc-log": "^5.0.0",
@@ -12858,7 +12920,7 @@
         "pacote": "bin/index.js"
       },
       "engines": {
-        "node": "^18.17.0 || >=20.5.0"
+        "node": "^20.17.0 || >=22.9.0"
       }
     },
     "node_modules/parent-module": {
@@ -18385,7 +18447,7 @@
         "@npmcli/fs": "^4.0.0",
         "@npmcli/installed-package-contents": "^3.0.0",
         "@npmcli/map-workspaces": "^4.0.1",
-        "@npmcli/metavuln-calculator": "^8.0.0",
+        "@npmcli/metavuln-calculator": "^9.0.0",
         "@npmcli/name-from-folder": "^3.0.0",
         "@npmcli/node-gyp": "^4.0.0",
         "@npmcli/package-json": "^6.0.1",
@@ -18404,7 +18466,7 @@
         "npm-package-arg": "^12.0.0",
         "npm-pick-manifest": "^10.0.0",
         "npm-registry-fetch": "^18.0.1",
-        "pacote": "^20.0.0",
+        "pacote": "^21.0.0",
         "parse-conflict-json": "^4.0.0",
         "proc-log": "^5.0.0",
         "proggy": "^3.0.0",
@@ -18485,7 +18547,7 @@
         "diff": "^5.1.0",
         "minimatch": "^9.0.4",
         "npm-package-arg": "^12.0.0",
-        "pacote": "^20.0.0",
+        "pacote": "^21.0.0",
         "tar": "^6.2.1"
       },
       "devDependencies": {
@@ -18505,7 +18567,7 @@
         "@npmcli/run-script": "^9.0.1",
         "ci-info": "^4.0.0",
         "npm-package-arg": "^12.0.0",
-        "pacote": "^20.0.0",
+        "pacote": "^21.0.0",
         "proc-log": "^5.0.0",
         "read": "^4.0.0",
         "read-package-json-fast": "^4.0.0",
@@ -18566,7 +18628,7 @@
         "@npmcli/arborist": "^9.0.0-pre.0",
         "@npmcli/run-script": "^9.0.1",
         "npm-package-arg": "^12.0.0",
-        "pacote": "^20.0.0"
+        "pacote": "^21.0.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^5.0.1",
diff --git a/package.json b/package.json
index 1ed039a8abcf1..7df27e3f32e38 100644
--- a/package.json
+++ b/package.json
@@ -56,7 +56,7 @@
     "@npmcli/config": "^10.0.0-pre.0",
     "@npmcli/fs": "^4.0.0",
     "@npmcli/map-workspaces": "^4.0.2",
-    "@npmcli/package-json": "^6.0.1",
+    "@npmcli/package-json": "^6.1.0",
     "@npmcli/promise-spawn": "^8.0.2",
     "@npmcli/redact": "^3.0.0",
     "@npmcli/run-script": "^9.0.1",
@@ -102,7 +102,7 @@
     "npm-registry-fetch": "^18.0.2",
     "npm-user-validate": "^3.0.0",
     "p-map": "^4.0.0",
-    "pacote": "^20.0.0",
+    "pacote": "^21.0.0",
     "parse-conflict-json": "^4.0.0",
     "proc-log": "^5.0.0",
     "qrcode-terminal": "^0.12.0",
@@ -200,7 +200,7 @@
     "cli-table3": "^0.6.4",
     "diff": "^5.2.0",
     "nock": "^13.4.0",
-    "npm-packlist": "^9.0.0",
+    "npm-packlist": "^10.0.0",
     "remark": "^14.0.2",
     "remark-gfm": "^3.0.1",
     "remark-github": "^11.2.4",
diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index 3a637c511bc60..377bcd632f349 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -7,7 +7,7 @@
     "@npmcli/fs": "^4.0.0",
     "@npmcli/installed-package-contents": "^3.0.0",
     "@npmcli/map-workspaces": "^4.0.1",
-    "@npmcli/metavuln-calculator": "^8.0.0",
+    "@npmcli/metavuln-calculator": "^9.0.0",
     "@npmcli/name-from-folder": "^3.0.0",
     "@npmcli/node-gyp": "^4.0.0",
     "@npmcli/package-json": "^6.0.1",
@@ -26,7 +26,7 @@
     "npm-package-arg": "^12.0.0",
     "npm-pick-manifest": "^10.0.0",
     "npm-registry-fetch": "^18.0.1",
-    "pacote": "^20.0.0",
+    "pacote": "^21.0.0",
     "parse-conflict-json": "^4.0.0",
     "proc-log": "^5.0.0",
     "proggy": "^3.0.0",
diff --git a/workspaces/libnpmdiff/package.json b/workspaces/libnpmdiff/package.json
index a1d8f58506973..44bad5a0ae739 100644
--- a/workspaces/libnpmdiff/package.json
+++ b/workspaces/libnpmdiff/package.json
@@ -53,7 +53,7 @@
     "diff": "^5.1.0",
     "minimatch": "^9.0.4",
     "npm-package-arg": "^12.0.0",
-    "pacote": "^20.0.0",
+    "pacote": "^21.0.0",
     "tar": "^6.2.1"
   },
   "templateOSS": {
diff --git a/workspaces/libnpmexec/package.json b/workspaces/libnpmexec/package.json
index 8a9a7a3249a89..46c5416635f18 100644
--- a/workspaces/libnpmexec/package.json
+++ b/workspaces/libnpmexec/package.json
@@ -64,7 +64,7 @@
     "@npmcli/run-script": "^9.0.1",
     "ci-info": "^4.0.0",
     "npm-package-arg": "^12.0.0",
-    "pacote": "^20.0.0",
+    "pacote": "^21.0.0",
     "proc-log": "^5.0.0",
     "read": "^4.0.0",
     "read-package-json-fast": "^4.0.0",
diff --git a/workspaces/libnpmpack/package.json b/workspaces/libnpmpack/package.json
index d700490570314..775a111513070 100644
--- a/workspaces/libnpmpack/package.json
+++ b/workspaces/libnpmpack/package.json
@@ -40,7 +40,7 @@
     "@npmcli/arborist": "^9.0.0-pre.0",
     "@npmcli/run-script": "^9.0.1",
     "npm-package-arg": "^12.0.0",
-    "pacote": "^20.0.0"
+    "pacote": "^21.0.0"
   },
   "engines": {
     "node": "^20.17.0 || >=22.9.0"