NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
npm · #989 most downloaded on npm
Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.
Last release 3 months ago
09 Jun 2026
Release timing varies
gaps range from 3 weeks to 10 months
Most releases are documented
notes for 48 of the last 60 stable releases
Nothing withdrawn
no release was ever pulled
10 years old
110 releases · first in 2016
bff2f4f #343 create cache directory tags ( @gezzz )
cacache now supports node ^22.22.2 || ^24.15.0 || >=26.0.0
One column per quarter.
cacache now supports node ^22.22.2 || ^24.15.0 || >=26.0.0224c45a #339 bump to new node engine range (@owlstronaut)2929aa5 #339 template-oss-apply (@owlstronaut)8f85b88 #339 template-oss-apply (@owlstronaut)af6256e #339 bumping @npmcli/template-oss from 4.30.0 to 5.1.0 (@owlstronaut)c1a85be #330 template-oss-apply (#330) (@owlstronaut)5929444 #331 bump @npmcli/template-oss from 4.29.0 to 4.30.0 (#331) (@dependabot[bot], @npm-cli-bot)dd3ff61 #328 remove unique-filename
1cf5e0c #326 bump @npmcli/template-oss from 4.28.1 to 4.29.0 (#326) (@dependabot[bot], @npm-cli-bot)f3a2cdd #322 bump glob from 11.1.0 to 13.0.0 ( #322 ) ( @dependabot [bot])
f3a2cdd #322 bump glob from 11.1.0 to 13.0.0 (#322) (@dependabot[bot])6f96e0f #319 bump @npmcli/fs from 4.0.0 to 5.0.0 (#319) (@dependabot[bot])49565c9 #320 bump unique-filename from 4.0.0 to 5.0.0 (#320) (@dependabot[bot])f813148 #321 bump @npmcli/eslint-config from 5.1.0 to 6.0.1 (#321) (@dependabot[bot])57fc04f #323 bump @npmcli/template-oss from 4.25.0 to 4.28.0 (#323) (@dependabot[bot], @npm-cli-bot)20.0.2 (2025-11-17) Dependencies 79d843c #316 ssri@13.0.0
20.0.1 (2025-08-18) Dependencies b237808 #314 remove tar
cacache now supports node ^20.17.0 || >=22.9.0
cacache now supports node ^20.17.0 || >=22.9.0de558cb #310 align to npm 11 node engine range (@owlstronaut)7d005df #310 template-oss apply fix (@owlstronaut)49e75b8 #304 bump @npmcli/template-oss from 4.23.3 to 4.23.4 (#304) (@dependabot[bot], @npm-cli-bot)e56c7fc #302 update p-map from ^4.0.0 to ^7.0.2
cacache now supports node ^18.17.0 || >=20.5.0
cacache now supports node ^18.17.0 || >=20.5.0beaab7c #291 bump tar from 6.2.1 to 7.4.3 (#291)81b6e34 #300 unique-filename@4.0.0dcab1af #300 ssri@12.0.0ba3a3b8 #300 @npmcli/fs@4.0.073ce729 #300 run template-oss-apply (@reggi)f663562 #294 bump @npmcli/eslint-config from 4.0.5 to 5.0.0 (@dependabot[bot])74ac800 #295 postinstall for dependabot template-oss PR (@hashtagchris)ae95894 #295 bump @npmcli/template-oss from 4.23.1 to 4.23.3 (@dependabot[bot])`326c7a3` #269 linting: no-unused-vars (@lukekarrys)
`b9f488d` #255 Speed up cache reads (#255) (@thecodrr)
`6755c0e` #250 attach a catch handler to the handleContentP promise (#250) (@kalinkrustev)
support for node 14 has been removed
`4b82a42` #217 bump minipass from 5.0.0 to 7.0.3
`a0a5e58` #209 normalize win32 paths to use on glob expressions (#209) (@supita)
`bd846d0` #206 catch eexists in moveOperations promise (#206) (@wraithgar)
`988d77a` #203 deduplicate move operations (#203) (@wraithgar)
`2e83cfc` #200 write: accept multiple integrity algorithms (#200) (@wraithgar)
`a6dd005` #176 bump glob from 8.1.0 to 9.3.1
`fe71fab` #159 bump fs-minipass from 2.1.0 to 3.0.0
`0dc98f7` #156 bump minipass from 3.3.6 to 4.0.0
`4a7382f` #152 replace @npmcli/move-file with @npmcli/fs (@lukekarrys)
this module no longer attempts to change file ownership automatically
cacache is now compatible with the following semver range for node: ^14.17.0 || ^16.13.0 || >=18.0.0bump unique-filename from 1.1.1 to 2.0.0
## 16.1.2 (2022-08-15) ### Bug Fixes * linting
read: change lstat to stat to correctly evaluate file size
allow external integrity/size source
put: don't flush if an error happened
normalize win32 paths before globbing
### 16.0.5 (2022-04-20) ### Dependencies * bump glob from 7.2.0 to 8.0.1
### Bug Fixes * use lru-cache.clear
this drops support for node10 and non-LTS versions of node12 and node14.
Nothing published for this version
8892a92 add a validateEntry option to compact
allow formatEntry to keep entries with no integrity value (930f531), closes #53
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
deps: Use move-file instead of move-file-concurrently. (92b125)
drop figgy-pudding and use canonical option names.
fix-owner: chownr.sync quits on non-root uid
Nothing published for this version
This subtly changes the streaming interface of everything in cacache that streams, which is, well, everything in cacache. Most users will probably not
The mississippi methods 'to', 'from', 'through', and so on, have been replaced with their Minipass counterparts, and streaming interaction with the file system is done via fs-minipass.
The following modules are of interest here:
minipass The core stream library.
fs-minipass Note that the 'WriteStream' class from fs-minipass is not a Minipass stream, but rather a plain old EventEmitter that duck types as a Writable.
minipass-collect Gather up all the data from a stream. Cacache only uses Collect.PassThrough, which is a basic Minipass passthrough stream which emits a 'collect' event with the completed data just before the 'end' event.
minipass-pipeline Connect one or more streams into a pipe chain. Errors anywhere in the pipeline are proxied down the chain and then up to the Pipeline object itself. Writes go into the head, reads go to the tail. Used in place of pump() and pumpify().
minipass-flush A Minipass passthrough stream that defers its 'end' event until after a flush() method has completed (either calling the supplied callback, or returning a promise.) Use in place of flush-write-stream (aka mississippi.to).
Streams from through2, concat-stream, and the behavior provided by end-of-stream are all implemented in Minipass itself.
Features of interest to cacache, which make Minipass a particularly good fit:
The biggest downside of Minipass is that it lacks some of the internal characteristics of node-core streams, which many community modules use to identify streams. They have no _writableState or _readableState objects, or _read or _write methods. As a result, the is-stream module (at least, at the time of this commit) doesn't recognize Minipass streams as readable or writable streams.
All in all, the changes required of downstream users should be minimal, but are unlikely to be zero. Hence the semver major change.
lib/util/infer-owner.js to
@npmcli/infer-owner
so that it could be more easily used in other parts of the npm CLI.Nothing published for this version
Nothing published for this version
Nothing published for this version
Nothing published for this version
infer uid/gid instead of accepting as options
Reasoning:
The number one reason to use a uid or gid option was to keep root-owned files from causing problems in the cache. In npm's case, this meant that CLI's ./lib/command.js had to work out the appropriate uid and gid, then pass it to the libnpmcommand module, which had to in turn pass the uid and gid to npm-registry-fetch, which then passed it to make-fetch-happen, which passed it to cacache. (For package fetching, pacote would be in that mix as well.)
Added to that, cacache.rm() will actually write a file into the
cache index, but has no way to accept an option so that its call to
entry-index.js will write the index with the appropriate uid/gid.
Little ownership bugs were all over the place, and tricky to trace
through. (Why should make-fetch-happen even care about accepting or
passing uids and gids? It's an http library.)
This change allows us to keep the cache from having mixed ownership in any situation.
Of course, this does mean that if you have a root-owned but
user-writable folder (for example, /tmp), then the cache will try to
chown everything to root.
The solution is for the user to create a folder, make it user-owned, and use that, rather than relying on cacache to create the root cache folder.
If we decide to restore the uid/gid opts, and use ownership inference only when uid/gid are unset, then take care to also make rm take an option object, and pass it through to entry-index.js.
<a name="11.3.2"></a>
Nothing published for this version
get: make sure to handle errors in the .then
get: export hasContent.sync properly
<a name="11.3.0"></a>
<a name="11.2.0"></a>
<a name="11.1.0"></a>
<a name="11.0.3"></a>
Your coding agent can read these notes before it upgrades. Set up the MCP server →