chore: release 21.5.0 (npm#470)

🤖 I have created a release *beep* *boop*
---


## [21.5.0](npm/pacote@v21.4.0...v21.5.0)
(2026-03-09)
### Features
*
[`d912f17`](npm@d912f17)
[npm#457](npm#457) expose fetched
attestation bundles on manifest (npm#457) (@mitchdenny)
### Chores
*
[`586a55d`](npm@586a55d)
[npm#471](npm#471) template-oss-apply for
new macos images (npm#471) (@wraithgar)
*
[`d1cc5c8`](npm@d1cc5c8)
[npm#460](npm#460) template-oss-apply for
release branches (npm#460) (@wraithgar)
*
[`b741e8b`](npm@b741e8b)
[npm#468](npm#468) bump @npmcli/template-oss
from 4.28.0 to 4.29.0 (npm#468) (@dependabot[bot], @npm-cli-bot)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 20.0.1 (npm#464)

🤖 I have created a release *beep* *boop*
---


## [20.0.1](npm/pacote@v20.0.0...v20.0.1)
(2026-03-06)
### Dependencies
*
[`f8e2931`](npm@f8e2931)
[npm#461](npm#461) `tar@7.5.10`
### Chores
*
[`01a126d`](npm@01a126d)
[npm#466](npm#466) enable backport mode for
v20 (npm#466) (@wraithgar)
*
[`98f72f6`](npm@98f72f6)
[npm#461](npm#461) tests should not inherit
--ignore-scripts flag from `npm run t… (npm#422) (@owlstronaut)
*
[`f8cf9ba`](npm@f8cf9ba)
[npm#461](npm#461)
`@npmcli/template-oss@4.29.0` (@wraithgar)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 19.0.2 (npm#463)

🤖 I have created a release *beep* *boop*
---


## [19.0.2](npm/pacote@v19.0.1...v19.0.2)
(2026-03-06)
### Dependencies
*
[`bf6e354`](npm@bf6e354)
[npm#459](npm#459) `tar@7.5.10`
### Chores
*
[`b7f2691`](npm@b7f2691)
[npm#465](npm#465) enable backport mode for
v19 (npm#465) (@wraithgar)
*
[`ed1aef0`](npm@ed1aef0)
[npm#459](npm#459) tests should not inherit
--ignore-scripts flag from `npm run t… (npm#422) (@owlstronaut)
*
[`415e369`](npm@415e369)
[npm#459](npm#459)
`@npmcli/template-oss@4.29.0` (@wraithgar)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 21.4.0 (npm#455)

🤖 I have created a release *beep* *boop*
---


## [21.4.0](npm/pacote@v21.3.1...v21.4.0)
(2026-02-24)
### Features
*
[`6912f24`](npm@6912f24)
[npm#451](npm#451) add allowRegistry option
(npm#451) (@wraithgar)
### Bug Fixes
*
[`ab37bc1`](npm@ab37bc1)
[npm#452](npm#452) prevent path duplication
in attestation URL for registries with … (npm#452) (@ajayk)
*
[`ab37bc1`](npm@ab37bc1)
[npm#452](npm#452) prevent path duplication
in attestation URL for registries with (@ajayk)
*
[`8b8ea3b`](npm@8b8ea3b)
[npm#454](npm#454) skip registry key check
for keyless (Sigstore/Fulcio) attestations (npm#454) (@ajayk)
*
[`8b8ea3b`](npm@8b8ea3b)
[npm#454](npm#454) skip registry key check
for keyless (Sigstore/Fulcio) attestations (@ajayk)
### Chores
*
[`0dfd1cd`](npm@0dfd1cd)
[npm#456](npm#456) remove git config from
tests (npm#456) (@wraithgar)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 21.3.1 (npm#448)

🤖 I have created a release *beep* *boop*
---


## [21.3.1](npm/pacote@v21.3.0...v21.3.1)
(2026-02-10)
### Bug Fixes
*
[`96e571a`](npm@96e571a)
[npm#439](npm#439) ensure that resolved git
ref matches expected sha (npm#439) (@klassiker, pacotedev)
### Chores
*
[`91847c4`](npm@91847c4)
[npm#447](npm#447) fix test for ssri
ignoring invalid hashes (npm#447) (@wraithgar)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 21.3.0 (npm#446)

🤖 I have created a release *beep* *boop*
---


## [21.3.0](npm/pacote@v21.2.0...v21.3.0)
(2026-02-09)
### Features
*
[`8f5091d`](npm@8f5091d)
[npm#445](npm#445) add support for git-256
sha lengths (npm#445) (@wraithgar)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 21.2.0 (npm#444)

🤖 I have created a release *beep* *boop*
---


## [21.2.0](npm/pacote@v21.1.0...v21.2.0)
(2026-02-06)
### Features
*
[`db21624`](npm@db21624)
[npm#442](npm#442) implement gitSubdir
according to npa spec (npm#442) (@Kakadus)
*
[`c2a4217`](npm@c2a4217)
[npm#443](npm#443) add allowRemote,
allowFile, allowDirectory (npm#443) (@wraithgar)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 21.1.0 (npm#441)

🤖 I have created a release *beep* *boop*
---


## [21.1.0](npm/pacote@v21.0.4...v21.1.0)
(2026-01-28)
### Features
*
[`258e5fd`](npm@258e5fd)
[npm#440](npm#440) add allowGit option
(npm#440) (@wraithgar)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 21.0.4 (npm#437)

🤖 I have created a release *beep* *boop*
---


## [21.0.4](npm/pacote@v21.0.3...v21.0.4)
(2025-11-13)
### Dependencies
*
[`edbcc02`](npm@edbcc02)
[npm#436](npm#436) `proc-log@6.0.0`
*
[`8dc1f22`](npm@8dc1f22)
[npm#436](npm#436)
`@npmcli/installed-package-contents@4.0.0`
*
[`505c3b0`](npm@505c3b0)
[npm#436](npm#436) `ssri@13.0.0`
*
[`a23fb17`](npm@a23fb17)
[npm#436](npm#436)
`@npmcli/promise-spawn@9.0.0`
### Chores
*
[`ff261aa`](npm@ff261aa)
[npm#436](npm#436)
`@npmcli/eslint-config@6.0.0` (@wraithgar)
*
[`2bba862`](npm@2bba862)
[npm#436](npm#436)
`@npmcli/template-oss@4.28.0` (@wraithgar)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: release 21.0.3 (npm#432)

🤖 I have created a release *beep* *boop*
---


## [21.0.3](npm/pacote@v21.0.2...v21.0.3)
(2025-09-17)
### Dependencies
*
[`eed1bd5`](npm@eed1bd5)
[npm#431](npm#431) `@npmcli/git@7.0.0`
(npm#431)

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>