chore: release 21.3.1

[github-actions]

🤖 I have created a release beep boop

21.3.1 (2026-02-10)

Bug Fixes

• 96e571a #439 ensure that resolved git ref matches expected sha (fix: ensure that resolved git ref matches expected sha #439) (@klassiker, pacotedev)

Chores

• 91847c4 #447 fix test for ssri ignoring invalid hashes (chore: fix test for ssri ignoring invalid hashes #447) (@wraithgar)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Release Manager

Release workflow run: https://github.com/npm/pacote/actions/runs/21878322219

Release Checklist for v21.3.1

• 1. Approve this PR

  gh pr review 448 -R npm/pacote --approve

• 2. Merge release PR 🚨 Merging this will auto publish 🚨

  gh pr merge 448 -R npm/pacote --squash

• 3. Check For Release Tags

  Release Please will run on the just pushed release commit and create GitHub releases and tags for each package.

  gh run watch -R npm/pacote $(gh run list -R npm/pacote --workspace release -b main -L 1 --json databaseId -q ".[0].databaseId")

[github-actions]

🤖 Created releases:

• v21.3.1

🌻

[github-actions]

Release Workflow

• pacote@21.3.1 https://github.com/npm/pacote/releases/tag/v21.3.1
• Workflow run: ✅ https://github.com/npm/pacote/actions/runs/21879205976