main
fix(outdated): don't report JSR pre-release versions as latest (#36325)
feat(npm): use JSR for `@jsr` scope (#31925)
fix(npm): show scoped-registry auth hint on tarball 404 (#35514)
fix(npm): use configured auth for tarball urls instead of scope auth (#24111)
fix(outdated): send npm Accept header when fetching package metadata (#35012)
fix(npm): ignore invalid package bin targets (#36354)