From 765f96a2521f283839f6de6190a931d6bc51515c Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 10 Feb 2026 18:56:56 +0000
Subject: [PATCH] chore: release 21.3.1

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 6 ++++++
 package.json                  | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 17aa97cd..4e127fed 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "21.3.0"
+  ".": "21.3.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3d42e7e6..3e52c631 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## [21.3.1](https://github.com/npm/pacote/compare/v21.3.0...v21.3.1) (2026-02-10)
+### Bug Fixes
+* [`96e571a`](https://github.com/npm/pacote/commit/96e571a4c2f1eaab1932ba40eb495cc6b9798c9b) [#439](https://github.com/npm/pacote/pull/439) ensure that resolved git ref matches expected sha (#439) (@klassiker, pacotedev)
+### Chores
+* [`91847c4`](https://github.com/npm/pacote/commit/91847c43637a5308119076371300be497cfcff74) [#447](https://github.com/npm/pacote/pull/447) fix test for ssri ignoring invalid hashes (#447) (@wraithgar)
+
 ## [21.3.0](https://github.com/npm/pacote/compare/v21.2.0...v21.3.0) (2026-02-09)
 ### Features
 * [`8f5091d`](https://github.com/npm/pacote/commit/8f5091d0a7fc356756707241f8b52dc8a036c34e) [#445](https://github.com/npm/pacote/pull/445) add support for git-256 sha lengths (#445) (@wraithgar)
diff --git a/package.json b/package.json
index 781c63c8..3a1eafd4 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "21.3.0",
+  "version": "21.3.1",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {