Release 6.11.1 #236

not all the tar implementations support --version flag e.g. the one used in openbsd doesn't, so the installation process fails PR-URL: #154 Credit: @agudulin Reviewed-By: @zkat

@phihag

The command is called stars, not starts. PR-URL: #158 Credit: @phihag Reviewed-By: @zkat

@ahasall

PR-URL: #160 Credit: @ahasall Reviewed-By: @zkat

@mansona

PR-URL: #162 Credit: @mansona Reviewed-By: @zkat

@vlasy

PR-URL: #139 Credit: @vlasy Reviewed-By: @zkat

@larsgw

Fixes: https://npm.community/t/4227 PR-URL: #132 Credit: @larsgw Reviewed-By: @iarna Reviewed-By: @zkat

@emilis-tm

PR-URL: #135 Credit: @emilis-tm Reviewed-By: @zkat

@larsgw

Fixes: https://npm.community/t/3784 PR-URL: #115 Credit: @larsgw Reviewed-By: @iarna Reviewed-By: @zkat

@larsgw

PR #11584 removed the possibility of updating local packages (linked with symlinks) with `npm update`. Reason was that this functionality didn't work in v3.6.0. However, the system behind local dependencies has since changed, and I can't reproduce the original error anymore. Reverts 59e5056 Fixes: https://npm.community/t/1725?u=larsgw PR-URL: #73 Credit: @larsgw Reviewed-By: @iarna Reviewed-By: @zkat

Adds support for package aliases

@zkat

PR-URL: #3 Credit: @zkat Reviewed-By: @aeschright

Adds opts.before support

@zkat

PR-URL: #90 Credit: @zkat Reviewed-By: @aeschright Reviewed-By: @iarna

@kemitchell

PR-URL: #164 Credit: @kemitchell Reviewed-By: @zkat

@zkat

Fixes: https://npm.community/t/npm-pack-leaving-out-files-6-8-0-only/5382 Credit: @zkat

@ljharb

PR-URL: #165 Credit: @ljharb Reviewed-By: @zkat Reviewed-By: @aeschright

@zkat

PR-URL: #173 Fixes: https://npm.community/t/npm-outdated-throw-an-error-cannot-read-property-length-of-undefined/5929 Credit: @zkat Reviewed-By: @aeschright

@zkat

PR-URL: #175 Fixes: https://npm.community/t/npm-token-create-doesnt-work-in-6-6-0-6-9-0/6259 Credit: @zkat Reviewed-By: @aeschright

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187 Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacs Close: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858 Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3 Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Total luxury problem. There are too many cores on my laptop, so commands kick off and complete too quickly, resulting in not properly demonstrating the behavior that this test is looking for.

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

When running an npm command from within a git environment, such as installing or testing during a git rebase or bisect, these environment variables will be passed to the child process, causing it to fetch/checkout/etc in the root project instead of doing what the user intends. Strip them out so that they are not passed to the child process. Also, remove git environs from the test environment, so that spawning git in a test to set up a dummy repo doesn't mess with the main project's git repository. This enables adding `exec npm test` in a `git rebase -i` list to run tests between commits.

This also updates make-fetch-happen, so it no longer requires the old lru-cache.

@larsgw

Instead of creating a new set each time a new node gets visited, so that its siblings do not have it in `seen`, just remove the node from the original set right after all child nodes are visited. See #76 Credit: @larsgw PR-URL: #206 Close: #206 Reviewed-by: @isaacs

@raywu0123

Credit: @raywu0123 PR-URL: #179 Close: #179 Reviewed-by: @isaacs

This handles an EISDIR error from cacache on Darwin in Node versions prior to 10.6. Fix: [npm.community#7901](https://npm.community/t/7901/) Fix: [npm.community#8203](https://npm.community/t/8203/) Fix: isaacs/chownr#20 PR-URL: isaacs/chownr#21

@irega

PR-URL: #208 Close: #208 Credit: @irega Reviewed-by: @isaacs

@rsmarples

On BSD platforms, there is a clear seperation between the OS and third party packages. Here, bash is a third party package so it won't be installed to /bin. FreeBSD: /usr/local/bin/bash NetBSD: /usr/pkg/bin/bash OpenBSD: /usr/ports/bin/bash As such, we need to use /usr/bin/env to launch these scripts. Credit: @rsmarples PR-URL: #212 Close: #212 Reviewed-by: @isaacs

@RobertJGabriel

Credit: @RobertJGabriel PR-URL: #210 Close: #210 Reviewed-by: @isaacs

@RobertJGabriel

Addresses replace-var-with-let/const Credit: @RobertJGabriel PR-URL: #211 Close: #211 Reviewed-by: @isaacs

This requires that all tests use `common.cache` as their cache folder, and fix the ownership of any cache files that the test is directly managing. It also adds a `sudotest` target which runs the tests as root, and then verifies that no root-owned files have been dropped into the cache. Lastly, several setup() and cleanup() methods have been removed, as they are largely unnecessary. common-tap does all the required setup for test package directories and cache folders, and removing the cache avoids the root-ownership test, which is an important integration requirement.

This is particularly handy when tests fail, so that we can inspect the fixtures that they were using.

This prevents metrics timing and debug logs from becoming root-owned.

When running as sudo (without the -H flag), the HOME environment variable is /var/root by default. The correct-mkdir module was reading env.HOME to determine the appropriate uid and gid for files written to the cache folder. However, this is rarely correct. In practice, this module was reading env.SUDO_UID and env.SUDO_GID in some cases, but matching ownership on /var/root in others. This patch changes correct-mkdir to match the behavior of cacache v12, where ownership of a file or folder is inferred from the ownership of its nearest parent directory.

Related: https://npm.community/t/npm-audit-fails-with-child-requires-fails-because-requires-must-be-an-object/8540

@jfirebaugh

Partially reverts #40/#86, keeping the "Don't record linked deps as bundled" part but reverting the "Don't iterate into linked deps" part. It seems that we need to record dependencies of linked deps in order for `npm ci` to work. Fix: https://npm.community/t/6-8-0-npm-ci-fails-with-local-dependency/5385 Fix: https://npm.community/t/npm-ci-fail-to-local-packages/6076 PR-URL: #216 Credit: @jfirebaugh Close: #216 Reviewed-by: @isaacs EDIT: Updated test to not rely on network and follow latest and greatest test patterns.

@kittenking

PR-URL: #220 Credit: @kittenking Close: #220 Reviewed-by: @isaacs

@claudiahdz

PR-URL: #219 Credit: @claudiahdz Close: #219 Reviewed-by: @isaacs

@sapegin

Consistently use “vulnerabilities” in the message, don't use confusing “vulns”. PR-URL: #223 Credit: @sapegin Close: #223 Reviewed-by: @isaacs

@isaacs

Close: #222 PR-URL: #226 Credit: @isaacs Close: #226

@godmar

Suggested by @godmar in https://npm.community/t/npm-err-cb-never-called-permission-denied/9167/5 Incidentally, this turned up that we're catching uncaughtExceptions in the main npm functions, but not unhandledRejections! Tracing this through, it seems like node-fetch-npm's use of cacache is particularly brittle. Any throw that comes from cacache is not caught properly, since node-fetch-npm is all streams and callbacks. The naive approach (just adding a catch and failing the callback) doesn't work, because then make-fetch-happen and npm-registry-fetch interpret the failure as an invalid response, when actually it was a local cache error. So, a bit more love and polish is definitely still needed in the guts of npm's fetching and caching code paths. In the meantime, though, handling any unhandledRejection at the top level prevents at least the worst and most useless type of error message. PR-URL: #227 Credit: @isaacs Close: #227 Reviewed-by: @isaacs

@mterrel

@salomvary

… children" This reverts commit 2f0c883 to fix https://npm.community/t/installing-the-same-module-under-multiple-relative-paths-fails-on-linux/8863 Add (failing) test for failing relative paths Test case to shocase a bug reported here: https://npm.community/t/installing-the-same-module-under-multiple-relative-paths-fails-on-linux/8863/1 PR-URL: #217 Credit: @salomvary Close: #217 Reviewed-by: @isaacs

@isaacs

This builds on the work of #217, bringing back the logic in 2f0c883 for all deps other than 'directory' symlinks where it causes problems. This also causes the installer to *fix* shrinkwraps that inappropriately list the dependencies of directory symlink packages, which goes further to address the problems highlighted in https://npm.community/t/installing-the-same-module-under-multiple-relative-paths-fails-on-linux/8863 and https://npm.community/t/reinstall-breaks-after-npm-update-to-6-10-2/9327, even if a prior npm install created a broken package-lock.json file. Related: #217 Credit: @isaacs Fix: https://npm.community/t/reinstall-breaks-after-npm-update-to-6-10-2/9327 Fix: https://npm.community/t/installing-the-same-module-under-multiple-relative-paths-fails-on-linux/8863

@gall0ws

Just replaced Integer.MAX_SAFE_INTEGER with Number.MAX_SAFE_INTEGER. PR-URL: #229 Credit: @gall0ws Close: #229 Reviewed-by: @isaacs

@olivr70

PR-URL: #228 Credit: @olivr70 Close: #228 Reviewed-by: @isaacs

The last two have been merged into the main test set.

Infer the ownership of all unpacked files in node_modules, so that we never have user-owned files in root-owned folders, or root-owned files in user-owned folders. This prevents one of the last remaining issues that bites users who use `sudo` unnecessarily. The only remaining issue is to no longer drop perms when running scripts as root, but that is a breaking change which will come in v7.

@XhmikosR

PR-URL: #231 Credit: @XhmikosR Close: #231 Reviewed-by: @isaacs

@arcanis

PR-URL: #224 Credit: @arcanis Close: #224 Reviewed-by: @isaacs

@basbossink

- [`9c93ac3`](npm/cmd-shim@9c93ac3) [#2](npm/cmd-shim#2) [#3380](npm/npm#3380) Handle environment variables properly ([@basbossink](https://github.com/basbossink)) - [`2d277f8`](npm/cmd-shim@2d277f8) [#25](npm/cmd-shim#25) [#36](npm/cmd-shim#36) [#35](npm/cmd-shim#35) Fix 'no shebang' case by always providing `$basedir` in shell script ([@igorklopov](https://github.com/igorklopov)) - [`adaf20b`](npm/cmd-shim@adaf20b) [#26](npm/cmd-shim#26) Fix `$*` causing an error when arguments contain parentheses ([@satazor](https://github.com/satazor)) - [`49f0c13`](npm/cmd-shim@49f0c13) [#30](npm/cmd-shim#30) Fix paths for MSYS/MINGW bash ([@dscho](https://github.com/dscho)) - [`51a8af3`](npm/cmd-shim@51a8af3) [#34](npm/cmd-shim#34) Add proper support for PowerShell ([@ExE-Boss](https://github.com/ExE-Boss))

This addresses the issue when people fail to install binary packages on Docker and other environments where there is no 'nobody' user. The Config.loadUid() method was failing in these cases, but not in a way that was particularly informative. Furthermore, the uid and gid resolved in that way were just ignored and never stored anywhere. However, until npm-lifecycle@3.1.3, an error from uid-number was _also_ ignored, so if we didn't crash somewhere, then it would run scripts as root when provided with an invalid user. This is arguably fine, but it is a violation of the contract that the npm CLI presents. As of npm-lifecycle@3.1.3, these errors are handled properly in npm-lifecycle, so the additional uninformative crash is no longer doing anything. This commit removes that uninformative crash. This also means that we won't fail _until_ an invalid user config is actually relevant; if someone never runs an install script (or runs with --ignore-scripts), then it's not relevant, so we can move forward anyway.

Fixes the regression where random config values in a .npmrc file are not passed to lifecycle scripts, breaking build processes which rely on them. Fix: nodejs/node#28987 Fix: https://npm.community/t/npm-ci-doesnt-respect-npmrc-variables/6032 Fix: https://npm.community/t/npm-ci-doesnt-fill-anymore-the-process-env-npm-config-cache-variable-on-post-install-scripts/6658 Fix: https://npm.community/t/npm-ci-does-not-compile-native-dependencies-according-to-npmrc-configuration/6069 Fix: https://npm.community/t/npm-6-9-x-not-passing-environment-to-node-gyp-regression-from-6-4-x/9323/2

Fix bug in node v10 and before, where it'd crash when attempting to stringify the `npmlog` object.

Prevent root-owned files in user-owned locations, and vice versa.

Don't use SUDO_UID and SUDO_GID. Just make the file match the folder it's being written into. The vast majority of the time, this will be the user's home directory, but if it's not, then we should not leave a user-owned file in a root-owned location. And, if running as root without SUDO_UID/SUDO_GID environs, but putting a config file in the user's home dir, then it's quite rude to leave it root-owned.

Do not leave a root-owned package-lock or npm-shrinkwrap file in the project root, where it will create problems when the user tries to update it later.

This seems to break every time a dependency is updated. Not sure why node 6 is any different than any other environment, but it's probably not worth debugging any further.

@theberbie

PR-URL: #235 Credit: @theberbie Close: #235 Reviewed-by: @isaacs EDIT(isaacs): Added test

@claudiahdz

cc: @claudiahdz

@claudiahdz

PR-URL: #234 Credit: @claudiahdz Close: #234 Reviewed-by: @isaacs

Commits on Mar 6, 2019

6.9.0

zkat committed Mar 6, 2019

2 Configuration menu

View commit details

Copy full SHA for 656bce7

Browse repository at this point

Copy the full SHA

656bce7 View commit details

Browse the repository at this point in the history

Commits on Jun 26, 2019

6.9.1

isaacs committed Jun 26, 2019

Configuration menu

View commit details

Copy full SHA for 43cb258

Browse repository at this point

Copy the full SHA

43cb258 View commit details

Browse the repository at this point in the history

Commits on Jul 2, 2019

doc: update changelog to set date for 6.10.0

isaacs committed Jul 2, 2019

Configuration menu

View commit details

Copy full SHA for 162858b

Browse repository at this point

Copy the full SHA

162858b View commit details

Browse the repository at this point in the history

Commits on Jul 23, 2019

6.10.2

isaacs committed Jul 23, 2019

Configuration menu

View commit details

Copy full SHA for 6bcafd3

Browse repository at this point

Copy the full SHA

6bcafd3 View commit details

Browse the repository at this point in the history

Commits on Jul 24, 2019

doc: fix typo in changelog

isaacs committed Jul 24, 2019

Configuration menu

View commit details

Copy full SHA for b1d5e8d

Browse repository at this point

Copy the full SHA

b1d5e8d View commit details

Browse the repository at this point in the history

Commits on Aug 13, 2019

read-package-json@2.1.0

isaacs committed Aug 13, 2019

Configuration menu

View commit details

Copy full SHA for 8845141

Browse repository at this point

Copy the full SHA

8845141 View commit details

Browse the repository at this point in the history

Release 6.11.1 #236

Release 6.11.1 #236

Commits on Jan 23, 2019

Commits on Feb 14, 2019

Commits on Feb 18, 2019

Commits on Feb 19, 2019

Commits on Feb 20, 2019

Commits on Mar 6, 2019

Commits on Mar 19, 2019

Commits on Mar 20, 2019

Commits on Jun 26, 2019

Commits on Jun 27, 2019

Commits on Jun 30, 2019

Commits on Jul 1, 2019

Commits on Jul 2, 2019

Commits on Jul 3, 2019

Commits on Jul 10, 2019

Commits on Jul 11, 2019

Commits on Jul 16, 2019

Commits on Jul 17, 2019

Commits on Jul 21, 2019

Commits on Jul 22, 2019

Commits on Jul 23, 2019

Commits on Jul 24, 2019

Commits on Aug 1, 2019

Commits on Aug 2, 2019

Commits on Aug 4, 2019

Commits on Aug 5, 2019

Commits on Aug 6, 2019

Commits on Aug 9, 2019

Commits on Aug 12, 2019

Commits on Aug 13, 2019

Commits on Aug 14, 2019

Commits on Aug 15, 2019

Commits on Aug 16, 2019

Commits on Aug 19, 2019

Commits on Aug 20, 2019

Commits on Aug 21, 2019