14.14.0
diff --git a/Makefile b/Makefile
index b78b9a7337e958..e15b56115606d2 100644
--- a/Makefile
+++ b/Makefile
@@ -123,7 +123,7 @@ $(NODE_G_EXE): config.gypi out/Debug/build.ninja
if [ ! -r $@ -o ! -L $@ ]; then ln -fs out/Debug/$(NODE_EXE) $@; fi
else
$(NODE_EXE) $(NODE_G_EXE):
- echo This Makefile currently only supports building with 'make' or 'ninja'
+ $(warning This Makefile currently only supports building with 'make' or 'ninja')
endif
endif
@@ -133,12 +133,9 @@ CONFIG_FLAGS += --debug
endif
.PHONY: with-code-cache
-with-code-cache:
- echo "'with-code-cache' target is a noop"
-
.PHONY: test-code-cache
-test-code-cache: with-code-cache
- echo "'test-code-cache' target is a noop"
+with-code-cache test-code-cache:
+ $(warning '$@' target is a noop)
out/Makefile: config.gypi common.gypi node.gyp \
deps/uv/uv.gyp deps/llhttp/llhttp.gyp deps/zlib/zlib.gyp \
@@ -468,7 +465,7 @@ benchmark/napi/.buildstamp: $(ADDONS_PREREQS) \
.PHONY: clear-stalled
clear-stalled:
- @echo "Clean up any leftover processes but don't error if found."
+ $(info Clean up any leftover processes but don't error if found.)
ps awwx | grep Release/node | grep -v grep | cat
@PS_OUT=`ps awwx | grep Release/node | grep -v grep | awk '{print $$1}'`; \
if [ "$${PS_OUT}" ]; then \
@@ -519,7 +516,7 @@ test-ci-js: | clear-stalled
$(PYTHON) tools/test.py $(PARALLEL_ARGS) -p tap --logfile test.tap \
--mode=$(BUILDTYPE_LOWER) --flaky-tests=$(FLAKY_TESTS) \
$(TEST_CI_ARGS) $(CI_JS_SUITES)
- @echo "Clean up any leftover processes, error if found."
+ $(info Clean up any leftover processes, error if found.)
ps awwx | grep Release/node | grep -v grep | cat
@PS_OUT=`ps awwx | grep Release/node | grep -v grep | awk '{print $$1}'`; \
if [ "$${PS_OUT}" ]; then \
@@ -535,7 +532,7 @@ test-ci: | clear-stalled bench-addons-build build-addons build-js-native-api-tes
--mode=$(BUILDTYPE_LOWER) --flaky-tests=$(FLAKY_TESTS) \
$(TEST_CI_ARGS) $(CI_JS_SUITES) $(CI_NATIVE_SUITES) $(CI_DOC)
out/Release/embedtest 'require("./test/embedding/test-embedding.js")'
- @echo "Clean up any leftover processes, error if found."
+ $(info Clean up any leftover processes, error if found.)
ps awwx | grep Release/node | grep -v grep | cat
@PS_OUT=`ps awwx | grep Release/node | grep -v grep | awk '{print $$1}'`; \
if [ "$${PS_OUT}" ]; then \
@@ -671,7 +668,7 @@ test-v8: v8 ## Runs the V8 test suite on deps/v8.
deps/v8/tools/run-tests.py --gn --arch=$(V8_ARCH) $(V8_TEST_OPTIONS) \
mjsunit cctest debugger inspector message preparser \
$(TAP_V8)
- @echo Testing hash seed
+ $(info Testing hash seed)
$(MAKE) test-hash-seed
test-v8-intl: v8
@@ -691,9 +688,8 @@ test-v8-all: test-v8 test-v8-intl test-v8-benchmarks test-v8-updates
# runs all v8 tests
else
test-v8 test-v8-intl test-v8-benchmarks test-v8-all:
- @echo "Testing v8 is not available through the source tarball."
- @echo "Use the git repo instead:" \
- "$ git clone https://github.com/nodejs/node.git"
+ $(warning Testing V8 is not available through the source tarball.)
+ $(warning Use the git repo instead: $$ git clone https://github.com/nodejs/node.git)
endif
apidoc_dirs = out/doc out/doc/api out/doc/api/assets
@@ -928,14 +924,13 @@ MACOSOUTDIR=out/macos
ifeq ($(SKIP_XZ), 1)
check-xz:
- @echo "SKIP_XZ=1 supplied, skipping .tar.xz creation"
+ $(info SKIP_XZ=1 supplied, skipping .tar.xz creation)
else
ifeq ($(HAS_XZ), 1)
check-xz:
else
check-xz:
- @echo "No xz command, cannot continue"
- @exit 1
+ $(error No xz command, cannot continue)
endif
endif
@@ -1168,12 +1163,9 @@ ifeq ($(XZ), 1)
endif
.PHONY: bench-all
-bench-all: bench-addons-build
- @echo "Please use benchmark/run.js or benchmark/compare.js to run the benchmarks."
-
.PHONY: bench
-bench: bench-addons-build
- @echo "Please use benchmark/run.js or benchmark/compare.js to run the benchmarks."
+bench bench-all: bench-addons-build
+ $(warning Please use benchmark/run.js or benchmark/compare.js to run the benchmarks.)
# Build required addons for benchmark before running it.
.PHONY: bench-addons-build
@@ -1197,7 +1189,7 @@ lint-md-clean:
.PHONY: lint-md-build
lint-md-build:
- $(warning "Deprecated no-op target 'lint-md-build'")
+ $(warning Deprecated no-op target 'lint-md-build')
ifeq ("$(wildcard tools/.mdlintstamp)","")
LINT_MD_NEWER =
@@ -1212,7 +1204,7 @@ LINT_MD_FILES = $(shell $(FIND) $(LINT_MD_TARGETS) -type f \
run-lint-md = tools/lint-md.js -q -f --no-stdout $(LINT_MD_FILES)
# Lint all changed markdown files maintained by us
tools/.mdlintstamp: $(LINT_MD_FILES)
- @echo "Running Markdown linter..."
+ $(info Running Markdown linter...)
@$(call available-node,$(run-lint-md))
@touch $@
@@ -1243,7 +1235,7 @@ lint-js:
fi
jslint: lint-js
- @echo "Please use lint-js instead of jslint"
+ $(warning Please use lint-js instead of jslint)
run-lint-js-ci = tools/node_modules/eslint/bin/eslint.js \
--report-unused-disable-directives --ext=.js,.mjs,.md -f tap \
@@ -1252,11 +1244,11 @@ run-lint-js-ci = tools/node_modules/eslint/bin/eslint.js \
.PHONY: lint-js-ci
# On the CI the output is emitted in the TAP format.
lint-js-ci:
- @echo "Running JS linter..."
+ $(info Running JS linter...)
@$(call available-node,$(run-lint-js-ci))
jslint-ci: lint-js-ci
- @echo "Please use lint-js-ci instead of jslint-ci"
+ $(warning Please use lint-js-ci instead of jslint-ci)
LINT_CPP_ADDON_DOC_FILES_GLOB = test/addons/??_*/*.cc test/addons/??_*/*.h
LINT_CPP_ADDON_DOC_FILES = $(wildcard $(LINT_CPP_ADDON_DOC_FILES_GLOB))
@@ -1313,15 +1305,15 @@ CLANG_FORMAT_START ?= HEAD
# $ CLANG_FORMAT_START=master make format-cpp
format-cpp: ## Format C++ diff from $CLANG_FORMAT_START to current changes
ifneq ("","$(wildcard tools/clang-format/node_modules/)")
- @echo "Formatting C++ diff from $(CLANG_FORMAT_START).."
+ $(info Formatting C++ diff from $(CLANG_FORMAT_START)..)
@$(PYTHON) tools/clang-format/node_modules/.bin/git-clang-format \
--binary=tools/clang-format/node_modules/.bin/clang-format \
--style=file \
$(CLANG_FORMAT_START) -- \
$(LINT_CPP_FILES)
else
- @echo "clang-format is not installed."
- @echo "To install (requires internet access) run: $ make format-cpp-build"
+ $(info clang-format is not installed.)
+ $(info To install (requires internet access) run: $$ make format-cpp-build)
endif
ifeq ($(V),1)
@@ -1334,7 +1326,7 @@ endif
lint-cpp: tools/.cpplintstamp
tools/.cpplintstamp: $(LINT_CPP_FILES)
- @echo "Running C++ linter..."
+ $(info Running C++ linter...)
@$(PYTHON) tools/cpplint.py $(CPPLINT_QUIET) $?
@$(PYTHON) tools/checkimports.py $?
@touch $@
@@ -1343,19 +1335,19 @@ tools/.cpplintstamp: $(LINT_CPP_FILES)
lint-addon-docs: tools/.doclintstamp
tools/.doclintstamp: test/addons/.docbuildstamp
- @echo "Running C++ linter on addon docs..."
+ $(info Running C++ linter on addon docs...)
@$(PYTHON) tools/cpplint.py $(CPPLINT_QUIET) --filter=$(ADDON_DOC_LINT_FLAGS) \
$(LINT_CPP_ADDON_DOC_FILES_GLOB)
@touch $@
cpplint: lint-cpp
- @echo "Please use lint-cpp instead of cpplint"
+ $(warning Please use lint-cpp instead of cpplint)
.PHONY: lint-py-build
# python -m pip install flake8
# Try with '--system' is to overcome systems that blindly set '--user'
lint-py-build:
- @echo "Pip installing flake8 linter on $(shell $(PYTHON) --version)..."
+ $(info Pip installing flake8 linter on $(shell $(PYTHON) --version)...)
$(PYTHON) -m pip install --upgrade -t tools/pip/site-packages flake8 || \
$(PYTHON) -m pip install --upgrade --system -t tools/pip/site-packages flake8
@@ -1367,8 +1359,8 @@ lint-py:
PYTHONPATH=tools/pip $(PYTHON) -m flake8 --count --show-source --statistics .
else
lint-py:
- @echo "Python linting with flake8 is not avalible"
- @echo "Run 'make lint-py-build'"
+ $(warning Python linting with flake8 is not avalible)
+ $(warning Run 'make lint-py-build')
endif
.PHONY: lint
@@ -1394,12 +1386,9 @@ lint-ci: lint-js-ci lint-cpp lint-py lint-md lint-addon-docs
exit 1 ; \
fi
else
-lint:
- @echo "Linting is not available through the source tarball."
- @echo "Use the git repo instead:" \
- "$ git clone https://github.com/nodejs/node.git"
-
-lint-ci: lint
+lint lint-ci:
+ $(info Linting is not available through the source tarball.)
+ $(info Use the git repo instead: $$ git clone https://github.com/nodejs/node.git)
endif
.PHONY: lint-clean
@@ -1419,6 +1408,5 @@ gen-openssl: ## Generate platform dependent openssl files (requires docker)
$(DOCKER_COMMAND) node-openssl-builder make -C deps/openssl/config
else
gen-openssl:
- @echo "No docker command, cannot continue"
- @exit 1
+ $(error No docker command, cannot continue)
endif
diff --git a/README.md b/README.md
index a5066a675f0a8e..4f4d26898a8750 100644
--- a/README.md
+++ b/README.md
@@ -583,6 +583,8 @@ Primary GPG keys for Node.js Releasers (some Releasers sign with subkeys):
`4ED778F539E3634C779C87C6D7062848A1AB005C`
* **Colin Ihrig** <cjihrig@gmail.com>
`94AE36675C464D64BAFA68DD7434390BDBE9B9C5`
+* **Danielle Adams** <adamzdanielle@gmail.com>
+`1C050899334244A8AF75E53792EF661D867B9DFA`
* **James M Snell** <jasnell@keybase.io>
`71DCFD284A79C3B38668286BC97EC7A07EDE3FC1`
* **Michaël Zasso** <targos@protonmail.com>
@@ -605,6 +607,7 @@ To import the full set of trusted release keys:
```bash
gpg --keyserver pool.sks-keyservers.net --recv-keys 4ED778F539E3634C779C87C6D7062848A1AB005C
gpg --keyserver pool.sks-keyservers.net --recv-keys 94AE36675C464D64BAFA68DD7434390BDBE9B9C5
+gpg --keyserver pool.sks-keyservers.net --recv-keys 1C050899334244A8AF75E53792EF661D867B9DFA
gpg --keyserver pool.sks-keyservers.net --recv-keys 71DCFD284A79C3B38668286BC97EC7A07EDE3FC1
gpg --keyserver pool.sks-keyservers.net --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600
gpg --keyserver pool.sks-keyservers.net --recv-keys C4F0DFFF4E8C1A8236409D08E73BC641CC11F4C8
diff --git a/deps/npm/AUTHORS b/deps/npm/AUTHORS
index 7134e67e859148..eaea11d4d13b6f 100644
--- a/deps/npm/AUTHORS
+++ b/deps/npm/AUTHORS
@@ -722,3 +722,6 @@ nlf
zhaoxuxu
liuye.adam
Michaël Zasso
+Gareth Jones
+Jake Champion
+takenspc
diff --git a/deps/npm/CHANGELOG.md b/deps/npm/CHANGELOG.md
index 2b22d5fbb9717c..21066d39caffc3 100644
--- a/deps/npm/CHANGELOG.md
+++ b/deps/npm/CHANGELOG.md
@@ -1,3 +1,42 @@
+## 7.0.3 (2020-10-20)
+
+### BUG FIXES
+
+* [`ce4724a38`](https://github.com/npm/cli/commit/ce4724a3835ded9a4a29d8d67323f925461155e5)
+ [#1986](https://github.com/npm/cli/pull/1986)
+ check `result` when determining exit code of `ls `
+ ([@G-Rath](https://github.com/G-Rath))
+* [`00d926f8d`](https://github.com/npm/cli/commit/00d926f8d884872d08d9a0cd73aa9cace2acb91b)
+ [#1987](https://github.com/npm/cli/pull/1987)
+ don't suppress run output when `--silent` is passed
+ ([@G-Rath](https://github.com/G-Rath))
+* [`043da2347`](https://github.com/npm/cli/commit/043da234745f36d55742e827314837dead5807ab)
+ improve cache clear error message
+ ([@isaacs](https://github.com/isaacs))
+
+### DOCUMENTATION
+
+* [`a57f5c466`](https://github.com/npm/cli/commit/a57f5c466ceae59575ef05bb7941cce8752d8c58)
+ update docs for: access, adduser, audit, bin, bugs, build, cache, ci,
+ completion, config and dedupe
+ ([@isaacs](https://github.com/isaacs))
+* [`5b88b72b9`](https://github.com/npm/cli/commit/5b88b72b9821f7114cc4e475bbf52726a1674e52)
+ remove the long-gone bundle command
+ ([@isaacs](https://github.com/isaacs))
+* [`ae09aa5c1`](https://github.com/npm/cli/commit/ae09aa5c1cd150727b05ccfaeaba8d45e5697e50)
+ [#1993](https://github.com/npm/cli/pull/1993)
+ document --save-peer as a common option to npm install
+ ([@JakeChampion](https://github.com/JakeChampion))
+* [`c9993e6b1`](https://github.com/npm/cli/commit/c9993e6b1c2918699c2d125bf9b966f44f5d3ebe)
+ [#1982](https://github.com/npm/cli/pull/1982)
+ fix url links for init-package-json/node-semver
+ ([@takenspc](https://github.com/takenspc))
+
+### DEPENDENCIES
+
+* [`5d9df8395`](https://github.com/npm/cli/commit/5d9df83958d3d5e6d8acad2ebabfbe5f3fd23c13)
+ `node-gyp@7.1.2`
+
## 7.0.2 (2020-10-16)
### DOCUMENTATION
diff --git a/deps/npm/docs/content/cli-commands/npm-access.md b/deps/npm/docs/content/cli-commands/npm-access.md
index f4088fe8855139..ad221c16bdaba2 100644
--- a/deps/npm/docs/content/cli-commands/npm-access.md
+++ b/deps/npm/docs/content/cli-commands/npm-access.md
@@ -75,11 +75,12 @@ You must have privileges to set the access of a package:
* You have been given read-write privileges for a package, either as a member
of a team or directly as an owner.
-If you have two-factor authentication enabled then you'll have to pass in an
-otp with `--otp` when making access changes.
+If you have two-factor authentication enabled then you'll be prompted to
+provide an otp token, or may use the `--otp=...` option to specify it on
+the command line.
-If your account is not paid, then attempts to publish scoped packages will fail
-with an HTTP 402 status code (logically enough), unless you use
+If your account is not paid, then attempts to publish scoped packages will
+fail with an HTTP 402 status code (logically enough), unless you use
`--access=public`.
Management of teams and team memberships is done with the `npm team` command.
diff --git a/deps/npm/docs/content/cli-commands/npm-adduser.md b/deps/npm/docs/content/cli-commands/npm-adduser.md
index ec61cdd39acbad..abacc290566292 100644
--- a/deps/npm/docs/content/cli-commands/npm-adduser.md
+++ b/deps/npm/docs/content/cli-commands/npm-adduser.md
@@ -54,8 +54,8 @@ with the specified scope. See [`scope`](/using-npm/scope). You can use both at t
e.g.
```bash
- npm adduser --registry=http://myregistry.example.com --scope=@myco
-```
+npm adduser --registry=http://myregistry.example.com --scope=@myco
+```
This will set a registry for the given scope and login or create a user for
that registry at the same time.
@@ -69,7 +69,7 @@ registry should include authorization information. Useful for private
registries. Can be used with `--registry` and / or `--scope`, e.g.
```bash
- npm adduser --registry=http://private-registry.example.com --always-auth
+npm adduser --registry=http://private-registry.example.com --always-auth
```
This will ensure that all requests to that registry (including for tarballs)
diff --git a/deps/npm/docs/content/cli-commands/npm-audit.md b/deps/npm/docs/content/cli-commands/npm-audit.md
index 8b944e94cc12e2..391537048cf1c8 100644
--- a/deps/npm/docs/content/cli-commands/npm-audit.md
+++ b/deps/npm/docs/content/cli-commands/npm-audit.md
@@ -17,118 +17,180 @@ npm audit fix [--force|--package-lock-only|--dry-run]
common options: [--production] [--only=(dev|prod)]
```
+### Description
+
+The audit command submits a description of the dependencies configured in
+your project to your default registry and asks for a report of known
+vulnerabilities. If any vulnerabilities are found, then the impact and
+appropriate remediation will be calculated. If the `fix` argument is
+provided, then remediations will be applied to the package tree.
+
+The command will exit with a 0 exit code if no vulnerabilities were found.
+
+Note that some vulnerabilities cannot be fixed automatically and will
+require manual intervention or review. Also note that since `npm audit
+fix` runs a full-fledged `npm install` under the hood, all configs that
+apply to the installer will also apply to `npm install` -- so things like
+`npm audit fix --package-lock-only` will work as expected.
+
+By default, the audit command will exit with a non-zero code if any
+vulnerability is found. It may be useful in CI environments to include the
+`--audit-level` parameter to specify the minimum vulnerability level that
+will cause the command to fail. This option does not filter the report
+output, it simply changes the command's failure threshold.
+
+### Audit Endpoints
+
+There are two audit endpoints that npm may use to fetch vulnerability
+information: the `Bulk Advisory` endpoint and the `Quick Audit` endpoint.
+
+#### Bulk Advisory Endpoint
+
+As of version 7, npm uses the much faster `Bulk Advisory` endpoint to
+optimize the speed of calculating audit results.
+
+npm will generate a JSON payload with the name and list of versions of each
+package in the tree, and POST it to the default configured registry at
+the path `/-/npm/v1/security/advisories/bulk`.
+
+Any packages in the tree that do not have a `version` field in their
+package.json file will be ignored. If any `--omit` options are specified
+(either via the `--omit` config, or one of the shorthands such as
+`--production`, `--only=dev`, and so on), then packages will be omitted
+from the submitted payload as appropriate.
+
+If the registry responds with an error, or with an invalid response, then
+npm will attempt to load advisory data from the `Quick Audit` endpoint.
+
+The expected result will contain a set of advisory objects for each
+dependency that matches the advisory range. Each advisory object contains
+a `name`, `url`, `id`, `severity`, `vulnerable_versions`, and `title`.
+
+npm then uses these advisory objects to calculate vulnerabilities and
+meta-vulnerabilities of the dependencies within the tree.
+
+#### Quick Audit Endpoint
+
+If the `Bulk Advisory` endpoint returns an error, or invalid data, npm will
+attempt to load advisory data from the `Quick Audit` endpoint, which is
+considerably slower in most cases.
+
+The full package tree as found in `package-lock.json` is submitted, along
+with the following pieces of additional metadata:
+
+* `npm_version`
+* `node_version`
+* `platform`
+* `arch`
+* `node_env`
+
+All packages in the tree are submitted to the Quick Audit endpoint.
+Omitted dependency types are skipped when generating the report.
+
+#### Scrubbing
+
+Out of an abundance of caution, npm versions 5 and 6 would "scrub" any
+packages from the submitted report if their name contained a `/` character,
+so as to avoid leaking the names of potentially private packages or git
+URLs.
+
+However, in practice, this resulted in audits often failing to properly
+detect meta-vulnerabilities, because the tree would appear to be invalid
+due to missing dependencies, and prevented the detection of vulnerabilities
+in package trees that used git dependencies or private modules.
+
+This scrubbing has been removed from npm as of version 7.
+
+#### Calculating Meta-Vulnerabilities and Remediations
+
+npm uses the
+[`@npmcli/metavuln-calculator`](http://npm.im/@npmcli/metavuln-calculator)
+module to turn a set of security advisories into a set of "vulnerability"
+objects. A "meta-vulnerability" is a dependency that is vulnerable by
+virtue of dependence on vulnerable versions of a vulnerable package.
+
+For example, if the package `foo` is vulnerable in the range `>=1.0.2
+<2.0.0`, and the package `bar` depends on `foo@^1.1.0`, then that version
+of `bar` can only be installed by installing a vulnerable version of `foo`.
+In this case, `bar` is a "metavulnerability".
+
+Once metavulnerabilities for a given package are calculated, they are
+cached in the `~/.npm` folder and only re-evaluated if the advisory range
+changes, or a new version of the package is published (in which case, the
+new version is checked for metavulnerable status as well).
+
+If the chain of metavulnerabilities extends all the way to the root
+project, and it cannot be updated without changing its dependency ranges,
+then `npm audit fix` will require the `--force` option to apply the
+remediation. If remediations do not require changes to the dependency
+ranges, then all vulnerable packages will be updated to a version that does
+not have an advisory or metavulnerability posted against it.
+
+### Exit Code
+
+The `npm audit` command will exit with a 0 exit code if no vulnerabilities
+were found. The `npm audit fix` command will exit with 0 exit code if no
+vulnerabilities are found _or_ if the remediation is able to successfully
+fix all vulnerabilities.
+
+If vulnerabilities were found the exit code will depend on the
+`audit-level` configuration setting.
+
### Examples
Scan your project for vulnerabilities and automatically install any compatible
updates to vulnerable dependencies:
+
```bash
$ npm audit fix
```
Run `audit fix` without modifying `node_modules`, but still updating the
pkglock:
+
```bash
$ npm audit fix --package-lock-only
```
Skip updating `devDependencies`:
+
```bash
$ npm audit fix --only=prod
```
-Have `audit fix` install semver-major updates to toplevel dependencies, not just
-semver-compatible ones:
+Have `audit fix` install SemVer-major updates to toplevel dependencies, not
+just SemVer-compatible ones:
+
```bash
$ npm audit fix --force
```
Do a dry run to get an idea of what `audit fix` will do, and _also_ output
install information in JSON format:
+
```bash
$ npm audit fix --dry-run --json
```
-Scan your project for vulnerabilities and just show the details, without fixing
-anything:
+Scan your project for vulnerabilities and just show the details, without
+fixing anything:
+
```bash
$ npm audit
```
Get the detailed audit report in JSON format:
-```bash
-$ npm audit --json
-```
-
-Get the detailed audit report in plain text result, separated by tab characters, allowing for
-future reuse in scripting or command line post processing, like for example, selecting
-some of the columns printed:
-```bash
-$ npm audit --parseable
-```
-To parse columns, you can use for example `awk`, and just print some of them:
```bash
-$ npm audit --parseable | awk -F $'\t' '{print $1,$4}'
+$ npm audit --json
```
Fail an audit only if the results include a vulnerability with a level of moderate or higher:
+
```bash
$ npm audit --audit-level=moderate
```
-### Description
-
-The audit command submits a description of the dependencies configured in
-your project to your default registry and asks for a report of known
-vulnerabilities. The report returned includes instructions on how to act on
-this information. The command will exit with a 0 exit code if no
-vulnerabilities were found.
-
-You can also have npm automatically fix the vulnerabilities by running `npm
-audit fix`. Note that some vulnerabilities cannot be fixed automatically and
-will require manual intervention or review. Also note that since `npm audit fix`
-runs a full-fledged `npm install` under the hood, all configs that apply to the
-installer will also apply to `npm install` -- so things like `npm audit fix
---package-lock-only` will work as expected.
-
-By default, the audit command will exit with a non-zero code if any vulnerability
-is found. It may be useful in CI environments to include the `--audit-level` parameter
-to specify the minimum vulnerability level that will cause the command to fail. This
-option does not filter the report output, it simply changes the command's failure
-threshold.
-
-### Content Submitted
-
-* npm_version
-* node_version
-* platform
-* node_env
-* A scrubbed version of your package-lock.json or npm-shrinkwrap.json
-
-#### Scrubbing
-
-In order to ensure that potentially sensitive information is not included in
-the audit data bundle, some dependencies may have their names (and sometimes
-versions) replaced with opaque non-reversible identifiers. It is done for
-the following dependency types:
-
-* Any module referencing a scope that is configured for a non-default
- registry has its name scrubbed. (That is, a scope you did a `npm login --scope=@ourscope` for.)
-* All git dependencies have their names and specifiers scrubbed.
-* All remote tarball dependencies have their names and specifiers scrubbed.
-* All local directory and tarball dependencies have their names and specifiers scrubbed.
-
-The non-reversible identifiers are a sha256 of a session-specific UUID and the
-value being replaced, ensuring a consistent value within the payload that is
-different between runs.
-
-### Exit Code
-
-The `npm audit` command will exit with a 0 exit code if no vulnerabilities were found.
-
-If vulnerabilities were found the exit code will depend on the `audit-level`
-configuration setting.
-
### See Also
* [npm install](/cli-commands/install)
diff --git a/deps/npm/docs/content/cli-commands/npm-bin.md b/deps/npm/docs/content/cli-commands/npm-bin.md
index eb0912ae48a92a..33b0aa822c9d04 100644
--- a/deps/npm/docs/content/cli-commands/npm-bin.md
+++ b/deps/npm/docs/content/cli-commands/npm-bin.md
@@ -9,6 +9,7 @@ description: Display npm bin folder
## Display npm bin folder
### Synopsis
+
```bash
npm bin [-g|--global]
```
diff --git a/deps/npm/docs/content/cli-commands/npm-bugs.md b/deps/npm/docs/content/cli-commands/npm-bugs.md
index 1e7272cec92493..d21e24a27e5a41 100644
--- a/deps/npm/docs/content/cli-commands/npm-bugs.md
+++ b/deps/npm/docs/content/cli-commands/npm-bugs.md
@@ -6,9 +6,10 @@ description: Bugs for a package in a web browser maybe
# npm-bugs(1)
-## Bugs for a package in a web browser maybe
+## Report bugs for a package in a web browser
### Synopsis
+
```bash
npm bugs [ [ ...]]
@@ -17,10 +18,10 @@ aliases: issues
### Description
-This command tries to guess at the likely location of a package's
-bug tracker URL, and then tries to open it using the `--browser`
-config param. If no package name is provided, it will search for
-a `package.json` in the current folder and use the `name` property.
+This command tries to guess at the likely location of a package's bug
+tracker URL, and then tries to open it using the `--browser` config param.
+If no package name is provided, it will search for a `package.json` in the
+current folder and use the `name` property.
### Configuration
@@ -43,7 +44,6 @@ Set to `true` to use default system URL opener.
The base URL of the npm package registry.
-
### See Also
* [npm docs](/cli-commands/docs)
diff --git a/deps/npm/docs/content/cli-commands/npm-bundle.md b/deps/npm/docs/content/cli-commands/npm-bundle.md
deleted file mode 100644
index c4fdc5e6bb0e64..00000000000000
--- a/deps/npm/docs/content/cli-commands/npm-bundle.md
+++ /dev/null
@@ -1,21 +0,0 @@
----
-section: cli-commands
-title: npm-bundle
-description: REMOVED
----
-
-# npm-bundle(1)
-
-## REMOVED
-
-### Description
-
-The `npm bundle` command has been removed in 1.0, for the simple reason
-that it is no longer necessary, as the default behavior is now to
-install packages into the local space.
-
-Just use `npm install` now to do what `npm bundle` used to do.
-
-### See Also
-
-* [npm install](/cli-commands/install)
diff --git a/deps/npm/docs/content/cli-commands/npm-cache.md b/deps/npm/docs/content/cli-commands/npm-cache.md
index 4d19749b80f2d9..e3c9d415511a72 100644
--- a/deps/npm/docs/content/cli-commands/npm-cache.md
+++ b/deps/npm/docs/content/cli-commands/npm-cache.md
@@ -16,7 +16,7 @@ npm cache add
npm cache add
npm cache add @
-npm cache clean []
+npm cache clean
aliases: npm cache clear, npm cache rm
npm cache verify
@@ -32,41 +32,45 @@ Used to add, list, or clean the npm cache folder.
add data to the local installation cache explicitly.
* clean:
- Delete all data out of the cache folder.
+ Delete all data out of the cache folder. Note that this is typically
+ unnecessary, as npm's cache is self-healing and resistant to data
+ corruption issues.
* verify:
- Verify the contents of the cache folder, garbage collecting any unneeded data,
- and verifying the integrity of the cache index and all cached data.
+ Verify the contents of the cache folder, garbage collecting any unneeded
+ data, and verifying the integrity of the cache index and all cached data.
### Details
npm stores cache data in an opaque directory within the configured `cache`,
-named `_cacache`. This directory is a `cacache`-based content-addressable cache
-that stores all http request data as well as other package-related data. This
-directory is primarily accessed through `pacote`, the library responsible for
-all package fetching as of npm@5.
-
-All data that passes through the cache is fully verified for integrity on both
-insertion and extraction. Cache corruption will either trigger an error, or
-signal to `pacote` that the data must be refetched, which it will do
-automatically. For this reason, it should never be necessary to clear the cache
-for any reason other than reclaiming disk space, thus why `clean` now requires
-`--force` to run.
-
-There is currently no method exposed through npm to inspect or directly manage
-the contents of this cache. In order to access it, `cacache` must be used
-directly.
+named `_cacache`. This directory is a
+[`cacache`](http://npm.im/cacache)-based content-addressable cache that
+stores all http request data as well as other package-related data. This
+directory is primarily accessed through `pacote`, the library responsible
+for all package fetching as of npm@5.
+
+All data that passes through the cache is fully verified for integrity on
+both insertion and extraction. Cache corruption will either trigger an
+error, or signal to `pacote` that the data must be refetched, which it will
+do automatically. For this reason, it should never be necessary to clear
+the cache for any reason other than reclaiming disk space, thus why `clean`
+now requires `--force` to run.
+
+There is currently no method exposed through npm to inspect or directly
+manage the contents of this cache. In order to access it, `cacache` must be
+used directly.
npm will not remove data by itself: the cache will grow as new packages are
installed.
### A note about the cache's design
-The npm cache is strictly a cache: it should not be relied upon as a persistent
-and reliable data store for package data. npm makes no guarantee that a
-previously-cached piece of data will be available later, and will automatically
-delete corrupted contents. The primary guarantee that the cache makes is that,
-if it does return data, that data will be exactly the data that was inserted.
+The npm cache is strictly a cache: it should not be relied upon as a
+persistent and reliable data store for package data. npm makes no guarantee
+that a previously-cached piece of data will be available later, and will
+automatically delete corrupted contents. The primary guarantee that the
+cache makes is that, if it does return data, that data will be exactly the
+data that was inserted.
To run an offline verification of existing cache contents, use `npm cache
verify`.
@@ -89,3 +93,5 @@ The root cache folder.
* [npm pack](/cli-commands/pack)
* https://npm.im/cacache
* https://npm.im/pacote
+* https://npm.im/@npmcli/arborist
+* https://npm.im/make-fetch-happen
diff --git a/deps/npm/docs/content/cli-commands/npm-ci.md b/deps/npm/docs/content/cli-commands/npm-ci.md
index b5b6447a485f8f..bb3bf931474477 100644
--- a/deps/npm/docs/content/cli-commands/npm-ci.md
+++ b/deps/npm/docs/content/cli-commands/npm-ci.md
@@ -9,10 +9,36 @@ description: Install a project with a clean slate
## Install a project with a clean slate
### Synopsis
+
```bash
npm ci
```
+### Description
+
+This command is similar to [`npm install`](/cli-commands/install), except
+it's meant to be used in automated environments such as test platforms,
+continuous integration, and deployment -- or any situation where you want
+to make sure you're doing a clean install of your dependencies.
+
+`npm ci` will be significantly faster when:
+
+- There is a `package-lock.json` or `npm-shrinkwrap.json` file.
+- The `node_modules` folder is missing or empty.
+
+In short, the main differences between using `npm install` and `npm ci` are:
+
+* The project **must** have an existing `package-lock.json` or
+ `npm-shrinkwrap.json`.
+* If dependencies in the package lock do not match those in `package.json`,
+ `npm ci` will exit with an error, instead of updating the package lock.
+* `npm ci` can only install entire projects at a time: individual
+ dependencies cannot be added with this command.
+* If a `node_modules` is already present, it will be automatically removed
+ before `npm ci` begins its install.
+* It will never write to `package.json` or any of the package-locks:
+ installs are essentially frozen.
+
### Example
Make sure you have a package-lock and an up-to-date install:
@@ -43,24 +69,6 @@ cache:
- "$HOME/.npm"
```
-### Description
-
-This command is similar to [`npm install`](/cli-commands/install), except it's meant to be used in
-automated environments such as test platforms, continuous integration, and
-deployment -- or any situation where you want to make sure you're doing a clean
-install of your dependencies. It can be significantly faster than a regular npm
-install by skipping certain user-oriented features. It is also more strict than
-a regular install, which can help catch errors or inconsistencies caused by the
-incrementally-installed local environments of most npm users.
-
-In short, the main differences between using `npm install` and `npm ci` are:
-
-* The project **must** have an existing `package-lock.json` or `npm-shrinkwrap.json`.
-* If dependencies in the package lock do not match those in `package.json`, `npm ci` will exit with an error, instead of updating the package lock.
-* `npm ci` can only install entire projects at a time: individual dependencies cannot be added with this command.
-* If a `node_modules` is already present, it will be automatically removed before `npm ci` begins its install.
-* It will never write to `package.json` or any of the package-locks: installs are essentially frozen.
-
### See Also
* [npm install](/cli-commands/install)
diff --git a/deps/npm/docs/content/cli-commands/npm-completion.md b/deps/npm/docs/content/cli-commands/npm-completion.md
index 59bfca503e0846..c79cf176a101f9 100644
--- a/deps/npm/docs/content/cli-commands/npm-completion.md
+++ b/deps/npm/docs/content/cli-commands/npm-completion.md
@@ -9,6 +9,7 @@ description: Tab Completion for npm
## Tab Completion for npm
### Synopsis
+
```bash
source <(npm completion)
```
diff --git a/deps/npm/docs/content/cli-commands/npm-config.md b/deps/npm/docs/content/cli-commands/npm-config.md
index 68d403746fc103..0c20e493556e4f 100644
--- a/deps/npm/docs/content/cli-commands/npm-config.md
+++ b/deps/npm/docs/content/cli-commands/npm-config.md
@@ -9,6 +9,7 @@ description: Manage the npm configuration files
## Manage the npm configuration files
### Synopsis
+
```bash
npm config set [-g|--global]
npm config get
@@ -26,10 +27,11 @@ aliases: c
npm gets its config settings from the command line, environment
variables, `npmrc` files, and in some cases, the `package.json` file.
-See [npmrc](/configuring-npm/npmrc) for more information about the npmrc files.
+See [npmrc](/configuring-npm/npmrc) for more information about the npmrc
+files.
-See [config](/using-npm/config) for a more thorough discussion of the mechanisms
-involved.
+See [config(7)](/using-npm/config) for a more thorough explanation of the
+mechanisms involved, and a full list of config options available.
The `npm config` command can be used to update and edit the contents
of the user and global npmrc files.
@@ -39,14 +41,17 @@ of the user and global npmrc files.
Config supports the following sub-commands:
#### set
+
```bash
npm config set key value
```
+
Sets the config key to the value.
If value is omitted, then it sets it to "true".
#### get
+
```bash
npm config get key
```
@@ -54,6 +59,7 @@ npm config get key
Echo the config value to stdout.
#### list
+
```bash
npm config list
```
@@ -62,6 +68,7 @@ Show all the config settings. Use `-l` to also show defaults. Use `--json`
to show the settings in json format.
#### delete
+
```bash
npm config delete key
```
@@ -69,6 +76,7 @@ npm config delete key
Deletes the key from all configuration files.
#### edit
+
```bash
npm config edit
```
diff --git a/deps/npm/docs/content/cli-commands/npm-dedupe.md b/deps/npm/docs/content/cli-commands/npm-dedupe.md
index e0493f5e2c98db..84ccb772fb9bc4 100644
--- a/deps/npm/docs/content/cli-commands/npm-dedupe.md
+++ b/deps/npm/docs/content/cli-commands/npm-dedupe.md
@@ -9,6 +9,7 @@ description: Reduce duplication
## Reduce duplication
### Synopsis
+
```bash
npm dedupe
npm ddp
@@ -55,8 +56,6 @@ be deleted.
Arguments are ignored. Dedupe always acts on the entire tree.
-Modules
-
Note that this operation transforms the dependency tree, but will never
result in new modules being installed.
diff --git a/deps/npm/docs/content/cli-commands/npm-init.md b/deps/npm/docs/content/cli-commands/npm-init.md
index 32b7f823019910..d88637cdf590fb 100644
--- a/deps/npm/docs/content/cli-commands/npm-init.md
+++ b/deps/npm/docs/content/cli-commands/npm-init.md
@@ -68,7 +68,7 @@ will create a scoped package.
### See Also
-*
+*
* [package.json](/configuring-npm/package-json)
* [npm version](/cli-commands/version)
* [npm scope](/using-npm/scope)
diff --git a/deps/npm/docs/content/cli-commands/npm-install.md b/deps/npm/docs/content/cli-commands/npm-install.md
index 5ffb96f688b6b7..20ae45850d81ce 100644
--- a/deps/npm/docs/content/cli-commands/npm-install.md
+++ b/deps/npm/docs/content/cli-commands/npm-install.md
@@ -24,7 +24,7 @@ npm install
npm install
aliases: npm i, npm add
-common options: [-P|--save-prod|-D|--save-dev|-O|--save-optional] [-E|--save-exact] [-B|--save-bundle] [--no-save] [--dry-run]
+common options: [-P|--save-prod|-D|--save-dev|-O|--save-optional|--save-peer] [-E|--save-exact] [-B|--save-bundle] [--no-save] [--dry-run]
```
### Description
diff --git a/deps/npm/docs/content/configuring-npm/package-json.md b/deps/npm/docs/content/configuring-npm/package-json.md
index 794c7ad7d43539..206009822f9d77 100644
--- a/deps/npm/docs/content/configuring-npm/package-json.md
+++ b/deps/npm/docs/content/configuring-npm/package-json.md
@@ -58,7 +58,7 @@ Changes to the package should come along with changes to the version. If you don
plan to publish your package, the name and version fields are optional.
Version must be parseable by
-[node-semver](https://github.com/isaacs/node-semver), which is bundled
+[node-semver](https://github.com/npm/node-semver), which is bundled
with npm as a dependency. (`npm install semver` to use it yourself.)
More on version numbers and ranges at [semver](/using-npm/semver).
diff --git a/deps/npm/docs/public/cli-commands/npm-access/index.html b/deps/npm/docs/public/cli-commands/npm-access/index.html
index efca31ca3fcf58..dd18a0c001b05d 100644
--- a/deps/npm/docs/public/cli-commands/npm-access/index.html
+++ b/deps/npm/docs/public/cli-commands/npm-access/index.html
@@ -76,7 +76,7 @@
}
}
})
-
If your account is not paid, then attempts to publish scoped packages will fail
-with an HTTP 402 status code (logically enough), unless you use
+
If you have two-factor authentication enabled then you'll be prompted to
+provide an otp token, or may use the --otp=... option to specify it on
+the command line.
+
If your account is not paid, then attempts to publish scoped packages will
+fail with an HTTP 402 status code (logically enough), unless you use
--access=public.
Management of teams and team memberships is done with the npm team command.