Release: npm@6.10.0 by isaacs · Pull Request #205 · npm/cli

isaacs · 2019-06-29T22:30:10Z

v6.10.0 (TBD):

FEATURES

87fef4e35#176 fix: Always return JSON for outdated --json (@sreeramjayan)
f101d44fc#203 fix(unpublish): add space after hyphen (@ffflorian)
a4475de4c#202 enable production flag for npm audit (@CalebCourier)
d192904d0#178 fix: Return a value for view when in silent mode (@stayradiated)
39d473adf#185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

d9238af0b#201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
4bec4f111#200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
ce93dab2d#180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

a823f3084 travis: Update to include new v12 LTS (@isaacs)
33e2d1dac fix flaky debug-logs test (@isaacs)
e9411c6cd Don't time out waiting for gpg user input (@isaacs)
d2d301704#195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

f5857e263#192 Clarify usage of bundledDependencies (@john-osullivan)
747fdaf66#159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

e36b3c320 graceful-fs@4.2.0 (@isaacs)
6bb935c09 read-package-tree@5.3.1 (@isaacs)
- e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
39538b460 write-file-atomic@2.4.3 (@isaacs)
- f8b1552#38 Ignore errors raised by fs.closeSync (@lukeapage)
042193069 pacote@9.5.1 (@isaacs)
- 8bbd051#172 limit git retry times, avoid unlimited retries (小秦)
- 92f5e4c#170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
8bd8e909f cacache@11.3.3 (@isaacs)
- 47de8f5#146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
- 5156561 fix(write): avoid a cb never called situation (@zkat)
- 90f40f0#166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
bf61c45c6 bluebird@3.5.5 (@isaacs)
f75d46a9d tar@4.4.10 (@isaacs)
- c80341a#215 Fix encoding/decoding of base-256 numbers (@justfalter)
- 77522f0#204 #214 Use stat instead of lstat when checking CWD (@stkb)
ec6236210 npm-packlist@1.4.4 (@isaacs)
- 63d1e3e#30 Sort package tarball entries by file type for compression benefits (@isaacs)
- 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
- 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
57bef61bc update fstream in node-gyp (@isaacs)
- Addresses security advisory #886
acbbf7eee#183 licensee@7.0.2 (@kemitchell)
011ae67f0 readable-stream@3.3.0 (@isaacs)
f5e884909 npm-registry-mock@1.2.1 (@isaacs)
b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacsClose: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

zkat

isaacs · 2019-06-29T22:30:10Z

v6.10.0 (TBD):

FEATURES

87fef4e35#176 fix: Always return JSON for outdated --json (@sreeramjayan)
f101d44fc#203 fix(unpublish): add space after hyphen (@ffflorian)
a4475de4c#202 enable production flag for npm audit (@CalebCourier)
d192904d0#178 fix: Return a value for view when in silent mode (@stayradiated)
39d473adf#185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

d9238af0b#201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
4bec4f111#200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
ce93dab2d#180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

a823f3084 travis: Update to include new v12 LTS (@isaacs)
33e2d1dac fix flaky debug-logs test (@isaacs)
e9411c6cd Don't time out waiting for gpg user input (@isaacs)
d2d301704#195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

f5857e263#192 Clarify usage of bundledDependencies (@john-osullivan)
747fdaf66#159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

e36b3c320 graceful-fs@4.2.0 (@isaacs)
6bb935c09 read-package-tree@5.3.1 (@isaacs)
- e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
39538b460 write-file-atomic@2.4.3 (@isaacs)
- f8b1552#38 Ignore errors raised by fs.closeSync (@lukeapage)
042193069 pacote@9.5.1 (@isaacs)
- 8bbd051#172 limit git retry times, avoid unlimited retries (小秦)
- 92f5e4c#170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
8bd8e909f cacache@11.3.3 (@isaacs)
- 47de8f5#146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
- 5156561 fix(write): avoid a cb never called situation (@zkat)
- 90f40f0#166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
bf61c45c6 bluebird@3.5.5 (@isaacs)
f75d46a9d tar@4.4.10 (@isaacs)
- c80341a#215 Fix encoding/decoding of base-256 numbers (@justfalter)
- 77522f0#204 #214 Use stat instead of lstat when checking CWD (@stkb)
ec6236210 npm-packlist@1.4.4 (@isaacs)
- 63d1e3e#30 Sort package tarball entries by file type for compression benefits (@isaacs)
- 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
- 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
57bef61bc update fstream in node-gyp (@isaacs)
- Addresses security advisory #886
acbbf7eee#183 licensee@7.0.2 (@kemitchell)
011ae67f0 readable-stream@3.3.0 (@isaacs)
f5e884909 npm-registry-mock@1.2.1 (@isaacs)
b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacsClose: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

zkat

isaacs · 2019-06-29T22:30:10Z

v6.10.0 (TBD):

FEATURES

87fef4e35#176 fix: Always return JSON for outdated --json (@sreeramjayan)
f101d44fc#203 fix(unpublish): add space after hyphen (@ffflorian)
a4475de4c#202 enable production flag for npm audit (@CalebCourier)
d192904d0#178 fix: Return a value for view when in silent mode (@stayradiated)
39d473adf#185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

d9238af0b#201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
4bec4f111#200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
ce93dab2d#180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

a823f3084 travis: Update to include new v12 LTS (@isaacs)
33e2d1dac fix flaky debug-logs test (@isaacs)
e9411c6cd Don't time out waiting for gpg user input (@isaacs)
d2d301704#195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

f5857e263#192 Clarify usage of bundledDependencies (@john-osullivan)
747fdaf66#159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

e36b3c320 graceful-fs@4.2.0 (@isaacs)
6bb935c09 read-package-tree@5.3.1 (@isaacs)
- e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
39538b460 write-file-atomic@2.4.3 (@isaacs)
- f8b1552#38 Ignore errors raised by fs.closeSync (@lukeapage)
042193069 pacote@9.5.1 (@isaacs)
- 8bbd051#172 limit git retry times, avoid unlimited retries (小秦)
- 92f5e4c#170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
8bd8e909f cacache@11.3.3 (@isaacs)
- 47de8f5#146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
- 5156561 fix(write): avoid a cb never called situation (@zkat)
- 90f40f0#166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
bf61c45c6 bluebird@3.5.5 (@isaacs)
f75d46a9d tar@4.4.10 (@isaacs)
- c80341a#215 Fix encoding/decoding of base-256 numbers (@justfalter)
- 77522f0#204 #214 Use stat instead of lstat when checking CWD (@stkb)
ec6236210 npm-packlist@1.4.4 (@isaacs)
- 63d1e3e#30 Sort package tarball entries by file type for compression benefits (@isaacs)
- 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
- 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
57bef61bc update fstream in node-gyp (@isaacs)
- Addresses security advisory #886
acbbf7eee#183 licensee@7.0.2 (@kemitchell)
011ae67f0 readable-stream@3.3.0 (@isaacs)
f5e884909 npm-registry-mock@1.2.1 (@isaacs)
b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacsClose: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

zkat

isaacs · 2019-06-29T22:30:10Z

v6.10.0 (TBD):

FEATURES

87fef4e35#176 fix: Always return JSON for outdated --json (@sreeramjayan)
f101d44fc#203 fix(unpublish): add space after hyphen (@ffflorian)
a4475de4c#202 enable production flag for npm audit (@CalebCourier)
d192904d0#178 fix: Return a value for view when in silent mode (@stayradiated)
39d473adf#185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

d9238af0b#201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
4bec4f111#200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
ce93dab2d#180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

a823f3084 travis: Update to include new v12 LTS (@isaacs)
33e2d1dac fix flaky debug-logs test (@isaacs)
e9411c6cd Don't time out waiting for gpg user input (@isaacs)
d2d301704#195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

f5857e263#192 Clarify usage of bundledDependencies (@john-osullivan)
747fdaf66#159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

e36b3c320 graceful-fs@4.2.0 (@isaacs)
6bb935c09 read-package-tree@5.3.1 (@isaacs)
- e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
39538b460 write-file-atomic@2.4.3 (@isaacs)
- f8b1552#38 Ignore errors raised by fs.closeSync (@lukeapage)
042193069 pacote@9.5.1 (@isaacs)
- 8bbd051#172 limit git retry times, avoid unlimited retries (小秦)
- 92f5e4c#170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
8bd8e909f cacache@11.3.3 (@isaacs)
- 47de8f5#146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
- 5156561 fix(write): avoid a cb never called situation (@zkat)
- 90f40f0#166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
bf61c45c6 bluebird@3.5.5 (@isaacs)
f75d46a9d tar@4.4.10 (@isaacs)
- c80341a#215 Fix encoding/decoding of base-256 numbers (@justfalter)
- 77522f0#204 #214 Use stat instead of lstat when checking CWD (@stkb)
ec6236210 npm-packlist@1.4.4 (@isaacs)
- 63d1e3e#30 Sort package tarball entries by file type for compression benefits (@isaacs)
- 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
- 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
57bef61bc update fstream in node-gyp (@isaacs)
- Addresses security advisory #886
acbbf7eee#183 licensee@7.0.2 (@kemitchell)
011ae67f0 readable-stream@3.3.0 (@isaacs)
f5e884909 npm-registry-mock@1.2.1 (@isaacs)
b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacsClose: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

zkat

isaacs · 2019-06-29T22:30:10Z

v6.10.0 (TBD):

FEATURES

87fef4e35#176 fix: Always return JSON for outdated --json (@sreeramjayan)
f101d44fc#203 fix(unpublish): add space after hyphen (@ffflorian)
a4475de4c#202 enable production flag for npm audit (@CalebCourier)
d192904d0#178 fix: Return a value for view when in silent mode (@stayradiated)
39d473adf#185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

d9238af0b#201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
4bec4f111#200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
ce93dab2d#180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

a823f3084 travis: Update to include new v12 LTS (@isaacs)
33e2d1dac fix flaky debug-logs test (@isaacs)
e9411c6cd Don't time out waiting for gpg user input (@isaacs)
d2d301704#195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

f5857e263#192 Clarify usage of bundledDependencies (@john-osullivan)
747fdaf66#159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

e36b3c320 graceful-fs@4.2.0 (@isaacs)
6bb935c09 read-package-tree@5.3.1 (@isaacs)
- e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
39538b460 write-file-atomic@2.4.3 (@isaacs)
- f8b1552#38 Ignore errors raised by fs.closeSync (@lukeapage)
042193069 pacote@9.5.1 (@isaacs)
- 8bbd051#172 limit git retry times, avoid unlimited retries (小秦)
- 92f5e4c#170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
8bd8e909f cacache@11.3.3 (@isaacs)
- 47de8f5#146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
- 5156561 fix(write): avoid a cb never called situation (@zkat)
- 90f40f0#166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
bf61c45c6 bluebird@3.5.5 (@isaacs)
f75d46a9d tar@4.4.10 (@isaacs)
- c80341a#215 Fix encoding/decoding of base-256 numbers (@justfalter)
- 77522f0#204 #214 Use stat instead of lstat when checking CWD (@stkb)
ec6236210 npm-packlist@1.4.4 (@isaacs)
- 63d1e3e#30 Sort package tarball entries by file type for compression benefits (@isaacs)
- 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
- 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
57bef61bc update fstream in node-gyp (@isaacs)
- Addresses security advisory #886
acbbf7eee#183 licensee@7.0.2 (@kemitchell)
011ae67f0 readable-stream@3.3.0 (@isaacs)
f5e884909 npm-registry-mock@1.2.1 (@isaacs)
b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacsClose: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

zkat

isaacs · 2019-06-29T22:30:10Z

v6.10.0 (TBD):

FEATURES

87fef4e35#176 fix: Always return JSON for outdated --json (@sreeramjayan)
f101d44fc#203 fix(unpublish): add space after hyphen (@ffflorian)
a4475de4c#202 enable production flag for npm audit (@CalebCourier)
d192904d0#178 fix: Return a value for view when in silent mode (@stayradiated)
39d473adf#185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

d9238af0b#201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
4bec4f111#200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
ce93dab2d#180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

a823f3084 travis: Update to include new v12 LTS (@isaacs)
33e2d1dac fix flaky debug-logs test (@isaacs)
e9411c6cd Don't time out waiting for gpg user input (@isaacs)
d2d301704#195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

f5857e263#192 Clarify usage of bundledDependencies (@john-osullivan)
747fdaf66#159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

e36b3c320 graceful-fs@4.2.0 (@isaacs)
6bb935c09 read-package-tree@5.3.1 (@isaacs)
- e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
39538b460 write-file-atomic@2.4.3 (@isaacs)
- f8b1552#38 Ignore errors raised by fs.closeSync (@lukeapage)
042193069 pacote@9.5.1 (@isaacs)
- 8bbd051#172 limit git retry times, avoid unlimited retries (小秦)
- 92f5e4c#170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
8bd8e909f cacache@11.3.3 (@isaacs)
- 47de8f5#146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
- 5156561 fix(write): avoid a cb never called situation (@zkat)
- 90f40f0#166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
bf61c45c6 bluebird@3.5.5 (@isaacs)
f75d46a9d tar@4.4.10 (@isaacs)
- c80341a#215 Fix encoding/decoding of base-256 numbers (@justfalter)
- 77522f0#204 #214 Use stat instead of lstat when checking CWD (@stkb)
ec6236210 npm-packlist@1.4.4 (@isaacs)
- 63d1e3e#30 Sort package tarball entries by file type for compression benefits (@isaacs)
- 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
- 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
57bef61bc update fstream in node-gyp (@isaacs)
- Addresses security advisory #886
acbbf7eee#183 licensee@7.0.2 (@kemitchell)
011ae67f0 readable-stream@3.3.0 (@isaacs)
f5e884909 npm-registry-mock@1.2.1 (@isaacs)
b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacsClose: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

zkat

isaacs · 2019-06-29T22:30:10Z

v6.10.0 (TBD):

FEATURES

87fef4e35#176 fix: Always return JSON for outdated --json (@sreeramjayan)
f101d44fc#203 fix(unpublish): add space after hyphen (@ffflorian)
a4475de4c#202 enable production flag for npm audit (@CalebCourier)
d192904d0#178 fix: Return a value for view when in silent mode (@stayradiated)
39d473adf#185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

d9238af0b#201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
4bec4f111#200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
ce93dab2d#180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

a823f3084 travis: Update to include new v12 LTS (@isaacs)
33e2d1dac fix flaky debug-logs test (@isaacs)
e9411c6cd Don't time out waiting for gpg user input (@isaacs)
d2d301704#195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

f5857e263#192 Clarify usage of bundledDependencies (@john-osullivan)
747fdaf66#159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

e36b3c320 graceful-fs@4.2.0 (@isaacs)
6bb935c09 read-package-tree@5.3.1 (@isaacs)
- e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
39538b460 write-file-atomic@2.4.3 (@isaacs)
- f8b1552#38 Ignore errors raised by fs.closeSync (@lukeapage)
042193069 pacote@9.5.1 (@isaacs)
- 8bbd051#172 limit git retry times, avoid unlimited retries (小秦)
- 92f5e4c#170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
8bd8e909f cacache@11.3.3 (@isaacs)
- 47de8f5#146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
- 5156561 fix(write): avoid a cb never called situation (@zkat)
- 90f40f0#166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
bf61c45c6 bluebird@3.5.5 (@isaacs)
f75d46a9d tar@4.4.10 (@isaacs)
- c80341a#215 Fix encoding/decoding of base-256 numbers (@justfalter)
- 77522f0#204 #214 Use stat instead of lstat when checking CWD (@stkb)
ec6236210 npm-packlist@1.4.4 (@isaacs)
- 63d1e3e#30 Sort package tarball entries by file type for compression benefits (@isaacs)
- 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
- 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
57bef61bc update fstream in node-gyp (@isaacs)
- Addresses security advisory #886
acbbf7eee#183 licensee@7.0.2 (@kemitchell)
011ae67f0 readable-stream@3.3.0 (@isaacs)
f5e884909 npm-registry-mock@1.2.1 (@isaacs)
b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacsClose: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

zkat

isaacs · 2019-06-29T22:30:10Z

v6.10.0 (TBD):

FEATURES

87fef4e35#176 fix: Always return JSON for outdated --json (@sreeramjayan)
f101d44fc#203 fix(unpublish): add space after hyphen (@ffflorian)
a4475de4c#202 enable production flag for npm audit (@CalebCourier)
d192904d0#178 fix: Return a value for view when in silent mode (@stayradiated)
39d473adf#185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

d9238af0b#201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
4bec4f111#200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
ce93dab2d#180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

a823f3084 travis: Update to include new v12 LTS (@isaacs)
33e2d1dac fix flaky debug-logs test (@isaacs)
e9411c6cd Don't time out waiting for gpg user input (@isaacs)
d2d301704#195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

f5857e263#192 Clarify usage of bundledDependencies (@john-osullivan)
747fdaf66#159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

e36b3c320 graceful-fs@4.2.0 (@isaacs)
6bb935c09 read-package-tree@5.3.1 (@isaacs)
- e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
39538b460 write-file-atomic@2.4.3 (@isaacs)
- f8b1552#38 Ignore errors raised by fs.closeSync (@lukeapage)
042193069 pacote@9.5.1 (@isaacs)
- 8bbd051#172 limit git retry times, avoid unlimited retries (小秦)
- 92f5e4c#170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
8bd8e909f cacache@11.3.3 (@isaacs)
- 47de8f5#146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
- 5156561 fix(write): avoid a cb never called situation (@zkat)
- 90f40f0#166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
bf61c45c6 bluebird@3.5.5 (@isaacs)
f75d46a9d tar@4.4.10 (@isaacs)
- c80341a#215 Fix encoding/decoding of base-256 numbers (@justfalter)
- 77522f0#204 #214 Use stat instead of lstat when checking CWD (@stkb)
ec6236210 npm-packlist@1.4.4 (@isaacs)
- 63d1e3e#30 Sort package tarball entries by file type for compression benefits (@isaacs)
- 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
- 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
57bef61bc update fstream in node-gyp (@isaacs)
- Addresses security advisory #886
acbbf7eee#183 licensee@7.0.2 (@kemitchell)
011ae67f0 readable-stream@3.3.0 (@isaacs)
f5e884909 npm-registry-mock@1.2.1 (@isaacs)
b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

This fixes a ERR_INVALID_OPT_VALUE error on Node v12

Several changes to the test suite to support running tests in parallel, bringing the overall test time down considerably. - Replace all literal 1337 and 1234 ports with a custom per-process port assignment based on the TAP_CHILD_ID environment variable. - Add common.pkg as a per-test working directory instead of polluting __dirname or accidentally reusing the same working directory for multiple tests. - Rework test config handling so that tests don't rely on config setup being run in a particular order. - Remove the npm-registry-couchapp tests, since it (a) relies on CouchDB, (b) is no longer a reliable indicator of registry compatibility, and (c) is already superceded in most cases by tests that use npm-registry-mock. (A test suite that runs against a reference implementation is a thing that should exist, but not here.) - Remove the fake-registry logging when TAP_CHILD_ID is set, since this is extremely hard to make sense of when running multiple tests in parallel. When Node v6 compatibility is dropped in npm v7, we can upgrade to the latest version of tap for a bit more speed, dropping Domains (and the associated deprecation warnings), and a fancier test reporter.

Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

Close: #183

@isaacs

-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

implementation added in #31

I spent a couple hours debugging the fact that package names in that key aren't supposed to include their versions! Assumed that it would need to have the same syntax as when running `npm install`. Thought this would be a good contribution for future readers.

Signed-off-by: ossdev <ossdev@puresoftware.com>

Addresses https://www.npmjs.com/advisories/886

npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

@isaacs

Note: SemVer minor -- @isaacsClose: #202

Never include /.git in the package. It creates packages that, once installed, can not be easily removed. Prevent .DS_Store files from being picked up if they are files rather than folders. (Note that a .DS_Store file in a specifically included dir _will_ still be included.) Don't bother walking node_modules in the root if no packages are bundled. (Saves thousands of lstat calls on npm publish in normal cases.) Sort package file lists in the tarball to optimize for gzip compression.

Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

Fix: npm/npm#17858Fix: npm/npm#18042 Fix: https://npm.community/t/issue-npm-dedupe-crash-with-typeerror-cannot-read-property-0-of-undefined/644/3Close: #201 This fixes a bug where a package folder might have a package.json which is missing or lacks a name property. It also properly detects the scoped-ness of a package folder even if the package name is not scoped, since one might install `express@npm:@scope/express` and end up in that state.

@isaacs

Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

zkat

isaacs force-pushed the release-next-6.10.0 branch 3 times, most recently from dcf460b to ce38c46Compare June 29, 2019 23:32

isaacsand others added 27 commits June 29, 2019 20:23

readable-stream@3.3.0
011ae67
This fixes a ERR_INVALID_OPT_VALUE error on Node v12

tap@12.7.0
740fd95

outdated: fix special 'remote' deps
ce93dab
Add a special case for 'remote' deps (tarballs). Before b7b54f2 the package names were possibly just looked up in the registry instead. See https://npm.community/t/6187Close: #180

licensee@7.0.2
acbbf7e
Close: #183

Fix: Return a value for view when in silent mode
d192904

Allow git to follow global tagsign config
39d473a
-a tells git to "ignore the git config for signing tags" that is all it does. Close: #185 Note: SemVer minor -- @isaacs

doc: add --audit-level param
747fdaf
implementation added in #31

chore: replace var with const in lib/adduser.js
8d4effb

CLI: Add the arm64 check for legacy-platform-all.js test case.
d2d3017
Signed-off-by: ossdev <ossdev@puresoftware.com>

update fstream in node-gyp
57bef61
Addresses https://www.npmjs.com/advisories/886

npm checks only node.exe and not node on local dir
4bec4f1
npm find local node.exe on windows, but relies on global node installation on linux. Added a test to check for a local installation of node before relying on the system wide installation. Close: #200

enable production flag for npm audit
a4475de
Note: SemVer minor -- @isaacsClose: #202

fix indentation in test
2ee405d

fix(unpublish): add space after hyphen
f101d44

tar@4.4.10
f75d46a
Fixes a bug related to FSReqWrap on Node v12, and incorrect encoding/decoding of base-256 numeric values.

bluebird@3.5.5
bf61c45

npm-registry-couchapp@2.7.2
b57d07e

test: Don't time out waiting for gpg user input
e9411c6

npm-registry-mock@1.2.1
f5e8849

fix: Always return JSON for outdated --json
87fef4e
Close: #176 EDIT: Added test, do not set exitStatus to 1 if we're just printing an empty list as JSON. -- @isaacs

cacache@11.3.3
8bd8e90

pacote@9.5.1
0421930

write-file-atomic@2.4.3
39538b4

isaacs added 3 commits June 29, 2019 23:43

read-package-tree@5.3.1
6bb935c

travis: Update to include new v12 LTS
a823f30

graceful-fs@4.2.0
e36b3c3

isaacs force-pushed the release-next-6.10.0 branch 2 times, most recently from 4b83db6 to 42bd015Compare July 1, 2019 04:51

isaacs marked this pull request as ready for review July 1, 2019 04:52

isaacs requested a review from a team as a code owner July 1, 2019 04:52

isaacs changed the title ~~Release next 6.10.0~~Release: 6.10.0Jul 1, 2019

isaacs added 2 commits June 30, 2019 22:27

test: use common.pkg basedir in newly added test
828c21d
Missed this on the review. Minor nit, not worth rebasing, now that the release is almost ready to ship.

doc: update changelog for npm@6.10.0
36ddc3c

isaacs force-pushed the release-next-6.10.0 branch from 42bd015 to 36ddc3cCompare July 1, 2019 05:27

isaacs changed the title ~~Release: 6.10.0~~Release: npm@6.10.0Jul 1, 2019

zkat added the release label Jul 1, 2019

zkat approved these changes Jul 1, 2019
View reviewed changes

isaacs added 4 commits July 1, 2019 11:03

update AUTHORS
cad4b85

6.10.0-next.0
eee0bcd

doc: update changelog to set date for 6.10.0
162858b

6.10.0
c1522be

isaacs merged commit c1522be into latestJul 3, 2019

ossdev07 mentioned this pull request Jul 9, 2019
Added ARM64 platform check #195
Closed

isaacs deleted the release-next-6.10.0 branch August 19, 2021 16:23

trentm mentioned this pull request Apr 13, 2023
chore: re-add require-in-the-middle dep elastic/apm-agent-nodejs#3266
Merged

gutwrinch mentioned this pull request Oct 19, 2023
[Snyk] Upgrade ini from 3.0.1 to 4.1.1 gutwrinch/cli-1#4
Merged

snyk-ioBot mentioned this pull request Oct 22, 2024
[Snyk] Fix for 55 vulnerabilities Graybar-codespace/cli-3#116
Open

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 8, 2026
🤖 봇 응답 (npm#205)
a6c3e67

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 20, 2026
📊 blog1 게시 완료 (npm#205)
e5c6c29

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 20, 2026
📊 blog2 게시 완료 (npm#205)
322f354

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 20, 2026
📊 blog3 게시 완료 (npm#205)
d21f68f

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Aug 16, 2026
🔧 자동 수리 완료 (npm#205)
9cf693a

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Aug 19, 2026
🔥 트렌드 선점 후보 갱신 (npm#205)
66197ad