Release: npm@6.4.0#43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
zkat merged 20 commits into from
Aug 15, 2018
Merged

Release: npm@6.4.0 #43

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
c3ab25f
doc: file-specifier: Remove stray comment
iarna Jul 26, 2018
6e9f04b
config: Search for authentication token defined by environment variab…
mkhl Aug 3, 2018
af98e76
docs: Update --dry-run docs (#34)
joebowbeer Aug 3, 2018
84bfd23
config: stop filtering out non-ipv4 addresses from local-addrs (#35)
Aug 3, 2018
e2b0f09
docs: Improved repository examples (#36)
noahbenham Aug 3, 2018
32e6947
colors@1.1.2 (#39)
iarna Aug 3, 2018
792c8c7
audit: configurable audit level for non-zero exit (#31)
lennym Aug 3, 2018
d811461
cli: don't check for updates to npm when we are updating npm itself (…
olore Aug 3, 2018
e2346e7
docs: added a section for usage with process.env (#14)
mwarger Aug 7, 2018
beb96b9
libcipm@2.0.1
zkat Aug 7, 2018
348fc91
validate-npm-package-license@3.0.4
zkat Aug 7, 2018
e57d345
iferr@1.0.2
zkat Aug 7, 2018
46f1c6a
tar@4.4.6
zkat Aug 7, 2018
50df1bf
hosted-git-info@2.7.1
zkat Aug 7, 2018
866d776
request@2.87.0
zkat Aug 9, 2018
f861c2b
node-gyp@3.8.0
zkat Aug 9, 2018
dbbb75c
doc: update changelog for npm@6.4.0
zkat Aug 9, 2018
214ef61
update AUTHORS
zkat Aug 9, 2018
361226d
6.4.0-next.0
zkat Aug 9, 2018
58ece89
6.4.0
zkat Aug 15, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
5 changes: 5 additions & 0 deletions AUTHORS
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -591,3 +591,8 @@ Darryl Pogue <dvpdiner2@gmail.com>
Rick Schubert <rickschubert@gmx.de>
Daniel W <dwilches@gmail.com>
XhmikosR <xhmikosr@gmail.com>
Martin Kühl <mkhl@users.noreply.github.com>
Valentin Ouvrard <valentin210594@gmail.com>
Noah Benham <noahbenham@users.noreply.github.com>
Brian Olore <brian@olore.net>
Mat Warger <mwarger@gmail.com>
89 changes: 89 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,92 @@
## v6.4.0 (2018-09-08):

### NEW FEATURES

* [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7)

@iarnaiarnaAug 9, 2018

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow the implementation for that ended up being waaay better than it originally was

@zkatzkatAug 9, 2018

Copy link
Copy Markdown
ContributorAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agreeee

[npm/cli#8](https://github.com/npm/cli/pull/8)
Search for authentication token defined by environment variables by preventing
the translation layer from env variable to npm option from breaking
`:_authToken`.
([@mkhl](https://github.com/mkhl))
* [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022)
[npm/cli#35](https://github.com/npm/cli/pull/35)
Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually
use IPv6 addresses when it must.
([@valentin2105](https://github.com/valentin2105))
* [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd)
[npm/cli#31](https://github.com/npm/cli/pull/31)
configurable audit level for non-zero exit
`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level.
Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found.
Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.
([@lennym](https://github.com/lennym))

### BUGFIXES

* [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c)
[npm/cli#32](https://github.com/npm/cli/pull/32)
Don't check for updates to npm when we are updating npm itself.
([@olore](https://github.com/olore))

### DEPENDENCY UPDATES

A very special dependency update event! Since the [release of
`node-gyp@3.8.0`](https://github.com/nodejs/node-gyp/pull/1521), an awkward
version conflict that was preventing `request` from begin flattened was
resolved. This means two things:

1. We've cut down the npm tarball size by another 200kb, to 4.6MB
2. `npm audit` now shows no vulnerabilities for npm itself!

Thanks, [@rvagg](https://github.com/rvagg)!

* [`866d776c2`](https://github.com/npm/cli/commit/866d776c27f80a71309389aaab42825b2a0916f6)
`request@2.87.0`
([@simov](https://github.com/simov))
* [`f861c2b57`](https://github.com/npm/cli/commit/f861c2b579a9d4feae1653222afcefdd4f0e978f)
`node-gyp@3.8.0`
([@rvagg](https://github.com/rvagg))
* [`32e6947c6`](https://github.com/npm/cli/commit/32e6947c60db865257a0ebc2f7e754fedf7a6fc9)
[npm/cli#39](https://github.com/npm/cli/pull/39)
`colors@1.1.2`:
REVERT REVERT, newer versions of this library are broken and print ansi
codes even when disabled.
([@iarna](https://github.com/iarna))
* [`beb96b92c`](https://github.com/npm/cli/commit/beb96b92caf061611e3faafc7ca10e77084ec335)
`libcipm@2.0.1`
([@zkat](https://github.com/zkat))
* [`348fc91ad`](https://github.com/npm/cli/commit/348fc91ad223ff91cd7bcf233018ea1d979a2af1)
`validate-npm-package-license@3.0.4`: Fixes errors with empty or string-only
license fields.
([@Gudahtt](https://github.com/Gudahtt))
* [`e57d34575`](https://github.com/npm/cli/commit/e57d3457547ef464828fc6f82ae4750f3e511550)
`iferr@1.0.2`
([@shesek](https://github.com/shesek))
* [`46f1c6ad4`](https://github.com/npm/cli/commit/46f1c6ad4b2fd5b0d7ec879b76b76a70a3a2595c)
`tar@4.4.6`
([@isaacs](https://github.com/isaacs))
* [`50df1bf69`](https://github.com/npm/cli/commit/50df1bf691e205b9f13e0fff0d51a68772c40561)
`hosted-git-info@2.7.1`
([@iarna](https://github.com/iarna))
([@Erveon](https://github.com/Erveon))
([@huochunpeng](https://github.com/huochunpeng))

### DOCUMENTATION

* [`af98e76ed`](https://github.com/npm/cli/commit/af98e76ed96af780b544962aa575585b3fa17b9a)
[npm/cli#34](https://github.com/npm/cli/pull/34)
Remove `npm publish` from list of commands not affected by `--dry-run`.
([@joebowbeer](https://github.com/joebowbeer))
* [`e2b0f0921`](https://github.com/npm/cli/commit/e2b0f092193c08c00f12a6168ad2bd9d6e16f8ce)
[npm/cli#36](https://github.com/npm/cli/pull/36)
Tweak formatting in repository field examples.
([@noahbenham](https://github.com/noahbenham))
* [`e2346e770`](https://github.com/npm/cli/commit/e2346e7702acccefe6d711168c2b0e0e272e194a)
[npm/cli#14](https://github.com/npm/cli/pull/14)
Used `process.env` examples to make accessing certain `npm run-scripts`
environment variables more clear.
([@mwarger](https://github.com/mwarger))

## v6.3.0 (2018-08-01):

This is basically the same as the prerelease, but two dependencies have been
Expand Down
3 changes: 3 additions & 0 deletions bin/npm-cli.js
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -69,12 +69,15 @@
npm.command = 'help'
}

var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm')

// now actually fire up npm and run the command.
// this is how to use npm programmatically:
conf._exit = true
npm.load(conf, function (er) {
if (er) return errorHandler(er)
if (
!isGlobalNpmUpdate &&
npm.config.get('update-notifier') &&
!unsupported.checkVersion(process.version).unsupported
) {
Expand Down
16 changes: 8 additions & 8 deletions doc/files/package.json.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -366,15 +366,15 @@ command will be able to find you.

Do it like this:

"repository" :
{ "type" : "git"
, "url" : "https://github.com/npm/cli.git"
}
"repository": {
"type" : "git",
"url" : "https://github.com/npm/cli.git"
}

"repository" :
{ "type" : "svn"
, "url" : "https://v8.googlecode.com/svn/trunk/"
}
"repository": {
"type" : "svn",
"url" : "https://v8.googlecode.com/svn/trunk/"
}

The URL should be a publicly available (perhaps read-only) url that can be handed
directly to a VCS program without any modification. It should not be a url to an
Expand Down
12 changes: 10 additions & 2 deletions doc/misc/npm-config.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -164,6 +164,14 @@ When "true" submit audit reports alongside `npm install` runs to the default
registry and all registries configured for scopes. See the documentation
for npm-audit(1) for details on what is submitted.

### audit-level

* Default: `"low"`
* Type: `'low'`, `'moderate'`, `'high'`, `'critical'`

The minimum level of vulnerability for `npm audit` to exit with
a non-zero exit code.

### auth-type

* Default: `'legacy'`
Expand DownExpand Up@@ -331,8 +339,8 @@ Install `dev-dependencies` along with packages.
Indicates that you don't want npm to make any changes and that it should
only report what it would have done. This can be passed into any of the
commands that modify your local installation, eg, `install`, `update`,
`dedupe`, `uninstall`. This is NOT currently honored by network related
commands, eg `dist-tags`, `owner`, `publish`, etc.
`dedupe`, `uninstall`. This is NOT currently honored by some network related
commands, eg `dist-tags`, `owner`, etc.

### editor

Expand Down
4 changes: 3 additions & 1 deletion doc/misc/npm-scripts.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -143,7 +143,9 @@ The package.json fields are tacked onto the `npm_package_` prefix. So,
for instance, if you had `{"name":"foo", "version":"1.2.5"}` in your
package.json file, then your package scripts would have the
`npm_package_name` environment variable set to "foo", and the
`npm_package_version` set to "1.2.5"
`npm_package_version` set to "1.2.5". You can access these variables
in your code with `process.env.npm_package_name` and
`process.env.npm_package_version`, and so on for other fields.

### configuration

Expand Down
3 changes: 0 additions & 3 deletions doc/spec/file-specifiers.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -55,9 +55,6 @@ note for the `npm-shrinkwrap.json` as it means the specifier there will
be different then the original `package.json` (where it was relative to that
`package.json`).

# No, for `file:` type specifiers, we SHOULD shrinkwrap. Other symlinks we
# should not. Other symlinks w/o the link spec should be an error.

When shrinkwrapping file specifiers, the contents of the destination
package's `node_modules` WILL NOT be included in the shrinkwrap. If you want to lock
down the destination package's `node_modules` you should create a shrinkwrap for it
Expand Down
10 changes: 5 additions & 5 deletions lib/audit.js
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -257,11 +257,11 @@ function auditCmd (args, cb) {
})
})
} else {
const vulns =
auditResult.metadata.vulnerabilities.low +
auditResult.metadata.vulnerabilities.moderate +
auditResult.metadata.vulnerabilities.high +
auditResult.metadata.vulnerabilities.critical
const levels = ['low', 'moderate', 'high', 'critical']
const minLevel = levels.indexOf(npm.config.get('audit-level'))
const vulns = levels.reduce((count, level, i) => {
return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
}, 0)
if (vulns > 0) process.exitCode = 1
if (npm.config.get('parseable')) {
return audit.printParseableReport(auditResult)
Expand Down
17 changes: 5 additions & 12 deletions lib/config/defaults.js
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
'always-auth': false,
also: null,
audit: true,
'audit-level': 'low',
'auth-type': 'legacy',

'bin-links': true,
Expand DownExpand Up@@ -257,6 +258,7 @@ exports.types = {
'always-auth': Boolean,
also: [null, 'dev', 'development'],
audit: Boolean,
'audit-level': ['low', 'moderate', 'high', 'critical'],
'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
'bin-links': Boolean,
browser: [null, String],
Expand DownExpand Up@@ -306,8 +308,6 @@ exports.types = {
key: [null, String],
'legacy-bundling': Boolean,
link: Boolean,
// local-address must be listed as an IP for a local network interface
// must be IPv4 due to node bug
'local-address': getLocalAddresses(),
loglevel: ['silent', 'error', 'warn', 'notice', 'http', 'timing', 'info', 'verbose', 'silly'],
logstream: Stream,
Expand DownExpand Up@@ -388,16 +388,9 @@ function getLocalAddresses () {
interfaces = {}
}

return Object.keys(interfaces).map(function (nic) {
return interfaces[nic].filter(function (addr) {
return addr.family === 'IPv4'
})
.map(function (addr) {
return addr.address
})
}).reduce(function (curr, next) {
return curr.concat(next)
}, []).concat(undefined)
return Object.keys(interfaces).map(
nic => interfaces[nic].map(({address}) => address)
).reduce((curr, next) => curr.concat(next), []).concat(undefined)
}

exports.shorthands = {
Expand Down
6 changes: 6 additions & 0 deletions lib/config/get-credentials-by-uri.js
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,12 @@ function getCredentialsByURI (uri) {
return c
}

if (this.get(nerfed + ':-authtoken')) {
c.token = this.get(nerfed + ':-authtoken')
// the bearer token is enough, don't confuse things
return c
}

// Handle the old-style _auth=<base64> style for the default
// registry, if set.
var authDef = this.get('_auth')
Expand Down
6 changes: 6 additions & 0 deletions node_modules/assert-plus/CHANGES.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

9 changes: 8 additions & 1 deletion node_modules/assert-plus/README.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 5 additions & 0 deletions node_modules/assert-plus/assert.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 10 additions & 10 deletions node_modules/assert-plus/package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion node_modules/aws-sign2/index.js
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Release: npm@6.4.0#43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

zkat
merged 20 commits into

from

Aug 15, 2018
 Merged


Release: npm@6.4.0
#43
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


20 commits


Select commit
Hold shift + click to select a range
c3ab25f

doc: file-specifier: Remove stray comment


iarna Jul 26, 2018
6e9f04b

config: Search for authentication token defined by environment variab…


mkhl Aug 3, 2018
af98e76

docs: Update --dry-run docs (#34)


joebowbeer Aug 3, 2018
84bfd23

config: stop filtering out non-ipv4 addresses from local-addrs (#35)

Aug 3, 2018
e2b0f09

docs: Improved repository examples (#36)


noahbenham Aug 3, 2018
32e6947

colors@1.1.2 (#39)


iarna Aug 3, 2018
792c8c7

audit: configurable audit level for non-zero exit (#31)


lennym Aug 3, 2018
d811461

cli: don't check for updates to npm when we are updating npm itself (…


olore Aug 3, 2018
e2346e7

docs: added a section for usage with process.env (#14)


mwarger Aug 7, 2018
beb96b9

libcipm@2.0.1


zkat Aug 7, 2018
348fc91

validate-npm-package-license@3.0.4


zkat Aug 7, 2018
e57d345

iferr@1.0.2


zkat Aug 7, 2018
46f1c6a

tar@4.4.6


zkat Aug 7, 2018
50df1bf

hosted-git-info@2.7.1


zkat Aug 7, 2018
866d776

request@2.87.0


zkat Aug 9, 2018
f861c2b

node-gyp@3.8.0


zkat Aug 9, 2018
dbbb75c

doc: update changelog for npm@6.4.0


zkat Aug 9, 2018
214ef61

update AUTHORS


zkat Aug 9, 2018
361226d

6.4.0-next.0


zkat Aug 9, 2018
58ece89

6.4.0


zkat Aug 15, 2018

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

5 changes: 5 additions & 0 deletions
AUTHORS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -591,3 +591,8 @@ Darryl Pogue <dvpdiner2@gmail.com>
Rick Schubert <rickschubert@gmx.de>
Daniel W <dwilches@gmail.com>
XhmikosR <xhmikosr@gmail.com>
Martin Kühl <mkhl@users.noreply.github.com>
Valentin Ouvrard <valentin210594@gmail.com>
Noah Benham <noahbenham@users.noreply.github.com>
Brian Olore <brian@olore.net>
Mat Warger <mwarger@gmail.com>

89 changes: 89 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,92 @@
## v6.4.0 (2018-09-08):

### NEW FEATURES

* [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7)
@iarnaiarnaAug 9, 2018

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow the implementation for that ended up being waaay better than it originally was
@zkatzkatAug 9, 2018

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agreeee
 [npm/cli#8](https://github.com/npm/cli/pull/8)
 Search for authentication token defined by environment variables by preventing
 the translation layer from env variable to npm option from breaking
 `:_authToken`.
 ([@mkhl](https://github.com/mkhl))
* [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022)
 [npm/cli#35](https://github.com/npm/cli/pull/35)
 Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually
 use IPv6 addresses when it must.
 ([@valentin2105](https://github.com/valentin2105))
* [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd)
 [npm/cli#31](https://github.com/npm/cli/pull/31)
 configurable audit level for non-zero exit
 `npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level.
 Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found.
 Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.
 ([@lennym](https://github.com/lennym))

### BUGFIXES

* [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c)
 [npm/cli#32](https://github.com/npm/cli/pull/32)
 Don't check for updates to npm when we are updating npm itself.
 ([@olore](https://github.com/olore))

### DEPENDENCY UPDATES

A very special dependency update event! Since the [release of
`node-gyp@3.8.0`](https://github.com/nodejs/node-gyp/pull/1521), an awkward
version conflict that was preventing `request` from begin flattened was
resolved. This means two things:

1. We've cut down the npm tarball size by another 200kb, to 4.6MB
2. `npm audit` now shows no vulnerabilities for npm itself!

Thanks, [@rvagg](https://github.com/rvagg)!

* [`866d776c2`](https://github.com/npm/cli/commit/866d776c27f80a71309389aaab42825b2a0916f6)
 `request@2.87.0`
 ([@simov](https://github.com/simov))
* [`f861c2b57`](https://github.com/npm/cli/commit/f861c2b579a9d4feae1653222afcefdd4f0e978f)
 `node-gyp@3.8.0`
 ([@rvagg](https://github.com/rvagg))
* [`32e6947c6`](https://github.com/npm/cli/commit/32e6947c60db865257a0ebc2f7e754fedf7a6fc9)
 [npm/cli#39](https://github.com/npm/cli/pull/39)
 `colors@1.1.2`:
 REVERT REVERT, newer versions of this library are broken and print ansi
 codes even when disabled.
 ([@iarna](https://github.com/iarna))
* [`beb96b92c`](https://github.com/npm/cli/commit/beb96b92caf061611e3faafc7ca10e77084ec335)
 `libcipm@2.0.1`
 ([@zkat](https://github.com/zkat))
* [`348fc91ad`](https://github.com/npm/cli/commit/348fc91ad223ff91cd7bcf233018ea1d979a2af1)
 `validate-npm-package-license@3.0.4`: Fixes errors with empty or string-only
 license fields.
 ([@Gudahtt](https://github.com/Gudahtt))
* [`e57d34575`](https://github.com/npm/cli/commit/e57d3457547ef464828fc6f82ae4750f3e511550)
 `iferr@1.0.2`
 ([@shesek](https://github.com/shesek))
* [`46f1c6ad4`](https://github.com/npm/cli/commit/46f1c6ad4b2fd5b0d7ec879b76b76a70a3a2595c)
 `tar@4.4.6`
 ([@isaacs](https://github.com/isaacs))
* [`50df1bf69`](https://github.com/npm/cli/commit/50df1bf691e205b9f13e0fff0d51a68772c40561)
 `hosted-git-info@2.7.1`
 ([@iarna](https://github.com/iarna))
 ([@Erveon](https://github.com/Erveon))
 ([@huochunpeng](https://github.com/huochunpeng))

### DOCUMENTATION

* [`af98e76ed`](https://github.com/npm/cli/commit/af98e76ed96af780b544962aa575585b3fa17b9a)
 [npm/cli#34](https://github.com/npm/cli/pull/34)
 Remove `npm publish` from list of commands not affected by `--dry-run`.
 ([@joebowbeer](https://github.com/joebowbeer))
* [`e2b0f0921`](https://github.com/npm/cli/commit/e2b0f092193c08c00f12a6168ad2bd9d6e16f8ce)
 [npm/cli#36](https://github.com/npm/cli/pull/36)
 Tweak formatting in repository field examples.
 ([@noahbenham](https://github.com/noahbenham))
* [`e2346e770`](https://github.com/npm/cli/commit/e2346e7702acccefe6d711168c2b0e0e272e194a)
 [npm/cli#14](https://github.com/npm/cli/pull/14)
 Used `process.env` examples to make accessing certain `npm run-scripts`
 environment variables more clear.
 ([@mwarger](https://github.com/mwarger))

## v6.3.0 (2018-08-01):

This is basically the same as the prerelease, but two dependencies have been
Expand Down

3 changes: 3 additions & 0 deletions
bin/npm-cli.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,12 +69,15 @@
 npm.command = 'help'
 }

 var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm')

 // now actually fire up npm and run the command.
 // this is how to use npm programmatically:
 conf._exit = true
 npm.load(conf, function (er) {
 if (er) return errorHandler(er)
 if (
 !isGlobalNpmUpdate &&
 npm.config.get('update-notifier') &&
 !unsupported.checkVersion(process.version).unsupported
 ) {
Expand Down

16 changes: 8 additions & 8 deletions
doc/files/package.json.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -366,15 +366,15 @@ command will be able to find you.

Do it like this:

 "repository" :
{ "type" : "git"
, "url" : "https://github.com/npm/cli.git"
}
 "repository": {
 "type" : "git",
 "url" : "https://github.com/npm/cli.git"
 }

 "repository" :
{ "type" : "svn"
, "url" : "https://v8.googlecode.com/svn/trunk/"
}
 "repository": {
 "type" : "svn",
 "url" : "https://v8.googlecode.com/svn/trunk/"
 }

The URL should be a publicly available (perhaps read-only) url that can be handed
directly to a VCS program without any modification. It should not be a url to an
Expand Down

12 changes: 10 additions & 2 deletions
doc/misc/npm-config.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -164,6 +164,14 @@ When "true" submit audit reports alongside `npm install` runs to the default
registry and all registries configured for scopes. See the documentation
for npm-audit(1) for details on what is submitted.

### audit-level

* Default: `"low"`
* Type: `'low'`, `'moderate'`, `'high'`, `'critical'`

The minimum level of vulnerability for `npm audit` to exit with
a non-zero exit code.

### auth-type

* Default: `'legacy'`
Expand DownExpand Up@@ -331,8 +339,8 @@ Install `dev-dependencies` along with packages.
Indicates that you don't want npm to make any changes and that it should
only report what it would have done. This can be passed into any of the
commands that modify your local installation, eg, `install`, `update`,
`dedupe`, `uninstall`. This is NOT currently honored by network related
commands, eg `dist-tags`, `owner`, `publish`, etc.
`dedupe`, `uninstall`. This is NOT currently honored by some network related
commands, eg `dist-tags`, `owner`, etc.

### editor

Expand Down

4 changes: 3 additions & 1 deletion
doc/misc/npm-scripts.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,7 +143,9 @@ The package.json fields are tacked onto the `npm_package_` prefix. So,
for instance, if you had `{"name":"foo", "version":"1.2.5"}` in your
package.json file, then your package scripts would have the
`npm_package_name` environment variable set to "foo", and the
`npm_package_version` set to "1.2.5"
`npm_package_version` set to "1.2.5". You can access these variables 
in your code with `process.env.npm_package_name` and 
`process.env.npm_package_version`, and so on for other fields.

### configuration

Expand Down

3 changes: 0 additions & 3 deletions
doc/spec/file-specifiers.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -55,9 +55,6 @@ note for the `npm-shrinkwrap.json` as it means the specifier there will
be different then the original `package.json` (where it was relative to that
`package.json`).

# No, for `file:` type specifiers, we SHOULD shrinkwrap. Other symlinks we
# should not. Other symlinks w/o the link spec should be an error.

When shrinkwrapping file specifiers, the contents of the destination
package's `node_modules` WILL NOT be included in the shrinkwrap. If you want to lock
down the destination package's `node_modules` you should create a shrinkwrap for it
Expand Down

10 changes: 5 additions & 5 deletions
lib/audit.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -257,11 +257,11 @@ function auditCmd (args, cb) {
 })
 })
 } else {
 const vulns =
 auditResult.metadata.vulnerabilities.low +
 auditResult.metadata.vulnerabilities.moderate +
 auditResult.metadata.vulnerabilities.high +
 auditResult.metadata.vulnerabilities.critical
 const levels = ['low', 'moderate', 'high', 'critical']
const minLevel = levels.indexOf(npm.config.get('audit-level'))
const vulns = levels.reduce((count, level, i) => {
return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
}, 0)
 if (vulns > 0) process.exitCode = 1
 if (npm.config.get('parseable')) {
 return audit.printParseableReport(auditResult)
Expand Down

17 changes: 5 additions & 12 deletions
lib/config/defaults.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
 'always-auth': false,
 also: null,
 audit: true,
 'audit-level': 'low',
 'auth-type': 'legacy',

 'bin-links': true,
Expand DownExpand Up@@ -257,6 +258,7 @@ exports.types = {
 'always-auth': Boolean,
 also: [null, 'dev', 'development'],
 audit: Boolean,
 'audit-level': ['low', 'moderate', 'high', 'critical'],
 'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
 'bin-links': Boolean,
 browser: [null, String],
Expand DownExpand Up@@ -306,8 +308,6 @@ exports.types = {
 key: [null, String],
 'legacy-bundling': Boolean,
 link: Boolean,
 // local-address must be listed as an IP for a local network interface
 // must be IPv4 due to node bug
 'local-address': getLocalAddresses(),
 loglevel: ['silent', 'error', 'warn', 'notice', 'http', 'timing', 'info', 'verbose', 'silly'],
 logstream: Stream,
Expand DownExpand Up@@ -388,16 +388,9 @@ function getLocalAddresses () {
 interfaces = {}
 }

 return Object.keys(interfaces).map(function (nic) {
 return interfaces[nic].filter(function (addr) {
 return addr.family === 'IPv4'
 })
 .map(function (addr) {
 return addr.address
 })
 }).reduce(function (curr, next) {
 return curr.concat(next)
 }, []).concat(undefined)
 return Object.keys(interfaces).map(
 nic => interfaces[nic].map(({address}) => address)
 ).reduce((curr, next) => curr.concat(next), []).concat(undefined)
}

exports.shorthands = {
Expand Down

6 changes: 6 additions & 0 deletions
lib/config/get-credentials-by-uri.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,12 @@ function getCredentialsByURI (uri) {
 return c
 }

 if (this.get(nerfed + ':-authtoken')) {
 c.token = this.get(nerfed + ':-authtoken')
 // the bearer token is enough, don't confuse things
 return c
 }

 // Handle the old-style _auth=<base64> style for the default
 // registry, if set.
 var authDef = this.get('_auth')
Expand Down

6 changes: 6 additions & 0 deletions
node_modules/assert-plus/CHANGES.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


9 changes: 8 additions & 1 deletion
node_modules/assert-plus/README.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


5 changes: 5 additions & 0 deletions
node_modules/assert-plus/assert.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


20 changes: 10 additions & 10 deletions
node_modules/assert-plus/package.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 1 addition & 1 deletion
node_modules/aws-sign2/index.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Release: npm@6.4.0#43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

zkat
merged 20 commits into

from

Aug 15, 2018
 Merged


Release: npm@6.4.0
#43
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


20 commits


Select commit
Hold shift + click to select a range
c3ab25f

doc: file-specifier: Remove stray comment


iarna Jul 26, 2018
6e9f04b

config: Search for authentication token defined by environment variab…


mkhl Aug 3, 2018
af98e76

docs: Update --dry-run docs (#34)


joebowbeer Aug 3, 2018
84bfd23

config: stop filtering out non-ipv4 addresses from local-addrs (#35)

Aug 3, 2018
e2b0f09

docs: Improved repository examples (#36)


noahbenham Aug 3, 2018
32e6947

colors@1.1.2 (#39)


iarna Aug 3, 2018
792c8c7

audit: configurable audit level for non-zero exit (#31)


lennym Aug 3, 2018
d811461

cli: don't check for updates to npm when we are updating npm itself (…


olore Aug 3, 2018
e2346e7

docs: added a section for usage with process.env (#14)


mwarger Aug 7, 2018
beb96b9

libcipm@2.0.1


zkat Aug 7, 2018
348fc91

validate-npm-package-license@3.0.4


zkat Aug 7, 2018
e57d345

iferr@1.0.2


zkat Aug 7, 2018
46f1c6a

tar@4.4.6


zkat Aug 7, 2018
50df1bf

hosted-git-info@2.7.1


zkat Aug 7, 2018
866d776

request@2.87.0


zkat Aug 9, 2018
f861c2b

node-gyp@3.8.0


zkat Aug 9, 2018
dbbb75c

doc: update changelog for npm@6.4.0


zkat Aug 9, 2018
214ef61

update AUTHORS


zkat Aug 9, 2018
361226d

6.4.0-next.0


zkat Aug 9, 2018
58ece89

6.4.0


zkat Aug 15, 2018

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

5 changes: 5 additions & 0 deletions
AUTHORS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -591,3 +591,8 @@ Darryl Pogue <dvpdiner2@gmail.com>
Rick Schubert <rickschubert@gmx.de>
Daniel W <dwilches@gmail.com>
XhmikosR <xhmikosr@gmail.com>
Martin Kühl <mkhl@users.noreply.github.com>
Valentin Ouvrard <valentin210594@gmail.com>
Noah Benham <noahbenham@users.noreply.github.com>
Brian Olore <brian@olore.net>
Mat Warger <mwarger@gmail.com>

89 changes: 89 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,92 @@
## v6.4.0 (2018-09-08):

### NEW FEATURES

* [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7)
@iarnaiarnaAug 9, 2018

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow the implementation for that ended up being waaay better than it originally was
@zkatzkatAug 9, 2018

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agreeee
 [npm/cli#8](https://github.com/npm/cli/pull/8)
 Search for authentication token defined by environment variables by preventing
 the translation layer from env variable to npm option from breaking
 `:_authToken`.
 ([@mkhl](https://github.com/mkhl))
* [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022)
 [npm/cli#35](https://github.com/npm/cli/pull/35)
 Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually
 use IPv6 addresses when it must.
 ([@valentin2105](https://github.com/valentin2105))
* [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd)
 [npm/cli#31](https://github.com/npm/cli/pull/31)
 configurable audit level for non-zero exit
 `npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level.
 Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found.
 Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.
 ([@lennym](https://github.com/lennym))

### BUGFIXES

* [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c)
 [npm/cli#32](https://github.com/npm/cli/pull/32)
 Don't check for updates to npm when we are updating npm itself.
 ([@olore](https://github.com/olore))

### DEPENDENCY UPDATES

A very special dependency update event! Since the [release of
`node-gyp@3.8.0`](https://github.com/nodejs/node-gyp/pull/1521), an awkward
version conflict that was preventing `request` from begin flattened was
resolved. This means two things:

1. We've cut down the npm tarball size by another 200kb, to 4.6MB
2. `npm audit` now shows no vulnerabilities for npm itself!

Thanks, [@rvagg](https://github.com/rvagg)!

* [`866d776c2`](https://github.com/npm/cli/commit/866d776c27f80a71309389aaab42825b2a0916f6)
 `request@2.87.0`
 ([@simov](https://github.com/simov))
* [`f861c2b57`](https://github.com/npm/cli/commit/f861c2b579a9d4feae1653222afcefdd4f0e978f)
 `node-gyp@3.8.0`
 ([@rvagg](https://github.com/rvagg))
* [`32e6947c6`](https://github.com/npm/cli/commit/32e6947c60db865257a0ebc2f7e754fedf7a6fc9)
 [npm/cli#39](https://github.com/npm/cli/pull/39)
 `colors@1.1.2`:
 REVERT REVERT, newer versions of this library are broken and print ansi
 codes even when disabled.
 ([@iarna](https://github.com/iarna))
* [`beb96b92c`](https://github.com/npm/cli/commit/beb96b92caf061611e3faafc7ca10e77084ec335)
 `libcipm@2.0.1`
 ([@zkat](https://github.com/zkat))
* [`348fc91ad`](https://github.com/npm/cli/commit/348fc91ad223ff91cd7bcf233018ea1d979a2af1)
 `validate-npm-package-license@3.0.4`: Fixes errors with empty or string-only
 license fields.
 ([@Gudahtt](https://github.com/Gudahtt))
* [`e57d34575`](https://github.com/npm/cli/commit/e57d3457547ef464828fc6f82ae4750f3e511550)
 `iferr@1.0.2`
 ([@shesek](https://github.com/shesek))
* [`46f1c6ad4`](https://github.com/npm/cli/commit/46f1c6ad4b2fd5b0d7ec879b76b76a70a3a2595c)
 `tar@4.4.6`
 ([@isaacs](https://github.com/isaacs))
* [`50df1bf69`](https://github.com/npm/cli/commit/50df1bf691e205b9f13e0fff0d51a68772c40561)
 `hosted-git-info@2.7.1`
 ([@iarna](https://github.com/iarna))
 ([@Erveon](https://github.com/Erveon))
 ([@huochunpeng](https://github.com/huochunpeng))

### DOCUMENTATION

* [`af98e76ed`](https://github.com/npm/cli/commit/af98e76ed96af780b544962aa575585b3fa17b9a)
 [npm/cli#34](https://github.com/npm/cli/pull/34)
 Remove `npm publish` from list of commands not affected by `--dry-run`.
 ([@joebowbeer](https://github.com/joebowbeer))
* [`e2b0f0921`](https://github.com/npm/cli/commit/e2b0f092193c08c00f12a6168ad2bd9d6e16f8ce)
 [npm/cli#36](https://github.com/npm/cli/pull/36)
 Tweak formatting in repository field examples.
 ([@noahbenham](https://github.com/noahbenham))
* [`e2346e770`](https://github.com/npm/cli/commit/e2346e7702acccefe6d711168c2b0e0e272e194a)
 [npm/cli#14](https://github.com/npm/cli/pull/14)
 Used `process.env` examples to make accessing certain `npm run-scripts`
 environment variables more clear.
 ([@mwarger](https://github.com/mwarger))

## v6.3.0 (2018-08-01):

This is basically the same as the prerelease, but two dependencies have been
Expand Down

3 changes: 3 additions & 0 deletions
bin/npm-cli.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,12 +69,15 @@
 npm.command = 'help'
 }

 var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm')

 // now actually fire up npm and run the command.
 // this is how to use npm programmatically:
 conf._exit = true
 npm.load(conf, function (er) {
 if (er) return errorHandler(er)
 if (
 !isGlobalNpmUpdate &&
 npm.config.get('update-notifier') &&
 !unsupported.checkVersion(process.version).unsupported
 ) {
Expand Down

16 changes: 8 additions & 8 deletions
doc/files/package.json.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -366,15 +366,15 @@ command will be able to find you.

Do it like this:

 "repository" :
{ "type" : "git"
, "url" : "https://github.com/npm/cli.git"
}
 "repository": {
 "type" : "git",
 "url" : "https://github.com/npm/cli.git"
 }

 "repository" :
{ "type" : "svn"
, "url" : "https://v8.googlecode.com/svn/trunk/"
}
 "repository": {
 "type" : "svn",
 "url" : "https://v8.googlecode.com/svn/trunk/"
 }

The URL should be a publicly available (perhaps read-only) url that can be handed
directly to a VCS program without any modification. It should not be a url to an
Expand Down

12 changes: 10 additions & 2 deletions
doc/misc/npm-config.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -164,6 +164,14 @@ When "true" submit audit reports alongside `npm install` runs to the default
registry and all registries configured for scopes. See the documentation
for npm-audit(1) for details on what is submitted.

### audit-level

* Default: `"low"`
* Type: `'low'`, `'moderate'`, `'high'`, `'critical'`

The minimum level of vulnerability for `npm audit` to exit with
a non-zero exit code.

### auth-type

* Default: `'legacy'`
Expand DownExpand Up@@ -331,8 +339,8 @@ Install `dev-dependencies` along with packages.
Indicates that you don't want npm to make any changes and that it should
only report what it would have done. This can be passed into any of the
commands that modify your local installation, eg, `install`, `update`,
`dedupe`, `uninstall`. This is NOT currently honored by network related
commands, eg `dist-tags`, `owner`, `publish`, etc.
`dedupe`, `uninstall`. This is NOT currently honored by some network related
commands, eg `dist-tags`, `owner`, etc.

### editor

Expand Down

4 changes: 3 additions & 1 deletion
doc/misc/npm-scripts.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,7 +143,9 @@ The package.json fields are tacked onto the `npm_package_` prefix. So,
for instance, if you had `{"name":"foo", "version":"1.2.5"}` in your
package.json file, then your package scripts would have the
`npm_package_name` environment variable set to "foo", and the
`npm_package_version` set to "1.2.5"
`npm_package_version` set to "1.2.5". You can access these variables 
in your code with `process.env.npm_package_name` and 
`process.env.npm_package_version`, and so on for other fields.

### configuration

Expand Down

3 changes: 0 additions & 3 deletions
doc/spec/file-specifiers.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -55,9 +55,6 @@ note for the `npm-shrinkwrap.json` as it means the specifier there will
be different then the original `package.json` (where it was relative to that
`package.json`).

# No, for `file:` type specifiers, we SHOULD shrinkwrap. Other symlinks we
# should not. Other symlinks w/o the link spec should be an error.

When shrinkwrapping file specifiers, the contents of the destination
package's `node_modules` WILL NOT be included in the shrinkwrap. If you want to lock
down the destination package's `node_modules` you should create a shrinkwrap for it
Expand Down

10 changes: 5 additions & 5 deletions
lib/audit.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -257,11 +257,11 @@ function auditCmd (args, cb) {
 })
 })
 } else {
 const vulns =
 auditResult.metadata.vulnerabilities.low +
 auditResult.metadata.vulnerabilities.moderate +
 auditResult.metadata.vulnerabilities.high +
 auditResult.metadata.vulnerabilities.critical
 const levels = ['low', 'moderate', 'high', 'critical']
const minLevel = levels.indexOf(npm.config.get('audit-level'))
const vulns = levels.reduce((count, level, i) => {
return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
}, 0)
 if (vulns > 0) process.exitCode = 1
 if (npm.config.get('parseable')) {
 return audit.printParseableReport(auditResult)
Expand Down

17 changes: 5 additions & 12 deletions
lib/config/defaults.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
 'always-auth': false,
 also: null,
 audit: true,
 'audit-level': 'low',
 'auth-type': 'legacy',

 'bin-links': true,
Expand DownExpand Up@@ -257,6 +258,7 @@ exports.types = {
 'always-auth': Boolean,
 also: [null, 'dev', 'development'],
 audit: Boolean,
 'audit-level': ['low', 'moderate', 'high', 'critical'],
 'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
 'bin-links': Boolean,
 browser: [null, String],
Expand DownExpand Up@@ -306,8 +308,6 @@ exports.types = {
 key: [null, String],
 'legacy-bundling': Boolean,
 link: Boolean,
 // local-address must be listed as an IP for a local network interface
 // must be IPv4 due to node bug
 'local-address': getLocalAddresses(),
 loglevel: ['silent', 'error', 'warn', 'notice', 'http', 'timing', 'info', 'verbose', 'silly'],
 logstream: Stream,
Expand DownExpand Up@@ -388,16 +388,9 @@ function getLocalAddresses () {
 interfaces = {}
 }

 return Object.keys(interfaces).map(function (nic) {
 return interfaces[nic].filter(function (addr) {
 return addr.family === 'IPv4'
 })
 .map(function (addr) {
 return addr.address
 })
 }).reduce(function (curr, next) {
 return curr.concat(next)
 }, []).concat(undefined)
 return Object.keys(interfaces).map(
 nic => interfaces[nic].map(({address}) => address)
 ).reduce((curr, next) => curr.concat(next), []).concat(undefined)
}

exports.shorthands = {
Expand Down

6 changes: 6 additions & 0 deletions
lib/config/get-credentials-by-uri.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,12 @@ function getCredentialsByURI (uri) {
 return c
 }

 if (this.get(nerfed + ':-authtoken')) {
 c.token = this.get(nerfed + ':-authtoken')
 // the bearer token is enough, don't confuse things
 return c
 }

 // Handle the old-style _auth=<base64> style for the default
 // registry, if set.
 var authDef = this.get('_auth')
Expand Down

6 changes: 6 additions & 0 deletions
node_modules/assert-plus/CHANGES.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


9 changes: 8 additions & 1 deletion
node_modules/assert-plus/README.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


5 changes: 5 additions & 0 deletions
node_modules/assert-plus/assert.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


20 changes: 10 additions & 10 deletions
node_modules/assert-plus/package.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 1 addition & 1 deletion
node_modules/aws-sign2/index.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Release: npm@6.4.0#43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

zkat
merged 20 commits into

from

Aug 15, 2018
 Merged


Release: npm@6.4.0
#43
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


20 commits


Select commit
Hold shift + click to select a range
c3ab25f

doc: file-specifier: Remove stray comment


iarna Jul 26, 2018
6e9f04b

config: Search for authentication token defined by environment variab…


mkhl Aug 3, 2018
af98e76

docs: Update --dry-run docs (#34)


joebowbeer Aug 3, 2018
84bfd23

config: stop filtering out non-ipv4 addresses from local-addrs (#35)

Aug 3, 2018
e2b0f09

docs: Improved repository examples (#36)


noahbenham Aug 3, 2018
32e6947

colors@1.1.2 (#39)


iarna Aug 3, 2018
792c8c7

audit: configurable audit level for non-zero exit (#31)


lennym Aug 3, 2018
d811461

cli: don't check for updates to npm when we are updating npm itself (…


olore Aug 3, 2018
e2346e7

docs: added a section for usage with process.env (#14)


mwarger Aug 7, 2018
beb96b9

libcipm@2.0.1


zkat Aug 7, 2018
348fc91

validate-npm-package-license@3.0.4


zkat Aug 7, 2018
e57d345

iferr@1.0.2


zkat Aug 7, 2018
46f1c6a

tar@4.4.6


zkat Aug 7, 2018
50df1bf

hosted-git-info@2.7.1


zkat Aug 7, 2018
866d776

request@2.87.0


zkat Aug 9, 2018
f861c2b

node-gyp@3.8.0


zkat Aug 9, 2018
dbbb75c

doc: update changelog for npm@6.4.0


zkat Aug 9, 2018
214ef61

update AUTHORS


zkat Aug 9, 2018
361226d

6.4.0-next.0


zkat Aug 9, 2018
58ece89

6.4.0


zkat Aug 15, 2018

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

5 changes: 5 additions & 0 deletions
AUTHORS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -591,3 +591,8 @@ Darryl Pogue <dvpdiner2@gmail.com>
Rick Schubert <rickschubert@gmx.de>
Daniel W <dwilches@gmail.com>
XhmikosR <xhmikosr@gmail.com>
Martin Kühl <mkhl@users.noreply.github.com>
Valentin Ouvrard <valentin210594@gmail.com>
Noah Benham <noahbenham@users.noreply.github.com>
Brian Olore <brian@olore.net>
Mat Warger <mwarger@gmail.com>

89 changes: 89 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,92 @@
## v6.4.0 (2018-09-08):

### NEW FEATURES

* [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7)
@iarnaiarnaAug 9, 2018

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow the implementation for that ended up being waaay better than it originally was
@zkatzkatAug 9, 2018

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agreeee
 [npm/cli#8](https://github.com/npm/cli/pull/8)
 Search for authentication token defined by environment variables by preventing
 the translation layer from env variable to npm option from breaking
 `:_authToken`.
 ([@mkhl](https://github.com/mkhl))
* [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022)
 [npm/cli#35](https://github.com/npm/cli/pull/35)
 Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually
 use IPv6 addresses when it must.
 ([@valentin2105](https://github.com/valentin2105))
* [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd)
 [npm/cli#31](https://github.com/npm/cli/pull/31)
 configurable audit level for non-zero exit
 `npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level.
 Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found.
 Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.
 ([@lennym](https://github.com/lennym))

### BUGFIXES

* [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c)
 [npm/cli#32](https://github.com/npm/cli/pull/32)
 Don't check for updates to npm when we are updating npm itself.
 ([@olore](https://github.com/olore))

### DEPENDENCY UPDATES

A very special dependency update event! Since the [release of
`node-gyp@3.8.0`](https://github.com/nodejs/node-gyp/pull/1521), an awkward
version conflict that was preventing `request` from begin flattened was
resolved. This means two things:

1. We've cut down the npm tarball size by another 200kb, to 4.6MB
2. `npm audit` now shows no vulnerabilities for npm itself!

Thanks, [@rvagg](https://github.com/rvagg)!

* [`866d776c2`](https://github.com/npm/cli/commit/866d776c27f80a71309389aaab42825b2a0916f6)
 `request@2.87.0`
 ([@simov](https://github.com/simov))
* [`f861c2b57`](https://github.com/npm/cli/commit/f861c2b579a9d4feae1653222afcefdd4f0e978f)
 `node-gyp@3.8.0`
 ([@rvagg](https://github.com/rvagg))
* [`32e6947c6`](https://github.com/npm/cli/commit/32e6947c60db865257a0ebc2f7e754fedf7a6fc9)
 [npm/cli#39](https://github.com/npm/cli/pull/39)
 `colors@1.1.2`:
 REVERT REVERT, newer versions of this library are broken and print ansi
 codes even when disabled.
 ([@iarna](https://github.com/iarna))
* [`beb96b92c`](https://github.com/npm/cli/commit/beb96b92caf061611e3faafc7ca10e77084ec335)
 `libcipm@2.0.1`
 ([@zkat](https://github.com/zkat))
* [`348fc91ad`](https://github.com/npm/cli/commit/348fc91ad223ff91cd7bcf233018ea1d979a2af1)
 `validate-npm-package-license@3.0.4`: Fixes errors with empty or string-only
 license fields.
 ([@Gudahtt](https://github.com/Gudahtt))
* [`e57d34575`](https://github.com/npm/cli/commit/e57d3457547ef464828fc6f82ae4750f3e511550)
 `iferr@1.0.2`
 ([@shesek](https://github.com/shesek))
* [`46f1c6ad4`](https://github.com/npm/cli/commit/46f1c6ad4b2fd5b0d7ec879b76b76a70a3a2595c)
 `tar@4.4.6`
 ([@isaacs](https://github.com/isaacs))
* [`50df1bf69`](https://github.com/npm/cli/commit/50df1bf691e205b9f13e0fff0d51a68772c40561)
 `hosted-git-info@2.7.1`
 ([@iarna](https://github.com/iarna))
 ([@Erveon](https://github.com/Erveon))
 ([@huochunpeng](https://github.com/huochunpeng))

### DOCUMENTATION

* [`af98e76ed`](https://github.com/npm/cli/commit/af98e76ed96af780b544962aa575585b3fa17b9a)
 [npm/cli#34](https://github.com/npm/cli/pull/34)
 Remove `npm publish` from list of commands not affected by `--dry-run`.
 ([@joebowbeer](https://github.com/joebowbeer))
* [`e2b0f0921`](https://github.com/npm/cli/commit/e2b0f092193c08c00f12a6168ad2bd9d6e16f8ce)
 [npm/cli#36](https://github.com/npm/cli/pull/36)
 Tweak formatting in repository field examples.
 ([@noahbenham](https://github.com/noahbenham))
* [`e2346e770`](https://github.com/npm/cli/commit/e2346e7702acccefe6d711168c2b0e0e272e194a)
 [npm/cli#14](https://github.com/npm/cli/pull/14)
 Used `process.env` examples to make accessing certain `npm run-scripts`
 environment variables more clear.
 ([@mwarger](https://github.com/mwarger))

## v6.3.0 (2018-08-01):

This is basically the same as the prerelease, but two dependencies have been
Expand Down

3 changes: 3 additions & 0 deletions
bin/npm-cli.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,12 +69,15 @@
 npm.command = 'help'
 }

 var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm')

 // now actually fire up npm and run the command.
 // this is how to use npm programmatically:
 conf._exit = true
 npm.load(conf, function (er) {
 if (er) return errorHandler(er)
 if (
 !isGlobalNpmUpdate &&
 npm.config.get('update-notifier') &&
 !unsupported.checkVersion(process.version).unsupported
 ) {
Expand Down

16 changes: 8 additions & 8 deletions
doc/files/package.json.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -366,15 +366,15 @@ command will be able to find you.

Do it like this:

 "repository" :
{ "type" : "git"
, "url" : "https://github.com/npm/cli.git"
}
 "repository": {
 "type" : "git",
 "url" : "https://github.com/npm/cli.git"
 }

 "repository" :
{ "type" : "svn"
, "url" : "https://v8.googlecode.com/svn/trunk/"
}
 "repository": {
 "type" : "svn",
 "url" : "https://v8.googlecode.com/svn/trunk/"
 }

The URL should be a publicly available (perhaps read-only) url that can be handed
directly to a VCS program without any modification. It should not be a url to an
Expand Down

12 changes: 10 additions & 2 deletions
doc/misc/npm-config.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -164,6 +164,14 @@ When "true" submit audit reports alongside `npm install` runs to the default
registry and all registries configured for scopes. See the documentation
for npm-audit(1) for details on what is submitted.

### audit-level

* Default: `"low"`
* Type: `'low'`, `'moderate'`, `'high'`, `'critical'`

The minimum level of vulnerability for `npm audit` to exit with
a non-zero exit code.

### auth-type

* Default: `'legacy'`
Expand DownExpand Up@@ -331,8 +339,8 @@ Install `dev-dependencies` along with packages.
Indicates that you don't want npm to make any changes and that it should
only report what it would have done. This can be passed into any of the
commands that modify your local installation, eg, `install`, `update`,
`dedupe`, `uninstall`. This is NOT currently honored by network related
commands, eg `dist-tags`, `owner`, `publish`, etc.
`dedupe`, `uninstall`. This is NOT currently honored by some network related
commands, eg `dist-tags`, `owner`, etc.

### editor

Expand Down

4 changes: 3 additions & 1 deletion
doc/misc/npm-scripts.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,7 +143,9 @@ The package.json fields are tacked onto the `npm_package_` prefix. So,
for instance, if you had `{"name":"foo", "version":"1.2.5"}` in your
package.json file, then your package scripts would have the
`npm_package_name` environment variable set to "foo", and the
`npm_package_version` set to "1.2.5"
`npm_package_version` set to "1.2.5". You can access these variables 
in your code with `process.env.npm_package_name` and 
`process.env.npm_package_version`, and so on for other fields.

### configuration

Expand Down

3 changes: 0 additions & 3 deletions
doc/spec/file-specifiers.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -55,9 +55,6 @@ note for the `npm-shrinkwrap.json` as it means the specifier there will
be different then the original `package.json` (where it was relative to that
`package.json`).

# No, for `file:` type specifiers, we SHOULD shrinkwrap. Other symlinks we
# should not. Other symlinks w/o the link spec should be an error.

When shrinkwrapping file specifiers, the contents of the destination
package's `node_modules` WILL NOT be included in the shrinkwrap. If you want to lock
down the destination package's `node_modules` you should create a shrinkwrap for it
Expand Down

10 changes: 5 additions & 5 deletions
lib/audit.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -257,11 +257,11 @@ function auditCmd (args, cb) {
 })
 })
 } else {
 const vulns =
 auditResult.metadata.vulnerabilities.low +
 auditResult.metadata.vulnerabilities.moderate +
 auditResult.metadata.vulnerabilities.high +
 auditResult.metadata.vulnerabilities.critical
 const levels = ['low', 'moderate', 'high', 'critical']
const minLevel = levels.indexOf(npm.config.get('audit-level'))
const vulns = levels.reduce((count, level, i) => {
return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
}, 0)
 if (vulns > 0) process.exitCode = 1
 if (npm.config.get('parseable')) {
 return audit.printParseableReport(auditResult)
Expand Down

17 changes: 5 additions & 12 deletions
lib/config/defaults.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
 'always-auth': false,
 also: null,
 audit: true,
 'audit-level': 'low',
 'auth-type': 'legacy',

 'bin-links': true,
Expand DownExpand Up@@ -257,6 +258,7 @@ exports.types = {
 'always-auth': Boolean,
 also: [null, 'dev', 'development'],
 audit: Boolean,
 'audit-level': ['low', 'moderate', 'high', 'critical'],
 'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
 'bin-links': Boolean,
 browser: [null, String],
Expand DownExpand Up@@ -306,8 +308,6 @@ exports.types = {
 key: [null, String],
 'legacy-bundling': Boolean,
 link: Boolean,
 // local-address must be listed as an IP for a local network interface
 // must be IPv4 due to node bug
 'local-address': getLocalAddresses(),
 loglevel: ['silent', 'error', 'warn', 'notice', 'http', 'timing', 'info', 'verbose', 'silly'],
 logstream: Stream,
Expand DownExpand Up@@ -388,16 +388,9 @@ function getLocalAddresses () {
 interfaces = {}
 }

 return Object.keys(interfaces).map(function (nic) {
 return interfaces[nic].filter(function (addr) {
 return addr.family === 'IPv4'
 })
 .map(function (addr) {
 return addr.address
 })
 }).reduce(function (curr, next) {
 return curr.concat(next)
 }, []).concat(undefined)
 return Object.keys(interfaces).map(
 nic => interfaces[nic].map(({address}) => address)
 ).reduce((curr, next) => curr.concat(next), []).concat(undefined)
}

exports.shorthands = {
Expand Down

6 changes: 6 additions & 0 deletions
lib/config/get-credentials-by-uri.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,12 @@ function getCredentialsByURI (uri) {
 return c
 }

 if (this.get(nerfed + ':-authtoken')) {
 c.token = this.get(nerfed + ':-authtoken')
 // the bearer token is enough, don't confuse things
 return c
 }

 // Handle the old-style _auth=<base64> style for the default
 // registry, if set.
 var authDef = this.get('_auth')
Expand Down

6 changes: 6 additions & 0 deletions
node_modules/assert-plus/CHANGES.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


9 changes: 8 additions & 1 deletion
node_modules/assert-plus/README.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


5 changes: 5 additions & 0 deletions
node_modules/assert-plus/assert.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


20 changes: 10 additions & 10 deletions
node_modules/assert-plus/package.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 1 addition & 1 deletion
node_modules/aws-sign2/index.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Release: npm@6.4.0#43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

zkat
merged 20 commits into

from

Aug 15, 2018
 Merged


Release: npm@6.4.0
#43
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


20 commits


Select commit
Hold shift + click to select a range
c3ab25f

doc: file-specifier: Remove stray comment


iarna Jul 26, 2018
6e9f04b

config: Search for authentication token defined by environment variab…


mkhl Aug 3, 2018
af98e76

docs: Update --dry-run docs (#34)


joebowbeer Aug 3, 2018
84bfd23

config: stop filtering out non-ipv4 addresses from local-addrs (#35)

Aug 3, 2018
e2b0f09

docs: Improved repository examples (#36)


noahbenham Aug 3, 2018
32e6947

colors@1.1.2 (#39)


iarna Aug 3, 2018
792c8c7

audit: configurable audit level for non-zero exit (#31)


lennym Aug 3, 2018
d811461

cli: don't check for updates to npm when we are updating npm itself (…


olore Aug 3, 2018
e2346e7

docs: added a section for usage with process.env (#14)


mwarger Aug 7, 2018
beb96b9

libcipm@2.0.1


zkat Aug 7, 2018
348fc91

validate-npm-package-license@3.0.4


zkat Aug 7, 2018
e57d345

iferr@1.0.2


zkat Aug 7, 2018
46f1c6a

tar@4.4.6


zkat Aug 7, 2018
50df1bf

hosted-git-info@2.7.1


zkat Aug 7, 2018
866d776

request@2.87.0


zkat Aug 9, 2018
f861c2b

node-gyp@3.8.0


zkat Aug 9, 2018
dbbb75c

doc: update changelog for npm@6.4.0


zkat Aug 9, 2018
214ef61

update AUTHORS


zkat Aug 9, 2018
361226d

6.4.0-next.0


zkat Aug 9, 2018
58ece89

6.4.0


zkat Aug 15, 2018

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

5 changes: 5 additions & 0 deletions
AUTHORS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -591,3 +591,8 @@ Darryl Pogue <dvpdiner2@gmail.com>
Rick Schubert <rickschubert@gmx.de>
Daniel W <dwilches@gmail.com>
XhmikosR <xhmikosr@gmail.com>
Martin Kühl <mkhl@users.noreply.github.com>
Valentin Ouvrard <valentin210594@gmail.com>
Noah Benham <noahbenham@users.noreply.github.com>
Brian Olore <brian@olore.net>
Mat Warger <mwarger@gmail.com>

89 changes: 89 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,92 @@
## v6.4.0 (2018-09-08):

### NEW FEATURES

* [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7)
@iarnaiarnaAug 9, 2018

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow the implementation for that ended up being waaay better than it originally was
@zkatzkatAug 9, 2018

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agreeee
 [npm/cli#8](https://github.com/npm/cli/pull/8)
 Search for authentication token defined by environment variables by preventing
 the translation layer from env variable to npm option from breaking
 `:_authToken`.
 ([@mkhl](https://github.com/mkhl))
* [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022)
 [npm/cli#35](https://github.com/npm/cli/pull/35)
 Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually
 use IPv6 addresses when it must.
 ([@valentin2105](https://github.com/valentin2105))
* [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd)
 [npm/cli#31](https://github.com/npm/cli/pull/31)
 configurable audit level for non-zero exit
 `npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level.
 Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found.
 Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.
 ([@lennym](https://github.com/lennym))

### BUGFIXES

* [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c)
 [npm/cli#32](https://github.com/npm/cli/pull/32)
 Don't check for updates to npm when we are updating npm itself.
 ([@olore](https://github.com/olore))

### DEPENDENCY UPDATES

A very special dependency update event! Since the [release of
`node-gyp@3.8.0`](https://github.com/nodejs/node-gyp/pull/1521), an awkward
version conflict that was preventing `request` from begin flattened was
resolved. This means two things:

1. We've cut down the npm tarball size by another 200kb, to 4.6MB
2. `npm audit` now shows no vulnerabilities for npm itself!

Thanks, [@rvagg](https://github.com/rvagg)!

* [`866d776c2`](https://github.com/npm/cli/commit/866d776c27f80a71309389aaab42825b2a0916f6)
 `request@2.87.0`
 ([@simov](https://github.com/simov))
* [`f861c2b57`](https://github.com/npm/cli/commit/f861c2b579a9d4feae1653222afcefdd4f0e978f)
 `node-gyp@3.8.0`
 ([@rvagg](https://github.com/rvagg))
* [`32e6947c6`](https://github.com/npm/cli/commit/32e6947c60db865257a0ebc2f7e754fedf7a6fc9)
 [npm/cli#39](https://github.com/npm/cli/pull/39)
 `colors@1.1.2`:
 REVERT REVERT, newer versions of this library are broken and print ansi
 codes even when disabled.
 ([@iarna](https://github.com/iarna))
* [`beb96b92c`](https://github.com/npm/cli/commit/beb96b92caf061611e3faafc7ca10e77084ec335)
 `libcipm@2.0.1`
 ([@zkat](https://github.com/zkat))
* [`348fc91ad`](https://github.com/npm/cli/commit/348fc91ad223ff91cd7bcf233018ea1d979a2af1)
 `validate-npm-package-license@3.0.4`: Fixes errors with empty or string-only
 license fields.
 ([@Gudahtt](https://github.com/Gudahtt))
* [`e57d34575`](https://github.com/npm/cli/commit/e57d3457547ef464828fc6f82ae4750f3e511550)
 `iferr@1.0.2`
 ([@shesek](https://github.com/shesek))
* [`46f1c6ad4`](https://github.com/npm/cli/commit/46f1c6ad4b2fd5b0d7ec879b76b76a70a3a2595c)
 `tar@4.4.6`
 ([@isaacs](https://github.com/isaacs))
* [`50df1bf69`](https://github.com/npm/cli/commit/50df1bf691e205b9f13e0fff0d51a68772c40561)
 `hosted-git-info@2.7.1`
 ([@iarna](https://github.com/iarna))
 ([@Erveon](https://github.com/Erveon))
 ([@huochunpeng](https://github.com/huochunpeng))

### DOCUMENTATION

* [`af98e76ed`](https://github.com/npm/cli/commit/af98e76ed96af780b544962aa575585b3fa17b9a)
 [npm/cli#34](https://github.com/npm/cli/pull/34)
 Remove `npm publish` from list of commands not affected by `--dry-run`.
 ([@joebowbeer](https://github.com/joebowbeer))
* [`e2b0f0921`](https://github.com/npm/cli/commit/e2b0f092193c08c00f12a6168ad2bd9d6e16f8ce)
 [npm/cli#36](https://github.com/npm/cli/pull/36)
 Tweak formatting in repository field examples.
 ([@noahbenham](https://github.com/noahbenham))
* [`e2346e770`](https://github.com/npm/cli/commit/e2346e7702acccefe6d711168c2b0e0e272e194a)
 [npm/cli#14](https://github.com/npm/cli/pull/14)
 Used `process.env` examples to make accessing certain `npm run-scripts`
 environment variables more clear.
 ([@mwarger](https://github.com/mwarger))

## v6.3.0 (2018-08-01):

This is basically the same as the prerelease, but two dependencies have been
Expand Down

3 changes: 3 additions & 0 deletions
bin/npm-cli.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,12 +69,15 @@
 npm.command = 'help'
 }

 var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm')

 // now actually fire up npm and run the command.
 // this is how to use npm programmatically:
 conf._exit = true
 npm.load(conf, function (er) {
 if (er) return errorHandler(er)
 if (
 !isGlobalNpmUpdate &&
 npm.config.get('update-notifier') &&
 !unsupported.checkVersion(process.version).unsupported
 ) {
Expand Down

16 changes: 8 additions & 8 deletions
doc/files/package.json.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -366,15 +366,15 @@ command will be able to find you.

Do it like this:

 "repository" :
{ "type" : "git"
, "url" : "https://github.com/npm/cli.git"
}
 "repository": {
 "type" : "git",
 "url" : "https://github.com/npm/cli.git"
 }

 "repository" :
{ "type" : "svn"
, "url" : "https://v8.googlecode.com/svn/trunk/"
}
 "repository": {
 "type" : "svn",
 "url" : "https://v8.googlecode.com/svn/trunk/"
 }

The URL should be a publicly available (perhaps read-only) url that can be handed
directly to a VCS program without any modification. It should not be a url to an
Expand Down

12 changes: 10 additions & 2 deletions
doc/misc/npm-config.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -164,6 +164,14 @@ When "true" submit audit reports alongside `npm install` runs to the default
registry and all registries configured for scopes. See the documentation
for npm-audit(1) for details on what is submitted.

### audit-level

* Default: `"low"`
* Type: `'low'`, `'moderate'`, `'high'`, `'critical'`

The minimum level of vulnerability for `npm audit` to exit with
a non-zero exit code.

### auth-type

* Default: `'legacy'`
Expand DownExpand Up@@ -331,8 +339,8 @@ Install `dev-dependencies` along with packages.
Indicates that you don't want npm to make any changes and that it should
only report what it would have done. This can be passed into any of the
commands that modify your local installation, eg, `install`, `update`,
`dedupe`, `uninstall`. This is NOT currently honored by network related
commands, eg `dist-tags`, `owner`, `publish`, etc.
`dedupe`, `uninstall`. This is NOT currently honored by some network related
commands, eg `dist-tags`, `owner`, etc.

### editor

Expand Down

4 changes: 3 additions & 1 deletion
doc/misc/npm-scripts.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,7 +143,9 @@ The package.json fields are tacked onto the `npm_package_` prefix. So,
for instance, if you had `{"name":"foo", "version":"1.2.5"}` in your
package.json file, then your package scripts would have the
`npm_package_name` environment variable set to "foo", and the
`npm_package_version` set to "1.2.5"
`npm_package_version` set to "1.2.5". You can access these variables 
in your code with `process.env.npm_package_name` and 
`process.env.npm_package_version`, and so on for other fields.

### configuration

Expand Down

3 changes: 0 additions & 3 deletions
doc/spec/file-specifiers.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -55,9 +55,6 @@ note for the `npm-shrinkwrap.json` as it means the specifier there will
be different then the original `package.json` (where it was relative to that
`package.json`).

# No, for `file:` type specifiers, we SHOULD shrinkwrap. Other symlinks we
# should not. Other symlinks w/o the link spec should be an error.

When shrinkwrapping file specifiers, the contents of the destination
package's `node_modules` WILL NOT be included in the shrinkwrap. If you want to lock
down the destination package's `node_modules` you should create a shrinkwrap for it
Expand Down

10 changes: 5 additions & 5 deletions
lib/audit.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -257,11 +257,11 @@ function auditCmd (args, cb) {
 })
 })
 } else {
 const vulns =
 auditResult.metadata.vulnerabilities.low +
 auditResult.metadata.vulnerabilities.moderate +
 auditResult.metadata.vulnerabilities.high +
 auditResult.metadata.vulnerabilities.critical
 const levels = ['low', 'moderate', 'high', 'critical']
const minLevel = levels.indexOf(npm.config.get('audit-level'))
const vulns = levels.reduce((count, level, i) => {
return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
}, 0)
 if (vulns > 0) process.exitCode = 1
 if (npm.config.get('parseable')) {
 return audit.printParseableReport(auditResult)
Expand Down

17 changes: 5 additions & 12 deletions
lib/config/defaults.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
 'always-auth': false,
 also: null,
 audit: true,
 'audit-level': 'low',
 'auth-type': 'legacy',

 'bin-links': true,
Expand DownExpand Up@@ -257,6 +258,7 @@ exports.types = {
 'always-auth': Boolean,
 also: [null, 'dev', 'development'],
 audit: Boolean,
 'audit-level': ['low', 'moderate', 'high', 'critical'],
 'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
 'bin-links': Boolean,
 browser: [null, String],
Expand DownExpand Up@@ -306,8 +308,6 @@ exports.types = {
 key: [null, String],
 'legacy-bundling': Boolean,
 link: Boolean,
 // local-address must be listed as an IP for a local network interface
 // must be IPv4 due to node bug
 'local-address': getLocalAddresses(),
 loglevel: ['silent', 'error', 'warn', 'notice', 'http', 'timing', 'info', 'verbose', 'silly'],
 logstream: Stream,
Expand DownExpand Up@@ -388,16 +388,9 @@ function getLocalAddresses () {
 interfaces = {}
 }

 return Object.keys(interfaces).map(function (nic) {
 return interfaces[nic].filter(function (addr) {
 return addr.family === 'IPv4'
 })
 .map(function (addr) {
 return addr.address
 })
 }).reduce(function (curr, next) {
 return curr.concat(next)
 }, []).concat(undefined)
 return Object.keys(interfaces).map(
 nic => interfaces[nic].map(({address}) => address)
 ).reduce((curr, next) => curr.concat(next), []).concat(undefined)
}

exports.shorthands = {
Expand Down

6 changes: 6 additions & 0 deletions
lib/config/get-credentials-by-uri.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,12 @@ function getCredentialsByURI (uri) {
 return c
 }

 if (this.get(nerfed + ':-authtoken')) {
 c.token = this.get(nerfed + ':-authtoken')
 // the bearer token is enough, don't confuse things
 return c
 }

 // Handle the old-style _auth=<base64> style for the default
 // registry, if set.
 var authDef = this.get('_auth')
Expand Down

6 changes: 6 additions & 0 deletions
node_modules/assert-plus/CHANGES.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


9 changes: 8 additions & 1 deletion
node_modules/assert-plus/README.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


5 changes: 5 additions & 0 deletions
node_modules/assert-plus/assert.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


20 changes: 10 additions & 10 deletions
node_modules/assert-plus/package.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 1 addition & 1 deletion
node_modules/aws-sign2/index.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Release: npm@6.4.0#43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

zkat
merged 20 commits into

from

Aug 15, 2018
 Merged


Release: npm@6.4.0
#43
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


20 commits


Select commit
Hold shift + click to select a range
c3ab25f

doc: file-specifier: Remove stray comment


iarna Jul 26, 2018
6e9f04b

config: Search for authentication token defined by environment variab…


mkhl Aug 3, 2018
af98e76

docs: Update --dry-run docs (#34)


joebowbeer Aug 3, 2018
84bfd23

config: stop filtering out non-ipv4 addresses from local-addrs (#35)

Aug 3, 2018
e2b0f09

docs: Improved repository examples (#36)


noahbenham Aug 3, 2018
32e6947

colors@1.1.2 (#39)


iarna Aug 3, 2018
792c8c7

audit: configurable audit level for non-zero exit (#31)


lennym Aug 3, 2018
d811461

cli: don't check for updates to npm when we are updating npm itself (…


olore Aug 3, 2018
e2346e7

docs: added a section for usage with process.env (#14)


mwarger Aug 7, 2018
beb96b9

libcipm@2.0.1


zkat Aug 7, 2018
348fc91

validate-npm-package-license@3.0.4


zkat Aug 7, 2018
e57d345

iferr@1.0.2


zkat Aug 7, 2018
46f1c6a

tar@4.4.6


zkat Aug 7, 2018
50df1bf

hosted-git-info@2.7.1


zkat Aug 7, 2018
866d776

request@2.87.0


zkat Aug 9, 2018
f861c2b

node-gyp@3.8.0


zkat Aug 9, 2018
dbbb75c

doc: update changelog for npm@6.4.0


zkat Aug 9, 2018
214ef61

update AUTHORS


zkat Aug 9, 2018
361226d

6.4.0-next.0


zkat Aug 9, 2018
58ece89

6.4.0


zkat Aug 15, 2018

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

5 changes: 5 additions & 0 deletions
AUTHORS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -591,3 +591,8 @@ Darryl Pogue <dvpdiner2@gmail.com>
Rick Schubert <rickschubert@gmx.de>
Daniel W <dwilches@gmail.com>
XhmikosR <xhmikosr@gmail.com>
Martin Kühl <mkhl@users.noreply.github.com>
Valentin Ouvrard <valentin210594@gmail.com>
Noah Benham <noahbenham@users.noreply.github.com>
Brian Olore <brian@olore.net>
Mat Warger <mwarger@gmail.com>

89 changes: 89 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,92 @@
## v6.4.0 (2018-09-08):

### NEW FEATURES

* [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7)
@iarnaiarnaAug 9, 2018

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow the implementation for that ended up being waaay better than it originally was
@zkatzkatAug 9, 2018

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agreeee
 [npm/cli#8](https://github.com/npm/cli/pull/8)
 Search for authentication token defined by environment variables by preventing
 the translation layer from env variable to npm option from breaking
 `:_authToken`.
 ([@mkhl](https://github.com/mkhl))
* [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022)
 [npm/cli#35](https://github.com/npm/cli/pull/35)
 Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually
 use IPv6 addresses when it must.
 ([@valentin2105](https://github.com/valentin2105))
* [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd)
 [npm/cli#31](https://github.com/npm/cli/pull/31)
 configurable audit level for non-zero exit
 `npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level.
 Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found.
 Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.
 ([@lennym](https://github.com/lennym))

### BUGFIXES

* [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c)
 [npm/cli#32](https://github.com/npm/cli/pull/32)
 Don't check for updates to npm when we are updating npm itself.
 ([@olore](https://github.com/olore))

### DEPENDENCY UPDATES

A very special dependency update event! Since the [release of
`node-gyp@3.8.0`](https://github.com/nodejs/node-gyp/pull/1521), an awkward
version conflict that was preventing `request` from begin flattened was
resolved. This means two things:

1. We've cut down the npm tarball size by another 200kb, to 4.6MB
2. `npm audit` now shows no vulnerabilities for npm itself!

Thanks, [@rvagg](https://github.com/rvagg)!

* [`866d776c2`](https://github.com/npm/cli/commit/866d776c27f80a71309389aaab42825b2a0916f6)
 `request@2.87.0`
 ([@simov](https://github.com/simov))
* [`f861c2b57`](https://github.com/npm/cli/commit/f861c2b579a9d4feae1653222afcefdd4f0e978f)
 `node-gyp@3.8.0`
 ([@rvagg](https://github.com/rvagg))
* [`32e6947c6`](https://github.com/npm/cli/commit/32e6947c60db865257a0ebc2f7e754fedf7a6fc9)
 [npm/cli#39](https://github.com/npm/cli/pull/39)
 `colors@1.1.2`:
 REVERT REVERT, newer versions of this library are broken and print ansi
 codes even when disabled.
 ([@iarna](https://github.com/iarna))
* [`beb96b92c`](https://github.com/npm/cli/commit/beb96b92caf061611e3faafc7ca10e77084ec335)
 `libcipm@2.0.1`
 ([@zkat](https://github.com/zkat))
* [`348fc91ad`](https://github.com/npm/cli/commit/348fc91ad223ff91cd7bcf233018ea1d979a2af1)
 `validate-npm-package-license@3.0.4`: Fixes errors with empty or string-only
 license fields.
 ([@Gudahtt](https://github.com/Gudahtt))
* [`e57d34575`](https://github.com/npm/cli/commit/e57d3457547ef464828fc6f82ae4750f3e511550)
 `iferr@1.0.2`
 ([@shesek](https://github.com/shesek))
* [`46f1c6ad4`](https://github.com/npm/cli/commit/46f1c6ad4b2fd5b0d7ec879b76b76a70a3a2595c)
 `tar@4.4.6`
 ([@isaacs](https://github.com/isaacs))
* [`50df1bf69`](https://github.com/npm/cli/commit/50df1bf691e205b9f13e0fff0d51a68772c40561)
 `hosted-git-info@2.7.1`
 ([@iarna](https://github.com/iarna))
 ([@Erveon](https://github.com/Erveon))
 ([@huochunpeng](https://github.com/huochunpeng))

### DOCUMENTATION

* [`af98e76ed`](https://github.com/npm/cli/commit/af98e76ed96af780b544962aa575585b3fa17b9a)
 [npm/cli#34](https://github.com/npm/cli/pull/34)
 Remove `npm publish` from list of commands not affected by `--dry-run`.
 ([@joebowbeer](https://github.com/joebowbeer))
* [`e2b0f0921`](https://github.com/npm/cli/commit/e2b0f092193c08c00f12a6168ad2bd9d6e16f8ce)
 [npm/cli#36](https://github.com/npm/cli/pull/36)
 Tweak formatting in repository field examples.
 ([@noahbenham](https://github.com/noahbenham))
* [`e2346e770`](https://github.com/npm/cli/commit/e2346e7702acccefe6d711168c2b0e0e272e194a)
 [npm/cli#14](https://github.com/npm/cli/pull/14)
 Used `process.env` examples to make accessing certain `npm run-scripts`
 environment variables more clear.
 ([@mwarger](https://github.com/mwarger))

## v6.3.0 (2018-08-01):

This is basically the same as the prerelease, but two dependencies have been
Expand Down

3 changes: 3 additions & 0 deletions
bin/npm-cli.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,12 +69,15 @@
 npm.command = 'help'
 }

 var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm')

 // now actually fire up npm and run the command.
 // this is how to use npm programmatically:
 conf._exit = true
 npm.load(conf, function (er) {
 if (er) return errorHandler(er)
 if (
 !isGlobalNpmUpdate &&
 npm.config.get('update-notifier') &&
 !unsupported.checkVersion(process.version).unsupported
 ) {
Expand Down

16 changes: 8 additions & 8 deletions
doc/files/package.json.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -366,15 +366,15 @@ command will be able to find you.

Do it like this:

 "repository" :
{ "type" : "git"
, "url" : "https://github.com/npm/cli.git"
}
 "repository": {
 "type" : "git",
 "url" : "https://github.com/npm/cli.git"
 }

 "repository" :
{ "type" : "svn"
, "url" : "https://v8.googlecode.com/svn/trunk/"
}
 "repository": {
 "type" : "svn",
 "url" : "https://v8.googlecode.com/svn/trunk/"
 }

The URL should be a publicly available (perhaps read-only) url that can be handed
directly to a VCS program without any modification. It should not be a url to an
Expand Down

12 changes: 10 additions & 2 deletions
doc/misc/npm-config.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -164,6 +164,14 @@ When "true" submit audit reports alongside `npm install` runs to the default
registry and all registries configured for scopes. See the documentation
for npm-audit(1) for details on what is submitted.

### audit-level

* Default: `"low"`
* Type: `'low'`, `'moderate'`, `'high'`, `'critical'`

The minimum level of vulnerability for `npm audit` to exit with
a non-zero exit code.

### auth-type

* Default: `'legacy'`
Expand DownExpand Up@@ -331,8 +339,8 @@ Install `dev-dependencies` along with packages.
Indicates that you don't want npm to make any changes and that it should
only report what it would have done. This can be passed into any of the
commands that modify your local installation, eg, `install`, `update`,
`dedupe`, `uninstall`. This is NOT currently honored by network related
commands, eg `dist-tags`, `owner`, `publish`, etc.
`dedupe`, `uninstall`. This is NOT currently honored by some network related
commands, eg `dist-tags`, `owner`, etc.

### editor

Expand Down

4 changes: 3 additions & 1 deletion
doc/misc/npm-scripts.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,7 +143,9 @@ The package.json fields are tacked onto the `npm_package_` prefix. So,
for instance, if you had `{"name":"foo", "version":"1.2.5"}` in your
package.json file, then your package scripts would have the
`npm_package_name` environment variable set to "foo", and the
`npm_package_version` set to "1.2.5"
`npm_package_version` set to "1.2.5". You can access these variables 
in your code with `process.env.npm_package_name` and 
`process.env.npm_package_version`, and so on for other fields.

### configuration

Expand Down

3 changes: 0 additions & 3 deletions
doc/spec/file-specifiers.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -55,9 +55,6 @@ note for the `npm-shrinkwrap.json` as it means the specifier there will
be different then the original `package.json` (where it was relative to that
`package.json`).

# No, for `file:` type specifiers, we SHOULD shrinkwrap. Other symlinks we
# should not. Other symlinks w/o the link spec should be an error.

When shrinkwrapping file specifiers, the contents of the destination
package's `node_modules` WILL NOT be included in the shrinkwrap. If you want to lock
down the destination package's `node_modules` you should create a shrinkwrap for it
Expand Down

10 changes: 5 additions & 5 deletions
lib/audit.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -257,11 +257,11 @@ function auditCmd (args, cb) {
 })
 })
 } else {
 const vulns =
 auditResult.metadata.vulnerabilities.low +
 auditResult.metadata.vulnerabilities.moderate +
 auditResult.metadata.vulnerabilities.high +
 auditResult.metadata.vulnerabilities.critical
 const levels = ['low', 'moderate', 'high', 'critical']
const minLevel = levels.indexOf(npm.config.get('audit-level'))
const vulns = levels.reduce((count, level, i) => {
return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
}, 0)
 if (vulns > 0) process.exitCode = 1
 if (npm.config.get('parseable')) {
 return audit.printParseableReport(auditResult)
Expand Down

17 changes: 5 additions & 12 deletions
lib/config/defaults.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
 'always-auth': false,
 also: null,
 audit: true,
 'audit-level': 'low',
 'auth-type': 'legacy',

 'bin-links': true,
Expand DownExpand Up@@ -257,6 +258,7 @@ exports.types = {
 'always-auth': Boolean,
 also: [null, 'dev', 'development'],
 audit: Boolean,
 'audit-level': ['low', 'moderate', 'high', 'critical'],
 'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
 'bin-links': Boolean,
 browser: [null, String],
Expand DownExpand Up@@ -306,8 +308,6 @@ exports.types = {
 key: [null, String],
 'legacy-bundling': Boolean,
 link: Boolean,
 // local-address must be listed as an IP for a local network interface
 // must be IPv4 due to node bug
 'local-address': getLocalAddresses(),
 loglevel: ['silent', 'error', 'warn', 'notice', 'http', 'timing', 'info', 'verbose', 'silly'],
 logstream: Stream,
Expand DownExpand Up@@ -388,16 +388,9 @@ function getLocalAddresses () {
 interfaces = {}
 }

 return Object.keys(interfaces).map(function (nic) {
 return interfaces[nic].filter(function (addr) {
 return addr.family === 'IPv4'
 })
 .map(function (addr) {
 return addr.address
 })
 }).reduce(function (curr, next) {
 return curr.concat(next)
 }, []).concat(undefined)
 return Object.keys(interfaces).map(
 nic => interfaces[nic].map(({address}) => address)
 ).reduce((curr, next) => curr.concat(next), []).concat(undefined)
}

exports.shorthands = {
Expand Down

6 changes: 6 additions & 0 deletions
lib/config/get-credentials-by-uri.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,12 @@ function getCredentialsByURI (uri) {
 return c
 }

 if (this.get(nerfed + ':-authtoken')) {
 c.token = this.get(nerfed + ':-authtoken')
 // the bearer token is enough, don't confuse things
 return c
 }

 // Handle the old-style _auth=<base64> style for the default
 // registry, if set.
 var authDef = this.get('_auth')
Expand Down

6 changes: 6 additions & 0 deletions
node_modules/assert-plus/CHANGES.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


9 changes: 8 additions & 1 deletion
node_modules/assert-plus/README.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


5 changes: 5 additions & 0 deletions
node_modules/assert-plus/assert.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


20 changes: 10 additions & 10 deletions
node_modules/assert-plus/package.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 1 addition & 1 deletion
node_modules/aws-sign2/index.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Release: npm@6.4.0#43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

zkat
merged 20 commits into

from

Aug 15, 2018
 Merged


Release: npm@6.4.0
#43
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


20 commits


Select commit
Hold shift + click to select a range
c3ab25f

doc: file-specifier: Remove stray comment


iarna Jul 26, 2018
6e9f04b

config: Search for authentication token defined by environment variab…


mkhl Aug 3, 2018
af98e76

docs: Update --dry-run docs (#34)


joebowbeer Aug 3, 2018
84bfd23

config: stop filtering out non-ipv4 addresses from local-addrs (#35)

Aug 3, 2018
e2b0f09

docs: Improved repository examples (#36)


noahbenham Aug 3, 2018
32e6947

colors@1.1.2 (#39)


iarna Aug 3, 2018
792c8c7

audit: configurable audit level for non-zero exit (#31)


lennym Aug 3, 2018
d811461

cli: don't check for updates to npm when we are updating npm itself (…


olore Aug 3, 2018
e2346e7

docs: added a section for usage with process.env (#14)


mwarger Aug 7, 2018
beb96b9

libcipm@2.0.1


zkat Aug 7, 2018
348fc91

validate-npm-package-license@3.0.4


zkat Aug 7, 2018
e57d345

iferr@1.0.2


zkat Aug 7, 2018
46f1c6a

tar@4.4.6


zkat Aug 7, 2018
50df1bf

hosted-git-info@2.7.1


zkat Aug 7, 2018
866d776

request@2.87.0


zkat Aug 9, 2018
f861c2b

node-gyp@3.8.0


zkat Aug 9, 2018
dbbb75c

doc: update changelog for npm@6.4.0


zkat Aug 9, 2018
214ef61

update AUTHORS


zkat Aug 9, 2018
361226d

6.4.0-next.0


zkat Aug 9, 2018
58ece89

6.4.0


zkat Aug 15, 2018

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

5 changes: 5 additions & 0 deletions
AUTHORS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -591,3 +591,8 @@ Darryl Pogue <dvpdiner2@gmail.com>
Rick Schubert <rickschubert@gmx.de>
Daniel W <dwilches@gmail.com>
XhmikosR <xhmikosr@gmail.com>
Martin Kühl <mkhl@users.noreply.github.com>
Valentin Ouvrard <valentin210594@gmail.com>
Noah Benham <noahbenham@users.noreply.github.com>
Brian Olore <brian@olore.net>
Mat Warger <mwarger@gmail.com>

89 changes: 89 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,92 @@
## v6.4.0 (2018-09-08):

### NEW FEATURES

* [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7)
@iarnaiarnaAug 9, 2018

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow the implementation for that ended up being waaay better than it originally was
@zkatzkatAug 9, 2018

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agreeee
 [npm/cli#8](https://github.com/npm/cli/pull/8)
 Search for authentication token defined by environment variables by preventing
 the translation layer from env variable to npm option from breaking
 `:_authToken`.
 ([@mkhl](https://github.com/mkhl))
* [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022)
 [npm/cli#35](https://github.com/npm/cli/pull/35)
 Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually
 use IPv6 addresses when it must.
 ([@valentin2105](https://github.com/valentin2105))
* [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd)
 [npm/cli#31](https://github.com/npm/cli/pull/31)
 configurable audit level for non-zero exit
 `npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level.
 Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found.
 Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.
 ([@lennym](https://github.com/lennym))

### BUGFIXES

* [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c)
 [npm/cli#32](https://github.com/npm/cli/pull/32)
 Don't check for updates to npm when we are updating npm itself.
 ([@olore](https://github.com/olore))

### DEPENDENCY UPDATES

A very special dependency update event! Since the [release of
`node-gyp@3.8.0`](https://github.com/nodejs/node-gyp/pull/1521), an awkward
version conflict that was preventing `request` from begin flattened was
resolved. This means two things:

1. We've cut down the npm tarball size by another 200kb, to 4.6MB
2. `npm audit` now shows no vulnerabilities for npm itself!

Thanks, [@rvagg](https://github.com/rvagg)!

* [`866d776c2`](https://github.com/npm/cli/commit/866d776c27f80a71309389aaab42825b2a0916f6)
 `request@2.87.0`
 ([@simov](https://github.com/simov))
* [`f861c2b57`](https://github.com/npm/cli/commit/f861c2b579a9d4feae1653222afcefdd4f0e978f)
 `node-gyp@3.8.0`
 ([@rvagg](https://github.com/rvagg))
* [`32e6947c6`](https://github.com/npm/cli/commit/32e6947c60db865257a0ebc2f7e754fedf7a6fc9)
 [npm/cli#39](https://github.com/npm/cli/pull/39)
 `colors@1.1.2`:
 REVERT REVERT, newer versions of this library are broken and print ansi
 codes even when disabled.
 ([@iarna](https://github.com/iarna))
* [`beb96b92c`](https://github.com/npm/cli/commit/beb96b92caf061611e3faafc7ca10e77084ec335)
 `libcipm@2.0.1`
 ([@zkat](https://github.com/zkat))
* [`348fc91ad`](https://github.com/npm/cli/commit/348fc91ad223ff91cd7bcf233018ea1d979a2af1)
 `validate-npm-package-license@3.0.4`: Fixes errors with empty or string-only
 license fields.
 ([@Gudahtt](https://github.com/Gudahtt))
* [`e57d34575`](https://github.com/npm/cli/commit/e57d3457547ef464828fc6f82ae4750f3e511550)
 `iferr@1.0.2`
 ([@shesek](https://github.com/shesek))
* [`46f1c6ad4`](https://github.com/npm/cli/commit/46f1c6ad4b2fd5b0d7ec879b76b76a70a3a2595c)
 `tar@4.4.6`
 ([@isaacs](https://github.com/isaacs))
* [`50df1bf69`](https://github.com/npm/cli/commit/50df1bf691e205b9f13e0fff0d51a68772c40561)
 `hosted-git-info@2.7.1`
 ([@iarna](https://github.com/iarna))
 ([@Erveon](https://github.com/Erveon))
 ([@huochunpeng](https://github.com/huochunpeng))

### DOCUMENTATION

* [`af98e76ed`](https://github.com/npm/cli/commit/af98e76ed96af780b544962aa575585b3fa17b9a)
 [npm/cli#34](https://github.com/npm/cli/pull/34)
 Remove `npm publish` from list of commands not affected by `--dry-run`.
 ([@joebowbeer](https://github.com/joebowbeer))
* [`e2b0f0921`](https://github.com/npm/cli/commit/e2b0f092193c08c00f12a6168ad2bd9d6e16f8ce)
 [npm/cli#36](https://github.com/npm/cli/pull/36)
 Tweak formatting in repository field examples.
 ([@noahbenham](https://github.com/noahbenham))
* [`e2346e770`](https://github.com/npm/cli/commit/e2346e7702acccefe6d711168c2b0e0e272e194a)
 [npm/cli#14](https://github.com/npm/cli/pull/14)
 Used `process.env` examples to make accessing certain `npm run-scripts`
 environment variables more clear.
 ([@mwarger](https://github.com/mwarger))

## v6.3.0 (2018-08-01):

This is basically the same as the prerelease, but two dependencies have been
Expand Down

3 changes: 3 additions & 0 deletions
bin/npm-cli.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,12 +69,15 @@
 npm.command = 'help'
 }

 var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm')

 // now actually fire up npm and run the command.
 // this is how to use npm programmatically:
 conf._exit = true
 npm.load(conf, function (er) {
 if (er) return errorHandler(er)
 if (
 !isGlobalNpmUpdate &&
 npm.config.get('update-notifier') &&
 !unsupported.checkVersion(process.version).unsupported
 ) {
Expand Down

16 changes: 8 additions & 8 deletions
doc/files/package.json.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -366,15 +366,15 @@ command will be able to find you.

Do it like this:

 "repository" :
{ "type" : "git"
, "url" : "https://github.com/npm/cli.git"
}
 "repository": {
 "type" : "git",
 "url" : "https://github.com/npm/cli.git"
 }

 "repository" :
{ "type" : "svn"
, "url" : "https://v8.googlecode.com/svn/trunk/"
}
 "repository": {
 "type" : "svn",
 "url" : "https://v8.googlecode.com/svn/trunk/"
 }

The URL should be a publicly available (perhaps read-only) url that can be handed
directly to a VCS program without any modification. It should not be a url to an
Expand Down

12 changes: 10 additions & 2 deletions
doc/misc/npm-config.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -164,6 +164,14 @@ When "true" submit audit reports alongside `npm install` runs to the default
registry and all registries configured for scopes. See the documentation
for npm-audit(1) for details on what is submitted.

### audit-level

* Default: `"low"`
* Type: `'low'`, `'moderate'`, `'high'`, `'critical'`

The minimum level of vulnerability for `npm audit` to exit with
a non-zero exit code.

### auth-type

* Default: `'legacy'`
Expand DownExpand Up@@ -331,8 +339,8 @@ Install `dev-dependencies` along with packages.
Indicates that you don't want npm to make any changes and that it should
only report what it would have done. This can be passed into any of the
commands that modify your local installation, eg, `install`, `update`,
`dedupe`, `uninstall`. This is NOT currently honored by network related
commands, eg `dist-tags`, `owner`, `publish`, etc.
`dedupe`, `uninstall`. This is NOT currently honored by some network related
commands, eg `dist-tags`, `owner`, etc.

### editor

Expand Down

4 changes: 3 additions & 1 deletion
doc/misc/npm-scripts.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,7 +143,9 @@ The package.json fields are tacked onto the `npm_package_` prefix. So,
for instance, if you had `{"name":"foo", "version":"1.2.5"}` in your
package.json file, then your package scripts would have the
`npm_package_name` environment variable set to "foo", and the
`npm_package_version` set to "1.2.5"
`npm_package_version` set to "1.2.5". You can access these variables 
in your code with `process.env.npm_package_name` and 
`process.env.npm_package_version`, and so on for other fields.

### configuration

Expand Down

3 changes: 0 additions & 3 deletions
doc/spec/file-specifiers.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -55,9 +55,6 @@ note for the `npm-shrinkwrap.json` as it means the specifier there will
be different then the original `package.json` (where it was relative to that
`package.json`).

# No, for `file:` type specifiers, we SHOULD shrinkwrap. Other symlinks we
# should not. Other symlinks w/o the link spec should be an error.

When shrinkwrapping file specifiers, the contents of the destination
package's `node_modules` WILL NOT be included in the shrinkwrap. If you want to lock
down the destination package's `node_modules` you should create a shrinkwrap for it
Expand Down

10 changes: 5 additions & 5 deletions
lib/audit.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -257,11 +257,11 @@ function auditCmd (args, cb) {
 })
 })
 } else {
 const vulns =
 auditResult.metadata.vulnerabilities.low +
 auditResult.metadata.vulnerabilities.moderate +
 auditResult.metadata.vulnerabilities.high +
 auditResult.metadata.vulnerabilities.critical
 const levels = ['low', 'moderate', 'high', 'critical']
const minLevel = levels.indexOf(npm.config.get('audit-level'))
const vulns = levels.reduce((count, level, i) => {
return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
}, 0)
 if (vulns > 0) process.exitCode = 1
 if (npm.config.get('parseable')) {
 return audit.printParseableReport(auditResult)
Expand Down

17 changes: 5 additions & 12 deletions
lib/config/defaults.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
 'always-auth': false,
 also: null,
 audit: true,
 'audit-level': 'low',
 'auth-type': 'legacy',

 'bin-links': true,
Expand DownExpand Up@@ -257,6 +258,7 @@ exports.types = {
 'always-auth': Boolean,
 also: [null, 'dev', 'development'],
 audit: Boolean,
 'audit-level': ['low', 'moderate', 'high', 'critical'],
 'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
 'bin-links': Boolean,
 browser: [null, String],
Expand DownExpand Up@@ -306,8 +308,6 @@ exports.types = {
 key: [null, String],
 'legacy-bundling': Boolean,
 link: Boolean,
 // local-address must be listed as an IP for a local network interface
 // must be IPv4 due to node bug
 'local-address': getLocalAddresses(),
 loglevel: ['silent', 'error', 'warn', 'notice', 'http', 'timing', 'info', 'verbose', 'silly'],
 logstream: Stream,
Expand DownExpand Up@@ -388,16 +388,9 @@ function getLocalAddresses () {
 interfaces = {}
 }

 return Object.keys(interfaces).map(function (nic) {
 return interfaces[nic].filter(function (addr) {
 return addr.family === 'IPv4'
 })
 .map(function (addr) {
 return addr.address
 })
 }).reduce(function (curr, next) {
 return curr.concat(next)
 }, []).concat(undefined)
 return Object.keys(interfaces).map(
 nic => interfaces[nic].map(({address}) => address)
 ).reduce((curr, next) => curr.concat(next), []).concat(undefined)
}

exports.shorthands = {
Expand Down

6 changes: 6 additions & 0 deletions
lib/config/get-credentials-by-uri.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,12 @@ function getCredentialsByURI (uri) {
 return c
 }

 if (this.get(nerfed + ':-authtoken')) {
 c.token = this.get(nerfed + ':-authtoken')
 // the bearer token is enough, don't confuse things
 return c
 }

 // Handle the old-style _auth=<base64> style for the default
 // registry, if set.
 var authDef = this.get('_auth')
Expand Down

6 changes: 6 additions & 0 deletions
node_modules/assert-plus/CHANGES.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


9 changes: 8 additions & 1 deletion
node_modules/assert-plus/README.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


5 changes: 5 additions & 0 deletions
node_modules/assert-plus/assert.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


20 changes: 10 additions & 10 deletions
node_modules/assert-plus/package.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 1 addition & 1 deletion
node_modules/aws-sign2/index.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Release: npm@6.4.0#43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

zkat
merged 20 commits into

from

Aug 15, 2018
 Merged


Release: npm@6.4.0
#43
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


20 commits


Select commit
Hold shift + click to select a range
c3ab25f

doc: file-specifier: Remove stray comment


iarna Jul 26, 2018
6e9f04b

config: Search for authentication token defined by environment variab…


mkhl Aug 3, 2018
af98e76

docs: Update --dry-run docs (#34)


joebowbeer Aug 3, 2018
84bfd23

config: stop filtering out non-ipv4 addresses from local-addrs (#35)

Aug 3, 2018
e2b0f09

docs: Improved repository examples (#36)


noahbenham Aug 3, 2018
32e6947

colors@1.1.2 (#39)


iarna Aug 3, 2018
792c8c7

audit: configurable audit level for non-zero exit (#31)


lennym Aug 3, 2018
d811461

cli: don't check for updates to npm when we are updating npm itself (…


olore Aug 3, 2018
e2346e7

docs: added a section for usage with process.env (#14)


mwarger Aug 7, 2018
beb96b9

libcipm@2.0.1


zkat Aug 7, 2018
348fc91

validate-npm-package-license@3.0.4


zkat Aug 7, 2018
e57d345

iferr@1.0.2


zkat Aug 7, 2018
46f1c6a

tar@4.4.6


zkat Aug 7, 2018
50df1bf

hosted-git-info@2.7.1


zkat Aug 7, 2018
866d776

request@2.87.0


zkat Aug 9, 2018
f861c2b

node-gyp@3.8.0


zkat Aug 9, 2018
dbbb75c

doc: update changelog for npm@6.4.0


zkat Aug 9, 2018
214ef61

update AUTHORS


zkat Aug 9, 2018
361226d

6.4.0-next.0


zkat Aug 9, 2018
58ece89

6.4.0


zkat Aug 15, 2018

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

5 changes: 5 additions & 0 deletions
AUTHORS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -591,3 +591,8 @@ Darryl Pogue <dvpdiner2@gmail.com>
Rick Schubert <rickschubert@gmx.de>
Daniel W <dwilches@gmail.com>
XhmikosR <xhmikosr@gmail.com>
Martin Kühl <mkhl@users.noreply.github.com>
Valentin Ouvrard <valentin210594@gmail.com>
Noah Benham <noahbenham@users.noreply.github.com>
Brian Olore <brian@olore.net>
Mat Warger <mwarger@gmail.com>

89 changes: 89 additions & 0 deletions
CHANGELOG.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,3 +1,92 @@
## v6.4.0 (2018-09-08):

### NEW FEATURES

* [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7)
@iarnaiarnaAug 9, 2018

Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wow the implementation for that ended up being waaay better than it originally was
@zkatzkatAug 9, 2018

Copy link


Copy Markdown

ContributorAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agreeee
 [npm/cli#8](https://github.com/npm/cli/pull/8)
 Search for authentication token defined by environment variables by preventing
 the translation layer from env variable to npm option from breaking
 `:_authToken`.
 ([@mkhl](https://github.com/mkhl))
* [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022)
 [npm/cli#35](https://github.com/npm/cli/pull/35)
 Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually
 use IPv6 addresses when it must.
 ([@valentin2105](https://github.com/valentin2105))
* [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd)
 [npm/cli#31](https://github.com/npm/cli/pull/31)
 configurable audit level for non-zero exit
 `npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level.
 Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found.
 Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.
 ([@lennym](https://github.com/lennym))

### BUGFIXES

* [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c)
 [npm/cli#32](https://github.com/npm/cli/pull/32)
 Don't check for updates to npm when we are updating npm itself.
 ([@olore](https://github.com/olore))

### DEPENDENCY UPDATES

A very special dependency update event! Since the [release of
`node-gyp@3.8.0`](https://github.com/nodejs/node-gyp/pull/1521), an awkward
version conflict that was preventing `request` from begin flattened was
resolved. This means two things:

1. We've cut down the npm tarball size by another 200kb, to 4.6MB
2. `npm audit` now shows no vulnerabilities for npm itself!

Thanks, [@rvagg](https://github.com/rvagg)!

* [`866d776c2`](https://github.com/npm/cli/commit/866d776c27f80a71309389aaab42825b2a0916f6)
 `request@2.87.0`
 ([@simov](https://github.com/simov))
* [`f861c2b57`](https://github.com/npm/cli/commit/f861c2b579a9d4feae1653222afcefdd4f0e978f)
 `node-gyp@3.8.0`
 ([@rvagg](https://github.com/rvagg))
* [`32e6947c6`](https://github.com/npm/cli/commit/32e6947c60db865257a0ebc2f7e754fedf7a6fc9)
 [npm/cli#39](https://github.com/npm/cli/pull/39)
 `colors@1.1.2`:
 REVERT REVERT, newer versions of this library are broken and print ansi
 codes even when disabled.
 ([@iarna](https://github.com/iarna))
* [`beb96b92c`](https://github.com/npm/cli/commit/beb96b92caf061611e3faafc7ca10e77084ec335)
 `libcipm@2.0.1`
 ([@zkat](https://github.com/zkat))
* [`348fc91ad`](https://github.com/npm/cli/commit/348fc91ad223ff91cd7bcf233018ea1d979a2af1)
 `validate-npm-package-license@3.0.4`: Fixes errors with empty or string-only
 license fields.
 ([@Gudahtt](https://github.com/Gudahtt))
* [`e57d34575`](https://github.com/npm/cli/commit/e57d3457547ef464828fc6f82ae4750f3e511550)
 `iferr@1.0.2`
 ([@shesek](https://github.com/shesek))
* [`46f1c6ad4`](https://github.com/npm/cli/commit/46f1c6ad4b2fd5b0d7ec879b76b76a70a3a2595c)
 `tar@4.4.6`
 ([@isaacs](https://github.com/isaacs))
* [`50df1bf69`](https://github.com/npm/cli/commit/50df1bf691e205b9f13e0fff0d51a68772c40561)
 `hosted-git-info@2.7.1`
 ([@iarna](https://github.com/iarna))
 ([@Erveon](https://github.com/Erveon))
 ([@huochunpeng](https://github.com/huochunpeng))

### DOCUMENTATION

* [`af98e76ed`](https://github.com/npm/cli/commit/af98e76ed96af780b544962aa575585b3fa17b9a)
 [npm/cli#34](https://github.com/npm/cli/pull/34)
 Remove `npm publish` from list of commands not affected by `--dry-run`.
 ([@joebowbeer](https://github.com/joebowbeer))
* [`e2b0f0921`](https://github.com/npm/cli/commit/e2b0f092193c08c00f12a6168ad2bd9d6e16f8ce)
 [npm/cli#36](https://github.com/npm/cli/pull/36)
 Tweak formatting in repository field examples.
 ([@noahbenham](https://github.com/noahbenham))
* [`e2346e770`](https://github.com/npm/cli/commit/e2346e7702acccefe6d711168c2b0e0e272e194a)
 [npm/cli#14](https://github.com/npm/cli/pull/14)
 Used `process.env` examples to make accessing certain `npm run-scripts`
 environment variables more clear.
 ([@mwarger](https://github.com/mwarger))

## v6.3.0 (2018-08-01):

This is basically the same as the prerelease, but two dependencies have been
Expand Down

3 changes: 3 additions & 0 deletions
bin/npm-cli.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -69,12 +69,15 @@
 npm.command = 'help'
 }

 var isGlobalNpmUpdate = conf.global && ['install', 'update'].includes(npm.command) && npm.argv.includes('npm')

 // now actually fire up npm and run the command.
 // this is how to use npm programmatically:
 conf._exit = true
 npm.load(conf, function (er) {
 if (er) return errorHandler(er)
 if (
 !isGlobalNpmUpdate &&
 npm.config.get('update-notifier') &&
 !unsupported.checkVersion(process.version).unsupported
 ) {
Expand Down

16 changes: 8 additions & 8 deletions
doc/files/package.json.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -366,15 +366,15 @@ command will be able to find you.

Do it like this:

 "repository" :
{ "type" : "git"
, "url" : "https://github.com/npm/cli.git"
}
 "repository": {
 "type" : "git",
 "url" : "https://github.com/npm/cli.git"
 }

 "repository" :
{ "type" : "svn"
, "url" : "https://v8.googlecode.com/svn/trunk/"
}
 "repository": {
 "type" : "svn",
 "url" : "https://v8.googlecode.com/svn/trunk/"
 }

The URL should be a publicly available (perhaps read-only) url that can be handed
directly to a VCS program without any modification. It should not be a url to an
Expand Down

12 changes: 10 additions & 2 deletions
doc/misc/npm-config.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -164,6 +164,14 @@ When "true" submit audit reports alongside `npm install` runs to the default
registry and all registries configured for scopes. See the documentation
for npm-audit(1) for details on what is submitted.

### audit-level

* Default: `"low"`
* Type: `'low'`, `'moderate'`, `'high'`, `'critical'`

The minimum level of vulnerability for `npm audit` to exit with
a non-zero exit code.

### auth-type

* Default: `'legacy'`
Expand DownExpand Up@@ -331,8 +339,8 @@ Install `dev-dependencies` along with packages.
Indicates that you don't want npm to make any changes and that it should
only report what it would have done. This can be passed into any of the
commands that modify your local installation, eg, `install`, `update`,
`dedupe`, `uninstall`. This is NOT currently honored by network related
commands, eg `dist-tags`, `owner`, `publish`, etc.
`dedupe`, `uninstall`. This is NOT currently honored by some network related
commands, eg `dist-tags`, `owner`, etc.

### editor

Expand Down

4 changes: 3 additions & 1 deletion
doc/misc/npm-scripts.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -143,7 +143,9 @@ The package.json fields are tacked onto the `npm_package_` prefix. So,
for instance, if you had `{"name":"foo", "version":"1.2.5"}` in your
package.json file, then your package scripts would have the
`npm_package_name` environment variable set to "foo", and the
`npm_package_version` set to "1.2.5"
`npm_package_version` set to "1.2.5". You can access these variables 
in your code with `process.env.npm_package_name` and 
`process.env.npm_package_version`, and so on for other fields.

### configuration

Expand Down

3 changes: 0 additions & 3 deletions
doc/spec/file-specifiers.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -55,9 +55,6 @@ note for the `npm-shrinkwrap.json` as it means the specifier there will
be different then the original `package.json` (where it was relative to that
`package.json`).

# No, for `file:` type specifiers, we SHOULD shrinkwrap. Other symlinks we
# should not. Other symlinks w/o the link spec should be an error.

When shrinkwrapping file specifiers, the contents of the destination
package's `node_modules` WILL NOT be included in the shrinkwrap. If you want to lock
down the destination package's `node_modules` you should create a shrinkwrap for it
Expand Down

10 changes: 5 additions & 5 deletions
lib/audit.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -257,11 +257,11 @@ function auditCmd (args, cb) {
 })
 })
 } else {
 const vulns =
 auditResult.metadata.vulnerabilities.low +
 auditResult.metadata.vulnerabilities.moderate +
 auditResult.metadata.vulnerabilities.high +
 auditResult.metadata.vulnerabilities.critical
 const levels = ['low', 'moderate', 'high', 'critical']
const minLevel = levels.indexOf(npm.config.get('audit-level'))
const vulns = levels.reduce((count, level, i) => {
return i < minLevel ? count : count + (auditResult.metadata.vulnerabilities[level] || 0)
}, 0)
 if (vulns > 0) process.exitCode = 1
 if (npm.config.get('parseable')) {
 return audit.printParseableReport(auditResult)
Expand Down

17 changes: 5 additions & 12 deletions
lib/config/defaults.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -110,6 +110,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
 'always-auth': false,
 also: null,
 audit: true,
 'audit-level': 'low',
 'auth-type': 'legacy',

 'bin-links': true,
Expand DownExpand Up@@ -257,6 +258,7 @@ exports.types = {
 'always-auth': Boolean,
 also: [null, 'dev', 'development'],
 audit: Boolean,
 'audit-level': ['low', 'moderate', 'high', 'critical'],
 'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
 'bin-links': Boolean,
 browser: [null, String],
Expand DownExpand Up@@ -306,8 +308,6 @@ exports.types = {
 key: [null, String],
 'legacy-bundling': Boolean,
 link: Boolean,
 // local-address must be listed as an IP for a local network interface
 // must be IPv4 due to node bug
 'local-address': getLocalAddresses(),
 loglevel: ['silent', 'error', 'warn', 'notice', 'http', 'timing', 'info', 'verbose', 'silly'],
 logstream: Stream,
Expand DownExpand Up@@ -388,16 +388,9 @@ function getLocalAddresses () {
 interfaces = {}
 }

 return Object.keys(interfaces).map(function (nic) {
 return interfaces[nic].filter(function (addr) {
 return addr.family === 'IPv4'
 })
 .map(function (addr) {
 return addr.address
 })
 }).reduce(function (curr, next) {
 return curr.concat(next)
 }, []).concat(undefined)
 return Object.keys(interfaces).map(
 nic => interfaces[nic].map(({address}) => address)
 ).reduce((curr, next) => curr.concat(next), []).concat(undefined)
}

exports.shorthands = {
Expand Down

6 changes: 6 additions & 0 deletions
lib/config/get-credentials-by-uri.js

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -34,6 +34,12 @@ function getCredentialsByURI (uri) {
 return c
 }

 if (this.get(nerfed + ':-authtoken')) {
 c.token = this.get(nerfed + ':-authtoken')
 // the bearer token is enough, don't confuse things
 return c
 }

 // Handle the old-style _auth=<base64> style for the default
 // registry, if set.
 var authDef = this.get('_auth')
Expand Down

6 changes: 6 additions & 0 deletions
node_modules/assert-plus/CHANGES.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


9 changes: 8 additions & 1 deletion
node_modules/assert-plus/README.md

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


5 changes: 5 additions & 0 deletions
node_modules/assert-plus/assert.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


20 changes: 10 additions & 10 deletions
node_modules/assert-plus/package.json

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.


2 changes: 1 addition & 1 deletion
node_modules/aws-sign2/index.js

View file


Open in desktop


Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading