Merge branch 'npm:latest' into latest

gutwrinch · Apr 4, 2024 · 2292f4e · 2292f4e
2 parents c37e12a + f84b753
commit 2292f4e
Show file tree

Hide file tree

Showing 130 changed files with 17,793 additions and 723 deletions.
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,16 +1,16 @@
 {
-  ".": "10.5.0",
-  "workspaces/arborist": "7.4.0",
-  "workspaces/libnpmaccess": "8.0.2",
-  "workspaces/libnpmdiff": "6.0.7",
-  "workspaces/libnpmexec": "7.0.8",
-  "workspaces/libnpmfund": "5.0.5",
-  "workspaces/libnpmhook": "10.0.1",
-  "workspaces/libnpmorg": "6.0.2",
-  "workspaces/libnpmpack": "6.0.7",
-  "workspaces/libnpmpublish": "9.0.4",
-  "workspaces/libnpmsearch": "7.0.1",
-  "workspaces/libnpmteam": "6.0.1",
+  ".": "10.5.1",
+  "workspaces/arborist": "7.4.1",
+  "workspaces/libnpmaccess": "8.0.3",
+  "workspaces/libnpmdiff": "6.0.8",
+  "workspaces/libnpmexec": "7.0.9",
+  "workspaces/libnpmfund": "5.0.6",
+  "workspaces/libnpmhook": "10.0.2",
+  "workspaces/libnpmorg": "6.0.3",
+  "workspaces/libnpmpack": "6.0.8",
+  "workspaces/libnpmpublish": "9.0.5",
+  "workspaces/libnpmsearch": "7.0.2",
+  "workspaces/libnpmteam": "6.0.2",
   "workspaces/libnpmversion": "5.0.2",
-  "workspaces/config": "8.2.0"
+  "workspaces/config": "8.2.1"
 }
diff --git a/AUTHORS b/AUTHORS
@@ -923,3 +923,8 @@ GoodDaisy <[email protected]>
 Aleks Sobieraj <[email protected]>
 Roberto Basile <[email protected]>
 rveerd <[email protected]>
+Jason Ho <[email protected]>
+Christian Oliff <[email protected]>
+Jamie King <[email protected]>
+David LJ <[email protected]>
+Uiolee <[email protected]>
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,57 @@
 # Changelog
 
+## [10.5.1](https://github.com/npm/cli/compare/v10.5.0...v10.5.1) (2024-04-03)
+
+### Bug Fixes
+
+* [`17d97d2`](https://github.com/npm/cli/commit/17d97d266807f69cfc2a7a3982e8db126f90c48a) [#7334](https://github.com/npm/cli/pull/7334) use @npmcli/redact for log redactions (@lukekarrys)
+* [`8cab136`](https://github.com/npm/cli/commit/8cab136f731c69be079be08d79e3514e01bbd563) [#7324](https://github.com/npm/cli/pull/7324) ensure maxSockets is respected (#7324) (@lukekarrys)
+* [`9bffa13`](https://github.com/npm/cli/commit/9bffa13e0b96efe1039d9075fdcb11d5946b2f90) [#7320](https://github.com/npm/cli/pull/7320) query: properly return :missing nodes (#7320) (@wraithgar)
+* [`9d4e85f`](https://github.com/npm/cli/commit/9d4e85f2379eded50b54f4e0b6f307031037f1ec) [#7297](https://github.com/npm/cli/pull/7297) search: include searchlimit option in help output (#7297) (@10xLaCroixDrinker)
+* [`bdb3c28`](https://github.com/npm/cli/commit/bdb3c28167f757060474ef2b82c92f3a1f210972) [#7274](https://github.com/npm/cli/pull/7274) added check for dry-run (#7274) (@cod1r)
+* [`7f1ab88`](https://github.com/npm/cli/commit/7f1ab8822a8d50403338595ab9f218e4d63f37fa) [#7271](https://github.com/npm/cli/pull/7271) more lightweight npm bin discovery in windows (#7271) (@wraithgar)
+
+### Documentation
+
+* [`1da5cf0`](https://github.com/npm/cli/commit/1da5cf0ace30d89edf05833b91ce80467c7864bd) [#7198](https://github.com/npm/cli/pull/7198) add link to engines section (#7198) (@uiolee)
+* [`1114a12`](https://github.com/npm/cli/commit/1114a12f2b4691d403d0863d4dca44f25580f57d) [#7307](https://github.com/npm/cli/pull/7307) fix incorrect npm audit key response link (#7307) (@davidlj95)
+* [`9807caf`](https://github.com/npm/cli/commit/9807cafbaf274eca2a0abbd04a9b2b55e850de9d) [#7304](https://github.com/npm/cli/pull/7304) update audit docs with provenance info (#7304) (@bdehamer)
+* [`e1ecfa7`](https://github.com/npm/cli/commit/e1ecfa7829be91282373862669b92ef42b9e48df) [#7285](https://github.com/npm/cli/pull/7285) Correct capitalization for URL (#7285) (@coliff)
+
+### Dependencies
+
+* [`87a61fc`](https://github.com/npm/cli/commit/87a61fc8bb65c950cda389ab3d14ae250ab2345d) [#7334](https://github.com/npm/cli/pull/7334) `[email protected]`
+* [`5469614`](https://github.com/npm/cli/commit/54696148f25986bcdf39e1acb5aca4bf09e7d1a0) [#7327](https://github.com/npm/cli/pull/7327) `[email protected]`
+* [`5469614`](https://github.com/npm/cli/commit/54696148f25986bcdf39e1acb5aca4bf09e7d1a0) [#7327](https://github.com/npm/cli/pull/7327) `[email protected]`
+* [`5469614`](https://github.com/npm/cli/commit/54696148f25986bcdf39e1acb5aca4bf09e7d1a0) [#7327](https://github.com/npm/cli/pull/7327) `[email protected]` (#7327)
+* [`9ccff72`](https://github.com/npm/cli/commit/9ccff72c332e6062e6ebcf8123c7888d8d617091) [#7329](https://github.com/npm/cli/pull/7329) `[email protected]`
+* [`7201a00`](https://github.com/npm/cli/commit/7201a00632f5cedf50101e8411a4b3c514439efb) [#7329](https://github.com/npm/cli/pull/7329) `[email protected]`
+* [`6fd94f2`](https://github.com/npm/cli/commit/6fd94f249f43080ae183da36b971981e8ad00882) [#7329](https://github.com/npm/cli/pull/7329) `[email protected]`
+* [`b048592`](https://github.com/npm/cli/commit/b048592a9583dca6f75a9c837edee57ab4e12ab0) [#7329](https://github.com/npm/cli/pull/7329) `[email protected]`
+* [`c54a84a`](https://github.com/npm/cli/commit/c54a84ab5fdd7513913518734c0ece5f3d3e39c9) [#7329](https://github.com/npm/cli/pull/7329) `[email protected]`
+* [`6853531`](https://github.com/npm/cli/commit/6853531da30bc8fecb776c823144766915b5e421) [#7329](https://github.com/npm/cli/pull/7329) `[email protected]`
+* [`c9315cb`](https://github.com/npm/cli/commit/c9315cb240be02babbbd99585f7ef23679e1d963) [#7329](https://github.com/npm/cli/pull/7329) `[email protected]`
+* [`5bb0031`](https://github.com/npm/cli/commit/5bb003147423a644969c04222e2ba1b6cf407e6f) [#7329](https://github.com/npm/cli/pull/7329) `@sigstore/[email protected]`
+* [`8cab136`](https://github.com/npm/cli/commit/8cab136f731c69be079be08d79e3514e01bbd563) [#7324](https://github.com/npm/cli/pull/7324) `[email protected]` (@lukekarrys)
+* [workspace](https://github.com/npm/cli/releases/tag/arborist-v7.4.1): `@npmcli/[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/config-v8.2.1): `@npmcli/[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmaccess-v8.0.3): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v6.0.8): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v7.0.9): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v5.0.6): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmhook-v10.0.2): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmorg-v6.0.3): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v6.0.8): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v9.0.5): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmsearch-v7.0.2): `[email protected]`
+* [workspace](https://github.com/npm/cli/releases/tag/libnpmteam-v6.0.2): `[email protected]`
+
+### Chores
+
+* [`8cab136`](https://github.com/npm/cli/commit/8cab136f731c69be079be08d79e3514e01bbd563) [#7324](https://github.com/npm/cli/pull/7324) add smoke-test for large prod installs (@lukekarrys)
+* [`0dab381`](https://github.com/npm/cli/commit/0dab3810e6b84e1b4afcc2a315c878fffccb328b) [#7258](https://github.com/npm/cli/pull/7258) `[email protected]` (#7258) (@wraithgar)
+* [`af3c48e`](https://github.com/npm/cli/commit/af3c48e074d03caebaa8ed24d39405329f545497) [#7262](https://github.com/npm/cli/pull/7262) test refactor (#7262) (@wraithgar)
+
 ## [10.5.0](https://github.com/npm/cli/compare/v10.4.0...v10.5.0) (2024-02-28)
 
 ### Features

diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md
@@ -12,8 +12,8 @@ graph LR;
   cacache-->ssri;
   cacache-->unique-filename;
   init-package-json-->npm-package-arg;
+  init-package-json-->npmcli-package-json["@npmcli/package-json"];
   init-package-json-->promzard;
-  init-package-json-->read-package-json;
   init-package-json-->read;
   init-package-json-->semver;
   init-package-json-->validate-npm-package-name;
@@ -127,6 +127,7 @@ graph LR;
   npm-->npmcli-mock-registry["@npmcli/mock-registry"];
   npm-->npmcli-package-json["@npmcli/package-json"];
   npm-->npmcli-promise-spawn["@npmcli/promise-spawn"];
+  npm-->npmcli-redact["@npmcli/redact"];
   npm-->npmcli-run-script["@npmcli/run-script"];
   npm-->npmcli-smoke-tests["@npmcli/smoke-tests"];
   npm-->npmcli-template-oss["@npmcli/template-oss"];
@@ -155,6 +156,7 @@ graph LR;
   npm-registry-fetch-->make-fetch-happen;
   npm-registry-fetch-->minipass-fetch;
   npm-registry-fetch-->npm-package-arg;
+  npm-registry-fetch-->npmcli-redact["@npmcli/redact"];
   npm-registry-fetch-->proc-log;
   npmcli-arborist-->bin-links;
   npmcli-arborist-->cacache;
@@ -322,8 +324,8 @@ graph LR;
   iconv-lite-->safer-buffer;
   ignore-walk-->minimatch;
   init-package-json-->npm-package-arg;
+  init-package-json-->npmcli-package-json["@npmcli/package-json"];
   init-package-json-->promzard;
-  init-package-json-->read-package-json;
   init-package-json-->read;
   init-package-json-->semver;
   init-package-json-->validate-npm-package-license;
@@ -541,6 +543,7 @@ graph LR;
   npm-->npmcli-mock-registry["@npmcli/mock-registry"];
   npm-->npmcli-package-json["@npmcli/package-json"];
   npm-->npmcli-promise-spawn["@npmcli/promise-spawn"];
+  npm-->npmcli-redact["@npmcli/redact"];
   npm-->npmcli-run-script["@npmcli/run-script"];
   npm-->npmcli-smoke-tests["@npmcli/smoke-tests"];
   npm-->npmcli-template-oss["@npmcli/template-oss"];
@@ -588,6 +591,7 @@ graph LR;
   npm-registry-fetch-->minipass;
   npm-registry-fetch-->minizlib;
   npm-registry-fetch-->npm-package-arg;
+  npm-registry-fetch-->npmcli-redact["@npmcli/redact"];
   npm-registry-fetch-->proc-log;
   npmcli-agent-->agent-base;
   npmcli-agent-->http-proxy-agent;
@@ -826,9 +830,9 @@ packages higher up the chain.
  - @npmcli/arborist
  - @npmcli/metavuln-calculator
  - pacote, libnpmversion
- - @npmcli/run-script, libnpmhook, libnpmorg, libnpmsearch, libnpmteam, npm-profile
+ - @npmcli/run-script, libnpmhook, libnpmorg, libnpmsearch, libnpmteam, init-package-json, npm-profile
  - @npmcli/package-json, npm-registry-fetch
- - @npmcli/git, make-fetch-happen, @npmcli/config, init-package-json
+ - @npmcli/git, make-fetch-happen, @npmcli/config
  - @npmcli/installed-package-contents, @npmcli/map-workspaces, cacache, npm-pick-manifest, read-package-json, promzard
  - @npmcli/docs, @npmcli/fs, npm-bundled, read-package-json-fast, unique-filename, npm-install-checks, npm-package-arg, normalize-package-data, npm-packlist, bin-links, nopt, npmlog, parse-conflict-json, @npmcli/mock-globals, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, minify-registry-metadata, ini, @npmcli/disparity-colors, mute-stream, npm-audit-report, npm-user-validate
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, minify-registry-metadata, ini, @npmcli/disparity-colors, mute-stream, npm-audit-report, npm-user-validate
diff --git a/docs/lib/content/commands/npm-audit.md b/docs/lib/content/commands/npm-audit.md
@@ -47,6 +47,13 @@ Registry signatures can be verified using the following `audit` command:
 $ npm audit signatures
 ```
 
+The `audit signatures` command will also verify the provenance attestations of
+downloaded packages. Because provenance attestations are such a new feature,
+security features may be added to (or changed in) the attestation format over
+time. To ensure that you're always able to verify attestation signatures check
+that you're running the latest version of the npm CLI. Please note this often
+means updating npm beyond the version that ships with Node.js.
+
 The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:
 
 1. Signatures are provided in the package's `packument` in each published version within the `dist` object:
@@ -87,7 +94,7 @@ Keys response:
 - `scheme`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
 - `key`: base64 encoded public key
 
-See this [example key's response from the public npm registry](https://registry.npmjs.org/-/npm/v1/keys").
+See this [example key's response from the public npm registry](https://registry.npmjs.org/-/npm/v1/keys).
 
 ### Audit Endpoints
 

diff --git a/docs/lib/content/configuring-npm/package-json.md b/docs/lib/content/configuring-npm/package-json.md
@@ -40,7 +40,7 @@ Some tips:
 * Don't use the same name as a core Node module.
 * Don't put "js" or "node" in the name.  It's assumed that it's js, since
   you're writing a package.json file, and you can specify the engine using
-  the "engines" field.  (See below.)
+  the "[engines](#engines)" field.  (See below.)
 * The name will probably be passed as an argument to require(), so it
   should be something short, but also reasonably descriptive.
 * You may want to check the npm registry to see if there's something by
@@ -75,7 +75,7 @@ your package as it's listed in `npm search`.
 
 ### homepage
 
-The url to the project homepage.
+The URL to the project homepage.
 
 Example:
 
@@ -85,7 +85,7 @@ Example:
 
 ### bugs
 
-The url to your project's issue tracker and / or the email address to which
+The URL to your project's issue tracker and / or the email address to which
 issues should be reported. These are helpful for people who encounter
 issues with your package.
 
@@ -101,10 +101,10 @@ It should look like this:
 ```
 
 You can specify either one or both values. If you want to provide only a
-url, you can specify the value for "bugs" as a simple string instead of an
+URL, you can specify the value for "bugs" as a simple string instead of an
 object.
 
-If a url is provided, it will be used by the `npm bugs` command.
+If a URL is provided, it will be used by the `npm bugs` command.
 
 ### license
 
@@ -511,9 +511,9 @@ Do it like this:
 }
 ```
 
-The URL should be a publicly available (perhaps read-only) url that can be
+The URL should be a publicly available (perhaps read-only) URL that can be
 handed directly to a VCS program without any modification.  It should not
-be a url to an html project page that you put in your browser.  It's for
+be a URL to an html project page that you put in your browser.  It's for
 computers.
 
 For GitHub, GitHub gist, Bitbucket, or GitLab repositories you can use the
@@ -636,7 +636,7 @@ install time.
 
 #### Git URLs as Dependencies
 
-Git urls are of the form:
+Git URLs are of the form:
 
 ```bash
 <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>[#<commit-ish> | #semver:<semver>]
@@ -683,7 +683,7 @@ will be rebuilt for every installation.
 
 #### GitHub URLs
 
-As of version 1.1.65, you can refer to GitHub urls as just "foo":
+As of version 1.1.65, you can refer to GitHub URLs as just "foo":
 "user/foo-project".  Just as with git URLs, a `commit-ish` suffix can be
 included.  For example:
 
@@ -889,7 +889,7 @@ none.
 If a dependency can be used, but you would like npm to proceed if it cannot
 be found or fails to install, then you may put it in the
 `optionalDependencies` object.  This is a map of package name to version or
-url, just like the `dependencies` object.  The difference is that build
+URL, just like the `dependencies` object.  The difference is that build
 failures do not cause installation to fail.  Running `npm install
 --omit=optional` will prevent these dependencies from being installed.
 

diff --git a/lib/commands/adduser.js b/lib/commands/adduser.js
@@ -1,5 +1,5 @@
 const log = require('../utils/log-shim.js')
-const replaceInfo = require('../utils/replace-info.js')
+const { redactLog: replaceInfo } = require('@npmcli/redact')
 const auth = require('../utils/auth.js')
 
 const BaseCommand = require('../base-command.js')

diff --git a/lib/commands/ci.js b/lib/commands/ci.js
@@ -75,14 +75,18 @@ class CI extends ArboristWorkspaceCmd {
       )
     }
 
-    // Only remove node_modules after we've successfully loaded the virtual
-    // tree and validated the lockfile
-    await this.npm.time('npm-ci:rm', async () => {
-      const path = `${where}/node_modules`
-      // get the list of entries so we can skip the glob for performance
-      const entries = await fs.readdir(path, null).catch(er => [])
-      return Promise.all(entries.map(f => fs.rm(`${path}/${f}`, { force: true, recursive: true })))
-    })
+    const dryRun = this.npm.config.get('dry-run')
+    if (!dryRun) {
+      // Only remove node_modules after we've successfully loaded the virtual
+      // tree and validated the lockfile
+      await this.npm.time('npm-ci:rm', async () => {
+        const path = `${where}/node_modules`
+        // get the list of entries so we can skip the glob for performance
+        const entries = await fs.readdir(path, null).catch(er => [])
+        return Promise.all(entries.map(f => fs.rm(`${path}/${f}`,
+          { force: true, recursive: true })))
+      })
+    }
 
     await arb.reify(opts)
 

diff --git a/lib/commands/login.js b/lib/commands/login.js
@@ -1,5 +1,5 @@
 const log = require('../utils/log-shim.js')
-const replaceInfo = require('../utils/replace-info.js')
+const { redactLog: replaceInfo } = require('@npmcli/redact')
 const auth = require('../utils/auth.js')
 
 const BaseCommand = require('../base-command.js')

diff --git a/lib/commands/publish.js b/lib/commands/publish.js
@@ -6,7 +6,7 @@ const runScript = require('@npmcli/run-script')
 const pacote = require('pacote')
 const npa = require('npm-package-arg')
 const npmFetch = require('npm-registry-fetch')
-const replaceInfo = require('../utils/replace-info.js')
+const { redactLog: replaceInfo } = require('@npmcli/redact')
 
 const otplease = require('../utils/otplease.js')
 const { getContents, logTar } = require('../utils/tar.js')

diff --git a/lib/commands/query.js b/lib/commands/query.js
@@ -113,10 +113,12 @@ class Query extends BaseCommand {
   // builds a normalized inventory
   buildResponse (items) {
     for (const node of items) {
-      if (!this.#seen.has(node.target.location)) {
+      if (!node.target.location || !this.#seen.has(node.target.location)) {
         const item = new QuerySelectorItem(node)
         this.#response.push(item)
-        this.#seen.add(item.location)
+        if (node.target.location) {
+          this.#seen.add(item.location)
+        }
       }
     }
   }

diff --git a/lib/commands/search.js b/lib/commands/search.js
@@ -42,6 +42,7 @@ class Search extends BaseCommand {
     'color',
     'parseable',
     'description',
+    'searchlimit',
     'searchopts',
     'searchexclude',
     'registry',

diff --git a/lib/npm.js b/lib/npm.js
@@ -12,7 +12,7 @@ const LogFile = require('./utils/log-file.js')
 const Timers = require('./utils/timers.js')
 const Display = require('./utils/display.js')
 const log = require('./utils/log-shim')
-const replaceInfo = require('./utils/replace-info.js')
+const { redactLog: replaceInfo } = require('@npmcli/redact')
 const updateNotifier = require('./utils/update-notifier.js')
 const pkg = require('../package.json')
 const { deref } = require('./utils/cmd-list.js')

diff --git a/lib/utils/audit-error.js b/lib/utils/audit-error.js
@@ -1,5 +1,5 @@
 const log = require('./log-shim')
-const replaceInfo = require('./replace-info.js')
+const { redactLog: replaceInfo } = require('@npmcli/redact')
 
 // print an error or just nothing if the audit report has an error
 // this is called by the audit command, and by the reify-output util

diff --git a/lib/utils/error-message.js b/lib/utils/error-message.js
@@ -1,7 +1,7 @@
 const { format } = require('util')
 const { resolve } = require('path')
 const nameValidator = require('validate-npm-package-name')
-const replaceInfo = require('./replace-info.js')
+const { redactLog: replaceInfo } = require('@npmcli/redact')
 const { report } = require('./explain-eresolve.js')
 const log = require('./log-shim')
 

diff --git a/lib/utils/exit-handler.js b/lib/utils/exit-handler.js
@@ -3,7 +3,7 @@ const fs = require('fs')
 
 const log = require('./log-shim.js')
 const errorMessage = require('./error-message.js')
-const replaceInfo = require('./replace-info.js')
+const { redactLog: replaceInfo } = require('@npmcli/redact')
 
 let npm = null // set by the cli
 let exitHandlerCalled = false

diff --git a/lib/utils/read-user-info.js b/lib/utils/read-user-info.js
@@ -1,4 +1,4 @@
-const read = require('read')
+const { read } = require('read')
 const userValidate = require('npm-user-validate')
 const log = require('./log-shim.js')