v6.13.6

Compare Source

DEPENDENCIES

• 6dba897a1
pacote@9.5.12:
  • d2f4176
    fix(git): Do not drop uid/gid when executing in root-owned directory
    (@​isaacs)

v6.13.5

Compare Source

BUG FIXES

• fd0a802ec #​550 Fix cache location for npm ci (@​zhenyavinogradov)
• 4b30f3cca #​648 fix(version): using 'allow-same-version', git commit --allow-empty and git tag -f (@​rhengles)

TESTING

• e16f68d30 test(ci): add failing cache config test (@​ruyadorno)
• 3f009fbf2 #​659 test: fix bin-overwriting test on Windows (@​isaacs)
• 43ae0791f #​601 ci: Allow builds to run even if one fails (@​XhmikosR)
• 4a669bee4 #​603 Remove the unused appveyor.yml (@​XhmikosR)
• 9295046ac #​600 ci: switch to actions/checkout@v2 (@​XhmikosR)

DOCUMENTATION

• f2d770ac7 #​569 fix netlify publish path config (@​claudiahdz)
• 462cf0983 #​627 update gatsby dependencies (@​felixonmars)
• 6fb5dbb72
  #​532 docs: clarify usage of global prefix (@​jgehrcke)

v6.13.4

Compare Source

v6.13.3

Compare Source

DEPENDENCIES

• 19ce061a2
bin-links@1.1.5 Properly normalize, sanitize, and verify bin entries
  in package.json.
• 59c836aae
npm-packlist@1.4.7
• fb4ecd7d2
pacote@9.5.11
  • 5f33040
    #​476
    npm/pacote#​22
    npm/pacote#​14 fix: Do not
    drop perms in git when not root (isaacs,
    @​darcyclarke)
  • 6f229f7
    sanitize and normalize package bin field
    (isaacs)
• 1743cb339
read-package-json@2.1.1

v6.13.2

Compare Source

BUG FIXES

• 4429645b3
  #​546
  fix docs target typo
  (@​richardlau)
• 867642942
  #​142
  fix(packageRelativePath): fix 'where' for file deps
  (@​larsgw)
• d480f2c17
  #​527
  Revert "windows: Add preliminary WSL support for npm and npx"
  (@​craigloewen-msft)
• e4b97962e
  #​504
  remove unnecessary package.json read when reading shrinkwrap
  (@​Lighting-Jack)
• 1c65d26ac
  #​501
  fix(fund): open url for string shorthand
  (@​ruyadorno)
• ae7afe565
  #​263
  Don't log error message if git tagging is disabled
  (@​woppa684)
• 4c1b16f6a
  #​182
  Warn the user that it is uninstalling npm-install
  (@​Hoidberg)

v6.13.1

Compare Source

BUG FIXES

• 938d6124d
  #​472
  fix(fund): support funding string shorthand
  (@​ruyadorno)
• b49c5535b
  #​471
  should not publish tap-snapshot folder
  (@​ruyadorno)
• 3471d5200
  #​253
  Add preliminary WSL support for npm and npx
  (@​infinnie)
• 3ef295f23
  #​486
  print quick audit report for human output
  (@​isaacs)

TESTING

• dbbf977ac
  #​278
  added workflow to trigger and run benchmarks
  (@​mikemimik)
• b4f5e3825
  #​457
  feat(docs): adding tests and updating docs to reflect changes in registry teams API.
  (@​nomadtechie)
• 454c7dd60
  #​456
  fix git configs for git 2.23 and above
  (@​isaacs)

DOCUMENTATION

• b8c1576a4 30b013ae8 26c1b2ef6 9f943a765 c0346b158 8e09d5ad6 4a2f551ee 87d67258c 5c3b32722 b150eaeff 7555a743c b89423e2f
  #​463
  #​285
  #​268
  #​232
  #​485
  #​453
  docs cleanup: typos, styling and content
  (@​claudiahdz)
  (@​XhmikosR)
  (@​mugli)
  (@​brettz9)
  (@​mkotsollaris)

DEPENDENCIES

• 661d86cd2
make-fetch-happen@5.0.2
  (@​claudiahdz)

v6.13.0

Compare Source

NEW FEATURES

• 4414b06d9
  #​273
  add fund command
  (@​ruyadorno)

DOCUMENTATION

• ae4c74d04
  #​274
  migrate existing docs to gatsby
  (@​claudiahdz)
• 4ff1bb180
  #​277
  updated documentation copy
  (@​oletizi)

BUG FIXES

• e4455409f
  #​281
  delete ps1 files on package removal
  (@​NoDocCat)
• cd14d4701
  #​279
  update supported node list to remove v6.0, v6.1, v9.0 - v9.2
  (@​ljharb)

DEPENDENCIES

• a37296b20
pacote@9.5.9
• d3cb3abe8
read-cmd-shim@1.0.5

TESTING

• 688cd97be
  #​272
  use github actions for CI
  (@​JasonEtco)
• 9a2d8af84
  #​240
  Clean up some flakiness and inconsistency
  (@​isaacs)

v6.12.1

Compare Source

BUG FIXES

• 6508e833d
  #​269
  add node v13 as a supported version
  (@​ljharb)
• b6588a8f7
  #​265
  Fix regression in lockfile repair for sub-deps
  (@​feelepxyz)
• d5dfe57a1
  #​266
  resolve circular dependency in pack.js
  (@​addaleax)

DEPENDENCIES

• 73678bb59
chownr@1.1.3
• 4b76926e2
graceful-fs@4.2.3
• c691f36a9
libcipm@4.0.7
• 5e1a14975
npm-packlist@1.4.6
• c194482d6
npm-registry-fetch@4.0.2
• bc6a8e0ec
tar@4.4.1
• 4dcca3cbb
uuid@3.3.3

v6.12.0

Compare Source

Now npm ci runs prepare scripts for git dependencies, and respects the
--no-optional argument. Warnings for engine mismatches are printed
again. Various other fixes and cleanups.

BUG FIXES

• 890b245dc
  #​252 ci: add dirPacker to options
  (@​claudiahdz)
• f3299acd0
  #​257
  npm.community#​4792
  warn message on engine mismatch
  (@​ruyadorno)
• bbc92fb8f
  #​259
  npm.community#​10288
  Fix figgyPudding error in npm token
  (@​benblank)
• 70f54dcb5
  #​241 doctor: Make OK more
  consistent (@​gemal)

FEATURES

• ed993a29c
  #​249 Add CI environment variables
  to user-agent (@​isaacs)
• f6b0459a4
  #​248 Add option to save
  package-lock without formatting Adds a new config
  --format-package-lock, which defaults to true.
  (@​bl00mber)

DEPENDENCIES

• 0ca063c5d
npm-lifecycle@3.1.4:
  • fix: filter functions and undefined out of makeEnv
    (@​isaacs)
• 5df6b0ea2
libcipm@4.0.4:
  • fix: pack git directories properly
    (@​claudiahdz)
  • respect no-optional argument
    (@​cruzdanilo)
• 7e04f728c
tar@4.4.12
• 5c380e5a3
stringify-package@1.0.1 (@​isaacs)
• 62f2ca692
node-gyp@5.0.5 (@​isaacs)
• 0ff0ea47a
npm-install-checks@3.0.2 (@​isaacs)
• f46edae94
hosted-git-info@2.8.5 (@​isaacs)

TESTING

• 44a2b036b
  #​262 fix root-ownership race
  conditions in meta-test (@​isaacs)

v6.11.3

Compare Source

Fix npm ci regressions and npm outdated depth.

BUG FIXES

• 235ed1d28
  #​239
  Don't override user specified depth in outdated
  Restores ability to update packages using --depth as suggested by npm audit.
  (@​G-Rath)
• 1fafb5151
  #​242
  npm.community#​9586
  Revert "install: do not descend into directory deps' child modules"
  (@​isaacs)
• cebf542e6
  #​243
  npm.community#​9720
  ci: pass appropriate configs for file/dir modes
  (@​isaacs)

DEPENDENCIES

• e5fbb7ed1
read-cmd-shim@1.0.4
  (@​claudiahdz)
• 23ce65616
npm-pick-manifest@3.0.2
  (@​claudiahdz)

v6.11.2

Compare Source

Fix a recent Windows regression, and two long-standing Windows bugs. Also,
get CI running on Windows, so these things are less likely in the future.

DEPENDENCIES

• 9778a1b87
cmd-shim@3.0.3: Fix regression where shims fail to preserve exit code
  (@​isaacs)
• bf93e91d8
npm-package-arg@6.1.1: Properly handle git+file: urls on Windows when a
  drive letter is included. (@​isaacs)

BUGFIXES

• 6cc4cc66f
  escape args properly on Windows Bash Despite being bash, Node.js running
  on windows git mingw bash still executes child processes using cmd.exe.
  As a result, arguments in this environment need to be escaped in the
  style of cmd.exe, not bash. (@​isaacs)

TESTS

• 291aba7b8
  make tests pass on Windows (@​isaacs)
• fea3a023a
  travis: run tests on Windows as well
  (@​isaacs)

v6.11.1

Compare Source

Fix a regression for windows command shim syntax.

• 37db29647
cmd-shim@3.0.2 (@​isaacs)

v6.11.0

Compare Source

A few meaty bugfixes, and introducing peerDependenciesMeta.

FEATURES

• a12341088
  #​224 Implements
  peerDependenciesMeta (@​arcanis)
• 2f3b79bba
  #​234 add new forbidden 403 error
  code (@​claudiahdz)

BUGFIXES

• 24acc9fc8
  and
  45772af0d
  #​217
  npm.community#​8863
  npm.community#​9327
  do not descend into directory deps' child modules, fix shrinkwrap files
  that inappropriately list child nodes of symlink packages
  (@​isaacs and
  @​salomvary)
• 50cfe113d
  #​229 fixed typo in semver doc
  (@​gall0ws)
• e8fb2a1bd
  #​231 Fix spelling mistakes in
  CHANGELOG-3.md (@​XhmikosR)
• 769d2e057
  npm/uid-number#​7 Better
  error on invalid --user/--group configs. This addresses the issue
  when people fail to install binary packages on Docker and other
  environments where there is no 'nobody' user.
  (@​isaacs)
• 8b43c9624
  nodejs/node#​28987
  npm.community#​6032
  npm.community#​6658
  npm.community#​6069
  npm.community#​9323
  Fix the regression where random config values in a .npmrc file are not
  passed to lifecycle scripts, breaking build processes which rely on them.
  (@​isaacs)
• 8b85eaa47
  save files with inferred ownership rather than relying on SUDO_UID and
  SUDO_GID. (@​isaacs)
• b7f6e5f02
  Infer ownership of shrinkwrap files
  (@​isaacs)
• 54b095d77
  #​235 Add spec to dist-tag remove
  function (@​theberbie)

DEPENDENCIES

• dc8f9e52f
pacote@9.5.7: Infer the ownership of all unpacked files in
  node_modules, so that we never have user-owned files in root-owned
  folders, or root-owned files in user-owned folders.
  (@​isaacs)
• bb33940c3
cmd-shim@3.0.0:
  • 9c93ac3
    #​2
    npm#​3380 Handle environment
    variables properly (@​basbossink)
  • 2d277f8
    #​25
    #​36
    #​35 Fix 'no shebang' case by
    always providing $basedir in shell script
    (@​igorklopov)
  • adaf20b
    #​26 Fix $* causing an
    error when arguments contain parentheses
    (@​satazor)
  • 49f0c13
    #​30 Fix paths for MSYS/MINGW
    bash (@​dscho)
  • 51a8af3
    #​34 Add proper support for
    PowerShell (@​ExE-Boss)
  • 4c37e04
    #​10 Work around quoted
    batch file names (@​isaacs)
• a4e279544
npm-lifecycle@3.1.3 (@​isaacs):
  • fail properly if uid-number raises an error
• 7086a1809
libcipm@4.0.3 (@​isaacs)
• 8845141f9
read-package-json@2.1.0 (@​isaacs)
• 51c028215
bin-links@1.1.3 (@​isaacs)
• 534a5548c
read-cmd-shim@1.0.3 (@​isaacs)
• 3038f2fd5
gentle-fs@2.2.1 (@​isaacs)
• a609a1648
graceful-fs@4.2.2 (@​isaacs)
• f0346f754
cacache@12.0.3 (@​isaacs)
• ca9c615c8
npm-pick-manifest@3.0.0 (@​isaacs)
• b417affbf
pacote@9.5.8 (@​isaacs)

TESTS

• b6df0913c
  #​228 Proper handing of
  /usr/bin/node lifecycle-path test
  (@​olivr70)
• aaf98e88c
npm-registry-mock@1.3.0 (@​isaacs)

v6.10.3

Compare Source

BUGFIXES

• 27cccfbda
  #​223 vulns → vulnerabilities in
  npm audit output (@​sapegin)
• d5e865eb7
  #​222
  #​226 install, doctor: don't crash
  if registry unset (@​dmitrydvorkin,
  @​isaacs)
• 5b3890226
  #​227
  npm.community#​9167
  Handle unhandledRejections, tell user what to do when encountering an
  EACCES error in the cache. (@​isaacs)

DEPENDENCIES

• 77516df6e
licensee@7.0.3 (@​isaacs)
• ceb993590
query-string@6.8.2 (@​isaacs)
• 4050b9189
hosted-git-info@2.8.2
  • #​46
    #​43
    #​47
    #​44 Add support for
    GitLab subgroups (@​mterrel,
    @​isaacs,
    @​ybiquitous)
  • 3b1d629
    #​48 fix http
    protocol using sshurl by default
    (@​fengmk2)
  • 5d4a8d7
    ignore noCommittish on tarball url generation
    (@​isaacs)
  • 1692435
    use gist tarball url that works for anonymous gists
    (@​isaacs)
  • d5cf830
    Do not allow invalid gist urls (@​isaacs)
  • e518222
    Use LRU cache to prevent unbounded memory consumption
    (@​iarna)

v6.10.2

Compare Source

tl;dr - Fixes several issues with the cache when npm is run as sudo on
Unix systems.

TESTING

• 2a78b96f8
  check test cache for root-owned files
  (@​isaacs)
• 108646ebc
  run sudo tests on Travis-CI (@​isaacs)
• cf984e946
  set --no-esm tap flag (@​isaacs)
• 8e0a3100d
  add script to run tests and leave fixtures for inspection and debugging
  (@​isaacs)

BUGFIXES

• 25f4f73f6
  add a util for writing arbitrary files to cache This prevents metrics
  timing and debug logs from becoming root-owned.
  (@​isaacs)
• 2c61ce65d
  infer cache owner from parent dir in correct-mkdir util
  (@​isaacs)
• 235e5d6df
  ensure correct owner on cached all-packages metadata
  (@​isaacs)
• e2d377bb6
  npm.community#​8540
  audit: report server error on failure
  (@​isaacs)
• 52576a39e
  #​216
  npm.community#​5385
  npm.community#​6076
  Fix npm ci with file: dependencies. Partially reverts
  #​40/#​86,
  recording dependencies of linked deps in order for npm ci to work.
  (@​jfirebaugh)

DEPENDENCIES

• 0fefdee13
cacache@12.0.2 (@​isaacs)
  • infer uid/gid instead of accepting as options, preventing the
    overwhelming majority of cases where root-owned files end up in the
    cache folder.
    (ac84d14)
    (@​isaacs)
    (#​1)
  • i18n: add another error message
    (676cb32)
    (@​zkat)
• e1d87a392
pacote@9.5.4 (@​isaacs)
  • git: ensure stream failures are reported
    (7f07b5d)
    #​1
    (@​lddubeau)
• 3f035bf09
infer-owner@1.0.4 (@​isaacs)
• ba3283112
npm-registry-fetch@4.0.0 (@​isaacs)
• ee90c334d
libnpm@3.0.1 (@​isaacs)
• 1e480c384
libnpmaccess@3.0.2 (@​isaacs)
• 7662ee850
libnpmhook@5.0.3 (@​isaacs)
• 1357fadc6
libnpmorg@1.0.1 (@​isaacs)
• a621b5cb6
libnpmsearch@2.0.2 (@​isaacs)
• 560cd31dd
libnpmteam@1.0.2 (@​isaacs)
• de7ae0867
npm-profile@4.0.2 (@​isaacs)
• e95da463c
libnpm@3.0.1 (@​isaacs)
• 554b641d4
npm-registry-fetch@4.0.0 (@​isaacs)
• 06772f34a
node-gyp@5.0.3 (@​isaacs)
• 85358db80
npm-lifecycle@3.1.2 (@​isaacs)
  • 051cf20
    #​26 fix switches for
    alternative shells on Windows
    (@​gucong3000)
  • 3aaf954
    #​25 set only one PATH
    env variable for child process on Windows
    (@​zkochan)
  • ea18ed2
    #​36
    #​11
    #​18 remove
    procInterrupt listener on SIGINT in procError
    (@​mattshin)
  • 5523951
    #​29
    #​30 Use platform
    specific path casing if present
    (@​mattezell)

v6.10.1

Compare Source

BUGFIXES

• 3cbd57712
  fix(git): strip GIT environs when running git
  (@​isaacs)
• a81a8c4c4
  #​206 improve isOnly(Dev,Optional)
  (@​larsgw)
• 172f9aca6
  #​179 fix-xmas-underline
  (@​raywu0123)
• f52673fc7
  #​212 build: use /usr/bin/env to
  load bash (@​rsmarples)

DEPENDENCIES

• ef4445ad3
  #​208 node-gyp@5.0.2
  (@​irega)
• c0d611356
npm-lifecycle@3.0.0 (@​isaacs)
• 7716ba972
libcipm@4.0.0 (@​isaacs)
• 42d22e837
libnpm@3.0.0 (@​isaacs)
• a2ea7f9ff
semver@5.7.0 (@​isaacs)
• 429226a5e
lru-cache@5.1.1 (@​isaacs)
• 175670ea6
npm-registry-fetch@3.9.1: (@​isaacs)
• 0d0517f7f
call-limit@1.1.1 (@​isaacs)
• 741400429
glob@7.1.4 (@​isaacs)
• bddd60e30
inherits@2.0.4 (@​isaacs)
• 4acf03fd1
libnpmsearch@2.0.1 (@​isaacs)
• c2bd17291
marked@0.6.3 (@​isaacs)
• 7f0221bb1
marked-man@0.6.0 (@​isaacs)
• f458fe7dd
npm-lifecycle@2.1.1 (@​isaacs)
• 009752978
node-gyp@4.0.0 (@​isaacs)
• 0fa2bb438
query-string@6.8.1 (@​isaacs)
• b86450929
tar-stream@2.1.0 (@​isaacs)
• 25db00fe9
worker-farm@1.7.0 (@​isaacs)
• 8dfbe8610
readable-stream@3.4.0 (@​isaacs)
• f6164d5dd
  isaacs/chownr#​21
  isaacs/chownr#​20
  npm.community#​7901
  npm.community#​8203 chownr@1.1.2 This
  fixes an EISDIR error from cacache on Darwin in Node versions prior to
  10.6. (@​isaacs)

v6.10.0

Compare Source

FEATURES

• 87fef4e35
  #​176 fix: Always return JSON for
  outdated --json (@​sreeramjayan)
• f101d44fc
  #​203 fix(unpublish): add space
  after hyphen (@​ffflorian)
• a4475de4c
  #​202 enable production flag for
  npm audit (@​CalebCourier)
• d192904d0
  #​178 fix: Return a value for
  view when in silent mode
  (@​stayradiated)
• 39d473adf
  #​185 Allow git to follow global
  tagsign config (@​junderw)

BUGFIXES

• d9238af0b
  #​201
  npm/npm#​17858
  npm/npm#​18042
  npm.community#​644 do not crash when
  removing nameless packages
  (@​SteveVanOpstal and
  @​isaacs)
• 4bec4f111
  #​200 Check for node (as well as
  node.exe) in npm's local dir on Windows
  (@​rgoulais)
• ce93dab2d
  #​180
  npm.community#​6187 Fix handling of
  remote deps in npm outdated (@​larsgw)

TESTING

• a823f3084 travis: Update
  to include new v12 LTS (@​isaacs)
• 33e2d1dac fix flaky
  debug-logs test (@​isaacs)
• e9411c6cd Don't time out
  waiting for gpg user input (@​isaacs)
• d2d301704
  #​195 Add the arm64 check for
  legacy-platform-all.js test case.
  (@​ossdev07)
• a4dc34243 parallel tests
  (@​isaacs)

DOCUMENTATION

• f5857e263
  #​192 Clarify usage of
  bundledDependencies
  (@​john-osullivan)
• 747fdaf66
  #​159 doc: add --audit-level param
  (@​ngraef)

DEPENDENCIES

• e36b3c320
  graceful-fs@4.2.0 (@​isaacs)
• 6bb935c09
  read-package-tree@5.3.1 (@​isaacs)
  • e9cd536
    Use custom caching realpath implementation, dramatically reducing
    lstat calls when reading the package tree
    (@​isaacs)
• 39538b460
  write-file-atomic@2.4.3 (@​isaacs)
  • f8b1552
    #​38 Ignore errors
    raised by fs.closeSync (@​lukeapage)
• 042193069 pacote@9.5.1
  (@​isaacs)
  • 8bbd051
    #​172 limit git retry
    times, avoid unlimited retries (小秦)
  • 92f5e4c
    #​170 fix(errors): Fix
    "TypeError: err.code.match is not a function" error
    (@​jviotti)
• 8bd8e909f cacache@11.3.3
  (@​isaacs)
  • 47de8f5
    #​146
    npm.community#​2395 fix(config): Add
    ssri config 'error' option (@​larsgw)
  • 5156561
    fix(write): avoid a cb never called situation
    (@​zkat)
  • 90f40f0
    #​166
    #​165 docs: Fix docs for
    path property in get.info
    (@​hdgarrood)
• bf61c45c6 bluebird@3.5.5
  (@​isaacs)
• f75d46a9d tar@4.4.10
  (@​isaacs)
  • c80341a
    #​215 Fix
    encoding/decoding of base-256 numbers
    (@​justfalter)
  • 77522f0
    #​204
    #​214 Use stat instead
    of lstat when checking CWD (@​stkb)
• ec6236210
  npm-packlist@1.4.4 (@​isaacs)
  • 63d1e3e
    #​30 Sort package
    tarball entries by file type for compression benefits
    (@​isaacs)
  • 7fcd045
    Ignore .DS_Store files as well as folders
    (@​isaacs)
  • 68b7c96 Never
    include .git folders in package root. (Note: this prevents the issue
    that broke the v6.9.1 release.)
    (@​isaacs)
• 57bef61bc update fstream
  in node-gyp (@​isaacs)
  • Addresses security advisory
    #​886
• acbbf7eee
  #​183 licensee@7.0.2
  (@​kemitchell)
• 011ae67f0
  readable-stream@3.3.0 (@​isaacs)
• f5e884909
  npm-registry-mock@1.2.1 (@​isaacs)
• b57d07e35
  npm-registry-couchapp@2.7.2 (@​isaacs)

v6.9.2

Compare Source

This release is identical to v6.9.1, but we had to publish a new version
due to a .git directory in the release.

v6.9.0

Compare Source

FEATURES

• 2ba3a0f67
  #​90
  Time traveling installs using the --before flag.
  (@​zkat)
• b7b54f2d1
  #​3
  Add support for package aliases. This allows packages to be installed under a
  different directory than the package name listed in package.json, and adds a
  new dependency type to allow this to be done for registry dependencies.
  (@​zkat)
• 684bccf06
  #​146
  Always save package-lock.json when using --package-lock-only.
  (@​aeschright)
• b8b8afd40
  #​139
  Make empty-string run-scripts run successfully as a no-op.
  (@​vlasy)
• 8047b19b1
  npm.community#​3784
  Match git semver ranges when flattening the tree.
  (@​larsgw)
• e135c2bb3
  npm.community#​1725
  Re-enable updating local packages.
  (@​larsgw)

BUGFIXES

• cf09fbaed
  #​153
  Set modified to undefined in npm view when time is not available. This
  fixes a bug where npm view would crash on certain third-party registries.
  (@​simonua)
• 774fc26ee
  #​154
  Print out tar version in install.sh only when the flag is supported not all
  the tar implementations support --version flag. This allows the install script
  to work in OpenBSD, for example.
  (@​agudulin)
• 863baff11
  #​158
  Fix typo in error message for npm stars.
  (@​phihag)
• a805a95ad
  npm.community#​4227
  Strip version info from pkg on E404. This improves the error messaging format.
  (@​larsgw)

DOCS

• 5d7633833
  #​160
  Add npm add as alias to npm install in docs.
  (@​ahasall)
• [489c2211c](https://togithub.com/npm/cli/commit/489c2211c96