v6.11.3

6.11.3 (2019-09-03):

Fix npm ci regressions and npm outdated depth.

BUG FIXES

• 235ed1d28#239 Don't override user specified depth in outdated. Restores ability to update packages using --depth as suggested by npm audit. (@G-Rath)
• 1fafb5151#242 npm.community#9586 Revert "install: do not descend into directory deps' child modules" (@isaacs)
• cebf542e6#243 npm.community#9720 ci: pass appropriate configs for file/dir modes (@isaacs)

DEPENDENCIES

• e5fbb7ed1 read-cmd-shim@1.0.4 (@claudiahdz)
• 23ce65616 npm-pick-manifest@3.0.2 (@claudiahdz)

v6.11.2

6.11.2 (2019-08-22):

Fix a recent Windows regression, and two long-standing Windows bugs. Also, get CI running on Windows, so these things are less likely in the future.

DEPENDENCIES

• 9778a1b87 cmd-shim@3.0.3: Fix regression where shims fail to preserve exit code (@isaacs)
• bf93e91d8 npm-package-arg@6.1.1: Properly handle git+file: urls on Windows when a drive letter is included. (@isaacs)

BUGFIXES

• 6cc4cc66f escape args properly on Windows Bash Despite being bash, Node.js running on windows git mingw bash still executes child processes using cmd.exe. As a result, arguments in this environment need to be escaped in the style of cmd.exe, not bash. (@isaacs)

TESTS

• 291aba7b8 make tests pass on Windows (@isaacs)
• fea3a023a travis: run tests on Windows as well (@isaacs)

v6.11.1

6.11.1 (2019-08-20):

Fix a regression for windows command shim syntax.

• 37db29647 cmd-shim@3.0.2 (@isaacs)

v6.11.0

v6.11.0 (2019-08-20):

A few meaty bugfixes, and introducing peerDependenciesMeta.

FEATURES

• a12341088 #224 Implements peerDependenciesMeta (@arcanis)
• 2f3b79bba #234 add new forbidden 403 error code (@claudiahdz)

BUGFIXES

• 24acc9fc8 and 45772af0d #217 npm.community#8863 npm.community#9327 do not descend into directory deps' child modules, fix shrinkwrap files that inappropriately list child nodes of symlink packages (@isaacs and @salomvary)
• 50cfe113d #229 fixed typo in semver doc (@gall0ws)
• e8fb2a1bd #231 Fix spelling mistakes in CHANGELOG-3.md (@XhmikosR)
• 769d2e057 npm/uid-number#7 Better error on invalid --user/--group configs. This addresses the issue when people fail to install binary packages on Docker and other environments where there is no 'nobody' user. (@isaacs)
• 8b43c9624 nodejs/node#28987 npm.community#6032 npm.community#6658 npm.community#6069 npm.community#9323 Fix the regression where random config values in a .npmrc file are not passed to lifecycle scripts, breaking build processes which rely on them. (@isaacs)
• 8b85eaa47 save files with inferred ownership rather than relying on SUDO_UID and SUDO_GID. (@isaacs)
• b7f6e5f02 Infer ownership of shrinkwrap files (@isaacs)
• 54b095d77 #235 Add spec to dist-tag remove function (@theberbie)

DEPENDENCIES

• dc8f9e52f pacote@9.5.7: Infer the ownership of all unpacked files in node_modules, so that we never have user-owned files in root-owned folders, or root-owned files in user-owned folders. (@isaacs)
• bb33940c3 cmd-shim@3.0.0:
  • 9c93ac3 #2 npm#3380 Handle environment variables properly (@basbossink)
  • 2d277f8 #25 #36 #35 Fix 'no shebang' case by always providing $basedir in shell script (@igorklopov)
  • adaf20b #26 Fix $* causing an error when arguments contain parentheses (@satazor)
  • 49f0c13 #30 Fix paths for MSYS/MINGW bash (@dscho)
  • 51a8af3 #34 Add proper support for PowerShell (@ExE-Boss)
  • 4c37e04 #10 Work around quoted batch file names (@isaacs)
• a4e279544 npm-lifecycle@3.1.3 (@isaacs):
  • fail properly if uid-number raises an error
• 7086a1809 libcipm@4.0.3 (@isaacs)
• 8845141f9 read-package-json@2.1.0 (@isaacs)
• 51c028215 bin-links@1.1.3 (@isaacs)
• 534a5548c read-cmd-shim@1.0.3 (@isaacs)
• 3038f2fd5 gentle-fs@2.2.1 (@isaacs)
• a609a1648 graceful-fs@4.2.2 (@isaacs)
• f0346f754 cacache@12.0.3 (@isaacs)
• ca9c615c8 npm-pick-manifest@3.0.0 (@isaacs)
• b417affbf pacote@9.5.8 (@isaacs)

TESTS

• b6df0913c #228 Proper handing of /usr/bin/node lifecycle-path test (@olivr70)
• aaf98e88c npm-registry-mock@1.3.0 (@isaacs)

v6.10.3

v6.10.3 (2019-08-06):

BUGFIXES

• 27cccfbda #223 vulns → vulnerabilities in npm audit output (@sapegin)
• d5e865eb7 #222 #226 install, doctor: don't crash if registry unset (@dmitrydvorkin, @isaacs)
• 5b3890226 #227 npm.community#9167 Handle unhandledRejections, tell user what to do when encountering an EACCES error in the cache. (@isaacs)

DEPENDENCIES

• 77516df6e licensee@7.0.3 (@isaacs)
• ceb993590 query-string@6.8.2 (@isaacs)
• 4050b9189 hosted-git-info@2.8.2
  • #46 #43 #47 #44 Add support for GitLab subgroups (@mterrel, @isaacs, @ybiquitous)
  • 3b1d629 #48 fix http protocol using sshurl by default (@fengmk2)
  • 5d4a8d7 ignore noCommittish on tarball url generation (@isaacs)
  • 1692435 use gist tarball url that works for anonymous gists (@isaacs)
  • d5cf830 Do not allow invalid gist urls (@isaacs)
  • e518222 Use LRU cache to prevent unbounded memory consumption (@iarna)

v6.10.2

v6.10.2 (2019-07-23):

tl;dr - Fixes several issues with the cache when npm is run as sudo on Unix systems.

TESTING

• 2a78b96f8 check test cache for root-owned files (@isaacs)
• 108646ebc run sudo tests on Travis-CI (@isaacs)
• cf984e946 set --no-esm tap flag (@isaacs)
• 8e0a3100d add script to run tests and leave fixtures for inspection and debugging (@isaacs)

BUGFIXES

• 25f4f73f6 add a util for writing arbitrary files to cache This prevents metrics timing and debug logs from becoming root-owned. (@isaacs)
• 2c61ce65d infer cache owner from parent dir in correct-mkdir util (@isaacs)
• 235e5d6df ensure correct owner on cached all-packages metadata (@isaacs)
• e2d377bb6 npm.community#8540 audit: report server error on failure (@isaacs)
• 52576a39e #216 npm.community#5385 npm.community#6076 Fix npm ci with file: dependencies. Partially reverts #40/#86, recording dependencies of linked deps in order for npm ci to work. (@jfirebaugh)

DEPENDENCIES

• 0fefdee13 cacache@12.0.2 (@isaacs)
  • infer uid/gid instead of accepting as options, preventing the overwhelming majority of cases where root-owned files end up in the cache folder. (ac84d14) (@isaacs) (#1)
  • i18n: add another error message (676cb32) (@zkat)
• e1d87a392 pacote@9.5.4 (@isaacs)
  • git: ensure stream failures are reported (7f07b5d) #1 (@lddubeau)
• 3f035bf09 infer-owner@1.0.4 (@isaacs)
• ba3283112 npm-registry-fetch@4.0.0 (@isaacs)
• ee90c334d libnpm@3.0.1 (@isaacs)
• 1e480c384 libnpmaccess@3.0.2 (@isaacs)
• 7662ee850 libnpmhook@5.0.3 (@isaacs)
• 1357fadc6 libnpmorg@1.0.1 (@isaacs)
• a621b5cb6 libnpmsearch@2.0.2 (@isaacs)
• 560cd31dd libnpmteam@1.0.2 (@isaacs)
• de7ae0867 npm-profile@4.0.2 (@isaacs)
• e95da463c libnpm@3.0.1 (@isaacs)
• 554b641d4 npm-registry-fetch@4.0.0 (@isaacs)
• 06772f34a node-gyp@5.0.3 (@isaacs)
• 85358db80 npm-lifecycle@3.1.2 (@isaacs)
  • 051cf20 #26 fix switches for alternative shells on Windows (@gucong3000)
  • 3aaf954 #25 set only one PATH env variable for child process on Windows (@zkochan)
  • ea18ed2 #36 #11 #18 remove procInterrupt listener on SIGINT in procError (@mattshin)
  • 5523951 #29 #30 Use platform specific path casing if present (@mattezell)

v6.10.1

BUGFIXES

• 3cbd57712 fix(git): strip GIT environs when running git (@isaacs)
• a81a8c4c4 #206 improve isOnly(Dev,Optional) (@larsgw)
• 172f9aca6 #179 fix-xmas-underline (@raywu0123)
• f52673fc7 #212 build: use /usr/bin/env to load bash (@rsmarples)

DEPENDENCIES

• ef4445ad3 #208 node-gyp@5.0.2 (@irega)
• c0d611356 npm-lifecycle@3.0.0 (@isaacs)
• 7716ba972 libcipm@4.0.0 (@isaacs)
• 42d22e837 libnpm@3.0.0 (@isaacs)
• a2ea7f9ff semver@5.7.0 (@isaacs)
• 429226a5e lru-cache@5.1.1 (@isaacs)
• 175670ea6 npm-registry-fetch@3.9.1: (@isaacs)
• 0d0517f7f call-limit@1.1.1 (@isaacs)
• 741400429 glob@7.1.4 (@isaacs)
• bddd60e30 inherits@2.0.4 (@isaacs)
• 4acf03fd1 libnpmsearch@2.0.1 (@isaacs)
• c2bd17291 marked@0.6.3 (@isaacs)
• 7f0221bb1 marked-man@0.6.0 (@isaacs)
• f458fe7dd npm-lifecycle@2.1.1 (@isaacs)
• 009752978 node-gyp@4.0.0 (@isaacs)
• 0fa2bb438 query-string@6.8.1 (@isaacs)
• b86450929 tar-stream@2.1.0 (@isaacs)
• 25db00fe9 worker-farm@1.7.0 (@isaacs)
• 8dfbe8610 readable-stream@3.4.0 (@isaacs)
• f6164d5dd isaacs/chownr#21 isaacs/chownr#20 npm.community#7901 npm.community#8203 chownr@1.1.2 This fixes an EISDIR error from cacache on Darwin in Node versions prior to 10.6. (@isaacs)

v6.10.0

FEATURES

• 87fef4e35 #176 fix: Always return JSON for outdated --json (@sreeramjayan)
• f101d44fc #203 fix(unpublish): add space after hyphen (@ffflorian)
• a4475de4c #202 enable production flag for npm audit (@CalebCourier)
• d192904d0 #178 fix: Return a value for view when in silent mode (@stayradiated)
• 39d473adf #185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

• d9238af0b #201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
• 4bec4f111 #200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
• ce93dab2d #180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

• a823f3084 travis: Update to include new v12 LTS (@isaacs)
• 33e2d1dac fix flaky debug-logs test (@isaacs)
• e9411c6cd Don't time out waiting for gpg user input (@isaacs)
• d2d301704 #195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
• a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

• f5857e263 #192 Clarify usage of bundledDependencies (@john-osullivan)
• 747fdaf66 #159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

• e36b3c320 graceful-fs@4.2.0 (@isaacs)
• 6bb935c09 read-package-tree@5.3.1 (@isaacs)
  • e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
• 39538b460 write-file-atomic@2.4.3 (@isaacs)
  • f8b1552 #38 Ignore errors raised by fs.closeSync (@lukeapage)
• 042193069 pacote@9.5.1 (@isaacs)
  • 8bbd051 #172 limit git retry times, avoid unlimited retries (小秦)
  • 92f5e4c #170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
• 8bd8e909f cacache@11.3.3 (@isaacs)
  • 47de8f5 #146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
  • 5156561 fix(write): avoid a cb never called situation (@zkat)
  • 90f40f0 #166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
• bf61c45c6 bluebird@3.5.5 (@isaacs)
• f75d46a9d tar@4.4.10 (@isaacs)
  • c80341a #215 Fix encoding/decoding of base-256 numbers (@justfalter)
  • 77522f0 #204 #214 Use stat instead of lstat when checking CWD (@stkb)
• ec6236210 npm-packlist@1.4.4 (@isaacs)
  • 63d1e3e #30 Sort package tarball entries by file type for compression benefits (@isaacs)
  • 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
  • 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
• 57bef61bc update fstream in node-gyp (@isaacs)
  • Addresses security advisory #886
• acbbf7eee #183 licensee@7.0.2 (@kemitchell)
• 011ae67f0 readable-stream@3.3.0 (@isaacs)
• f5e884909 npm-registry-mock@1.2.1 (@isaacs)
• b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

v6.10.0-next.0

FEATURES

• 87fef4e35 #176 fix: Always return JSON for outdated --json (@sreeramjayan)
• f101d44fc #203 fix(unpublish): add space after hyphen (@ffflorian)
• a4475de4c #202 enable production flag for npm audit (@CalebCourier)
• d192904d0 #178 fix: Return a value for view when in silent mode (@stayradiated)
• 39d473adf #185 Allow git to follow global tagsign config (@junderw)

BUGFIXES

• d9238af0b #201 npm/npm#17858 npm/npm#18042 npm.community#644 do not crash when removing nameless packages (@SteveVanOpstal and @isaacs)
• 4bec4f111 #200 Check for node (as well as node.exe) in npm's local dir on Windows (@rgoulais)
• ce93dab2d #180 npm.community#6187 Fix handling of remote deps in npm outdated (@larsgw)

TESTING

• a823f3084 travis: Update to include new v12 LTS (@isaacs)
• 33e2d1dac fix flaky debug-logs test (@isaacs)
• e9411c6cd Don't time out waiting for gpg user input (@isaacs)
• d2d301704 #195 Add the arm64 check for legacy-platform-all.js test case. (@ossdev07)
• a4dc34243 parallel tests (@isaacs)

DOCUMENTATION

• f5857e263 #192 Clarify usage of bundledDependencies (@john-osullivan)
• 747fdaf66 #159 doc: add --audit-level param (@ngraef)

DEPENDENCIES

• e36b3c320 graceful-fs@4.2.0 (@isaacs)
• 6bb935c09 read-package-tree@5.3.1 (@isaacs)
  • e9cd536 Use custom caching realpath implementation, dramatically reducing lstat calls when reading the package tree (@isaacs)
• 39538b460 write-file-atomic@2.4.3 (@isaacs)
  • f8b1552 #38 Ignore errors raised by fs.closeSync (@lukeapage)
• 042193069 pacote@9.5.1 (@isaacs)
  • 8bbd051 #172 limit git retry times, avoid unlimited retries (小秦)
  • 92f5e4c #170 fix(errors): Fix "TypeError: err.code.match is not a function" error (@jviotti)
• 8bd8e909f cacache@11.3.3 (@isaacs)
  • 47de8f5 #146 npm.community#2395 fix(config): Add ssri config 'error' option (@larsgw)
  • 5156561 fix(write): avoid a cb never called situation (@zkat)
  • 90f40f0 #166 #165 docs: Fix docs for path property in get.info (@hdgarrood)
• bf61c45c6 bluebird@3.5.5 (@isaacs)
• f75d46a9d tar@4.4.10 (@isaacs)
  • c80341a #215 Fix encoding/decoding of base-256 numbers (@justfalter)
  • 77522f0 #204 #214 Use stat instead of lstat when checking CWD (@stkb)
• ec6236210 npm-packlist@1.4.4 (@isaacs)
  • 63d1e3e #30 Sort package tarball entries by file type for compression benefits (@isaacs)
  • 7fcd045 Ignore .DS_Store files as well as folders (@isaacs)
  • 68b7c96 Never include .git folders in package root. (Note: this prevents the issue that broke the v6.9.1 release.) (@isaacs)
• 57bef61bc update fstream in node-gyp (@isaacs)
  • Addresses security advisory #886
• acbbf7eee #183 licensee@7.0.2 (@kemitchell)
• 011ae67f0 readable-stream@3.3.0 (@isaacs)
• f5e884909 npm-registry-mock@1.2.1 (@isaacs)
• b57d07e35 npm-registry-couchapp@2.7.2 (@isaacs)

v6.9.2

This release is identical to v6.9.1, but we had to publish a new version due to a .git directory in the release.