deps: update npm to 5.5.1

Closes: #16280

PR-URL: #16509
Fixes: #14161
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Michaël Zasso <targos@protonmail.com>

deps/npm/CHANGELOG.md

@@ -1,3 +1,118 @@
+## v5.5.1 (2017-10-04):
+
+A very quick, record time, patch release, of a bug fix to a (sigh) last minute bug fix.
+
+* [`e628e058b`](https://github.com/npm/npm/commit/e628e058b)
+ Fix login to properly recognize OTP request and store bearer tokens.
+ ([@Rebecca Turner](https://github.com/Rebecca Turner))
+
+## v5.5.0 (2017-10-04):
+
+Hey y'all, this is a big new feature release! We've got some security
+related goodies plus a some quality-of-life improvements for anyone who uses
+the public registry (so, virtually everyone).
+
+The changes largely came together in one piece, so I'm just gonna leave the commit line here:
+
+* [`f6ebf5e8b`](https://github.com/npm/npm/commit/f6ebf5e8bd6a212c7661e248c62c423f2b54d978)
+ [`f97ad6a38`](https://github.com/npm/npm/commit/f97ad6a38412581d059108ea29be470acb4fa510)
+ [`f644018e6`](https://github.com/npm/npm/commit/f644018e6ef1ff7523c6ec60ae55a24e87a9d9ae)
+ [`8af91528c`](https://github.com/npm/npm/commit/8af91528ce6277cd3a8c7ca8c8102671baf10d2f)
+ [`346a34260`](https://github.com/npm/npm/commit/346a34260b5fba7de62717135f3e083cc4820853)
+ Two factor authentication, profile editing and token management.
+ ([@iarna](https://github.com/iarna))
+
+### TWO FACTOR AUTHENTICATION
+
+You can now enable two-factor authentication for your npm account. You can
+even do it from the CLI. In fact, you have to, for the time being:
+
+```
+npm profile enable-tfa
+```
+
+With the default two-factor authentication mode you'll be prompted to enter
+a one-time password when logging in, when publishing and when modifying access rights to
+your modules.
+
+### TOKEN MANAGEMENT
+
+You can now create, list and delete authentication tokens from the comfort
+of the command line. Authentication tokens created this way can have NEW
+restrictions placed on them. For instance, you can create a `read-only`
+token to give to your CI. It will be able to download your private modules
+but it won't be able to publish or modify modules. You can also create
+tokens that can only be used from certain network addresses. This way you
+can lock down access to your corporate VPN or other trusted machines.
+
+Deleting tokens isn't new, you could [do it via the
+website](https://www.npmjs.com/settings/tokens) but now you can do it via
+the CLI as well.
+
+### CHANGE YOUR PASSWORD, SET YOUR EMAIL
+
+You can finally change your password from the CLI with `npm profile set
+password`! You can also update your email address with `npm profile set
+email <address>`. If you change your email address we'll send you a new
+verification email so you verify that its yours.
+
+### AND EVERYTHING ELSE ON YOUR PROFILE
+
+You can also update all of the other attributes of your profile that
+previously you could only update via the website: `fullname`, `homepage`,
+`freenode`, `twitter` and `github`.
+
+### AVAILABLE STAND ALONE
+
+All of these features were implemented in a stand alone library, so if you
+have use for them in your own project you can find them in
+[npm-profile](https://www.npmjs.com/package/npm-profile) on the registry.
+There's also a little mini-cli written just for it at
+[npm-profile-cli](https://www.npmjs.com/package/npm-profile-cli). You might
+also be interested in the [API
+documentation](https://github.com/npm/registry/tree/master/docs) for these
+new features: [user profile editing](https://github.com/npm/registry/blob/master/docs/user/profile.md) and
+[authentication](https://github.com/npm/registry/blob/master/docs/user/authentication.md).
+
+### BUG FIXES
+
+* [`5ee55dc71`](https://github.com/npm/npm/commit/5ee55dc71b8b74b8418c3d5ec17483a07b3b6777)
+ install.sh: Drop support for upgrading from npm@1 as npm@5 can't run on
+ any Node.js version that ships npm@1. This fixes an issue some folks were seeing when trying
+ to upgrade using `curl | http://npmjs.com/install.sh`.
+ ([@iarna](https://github.com/iarna))
+* [`5cad1699a`](https://github.com/npm/npm/commit/5cad1699a7a0fc85ac7f77a95087a9647f75e344)
+ `npm-lifecycle@1.0.3` Fix a bug where when more than one lifecycle script
+ got queued to run, npm would crash.
+ ([@zkat](https://github.com/zkat))
+* [`cd256cbb2`](https://github.com/npm/npm/commit/cd256cbb2f97fcbcb82237e94b66eac80e493626)
+ `npm-packlist@1.1.9` Fix a bug where test directories would always be
+ excluded from published modules.
+ ([@isaacs](https://github.com/isaacs))
+* [`2a11f0215`](https://github.com/npm/npm/commit/2a11f021561acb1eb1ad4ad45ad955793b1eb4af)
+ Fix formatting of unsupported version warning
+ ([@iarna](https://github.com/iarna))
+
+### DEPENDENCY UPDATES
+
+* [`6d2a285a5`](https://github.com/npm/npm/commit/6d2a285a58655f10834f64d38449eb1f3c8b6c47)
+ `npm-registry-client@8.5.0`
+* [`69e64e27b`](https://github.com/npm/npm/commit/69e64e27bf58efd0b76b3cf6e8182c77f8cc452f)
+ `request@2.83.0`
+* [`34e0f4209`](https://github.com/npm/npm/commit/34e0f42090f6153eb5462f742e402813e4da56c8)
+ `abbrev@1.1.1`
+* [`10d31739d`](https://github.com/npm/npm/commit/10d31739d39765f1f0249f688bd934ffad92f872)
+ `aproba@1.2.0`
+* [`2b02e86c0`](https://github.com/npm/npm/commit/2b02e86c06cf2a5fe7146404f5bfd27f190ee4f4)
+ `meant@1.0.1`
+* [`b81fff808`](https://github.com/npm/npm/commit/b81fff808ee269361d3dcf38c1b6019f1708ae02)
+ `rimraf@2.6.2`:
+ Fixes a long standing bug in rimraf's attempts to work around Windows limitations
+ where it owns a file and can change its perms but can't remove it without
+ first changing its perms. This _may_ be an improvement for Windows users of npm under
+ some circumstances.
+ ([@isaacs](https://github.com/isaacs))
+
 ## v5.4.2 (2017-09-14):
 
 This is a small bug fix release wrapping up most of the issues introduced with 5.4.0.

deps/npm/doc/cli/npm-access.md

@@ -60,6 +60,9 @@ You must have privileges to set the access of a package:
 * You have been given read-write privileges for a package, either as a member
  of a team or directly as an owner.
 
+If you have two-factor authentication enabled then you'll have to pass in an
+otp with `--otp` when making access changes.
+
 If your account is not paid, then attempts to publish scoped packages will fail
 with an HTTP 402 status code (logically enough), unless you use
 `--access=public`.

deps/npm/doc/cli/npm-dist-tag.md

@@ -15,7 +15,9 @@ Add, remove, and enumerate distribution tags on a package:
 
 * add:
  Tags the specified version of the package with the specified tag, or the
- `--tag` config if not specified.
+ `--tag` config if not specified. The tag you're adding is `latest` and you
+ have two-factor authentication on auth-and-writes then you'll need to include
+ an otp on the command line with `--otp`.
 
 * rm:
  Clear a tag that is no longer in use from the package.

deps/npm/doc/cli/npm-owner.md

@@ -27,6 +27,10 @@ Note that there is only one level of access. Either you can modify a package,
 or you can't. Future versions may contain more fine-grained access levels, but
 that is not implemented at this time.
 
+If you have two-factor authentication enabled with `auth-and-writes` then
+you'll need to include an otp on the command line when changing ownership
+with `--otp`.
+
 ## SEE ALSO
 
 * npm-publish(1)

deps/npm/doc/cli/npm-profile.md

@@ -0,0 +1,74 @@
+npm-profile(1) -- Change settings on your registry profile
+==========================================================
+
+## SYNOPSIS
+
+ npm profile get [--json|--parseable] [<property>]
+ npm profile set [--json|--parseable] <property> <value>
+ npm profile set password
+ npm profile enable-2fa [auth-and-writes|auth-only]
+ npm profile disable-2fa
+
+## DESCRIPTION
+
+Change your profile information on the registry. This not be available if
+you're using a non-npmjs registry.
+
+* `npm profile get [<property>]`:
+ Display all of the properties of your profile, or one or more specific
+ properties. It looks like:
+
+```
++-----------------+---------------------------+
+| name | example |
++-----------------+---------------------------+
+| email | me@example.com (verified) |
++-----------------+---------------------------+
+| two factor auth | auth-and-writes |
++-----------------+---------------------------+
+| fullname | Example User |
++-----------------+---------------------------+
+| homepage | |
++-----------------+---------------------------+
+| freenode | |
++-----------------+---------------------------+
+| twitter | |
++-----------------+---------------------------+
+| github | |
++-----------------+---------------------------+
+| created | 2015-02-26T01:38:35.892Z |
++-----------------+---------------------------+
+| updated | 2017-10-02T21:29:45.922Z |
++-----------------+---------------------------+
+```
+
+* `npm profile set <property> <value>`:
+ Set the value of a profile property. You can set the following properties this way:
+ email, fullname, homepage, freenode, twitter, github
+
+* `npm profile set password`:
+ Change your password. This is interactive, you'll be prompted for your
+ current password and a new password. You'll also be prompted for an OTP
+ if you have two-factor authentication enabled.
+
+* `npm profile enable-2fa [auth-and-writes|auth-only]`:
+ Enables two-factor authentication. Defaults to `auth-and-writes` mode. Modes are:
+ * `auth-only`: Require an OTP when logging in or making changes to your
+ account's authentication. The OTP will be required on both the website
+ and the command line.
+ * `auth-and-writes`: Requires an OTP at all the times `auth-only` does, and also requires one when
+ publishing a module, setting the `latest` dist-tag, or changing access
+ via `npm access` and `npm owner`.
+
+* `npm profile disable-2fa`:
+ Disables two-factor authentication.
+
+## DETAILS
+
+All of the `npm profile` subcommands accept `--json` and `--parseable` and
+will tailor their output based on those. Some of these commands may not be
+available on non npmjs.com registries.
+
+## SEE ALSO
+
+* npm-config(7)

deps/npm/doc/cli/npm-publish.md

@@ -4,7 +4,7 @@ npm-publish(1) -- Publish a package
 
 ## SYNOPSIS
 
- npm publish [<tarball>|<folder>] [--tag <tag>] [--access <public|restricted>]
+ npm publish [<tarball>|<folder>] [--tag <tag>] [--access <public|restricted>] [--otp otpcode]
 
  Publishes '.' if no argument supplied
  Sets tag 'latest' if no --tag specified
@@ -41,6 +41,11 @@ specifying a different default registry or using a `npm-scope(7)` in the name
  If you don't have a paid account, you must publish with `--access public`
  to publish scoped packages.
 
+* `[--otp <otpcode>]`
+ If you have two-factor authentication enabled in `auth-and-writes` mode
+ then you can provide a code from your authenticator with this. If you
+ don't include this and you're running from a TTY then you'll be prompted.
+
 Fails if the package name and version combination already exists in
 the specified registry.
 
@@ -65,3 +70,4 @@ packs them into a tarball to be uploaded to the registry.
 * npm-deprecate(1)
 * npm-dist-tag(1)
 * npm-pack(1)
+* npm-profile(1)

deps/npm/doc/cli/npm-token.md

@@ -0,0 +1,59 @@
+npm-token(1) -- Manage your authentication tokens
+=================================================
+
+## SYNOPSIS
+
+ npm token list [--json|--parseable]
+ npm token create [--read-only] [--cidr=1.1.1.1/24,2.2.2.2/16]
+ npm token delete <id|token>
+
+## DESCRIPTION
+
+This list you list, create and delete authentication tokens.
+
+* `npm token list`:
+ Shows a table of all active authentication tokens. You can request this as
+ JSON with `--json` or tab-separated values with `--parseable`.
+```
++--------+---------+------------+----------+----------------+
+| id | token | created | read-only | CIDR whitelist |
++--------+---------+------------+----------+----------------+
+| 7f3134 | 1fa9ba… | 2017-10-02 | yes | |
++--------+---------+------------+----------+----------------+
+| c03241 | af7aef… | 2017-10-02 | no | 192.168.0.1/24 |
++--------+---------+------------+----------+----------------+
+| e0cf92 | 3a436a… | 2017-10-02 | no | |
++--------+---------+------------+----------+----------------+
+| 63eb9d | 74ef35… | 2017-09-28 | no | |
++--------+---------+------------+----------+----------------+
+| 2daaa8 | cbad5f… | 2017-09-26 | no | |
++--------+---------+------------+----------+----------------+
+| 68c2fe | 127e51… | 2017-09-23 | no | |
++--------+---------+------------+----------+----------------+
+| 6334e1 | 1dadd1… | 2017-09-23 | no | |
++--------+---------+------------+----------+----------------+
+```
+
+* `npm token create [--read-only] [--cidr=<cidr-ranges>]`:
+ Create a new authentication token. It can be `--read-only` or accept a list of
+ [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) ranges to
+ limit use of this token to. This will prompt you for your password, and, if you have
+ two-factor authentication enabled, an otp.
+
+```
++----------------+--------------------------------------+
+| token | a73c9572-f1b9-8983-983d-ba3ac3cc913d |
++----------------+--------------------------------------+
+| cidr_whitelist | |
++----------------+--------------------------------------+
+| readonly | false |
++----------------+--------------------------------------+
+| created | 2017-10-02T07:52:24.838Z |
++----------------+--------------------------------------+
+```
+
+* `npm token delete <token|id>`:
+ This removes an authentication token, making it immediately unusable. This can accept
+ both complete tokens (as you get back from `npm token create` and will
+ find in your `.npmrc`) and ids as seen in the `npm token list` output.
+ This will NOT accept the truncated token found in `npm token list` output.

deps/npm/doc/misc/npm-config.md

@@ -269,6 +269,13 @@ PEM format (Windows calls it "Base-64 encoded X.509 (.CER)") with newlines repla
 
 It is _not_ the path to a certificate file (and there is no "certfile" option).
 
+### cidr
+
+* Default: `null`
+* Type: String, Array, null
+
+This is a list of CIDR address to be used when configuring limited access tokens with the `npm token create` command.
+
 ### color
 
 * Default: true
@@ -699,6 +706,14 @@ Attempt to install packages in the `optionalDependencies` object. Note
 that if these packages fail to install, the overall installation
 process is not aborted.
 
+### otp
+
+* Default: null
+* Type: Number
+
+This is a one-time password from a two-factor authenticator. It's needed
+when publishing or changing package permissions with `npm access`.
+
 ### package-lock
 
 * Default: true
@@ -773,6 +788,13 @@ A proxy to use for outgoing http requests. If the `HTTP_PROXY` or
 `http_proxy` environment variables are set, proxy settings will be
 honored by the underlying `request` library.
 
+### read-only
+
+* Default: false
+* Type: Boolean
+
+This is used to mark a token as unable to publish when configuring limited access tokens with the `npm token create` command.
+
 ### rebuild-bundle
 
 * Default: true

deps/npm/doc/misc/npm-index.md

@@ -129,6 +129,10 @@ Ping npm registry
 
 Display prefix
 
+### npm-profile(1)
+
+Change settings on your registry profile
+
 ### npm-prune(1)
 
 Remove extraneous packages
@@ -189,6 +193,10 @@ Manage organization teams and team memberships
 
 Test a package
 
+### npm-token(1)
+
+Manage your authentication tokens
+
 ### npm-uninstall(1)
 
 Remove a package

deps/npm/html/doc/README.html

@@ -127,5 +127,5 @@ <h2 id="see-also">SEE ALSO</h2>
 <tr><td style="width:60px;height:10px;background:rgb(237,127,127)" colspan=6>&nbsp;</td><td colspan=10 style="width:10px;height:10px;background:rgb(237,127,127)">&nbsp;</td></tr>
 <tr><td colspan=5 style="width:50px;height:10px;background:#fff">&nbsp;</td><td style="width:40px;height:10px;background:rgb(237,127,127)" colspan=4>&nbsp;</td><td style="width:90px;height:10px;background:#fff" colspan=9>&nbsp;</td></tr>
 </table>
-<p id="footer"><a href="../doc/README.html">README</a> &mdash; npm@5.4.2</p>
+<p id="footer"><a href="../doc/README.html">README</a> &mdash; npm@5.5.1</p>
 

deps/npm/html/doc/cli/npm-access.html

@@ -61,6 +61,8 @@ <h2 id="details">DETAILS</h2>
 <li>You have been given read-write privileges for a package, either as a member
 of a team or directly as an owner.</li>
 </ul>
+<p>If you have two-factor authentication enabled then you&#39;ll have to pass in an
+otp with <code>--otp</code> when making access changes.</p>
 <p>If your account is not paid, then attempts to publish scoped packages will fail
 with an HTTP 402 status code (logically enough), unless you use
 <code>--access=public</code>.</p>
@@ -84,5 +86,5 @@ <h2 id="see-also">SEE ALSO</h2>
 <tr><td style="width:60px;height:10px;background:rgb(237,127,127)" colspan=6>&nbsp;</td><td colspan=10 style="width:10px;height:10px;background:rgb(237,127,127)">&nbsp;</td></tr>
 <tr><td colspan=5 style="width:50px;height:10px;background:#fff">&nbsp;</td><td style="width:40px;height:10px;background:rgb(237,127,127)" colspan=4>&nbsp;</td><td style="width:90px;height:10px;background:#fff" colspan=9>&nbsp;</td></tr>
 </table>
-<p id="footer">npm-access &mdash; npm@5.4.2</p>
+<p id="footer">npm-access &mdash; npm@5.5.1</p>