deps: upgrade npm to 6.14.1

Backport-PR-URL: #32527
PR-URL: #31977
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Shelley Vohr <codebytere@gmail.com>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>

deps/npm/AUTHORS

@@ -682,3 +682,9 @@ Zhenya Vinogradov <zhenyavinogradov@gmail.com>
 Rafael Hengles <rhengles@gmail.com>
 Jan-Philip Gehrcke <jp@opstrace.com>
 Caleb Sacks <16855387+clabe45@users.noreply.github.com>
+Kyle Getz <kgetz@arista.com>
+Sean Healy <s@xib.ca>
+Netanel Gilad <netanelg@wix.com>
+Dave Nicolson <david.nicolson@gmail.com>
+Ajay Narain Mathur <ajaynarainmathur@gmail.com>
+Vitaliy Markitanov <9357021+vit100@users.noreply.github.com>

deps/npm/CHANGELOG.md

@@ -1,3 +1,41 @@
+## 6.14.1 (2020-02-26)
+
+* [`303e5c11e`](https://github.com/npm/cli/commit/303e5c11e7db34cf014107aecd2e81c821bfde8d)
+  `hosted-git-info@2.8.7`
+  Fixes a regression where scp-style git urls are passed to the WhatWG URL
+  parser, which does not handle them properly.
+  ([@isaacs](https://github.com/isaacs))
+
+## 6.14.0 (2020-02-25)
+
+### FEATURES
+* [`30f170877`](https://github.com/npm/cli/commit/30f170877954acd036cb234a581e4eb155049b82) [#731](https://github.com/npm/cli/pull/731) add support for multiple funding sources ([@ljharb](https://github.com/ljharb) & [@ruyadorno](hhttps://github.com/ruyadorno/))
+
+### BUG FIXES
+* [`55916b130`](https://github.com/npm/cli/commit/55916b130ef52984584678f2cc17c15c1f031cb5) [#508](https://github.com/npm/cli/pull/508) fix: check `npm.config` before accessing its members ([@kaiyoma](https://github.com/kaiyoma))
+* [`7d0cd65b2`](https://github.com/npm/cli/commit/7d0cd65b23c0986b631b9b54d87bbe74902cc023) [#733](https://github.com/npm/cli/pull/733) fix: access grant with unscoped packages ([@netanelgilad](https://github.com/netanelgilad))
+* [`28c3d40d6`](https://github.com/npm/cli/commit/28c3d40d65eef63f9d6ccb60b99ac57f5057a46e), [`0769c5b20`](https://github.com/npm/cli/commit/30f170877954acd036cb234a581e4eb155049b82) [#945](https://github.com/npm/cli/pull/945), [#697](https://github.com/npm/cli/pull/697) fix: allow new major versions of node to be automatically considered "supported" ([@isaacs](https://github.com/isaacs), [@ljharb](https://github.com/ljharb))
+
+### DEPENDENCIES
+* [`6f39e93`](https://github.com/npm/hosted-git-info/commit/6f39e93bae9162663af6f15a9d10bce675dd5de3) `hosted-git-info@2.8.6` ([@darcyclarke](https://github.com/darcyclarke))
+  * fix: passwords & usernames are escaped properly in git deps ([@stevenhilder](https://github.com/stevenhilder))
+* [`f14b594ee`](https://github.com/npm/cli/commit/f14b594ee9dbfc98ed0b65c65d904782db4f31ad) `chownr@1.1.4` ([@isaacs](https://github.com/isaacs))
+* [`77044150b`](https://github.com/npm/cli/commit/77044150b763d67d997f9ff108219132ea922678) `npm-packlist@1.4.8` ([@isaacs](https://github.com/isaacs))
+* [`1d112461a`](https://github.com/npm/cli/commit/1d112461ad8dc99e5ff7fabb5177e8c2f89a9755) `npm-registry-fetch@4.0.3` ([@isaacs](https://github.com/isaacs))
+  * [`ba8b4fe`](https://github.com/npm/npm-registry-fetch/commit/ba8b4fe60eb6cdf9b39012560aec596eda8ce924) fix: always bypass cache when ?write=true
+* [`a47fed760`](https://github.com/npm/cli/commit/a47fed7603a6ed31dcc314c0c573805f05a96830) `readable-stream@3.6.0`
+  * [`3bbf2d6`](https://github.com/nodejs/readable-stream/commit/3bbf2d6feb45b03f4e46a2ae8251601ad2262121) fix: babel's "loose mode" class transform enbrittles BufferList ([@ljharb](https://github.com/ljharb))
+
+### DOCUMENTATION
+* [`284c1c055`](https://github.com/npm/cli/commit/284c1c055a28c4b334496101799acefe3c54ceb3), [`fbb5f0e50`](https://github.com/npm/cli/commit/fbb5f0e50e54425119fa3f03c5de93e4cb6bfda7) [#729](https://github.com/npm/cli/pull/729) update lifecycle hooks docs
+  ([@seanhealy](https://github.com/seanhealy), [@mikemimik](https://github.com/mikemimik))
+* [`1c272832d`](https://github.com/npm/cli/commit/1c272832d048300e409882313305c416dc6f21a2) [#787](https://github.com/npm/cli/pull/787) fix: trademarks typo ([@dnicolson](https://github.com/dnicolson))
+* [`f6ff41776`](https://github.com/npm/cli/commit/f6ff417767d52418cc8c9e7b9731ede2c3916d2e) [#936](https://github.com/npm/cli/pull/936) fix: postinstall example ([@ajaymathur](https://github.com/ajaymathur))
+* [`373224b16`](https://github.com/npm/cli/commit/373224b16e019b7b63d8f0b4c5d4adb7e5cb80dd) [#939](https://github.com/npm/cli/pull/939) fix: bad links in publish docs ([@vit100](https://github.com/vit100))
+
+### MISCELLANEOUS
+* [`85c79636d`](https://github.com/npm/cli/commit/85c79636df31bac586c0e380c4852ee155a7723c) [#736](https://github.com/npm/cli/pull/736) add script to update dist-tags ([@mikemimik](https://github.com/mikemimik))
+
 ## 6.13.7 (2020-01-28)
 
 ### BUG FIXES

deps/npm/docs/content/cli-commands/npm-fund.md

@@ -21,7 +21,8 @@ a given project. If no package name is provided, it will list all
 dependencies that are looking for funding in a tree-structure in which
 are listed the type of funding and the url to visit. If a package name
 is provided then it tries to open its funding url using the `--browser`
-config param.
+config param; if there are multiple funding sources for the package, the
+user will be instructed to pass the `--which` command to disambiguate.
 
 The list will avoid duplicated entries and will stack all packages
 that share the same type/url as a single entry. Given this nature the
@@ -38,8 +39,8 @@ The browser that is called by the `npm fund` command to open websites.
 
 #### json
 
-* Default: false
 * Type: Boolean
+* Default: false
 
 Show information in JSON format.
 
@@ -51,6 +52,13 @@ Show information in JSON format.
 Whether to represent the tree structure using unicode characters.
 Set it to `false` in order to use all-ansi output.
 
+#### which
+
+* Type: Number
+* Default: undefined
+
+If there are multiple funding sources, which 1-indexed source URL to open.
+
 ## See Also
 
 * [npm docs](/cli-commands/npm-docs)

deps/npm/docs/content/cli-commands/npm-publish.md

@@ -73,9 +73,9 @@ included and packs them into a tarball to be uploaded to the registry.
 
 * [npm registry](/using-npm/registry)
 * [npm scope](/using-npm/scope)
-* [npm adduser](/cli-commands/npm-adduser)
-* [npm owner](/cli-commands/npm-owner)
-* [npm deprecate](/cli-commands/npm-deprecate)
-* [npm dist-tag](/cli-commands/npm-dist-tag)
-* [npm pack](/cli-commands/npm-pack)
-* [npm profile](/cli-commands/npm-profile)
+* [npm adduser](/cli-commands/adduser)
+* [npm owner](/cli-commands/owner)
+* [npm deprecate](/cli-commands/deprecate)
+* [npm dist-tag](/cli-commands/dist-tag)
+* [npm pack](/cli-commands/pack)
+* [npm profile](/cli-commands/profile)

deps/npm/docs/content/configuring-npm/package-json.md

@@ -197,7 +197,8 @@ npm also sets a top-level "maintainers" field with your npm user info.
 ### funding
 
 You can specify an object containing an URL that provides up-to-date
-information about ways to help fund development of your package:
+information about ways to help fund development of your package, or
+a string URL, or an array of these:
 
     "funding": {
       "type" : "individual",
@@ -209,10 +210,26 @@ information about ways to help fund development of your package:
       "url" : "https://www.patreon.com/my-account"
     }
 
+    "funding": "http://example.com/donate"
+
+    "funding": [
+      {
+        "type" : "individual",
+        "url" : "http://example.com/donate"
+      },
+      "http://example.com/donateAlso",
+      {
+        "type" : "patreon",
+        "url" : "https://www.patreon.com/my-account"
+      }
+    ]
+
+
 Users can use the `npm fund` subcommand to list the `funding` URLs of all
 dependencies of their project, direct and indirect. A shortcut to visit each
 funding url is also available when providing the project name such as:
-`npm fund <projectname>`.
+`npm fund <projectname>` (when there are multiple URLs, the first one will be
+visited)
 
 ### files
 

deps/npm/docs/content/using-npm/disputes.md

@@ -105,7 +105,7 @@ If you see bad behavior like this, please report it to <abuse@npmjs.com> right
 away. **You are never expected to resolve abusive behavior on your own. We are
 here to help.**
 
-### Trademarkss
+### Trademarks
 
 If you think another npm publisher is infringing your trademark, such as by
 using a confusingly similar package name, email <abuse@npmjs.com> with a link to

deps/npm/docs/content/using-npm/scripts.md

@@ -10,90 +10,64 @@ description: How npm handles the "scripts" field
 
 ### Description
 
-npm supports the "scripts" property of the package.json file, for the
-following scripts:
-
-* **prepublish** (_as of npm@5, `prepublish` is deprecated. Use `prepare` for build steps and `prepublishOnly` for upload-only._):
-  Run BEFORE the package is packed and published, as well as on local `npm
-  install` without any arguments. (See below)
-* **prepare**:
-  Run both BEFORE the package is packed and published, on local `npm
-  install` without any arguments, and when installing git dependencies (See
-  below). This is run AFTER `prepublish`, but BEFORE `prepublishOnly`.
-* **prepublishOnly**:
-  Run BEFORE the package is prepared and packed, ONLY on `npm publish`. (See
-  below.)
-* **prepack**:
-  run BEFORE a tarball is packed (on `npm pack`, `npm publish`, and when
-  installing git dependencies)
-* **postpack**:
-  Run AFTER the tarball has been generated and moved to its final destination.
-* **publish**, **postpublish**:
-  Run AFTER the package is published.
-* **preinstall**:
-  Run BEFORE the package is installed
-* **install**, **postinstall**:
-  Run AFTER the package is installed.
-* **preuninstall**, **uninstall**:
-  Run BEFORE the package is uninstalled.
-* **postuninstall**:
-  Run AFTER the package is uninstalled.
-* **preversion**:
-  Run BEFORE bumping the package version.
-* **version**:
-  Run AFTER bumping the package version, but BEFORE commit.
-* **postversion**:
-  Run AFTER bumping the package version, and AFTER commit.
-* **pretest**, **test**, **posttest**:
-  Run by the `npm test` command.
-* **prestop**, **stop**, **poststop**:
-  Run by the `npm stop` command.
-* **prestart**, **start**, **poststart**:
-  Run by the `npm start` command.
-* **prerestart**, **restart**, **postrestart**:
-  Run by the `npm restart` command. Note: `npm restart` will run the
-  stop and start scripts if no `restart` script is provided.
-* **preshrinkwrap**, **shrinkwrap**, **postshrinkwrap**:
-  Run by the `npm shrinkwrap` command.
-
-Additionally, arbitrary scripts can be executed by running `npm
-run-script <stage>`. *Pre* and *post* commands with matching
-names will be run for those as well (e.g. `premyscript`, `myscript`,
-`postmyscript`). Scripts from dependencies can be run with 
-`npm explore <pkg> -- npm run <stage>`.
-
-#### Prepublish and Prepare
-
-#### Deprecation Note
-
-Since `npm@1.1.71`, the npm CLI has run the `prepublish` script for both `npm
-publish` and `npm install`, because it's a convenient way to prepare a package
-for use (some common use cases are described in the section below).  It has
-also turned out to be, in practice, [very
-confusing](https://github.com/npm/npm/issues/10074).  As of `npm@4.0.0`, a new
-event has been introduced, `prepare`, that preserves this existing behavior. A
-_new_ event, `prepublishOnly` has been added as a transitional strategy to
-allow users to avoid the confusing behavior of existing npm versions and only
-run on `npm publish` (for instance, running the tests one last time to ensure
-they're in good shape).
-
-See <https://github.com/npm/npm/issues/10074> for a much lengthier
-justification, with further reading, for this change.
-
-#### Use Cases
-
-If you need to perform operations on your package before it is used, in a way
-that is not dependent on the operating system or architecture of the
-target system, use a `prepublish` script.  This includes
-tasks such as:
+The `"scripts"` property of of your `package.json` file supports a number of built-in scripts and their preset life cycle events as well as arbitrary scripts. These all can be executed by running `npm run-script <stage>` or `npm run <stage>` for short. *Pre* and *post* commands with matching names will be run for those as well (e.g. `premyscript`, `myscript`, `postmyscript`). Scripts from dependencies can be run with `npm explore <pkg> -- npm run <stage>`.
+
+### Pre & Post Scripts
+
+To create "pre" or "post" scripts for any scripts defined in the `"scripts"` section of the `package.json`, simply create another script *with a matching name* and add "pre" or "post" to the beginning of them.
+
+```json
+{
+  "scripts": {
+    "precompress": "{{ executes BEFORE the `compress` script }}",
+    "compress": "{{ run command to compress files }}",
+    "postcompress": "{{ executes AFTER `compress` script }}"
+  }
+}
+```
+
+### Life Cycle Scripts
+
+There are some special life cycle scripts that happen only in certain situations. These scripts happen in addtion to the "pre" and "post" script.
+* `prepare`, `prepublish`, `prepublishOnly`, `prepack`, `postpack`
+
+**prepare** (since `npm@4.0.0`)
+* Runs BEFORE the package is packed
+* Runs BEFORE the package is published
+* Runs on local `npm install` without any arguments
+* Run AFTER `prepublish`, but BEFORE `prepublishOnly`
+* NOTE: If a package being installed through git contains a `prepare` script, its `dependencies` and `devDependencies` will be installed, and the prepare script will be run, before the package is packaged and installed.
+
+**prepublish** (DEPRECATED)
+* Same as `prepare`
+
+**prepublishOnly**
+* Runs BEFORE the package is prepared and packed, ONLY on `npm publish`.
+
+**prepack**
+* Runs BEFORE a tarball is packed (on "`npm pack`", "`npm publish`", and when installing a git dependencies).
+* NOTE: "`npm run pack`" is NOT the same as "`npm pack`". "`npm run pack`" is an arbitrary user defined script name, where as, "`npm pack`" is a CLI defined command.
+
+**postpack**
+* Runs AFTER the tarball has been generated and moved to its final destination.
+
+#### Prepare and Prepublish
+
+**Deprecation Note: prepublish**
+
+Since `npm@1.1.71`, the npm CLI has run the `prepublish` script for both `npm publish` and `npm install`, because it's a convenient way to prepare a package for use (some common use cases are described in the section below).  It has also turned out to be, in practice, [very confusing](https://github.com/npm/npm/issues/10074).  As of `npm@4.0.0`, a new event has been introduced, `prepare`, that preserves this existing behavior. A _new_ event, `prepublishOnly` has been added as a transitional strategy to allow users to avoid the confusing behavior of existing npm versions and only run on `npm publish` (for instance, running the tests one last time to ensure they're in good shape).
+
+See <https://github.com/npm/npm/issues/10074> for a much lengthier justification, with further reading, for this change.
+
+**Use Cases**
+
+If you need to perform operations on your package before it is used, in a way that is not dependent on the operating system or architecture of the target system, use a `prepublish` script. This includes tasks such as:
 
 * Compiling CoffeeScript source code into JavaScript.
 * Creating minified versions of JavaScript source code.
 * Fetching remote resources that your package will use.
 
-The advantage of doing these things at `prepublish` time is that they can be done once, in a
-single place, thus reducing complexity and variability.
-Additionally, this means that:
+The advantage of doing these things at `prepublish` time is that they can be done once, in a single place, thus reducing complexity and variability. Additionally, this means that:
 
 * You can depend on `coffee-script` as a `devDependency`, and thus
   your users don't need to have it installed.
@@ -102,8 +76,41 @@ Additionally, this means that:
 * You don't need to rely on your users having `curl` or `wget` or
   other system tools on the target machines.
 
-### Default Values
+### Life Cycle Operation Order
+
+#### [`npm publish`](/cli-commands/npm-publish)
+
+* `prepublishOnly`
+* `prepare`
+* `prepublish`
+* `publish`
+* `postpublish`
+
+#### [`npm pack`](/cli-commands/npm-pack)
+
+* `prepack`
+* `postpack`
 
+#### [`npm install`](/cli-commands/npm-install)
+
+* `preinstall`
+* `install`
+* `postinstall`
+
+Also triggers
+
+* `prepublish` (when on local)
+* `prepare` (when on local)
+
+#### [`npm start`](/cli-commands/npm-start)
+
+`npm run start` has an `npm start` shorthand.
+
+* `prestart`
+* `start`
+* `poststart`
+
+### Default Values
 npm will default some script values based on package contents.
 
 * `"start": "node server.js"`:
@@ -208,7 +215,7 @@ For example, if your package.json contains this:
 ```json
 { "scripts" :
   { "install" : "scripts/install.js"
-  , "postinstall" : "scripts/install.js"
+  , "postinstall" : "scripts/postinstall.js"
   , "uninstall" : "scripts/uninstall.js"
   }
 }