diff --git a/CHANGELOG.md b/CHANGELOG.md index 8c346784df1812..1ab73471c87b8a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -29,11 +29,12 @@ release.
+Mason Pawsey
+Johannes Bader
+Michael Zabka
+Bruce MacNaughton
+Christopher Patty
+Max Stoiber
+Enrico Weigelt
+David Hu
+Steven R. Loomis
+Julien Deniau
+Prasanna Venkatesh T S
+Alec Larson
+John-David Dalton
+Raymond Feng
+Tieme van Veen
+Finn Pauls
+Jeremy Kahn
+Mertcan Mermerkaya
diff --git a/deps/npm/CHANGELOG.md b/deps/npm/CHANGELOG.md
index 0e42392d652854..e292478eabf9c4 100644
--- a/deps/npm/CHANGELOG.md
+++ b/deps/npm/CHANGELOG.md
@@ -1,1488 +1,706 @@
-## v5.6.0 (2017-11-27):
+## v6.1.0 (2018-05-17):
-### Features!
+### FIX WRITE AFTER END ERROR
-You may have noticed this is a semver-minor bump. Wondering why? This is why!
+First introduced in 5.8.0, this finally puts to bed errors where you would
+occasionally see `Error: write after end at MiniPass.write`.
-* [`bc263c3fd`](https://github.com/npm/npm/commit/bc263c3fde6ff4b04deee132d0a9d89379e28c27)
- [#19054](https://github.com/npm/npm/pull/19054)
- **Fully cross-platform `package-lock.json`**. Installing a failing optional
- dependency on one platform no longer removes it from the dependency tree,
- meaning that `package-lock.json` should now be generated consistently across
- platforms! 🎉
- ([@iarna](https://github.com/iarna))
-* [`f94fcbc50`](https://github.com/npm/npm/commit/f94fcbc50d8aec7350164df898d1e12a1e3da77f)
- [#19160](https://github.com/npm/npm/pull/19160)
- Add `--package-lock-only` config option. This makes it so you can generate a
- target `package-lock.json` without performing a full install of
- `node_modules`.
- ([@alopezsanchez](https://github.com/alopezsanchez))
-* [`66d18280c`](https://github.com/npm/npm/commit/66d18280ca320f880f4377cf80a8052491bbccbe)
- [#19104](https://github.com/npm/npm/pull/19104)
- Add new `--node-options` config to pass through a custom `NODE_OPTIONS` for
- lifecycle scripts.
- ([@bmeck](https://github.com/bmeck))
-* [`114d518c7`](https://github.com/npm/npm/commit/114d518c75732c42acbef3acab36ba1d0fd724e2)
- Ignore mtime when packing tarballs: This means that doing `npm pack` on the
- same repository should yield two tarballs with the same checksum. This will
- also help prevent cache bloat when using git dependencies. In the future, this
- will allow npm to explicitly cache git dependencies.
- ([@isaacs](https://github.com/isaacs))
-
-### Performance
-
-* [`39ba4aa74`](https://github.com/npm/npm/commit/39ba4aa7479220e61573c0c1977124c2199f49d0)
- `tar@4.1.0`: Reduce number of overall fs operations during packing/unpacking.
-
-### Node 9
+* [`171f3182f`](https://github.com/npm/npm/commit/171f3182f32686f2f94ea7d4b08035427e0b826e)
+ [node-tar#180](https://github.com/npm/node-tar/issues/180)
+ [npm.community#35](https://npm.community/t/write-after-end-when-installing-packages-with-5-8-and-later/35)
+ `pacote@8.1.5`: Fix write-after-end errors.
+ ([@zkat](https://github.com/zkat))
-Previously, it turns out npm broke on the latest Node, `node@9`. We went ahead
-and fixed it up so y'all should be able to use the latest npm again!
+### DETECT CHANGES IN GIT SPECIFIERS
-* [`4ca695819`](https://github.com/npm/npm/commit/4ca6958196ae41cef179473e3f7dbed9df9a32f1)
- `minizlib@1.0.4`: `Fix node@9` incompatibility.
- ([@isaacs](https://github.com/isaacs))
-* [`c851bb503`](https://github.com/npm/npm/commit/c851bb503a756b7cd48d12ef0e12f39e6f30c577)
- `tar@4.0.2`: Fix `node@9` incompatibility.
- ([@isaacs](https://github.com/isaacs))
-* [`6caf23096`](https://github.com/npm/npm/commit/6caf2309613d14ce77923ad3d1275cb89c6cf223)
- Remove "unsupported" warning for Node 9 now that things are fixed.
- ([@iarna](https://github.com/iarna))
-* [`1930b0f8c`](https://github.com/npm/npm/commit/1930b0f8c44373301edc9fb6ccdf7efcb350fa42)
- Update test matrix with `node@8` LTS and `node@9`.
+* [`0e1726c03`](https://github.com/npm/npm/commit/0e1726c0350a02d5a60f5fddb1e69c247538625e)
+ We can now determine if the commitid of a git dependency in the lockfile is derived
+ from the specifier in the package.json and if it isn't we now trigger an update for it.
([@iarna](https://github.com/iarna))
-### Bug Fixes
+### OTHER BUGS
-* [`b70321733`](https://github.com/npm/npm/commit/b7032173361665a12c9e4200bdc3f0eb4dee682f)
- [#18881](https://github.com/npm/npm/pull/18881)
- When dealing with a `node_modules` that was created with older versions of npm
- (and thus older versions of npa) we need to gracefully handle older spec
- entries. Failing to do so results in us treating those packages as if they
- were http remote deps, which results in invalid lock files with `version` set
- to tarball URLs. This should now be fixed.
- ([@iarna](https://github.com/iarna))
-* [`2f9c5dd00`](https://github.com/npm/npm/commit/2f9c5dd0046a53ece3482e92a412413f5aed6955)
- [#18880](https://github.com/npm/npm/pull/18880)
- Stop overwriting version in package data on disk. This is another safeguard
- against the version overwriting that's plagued some folks upgrading from older
- package-locks.
- ([@iarna](https://github.com/iarna))
- ([@joshclow](https://github.com/joshclow))
-* [`a93e0a51d`](https://github.com/npm/npm/commit/a93e0a51d3dafc31c809ca28cd7dfa71b2836f86)
- [#18846](https://github.com/npm/npm/pull/18846)
- Correctly save transitive dependencies when using `npm update` in
- `package-lock.json`.
- ([@iarna](https://github.com/iarna))
-* [`fdde7b649`](https://github.com/npm/npm/commit/fdde7b649987b2acd9a37ef203f1e263fdf6fece)
- [#18825](https://github.com/npm/npm/pull/18825)
- Fix typo and concatenation in error handling.
- ([@alulsh](https://github.com/alulsh))
-* [`be67de7b9`](https://github.com/npm/npm/commit/be67de7b90790cef0a9f63f91c2f1a00942205ee)
- [#18711](https://github.com/npm/npm/pull/18711)
- Upgrade to bearer tokens from legacy auth when enabling 2FA.
+* [`442d2484f`](https://github.com/npm/npm/commit/442d2484f686e3a371b07f8473a17708f84d9603)
+ [`2f0c88351`](https://github.com/npm/npm/commit/2f0c883519f17c94411dd1d9877c5666f260c12f)
+ [`631d30a34`](https://github.com/npm/npm/commit/631d30a340f5805aed6e83f47a577ca4125599b2)
+ When requesting the update of a direct dependency that was also a
+ transitive dependency to a version incompatible with the transitive
+ requirement and you had a lock-file but did not have a `node_modules`
+ folder then npm would fail to provide a new copy of the transitive
+ dependency, resulting in an invalid lock-file that could not self heal.
([@iarna](https://github.com/iarna))
-* [`bfdf0fd39`](https://github.com/npm/npm/commit/bfdf0fd39646b03db8e543e2bec7092da7880596)
- [#19033](https://github.com/npm/npm/pull/19033)
- Fix issue where files with `@` signs in their names would not get included
- when packing tarballs.
- ([@zkat](https://github.com/zkat))
-* [`b65b89bde`](https://github.com/npm/npm/commit/b65b89bdeaa65516f3e13afdb6e9aeb22d8508f4)
- [#19048](https://github.com/npm/npm/pull/19048)
- Fix problem where `npm login` was ignoring various networking-related options,
- such as custom certs.
- ([@wejendorp](https://github.com/wejendorp))
-* [`8c194b86e`](https://github.com/npm/npm/commit/8c194b86ec9617e2bcc31f30ee4772469a0bb440)
- `npm-packlist@1.1.10`: Include `node_modules/` directories not in the root.
- ([@isaacs](https://github.com/isaacs))
-* [`d7ef6a20b`](https://github.com/npm/npm/commit/d7ef6a20b44e968cb92babab1beb51f99110781d)
- `libnpx@9.7.1`: Fix some *nix binary path escaping issues.
- ([@zkat](https://github.com/zkat))
-* [`981828466`](https://github.com/npm/npm/commit/981828466a5936c70abcccea319b227c443e812b)
- `cacache@10.0.1`: Fix fallback to `copy-concurrently` when file move fails.
- This might fix permissions and such issues on platforms that were getting
- weird filesystem errors during install.
- ([@karolba](https://github.com/karolba))
-* [`a0be6bafb`](https://github.com/npm/npm/commit/a0be6bafb6dd7acb3e7b717c27c8575a2215bfff)
- `pacote@7.0.2`: Includes a bunch of fixes, specially for issues around git
- dependencies. Shasum-related errors should be way less common now, too.
- ([@zkat](https://github.com/zkat))
-* [`b80d650de`](https://github.com/npm/npm/commit/b80d650def417645d2525863e9f17af57a917b42)
- [#19163](https://github.com/npm/npm/pull/19163)
- Fix a number of git and tarball specs and checksum errors.
- ([@zkat](https://github.com/zkat))
-* [`cac225025`](https://github.com/npm/npm/commit/cac225025fa06cd055286e75541138cd95f52def)
- [#19054](https://github.com/npm/npm/pull/19054)
- Don't count failed optionals when summarizing installed packages.
+* [`be5dd0f49`](https://github.com/npm/npm/commit/be5dd0f496ec1485b1ea3094c479dfc17bd50d82)
+ [#20715](https://github.com/npm/npm/pull/20715)
+ Cleanup output of `npm ci` summary report.
+ ([@legodude17](https://github.com/legodude17))
+* [`98ffe4adb`](https://github.com/npm/npm/commit/98ffe4adb55a6f4459271856de2e27e95ee63375)
+ Node.js now has a test that scans for things that look like conflict
+ markers in source code. This was triggering false positives on a fixture in a test
+ of npm's ability to heal lockfiles with conflicts in them.
([@iarna](https://github.com/iarna))
-### UX
-
-* [`b1ec2885c`](https://github.com/npm/npm/commit/b1ec2885c43f8038c4e05b83253041992fdfe382)
- [#18326](https://github.com/npm/npm/pull/18326)
- Stop truncating output of `npm view`. This means, for example, that you no
- longer need to use `--json` when a package has a lot of versions, to see the
- whole list.
- ([@SimenB](https://github.com/SimenB))
-* [`55a124e0a`](https://github.com/npm/npm/commit/55a124e0aa6097cb46f1484f666444b2a445ba57)
- [#18884](https://github.com/npm/npm/pull/18884)
- Profile UX improvements: better messaging on unexpected responses, and stop
- claiming we set passwords to null when resetting them.
- ([@iarna](https://github.com/iarna))
-* [`635481c61`](https://github.com/npm/npm/commit/635481c6143bbe10a6f89747795bf4b83f75a7e9)
- [#18844](https://github.com/npm/npm/pull/18844)
- Improve error messaging for OTP/2FA.
- ([@iarna](https://github.com/iarna))
-* [`52b142ed5`](https://github.com/npm/npm/commit/52b142ed5e0f13f23c99209932e8de3f7649fd47)
- [#19054](https://github.com/npm/npm/pull/19054)
- Stop running the same rollback multiple times. This should address issues
- where Windows users saw strange failures when `fsevents` failed to install.
- ([@iarna](https://github.com/iarna))
-* [`798428b0b`](https://github.com/npm/npm/commit/798428b0b7b6cfd6ce98041c45fc0a36396e170c)
- [#19172](https://github.com/npm/npm/pull/19172)
- `bin-links@1.1.0`: Log the fact line endings are being changed upon install.
- ([@marcosscriven](https://github.com/marcosscriven))
-
-### Refactors
-
-Usually, we don't include internal refactor stuff in our release notes, but it's
-worth calling out some of them because they're part of a larger effort the CLI
-team and associates are undertaking to modularize npm itself so other package
-managers and associated tools can reuse all that code!
-
-* [`9d22c96b7`](https://github.com/npm/npm/commit/9d22c96b7160729c8126a38dcf554611b9e3ba87)
- [#18500](https://github.com/npm/npm/pull/18500)
- Extract bin-links and gentle-fs to a separate library. This will allow
- external tools to do bin linking and certain fs operations in an
- npm-compatible way!
- ([@mikesherov](https://github.com/mikesherov))
-* [`015a7803b`](https://github.com/npm/npm/commit/015a7803b7b63bc8543882196d987b92b461932d)
- [#18883](https://github.com/npm/npm/pull/18883)
- Capture logging from log events on the process global. This allows npm to use
- npmlog to report logging from external libraries like `npm-profile`.
- ([@iarna](https://github.com/iarna))
-* [`c930e98ad`](https://github.com/npm/npm/commit/c930e98adc03cef357ae5716269a04d74744a852)
- `npm-lifecycle@2.0.0`: Use our own `node-gyp`. This means npm no longer needs
- to pull some maneuvers to make sure `node-gyp` is in the right place, and that
- external packages using `npm-lifecycle` will get working native builds without
- having to do their own `node-gyp` maneuvers.
- ([@zkochan](https://github.com/zkochan))
-* [`876f0c8f3`](https://github.com/npm/npm/commit/876f0c8f341f8915e338b409f4b8616bb5263500) [`829893d61`](https://github.com/npm/npm/commit/829893d617bf81bba0d1ce4ea303f76ea37a2b2d)
- [#19099](https://github.com/npm/npm/pull/19099)
- `find-npm-prefix@1.0.1`: npm's prefix-finding logic is now a standalone
- module. That is, the logic that figures out where the root of your project is
- if you've `cd`'d into a subdirectory. Did you know you can run `npm install`
- from these subdirectories, and it'll only affect the root? It works like git!
- ([@iarna](https://github.com/iarna))
+### DEPENDENCY UPDATES
-### Docs
-
-* [`7ae12b21c`](https://github.com/npm/npm/commit/7ae12b21cc841f76417d3bb13b74f177319d4deb)
- [#18823](https://github.com/npm/npm/pull/18823)
- Fix spelling of the word authenticator. Because English is hard.
- ([@tmcw](https://github.com/tmcw))
-* [`5dfc3ab7b`](https://github.com/npm/npm/commit/5dfc3ab7bc2cb0fa7d9a8c00aa95fecdd14d7ae1)
- [#18742](https://github.com/npm/npm/pull/18742)
- Explicitly state 'github:foo/bar' as a valid shorthand for hosted git specs.
- ([@felicio](https://github.com/felicio))
-* [`a9dc098a6`](https://github.com/npm/npm/commit/a9dc098a6eb7a87895f52a101ac0d41492da698e)
- [#18679](https://github.com/npm/npm/pull/18679)
- Add some documentation about the `script-shell` config.
- ([@gszabo](https://github.com/gszabo))
-* [`24d7734d1`](https://github.com/npm/npm/commit/24d7734d1a1e906c83c53b6d1853af8dc758a998)
- [#18571](https://github.com/npm/npm/pull/18571)
- Change `verboten` to `forbidden`.
- ([@devmount](https://github.com/devmount))
-* [`a8a45668f`](https://github.com/npm/npm/commit/a8a45668fb9b8eb84234fe89234bdcdf644ead58)
- [#18568](https://github.com/npm/npm/pull/18568)
- Improve wording for the docs for the "engines" section of package.json files.
- ([@apitman](https://github.com/apitman))
-* [`dbc7e5b60`](https://github.com/npm/npm/commit/dbc7e5b602870330a8cdaf63bd303cd9050f792f)
- [#19118](https://github.com/npm/npm/pull/19118)
- Use valid JSON in example for bundledDependencies.
- ([@charmander](https://github.com/charmander))
-* [`779339485`](https://github.com/npm/npm/commit/779339485bab5137d0fdc68d1ed6fa987aa8965a)
- [#19162](https://github.com/npm/npm/pull/19162)
- Remove trailing white space from `npm access` docs.
- ([@WispProxy](https://github.com/WispProxy))
-
-### Dependency Bumps
-
-* [`0e7cac941`](https://github.com/npm/npm/commit/0e7cac9413ff1104cf242cc3006f42aa1c2ab63f)
- `bluebird@3.5.1`
- ([@petkaantonov](https://github.com/petkaantonov))
-* [`c4d5887d9`](https://github.com/npm/npm/commit/c4d5887d978849ddbe2673630de657f141ae5bcf)
- `update-notifier@2.3.0`
- ([@sindresorhus](https://github.com/sindresorhus))
-* [`eb19a9691`](https://github.com/npm/npm/commit/eb19a9691cf76fbc9c5b66aa7aadb5d905af467a)
- `npm-package-arg@6.0.0`
- ([@zkat](https://github.com/zkat))
-* [`91d5dca96`](https://github.com/npm/npm/commit/91d5dca96772bc5c45511ddcbeeb2685c7ea68e8)
- `npm-profile@2.0.5`
+* [`3f2e306b8`](https://github.com/npm/npm/commit/3f2e306b884a027df03f64524beb8658ce1772cb)
+ Using `npm audit fix`, replace some transitive dependencies with security
+ issues with versions that don't have any.
([@iarna](https://github.com/iarna))
-* [`8de66c46e`](https://github.com/npm/npm/commit/8de66c46e57e4b449c9540c8ecafbc4fd58faff5)
- `ssri@5.0.0`
+* [`1d07134e0`](https://github.com/npm/npm/commit/1d07134e0b157f7484a20ce6987ff57951842954)
+ `tar@4.4.1`:
+ Dropping to 4.4.1 from 4.4.2 due to https://github.com/npm/node-tar/issues/183
([@zkat](https://github.com/zkat))
-* [`cfbc3ea69`](https://github.com/npm/npm/commit/cfbc3ea69a8c62dc8e8543193c3ac472631dcef9)
- `worker-farm@1.5.1`
- ([@rvagg](https://github.com/rvagg))
-* [`60c228160`](https://github.com/npm/npm/commit/60c228160f22d41c2b36745166c9e8c2d84fee58)
- `query-string@5.0.1`
- ([@sindresorhus](https://github.com/sindresorhus))
-* [`72cad8c66`](https://github.com/npm/npm/commit/72cad8c664efd8eb1bec9a418bccd6c6ca9290de)
- `copy-concurrently@1.0.5`
- ([@iarna](https://github.com/iarna))
-
-## v5.5.1 (2017-10-04):
-A very quick, record time, patch release, of a bug fix to a (sigh) last minute bug fix.
-* [`e628e058b`](https://github.com/npm/npm/commit/e628e058b)
- Fix login to properly recognize OTP request and store bearer tokens.
- ([@Rebecca Turner](https://github.com/Rebecca Turner))
+## v6.1.0-next.0 (2018-05-17):
-## v5.5.0 (2017-10-04):
+Look at that! A feature bump! `npm@6` was super-exciting not just because it
+used a bigger number than ever before, but also because it included a super
+shiny new command: `npm audit`. Well, we've kept working on it since then and
+have some really nice improvements for it. You can expect more of them, and the
+occasional fix, in the next few releases as more users start playing with it and
+we get more feedback about what y'all would like to see from something like
+this.
-Hey y'all, this is a big new feature release! We've got some security
-related goodies plus a some quality-of-life improvements for anyone who uses
-the public registry (so, virtually everyone).
+I, for one, have started running it (and the new subcommand...) in all my
+projects, and it's one of those things that I don't know how I ever functioned
+-without- it! This will make a world of difference to so many people as far as
+making the npm ecosystem a higher-quality, safer commons for all of us.
-The changes largely came together in one piece, so I'm just gonna leave the commit line here:
+This is also a good time to remind y'all that we have a new [RFCs
+repository](https://github.com/npm/rfcs), along with a new process for them.
+This repo is open to anyone's RFCs, and has already received some great ideas
+about where we can take the CLI (and, to a certain extent, the registry). It's a
+great place to get feedback, and completely replaces feature requests in the
+main repo, so we won't be accepting feature requests there at all anymore. Check
+it out if you have something you'd like to suggest, or if you want to keep track
+of what the future might look like!
-* [`f6ebf5e8b`](https://github.com/npm/npm/commit/f6ebf5e8bd6a212c7661e248c62c423f2b54d978)
- [`f97ad6a38`](https://github.com/npm/npm/commit/f97ad6a38412581d059108ea29be470acb4fa510)
- [`f644018e6`](https://github.com/npm/npm/commit/f644018e6ef1ff7523c6ec60ae55a24e87a9d9ae)
- [`8af91528c`](https://github.com/npm/npm/commit/8af91528ce6277cd3a8c7ca8c8102671baf10d2f)
- [`346a34260`](https://github.com/npm/npm/commit/346a34260b5fba7de62717135f3e083cc4820853)
- Two factor authentication, profile editing and token management.
- ([@iarna](https://github.com/iarna))
+### NEW FEATURE: `npm audit fix`
-### TWO FACTOR AUTHENTICATION
+This is the biggie with this release! `npm audit fix` does exactly what it says
+on the tin. It takes all the actionable reports from your `npm audit` and runs
+the installs automatically for you, so you don't have to try to do all that
+mechanical work yourself!
-You can now enable two-factor authentication for your npm account. You can
-even do it from the CLI. In fact, you have to, for the time being:
+Note that by default, `npm audit fix` will stick to semver-compatible changes,
+so you should be able to safely run it on most projects and carry on with your
+day without having to track down what breaking changes were included. If you
+want your (toplevel) dependencies to accept semver-major bumps as well, you can
+use `npm audit fix --force` and it'll toss those in, as well. Since it's running
+the npm installer under the hood, it also supports `--production` and
+`--only=dev` flags, as well as things like `--dry-run`, `--json`, and
+`--package-lock-only`, if you want more control over what it does.
-```
-npm profile enable-tfa
-```
+Give it a whirl and tell us what you think! See `npm help audit` for full docs!
-With the default two-factor authentication mode you'll be prompted to enter
-a one-time password when logging in, when publishing and when modifying access rights to
-your modules.
+* [`3800a660d`](https://github.com/npm/npm/commit/3800a660d99ca45c0175061dbe087520db2f54b7)
+ Add `npm audit fix` subcommand to automatically fix detected vulnerabilities.
+ ([@zkat](https://github.com/zkat))
-### TOKEN MANAGEMENT
+### OTHER NEW `audit` FEATURES
-You can now create, list and delete authentication tokens from the comfort
-of the command line. Authentication tokens created this way can have NEW
-restrictions placed on them. For instance, you can create a `read-only`
-token to give to your CI. It will be able to download your private modules
-but it won't be able to publish or modify modules. You can also create
-tokens that can only be used from certain network addresses. This way you
-can lock down access to your corporate VPN or other trusted machines.
+* [`1854b1c7f`](https://github.com/npm/npm/commit/1854b1c7f09afceb49627e539a086d8a3565601c)
+ [#20568](https://github.com/npm/npm/pull/20568)
+ Add support for `npm audit --json` to print the report in JSON format.
+ ([@finnp](https://github.com/finnp))
+* [`85b86169d`](https://github.com/npm/npm/commit/85b86169d9d0423f50893d2ed0c7274183255abe)
+ [#20570](https://github.com/npm/npm/pull/20570)
+ Include number of audited packages in `npm install` summary output.
+ ([@zkat](https://github.com/zkat))
+* [`957cbe275`](https://github.com/npm/npm/commit/957cbe27542d30c33e58e7e6f2f04eeb64baf5cd)
+ `npm-audit-report@1.2.1`:
+ Overhaul audit install and detail output format. The new format is terser and
+ fits more closely into the visual style of the CLI, while still providing you
+ with the important bits of information you need. They also include a bit more
+ detail on the footer about what actions you can take!
+ ([@zkat](https://github.com/zkat))
-Deleting tokens isn't new, you could [do it via the
-website](https://www.npmjs.com/settings/tokens) but now you can do it via
-the CLI as well.
+### NEW FEATURE: GIT DEPS AND `npm init `!
-### CHANGE YOUR PASSWORD, SET YOUR EMAIL
+Another exciting change that came with `npm@6` was the new `npm init` command
+that allows for community-authored generators. That means you can, for example,
+do `npm init react-app` and it'll one-off download, install, and run
+[`create-react-app`](https://npm.im/create-react-app) for you, without requiring
+or keeping around any global installs. That is, it basically just calls out to
+[`npx`](https://npm.im/npx).
-You can finally change your password from the CLI with `npm profile set
-password`! You can also update your email address with `npm profile set
-email `. If you change your email address we'll send you a new
-verification email so you verify that its yours.
+The first version of this command only really supported registry dependencies,
+but now, [@jdalton](https://github.com/jdalton) went ahead and extended this
+feature so you can use hosted git dependencies, and their shorthands.
-### AND EVERYTHING ELSE ON YOUR PROFILE
+So go ahead and do `npm init facebook/create-react-app` and it'll grab the
+package from the github repo now! Or you can use it with a private github
+repository to maintain your organizational scaffolding tools or whatnot. ✨
-You can also update all of the other attributes of your profile that
-previously you could only update via the website: `fullname`, `homepage`,
-`freenode`, `twitter` and `github`.
+* [`483e01180`](https://github.com/npm/npm/commit/483e011803af82e63085ef41b7acce5b22aa791c)
+ [#20403](https://github.com/npm/npm/pull/20403)
+ Add support for hosted git packages to `npm init `.
+ ([@jdalton](https://github.com/jdalton))
-### AVAILABLE STAND ALONE
+### BUGFIXES
-All of these features were implemented in a stand alone library, so if you
-have use for them in your own project you can find them in
-[npm-profile](https://www.npmjs.com/package/npm-profile) on the registry.
-There's also a little mini-cli written just for it at
-[npm-profile-cli](https://www.npmjs.com/package/npm-profile-cli). You might
-also be interested in the [API
-documentation](https://github.com/npm/registry/tree/master/docs) for these
-new features: [user profile editing](https://github.com/npm/registry/blob/master/docs/user/profile.md) and
-[authentication](https://github.com/npm/registry/blob/master/docs/user/authentication.md).
+* [`a41c0393c`](https://github.com/npm/npm/commit/a41c0393cba710761a15612c6c85c9ef2396e65f)
+ [#20538](https://github.com/npm/npm/pull/20538)
+ Make the new `npm view` work when the license field is an object instead of a
+ string.
+ ([@zkat](https://github.com/zkat))
+* [`eb7522073`](https://github.com/npm/npm/commit/eb75220739302126c94583cc65a5ff12b441e3c6)
+ [#20582](https://github.com/npm/npm/pull/20582)
+ Add support for environments (like Docker) where the expected binary for
+ opening external URLs is not available.
+ ([@bcoe](https://github.com/bcoe))
+* [`212266529`](https://github.com/npm/npm/commit/212266529ae72056bf0876e2cff4b8ba01d09d0f)
+ [#20536](https://github.com/npm/npm/pull/20536)
+ Fix a spurious colon in the new update notifier message and add support for
+ the npm canary.
+ ([@zkat](https://github.com/zkat))
+* [`5ee1384d0`](https://github.com/npm/npm/commit/5ee1384d02c3f11949d7a26ec6322488476babe6)
+ [#20597](https://github.com/npm/npm/pull/20597)
+ Infer a version range when a `package.json` has a dist-tag instead of a
+ version range in one of its dependency specs. Previously, this would cause
+ dependencies to be flagged as invalid.
+ ([@zkat](https://github.com/zkat))
+* [`4fa68ae41`](https://github.com/npm/npm/commit/4fa68ae41324293e59584ca6cf0ac24b3e0825bb)
+ [#20585](https://github.com/npm/npm/pull/20585)
+ Make sure scoped bundled deps are shown in the new publish preview, too.
+ ([@zkat](https://github.com/zkat))
+* [`1f3ee6b7e`](https://github.com/npm/npm/commit/1f3ee6b7e1b36b52bdedeb9241296d4e66561d48)
+ `cacache@11.0.2`:
+ Stop dropping `size` from metadata on `npm cache verify`.
+ ([@jfmartinez](https://github.com/jfmartinez))
+* [`91ef93691`](https://github.com/npm/npm/commit/91ef93691a9d6ce7c016fefdf7da97854ca2b2ca)
+ [#20513](https://github.com/npm/npm/pull/20513)
+ Fix nested command aliases.
+ ([@mmermerkaya](https://github.com/mmermerkaya))
+* [`18b2b3cf7`](https://github.com/npm/npm/commit/18b2b3cf71a438648ced1bd13faecfb50c71e979)
+ `npm-lifecycle@2.0.3`:
+ Make sure different versions of the `Path` env var on Windows all get
+ `node_modules/.bin` prepended when running lifecycle scripts.
+ ([@laggingreflex](https://github.com/laggingreflex))
-### BUG FIXES
+### DOCUMENTATION
-* [`5ee55dc71`](https://github.com/npm/npm/commit/5ee55dc71b8b74b8418c3d5ec17483a07b3b6777)
- install.sh: Drop support for upgrading from npm@1 as npm@5 can't run on
- any Node.js version that ships npm@1. This fixes an issue some folks were seeing when trying
- to upgrade using `curl | http://npmjs.com/install.sh`.
- ([@iarna](https://github.com/iarna))
-* [`5cad1699a`](https://github.com/npm/npm/commit/5cad1699a7a0fc85ac7f77a95087a9647f75e344)
- `npm-lifecycle@1.0.3` Fix a bug where when more than one lifecycle script
- got queued to run, npm would crash.
- ([@zkat](https://github.com/zkat))
-* [`cd256cbb2`](https://github.com/npm/npm/commit/cd256cbb2f97fcbcb82237e94b66eac80e493626)
- `npm-packlist@1.1.9` Fix a bug where test directories would always be
- excluded from published modules.
- ([@isaacs](https://github.com/isaacs))
-* [`2a11f0215`](https://github.com/npm/npm/commit/2a11f021561acb1eb1ad4ad45ad955793b1eb4af)
- Fix formatting of unsupported version warning
+* [`a91d87072`](https://github.com/npm/npm/commit/a91d87072f292564e58dcab508b5a8c6702b9aae)
+ [#20550](https://github.com/npm/npm/pull/20550)
+ Update required node versions in README.
+ ([@legodude17](https://github.com/legodude17))
+* [`bf3cfa7b8`](https://github.com/npm/npm/commit/bf3cfa7b8b351714c4ec621e1a5867c8450c6fff)
+ Pull in changelogs from the last `npm@5` release.
([@iarna](https://github.com/iarna))
+* [`b2f14b14c`](https://github.com/npm/npm/commit/b2f14b14ca25203c2317ac2c47366acb50d46e69)
+ [#20629](https://github.com/npm/npm/pull/20629)
+ Make tone in `publishConfig` docs more neutral.
+ ([@jeremyckahn](https://github.com/jeremyckahn))
-### DEPENDENCY UPDATES
+### DEPENDENCY BUMPS
-* [`6d2a285a5`](https://github.com/npm/npm/commit/6d2a285a58655f10834f64d38449eb1f3c8b6c47)
- `npm-registry-client@8.5.0`
-* [`69e64e27b`](https://github.com/npm/npm/commit/69e64e27bf58efd0b76b3cf6e8182c77f8cc452f)
- `request@2.83.0`
-* [`34e0f4209`](https://github.com/npm/npm/commit/34e0f42090f6153eb5462f742e402813e4da56c8)
- `abbrev@1.1.1`
-* [`10d31739d`](https://github.com/npm/npm/commit/10d31739d39765f1f0249f688bd934ffad92f872)
- `aproba@1.2.0`
-* [`2b02e86c0`](https://github.com/npm/npm/commit/2b02e86c06cf2a5fe7146404f5bfd27f190ee4f4)
- `meant@1.0.1`
-* [`b81fff808`](https://github.com/npm/npm/commit/b81fff808ee269361d3dcf38c1b6019f1708ae02)
- `rimraf@2.6.2`:
- Fixes a long standing bug in rimraf's attempts to work around Windows limitations
- where it owns a file and can change its perms but can't remove it without
- first changing its perms. This _may_ be an improvement for Windows users of npm under
- some circumstances.
+* [`5fca4eae8`](https://github.com/npm/npm/commit/5fca4eae8a62a7049b1ae06aa0bbffdc6e0ad6cc)
+ `byte-size@4.0.3`
+ ([@75lb](https://github.com/75lb))
+* [`d9ef3fba7`](https://github.com/npm/npm/commit/d9ef3fba79f87c470889a6921a91f7cdcafa32b9)
+ `lru-cache@4.1.3`
+ ([@isaacs](https://github.com/isaacs))
+* [`f1baf011a`](https://github.com/npm/npm/commit/f1baf011a0d164f8dc8aa6cd31e89225e3872e3b)
+ `request@2.86.0`
+ ([@simonv](https://github.com/simonv))
+* [`005fa5420`](https://github.com/npm/npm/commit/005fa542072f09a83f77a9d62c5e53b8f6309371)
+ `require-inject@1.4.3`
+ ([@iarna](https://github.com/iarna))
+* [`1becdf09a`](https://github.com/npm/npm/commit/1becdf09a2f19716726c88e9a2342e1e056cfc71)
+ `tap@11.1.5`
([@isaacs](https://github.com/isaacs))
-## v5.4.2 (2017-09-14):
+## v6.0.1 (2018-05-09):
-This is a small bug fix release wrapping up most of the issues introduced with 5.4.0.
+### AUDIT SHOULDN'T WAIT FOREVER
-### Bugs
+This will likely be reduced further with the goal that the audit process
+shouldn't noticibly slow down your builds regardless of your network
+situation.
-* [`0b28ac72d`](https://github.com/npm/npm/commit/0b28ac72d29132e9b761717aba20506854465865)
- [#18458](https://github.com/npm/npm/pull/18458)
- Fix a bug on Windows where rolling back of failed optional dependencies would fail.
- ([@marcins](https://github.com/marcins))
-* [`3a1b29991`](https://github.com/npm/npm/commit/3a1b299913ce94fdf25ed3ae5c88fe6699b04e24)
- `write-file-atomic@2.1.0` Revert update of `write-file-atomic`. There were changes made to it
- that were resulting in EACCES errors for many users.
- ([@iarna](https://github.com/iarna))
-* [`cd8687e12`](https://github.com/npm/npm/commit/cd8687e1257f59a253436d69e8d79a29c85d00c8)
- Fix a bug where if npm decided it needed to move a module during an upgrade it would strip
- out much of the `package.json`. This would result in broken trees after package updates.
-* [`5bd0244ee`](https://github.com/npm/npm/commit/5bd0244eec347ce435e88ff12148c35da7c69efe)
- [#18385](https://github.com/npm/npm/pull/18385)
- Fix `npm outdated` when run on non-registry dependencies.
- ([@joshclow](https://github.com/joshclow))
+* [`3dcc240db`](https://github.com/npm/npm/commit/3dcc240dba5258532990534f1bd8a25d1698b0bf)
+ Timeout audit requests eventually.
([@iarna](https://github.com/iarna))
-### Ux
+### Looking forward
+
+We're still a way from having node@11, so now's a good time to ensure we
+don't warn about being used with it.
-* [`339f17b1e`](https://github.com/npm/npm/commit/339f17b1e6816eccff7df97875db33917eccdd13)
- Report unsupported node versions with greater granularity.
+* [`ed1aebf55`](https://github.com/npm/npm/commit/ed1aebf55)
+ Allow node@11, when it comes.
([@iarna](https://github.com/iarna))
-### Docs
+## v6.0.1-next.0 (2018-05-03):
-* [`b2ab6f43b`](https://github.com/npm/npm/commit/b2ab6f43b8ae645134238acd8dd3083e5ba8846e)
- [#18397](https://github.com/npm/npm/pull/18397)
- Document that the default loglevel with `npm@5` is `notice`.
- ([@KenanY](https://github.com/KenanY))
-* [`e5aedcd82`](https://github.com/npm/npm/commit/e5aedcd82af81fa9e222f9210f6f890c72a18dd3)
- [#18372](https://github.com/npm/npm/pull/18372)
- In npm-config documentation, note that env vars use \_ in place of -.
- ([@jakubholynet](https://github.com/jakubholynet))
+### CTRL-C OUT DURING PACKAGE EXTRACTION AS MUCH AS YOU WANT!
-## v5.4.1 (2017-09-06):
+* [`b267bbbb9`](https://github.com/npm/npm/commit/b267bbbb9ddd551e3dbd162cc2597be041b9382c)
+ [npm/lockfile#29](https://github.com/npm/lockfile/pull/29)
+ `lockfile@1.0.4`:
+ Switches to `signal-exit` to detect abnormal exits and remove locks.
+ ([@Redsandro](https://github.com/Redsandro))
-This is a very small bug fix release to fix a problem where permissions on
-installed binaries were being set incorrectly.
+### SHRONKWRAPS AND LACKFILES
-* [`767ff6eee`](https://github.com/npm/npm/commit/767ff6eee7fa3a0f42ad677dedc0ec1f0dc15e7c)
- [zkat/pacote#117](https://github.com/zkat/pacote/pull/117)
- [#18324](https://github.com/npm/npm/issues/18324)
- `pacote@6.0.2`
- ([@zkat](https://github.com/zkat))
+If a published modules had legacy `npm-shrinkwrap.json` we were saving
+ordinary registry dependencies (`name@version`) to your `package-lock.json`
+as `https://` URLs instead of versions.
-## v5.4.0 (2017-08-22):
+* [`89102c0d9`](https://github.com/npm/npm/commit/89102c0d995c3d707ff2b56995a97a1610f8b532)
+ When saving the lock-file compute how the dependency is being required instead of using
+ `_resolved` in the `package.json`. This fixes the bug that was converting
+ registry dependencies into `https://` dependencies.
+ ([@iarna](https://github.com/iarna))
+* [`676f1239a`](https://github.com/npm/npm/commit/676f1239ab337ff967741895dbe3a6b6349467b6)
+ When encountering a `https://` URL in our lockfiles that point at our default registry, extract
+ the version and use them as registry dependencies. This lets us heal
+ `package-lock.json` files produced by 6.0.0
+ ([@iarna](https://github.com/iarna))
-Here's another ~~small~~ big release, with a ~~handful~~ bunch of fixes and
-a couple of ~~small~~ new features! This release has been incubating rather
-longer than usual and it's grown quite a bit in that time. I'm also excited
-to say that it has contributions from **27** different folks, which is a new
-record for us. Our previous record was 5.1.0 at 21. Before that the record
-had been held by 1.3.16 since _December of 2013_.
+### AUDIT AUDIT EVERYWHERE
-![chart of contributor counts by version, showing an increasing rate over time and spikes mid in the 1.x series and later at 5.x](https://pbs.twimg.com/media/DH38rbZUwAAf9hS.jpg)
+You can't use it _quite_ yet, but we do have a few last moment patches to `npm audit` to make
+it even better when it is turned on!
-If you can't get enough of the bleeding edge, I encourage you to check out
-our canary release of npm. Get it with `npm install -g npmc`. It's going to
-be seeing some exciting stuff in the next couple of weeks, starting with a
-rewriten `npm dedupe`, but moving on to… well, you'll just have to wait and
-find out.
+* [`b2e4f48f5`](https://github.com/npm/npm/commit/b2e4f48f5c07b8ebc94a46ce01a810dd5d6cd20c)
+ Make sure we hide stream errors on background audit submissions. Previously some classes
+ of error could end up being displayed (harmlessly) during installs.
+ ([@iarna](https://github.com/iarna))
+* [`1fe0c7fea`](https://github.com/npm/npm/commit/1fe0c7fea226e592c96b8ab22fd9435e200420e9)
+ Include session and scope in requests (as we do in other requests to the registry).
+ ([@iarna](https://github.com/iarna))
+* [`d04656461`](https://github.com/npm/npm/commit/d046564614639c37e7984fff127c79a8ddcc0c92)
+ Exit with non-zero status when vulnerabilities are found. So you can have `npm audit` as a test or prepublish step!
+ ([@iarna](https://github.com/iarna))
+* [`fcdbcbacc`](https://github.com/npm/npm/commit/fcdbcbacc16d96a8696dde4b6d7c1cba77828337)
+ Verify lockfile integrity before running. You'd get an error either way, but this way it's
+ faster and can give you more concrete instructions on how to fix it.
+ ([@iarna](https://github.com/iarna))
+* [`2ac8edd42`](https://github.com/npm/npm/commit/2ac8edd4248f2393b35896f0300b530e7666bb0e)
+ Refuse to run in global mode. Audits require a lockfile and globals don't have one. Yet.
+ ([@iarna](https://github.com/iarna))
-### PERFORMANCE
+### DOCUMENTATION IMPROVEMENTS
-* [`d080379f6`](https://github.com/npm/npm/commit/d080379f620c716afa2c1d2e2ffc0a1ac3459194)
- `pacote@6.0.1` Updates extract to use tar@4, which is much faster than the
- older tar@2. It reduces install times by as much as 10%.
- ([@zkat](https://github.com/zkat))
-* [`4cd6a1774`](https://github.com/npm/npm/commit/4cd6a1774f774506323cae5685c9ca9a10deab63)
- [`0195c0a8c`](https://github.com/npm/npm/commit/0195c0a8cdf816834c2f737372194ddc576c451d)
- [#16804](https://github.com/npm/npm/pull/16804)
- `tar@4.0.1` Update publish to use tar@4. tar@4 brings many advantages
- over tar@2: It's faster, better tested and easier to work with. It also
- produces exactly the same byte-for-byte output when producing tarballs
- from the same set of files. This will have some nice carry on effects for
- things like caching builds from git. And finally, last but certainly not
- least, upgrading to it also let's us finally eliminate `fstream`—if
- you know what that is you'll know why we're so relieved.
- ([@isaacs](https://github.com/isaacs))
+* [`b7fca1084`](https://github.com/npm/npm/commit/b7fca1084b0be6f8b87ec0807c6daf91dbc3060a)
+ [#20407](https://github.com/npm/npm/pull/20407)
+ Update the lock-file spec doc to mention that we now generate the from field for `git`-type dependencies.
+ ([@watilde](https://github.com/watilde))
+* [`7a6555e61`](https://github.com/npm/npm/commit/7a6555e618e4b8459609b7847a9e17de2d4fa36e)
+ [#20408](https://github.com/npm/npm/pull/20408)
+ Describe what the colors in outdated mean.
+ ([@teameh](https://github.com/teameh))
-### FEATURES
+### DEPENDENCY UPDATES
-* [`1ac470dd2`](https://github.com/npm/npm/commit/1ac470dd283cc7758dc37721dd6331d5b316dc99)
- [#10382](https://github.com/npm/npm/pull/10382)
- If you make a typo when writing a command now, npm will print a brief "did you
- mean..." message with some possible alternatives to what you meant.
- ([@watilde](https://github.com/watilde))
-* [`20c46228d`](https://github.com/npm/npm/commit/20c46228d8f9243910f8c343f4830d52455d754e)
- [#12356](https://github.com/npm/npm/pull/12356)
- When running lifecycle scripts, `INIT_CWD` will now contain the original
- working directory that npm was executed from. Remember that you can use `npm
- run-script` even if you're not inside your package root directory!
- ([@MichaelQQ](https://github.com/MichaelQQ))
-* [`be91e1726`](https://github.com/npm/npm/commit/be91e1726e9c21c4532723e4f413b73a93dd53d1)
- [`4e7c41f4a`](https://github.com/npm/npm/commit/4e7c41f4a29744a9976cc22c77eee9d44172f21e)
- `libnpx@9.6.0`: Fixes a number of issues on Windows and adds support for
- several more languages: Korean, Norwegian (bokmål and nynorsk), Ukrainian,
- Serbian, Bahasa Indonesia, Polish, Dutch and Arabic.
- ([@zkat](https://github.com/zkat))
-* [`2dec601c6`](https://github.com/npm/npm/commit/2dec601c6d5a576751d50efbcf76eaef4deff31e)
- [#17142](https://github.com/npm/npm/pull/17142)
- Add the new `commit-hooks` option to `npm version` so that you can disable commit
- hooks when committing the version bump.
- ([@faazshift](https://github.com/faazshift))
-* [`bde151902`](https://github.com/npm/npm/commit/bde15190230b5c62dbd98095311eab71f6b52321)
- [#14461](https://github.com/npm/npm/pull/14461)
- Make output from `npm ping` clear as to its success or failure.
- ([@legodude17](https://github.com/legodude17))
+* [`5e56b3209`](https://github.com/npm/npm/commit/5e56b3209c4719e3c4d7f0d9346dfca3881a5d34)
+ `npm-audit-report@1.0.8`
+ ([@evilpacket](https://github.com/evilpacket))
+* [`58a0b31b4`](https://github.com/npm/npm/commit/58a0b31b43245692b4de0f1e798fcaf71f8b7c31)
+ `lock-verify@2.0.2`
+ ([@iarna](https://github.com/iarna))
+* [`e7a8c364f`](https://github.com/npm/npm/commit/e7a8c364f3146ffb94357d8dd7f643e5563e2f2b)
+ [zkat/pacote#148](https://github.com/zkat/pacote/pull/148)
+ `pacote@8.1.1`
+ ([@redonkulus](https://github.com/redonkulus))
+* [`46c0090a5`](https://github.com/npm/npm/commit/46c0090a517526dfec9b1b6483ff640227f0cd10)
+ `tar@4.4.2`
+ ([@isaacs](https://github.com/isaacs))
+* [`8a16db3e3`](https://github.com/npm/npm/commit/8a16db3e39715301fd085a8f4c80ae836f0ec714)
+ `update-notifier@2.5.0`
+ ([@alexccl](https://github.com/alexccl))
+* [`696375903`](https://github.com/npm/npm/commit/6963759032fe955c1404d362e14f458d633c9444)
+ `safe-buffer@5.1.2`
+ ([@feross](https://github.com/feross))
+* [`c949eb26a`](https://github.com/npm/npm/commit/c949eb26ab6c0f307e75a546f342bb2ec0403dcf)
+ `query-string@6.1.0`
+ ([@sindresorhus](https://github.com/sindresorhus))
-### BUGFIXES
+## v6.0.0 (2018-04-20):
-* [`b6d5549d2`](https://github.com/npm/npm/commit/b6d5549d2c2d38dd0e4319c56b69ad137f0d50cd)
- [#17844](https://github.com/npm/npm/pull/17844)
- Make package-lock.json sorting locale-agnostic. Previously, sorting would vary
- by locale, due to using `localeCompare` for key sorting. This'll give you
- a little package-lock.json churn as it reshuffles things, sorry!
- ([@LotharSee](https://github.com/LotharSee))
-* [`44b98b9dd`](https://github.com/npm/npm/commit/44b98b9ddcfcccf68967fdf106fca52bf0c3da4b)
- [#17919](https://github.com/npm/npm/pull/17919)
- Fix a crash where `npm prune --production` would fail while removing `.bin`.
- ([@fasterthanlime](https://github.com/fasterthanlime))
-* [`c3d1d3ba8`](https://github.com/npm/npm/commit/c3d1d3ba82aa41dfb2bd135e6cdc59f8d33cd9fb)
- [#17816](https://github.com/npm/npm/pull/17816)
- Fail more smoothly when attempting to install an invalid package name.
- ([@SamuelMarks](https://github.com/SamuelMarks))
-* [`55ac2fca8`](https://github.com/npm/npm/commit/55ac2fca81bf08338302dc7dc2070494e71add5c)
- [#12784](https://github.com/npm/npm/pull/12784)
- Guard against stack overflows when marking packages as failed.
- ([@vtravieso](https://github.com/vtravieso))
-* [`597cc0e4b`](https://github.com/npm/npm/commit/597cc0e4b5e6ee719014e3171d4e966df42a275c)
- [#15087](https://github.com/npm/npm/pull/15087)
- Stop outputting progressbars or using color on dumb terminals.
- ([@iarna](https://github.com/iarna))
-* [`7a7710ba7`](https://github.com/npm/npm/commit/7a7710ba72e6f82414653c2e7e91fea9a1aba7e2)
- [#15088](https://github.com/npm/npm/pull/15088)
- Don't exclude modules that are both dev & prod when using `npm ls --production`.
- ([@iarna](https://github.com/iarna))
-* [`867df2b02`](https://github.com/npm/npm/commit/867df2b0214689822b87b51578e347f353be97e8)
- [#18164](https://github.com/npm/npm/pull/18164)
- Only do multiple procs on OSX for now. We've seen a handful of issues
- relating to this in Docker and in on Windows with antivirus.
- ([@zkat](https://github.com/zkat))
-* [`23540af7b`](https://github.com/npm/npm/commit/23540af7b0ec5f12bbdc1558745c8c4f0861042b)
- [#18117](https://github.com/npm/npm/pull/18117)
- Some package managers would write spaces to the \_from field in package.json's in the
- form of `name @spec`. This was causing npm to fail to interpret them. We now handle that
- correctly and doubly make sure we don't do that ourselves.
- ([@IgorNadj](https://github.com/IgorNadj))
-* [`0ef320cb4`](https://github.com/npm/npm/commit/0ef320cb40222693b7367b97c60ddffabc2d58c5)
- [#16634](https://github.com/npm/npm/pull/16634)
- Convert any bin script with a shbang a the start to Unix line-endings. (These sorts of scripts
- are not compatible with Windows line-endings even on Windows.)
- ([@ScottFreeCode](https://github.com/ScottFreeCode))
-* [`71191ca22`](https://github.com/npm/npm/commit/71191ca2227694355c49dfb187104f68df5126bd)
- [#16476](https://github.com/npm/npm/pull/16476)
- `npm-lifecycle@1.0.2` Running an install with `--ignore-scripts` was resulting in the
- the package object being mutated to have the lifecycle scripts removed from it and that
- in turn was being written out to disk, causing further problems. This fixes that:
- No more mutation, no more unexpected changes.
- ([@addaleax](https://github.com/addaleax))
-* [`459fa9d51`](https://github.com/npm/npm/commit/459fa9d51600904ee75ed6267b159367a1209793)
- [npm/read-package-json#74](https://github.com/npm/read-package-json/pull/74)
- [#17802](https://github.com/npm/npm/pull/17802)
- `read-package-json@2.0.1` Use unix-style slashes for generated bin
- entries, which lets them be cross platform even when produced on Windows.
- ([@iarna](https://github.com/iarna))
-* [`5ec72ab5b`](https://github.com/npm/npm/commit/5ec72ab5b27c5c83cee9ff568cf75a9479d4b83a)
- [#18229](https://github.com/npm/npm/pull/18229)
- Make install.sh find nodejs on debian.
- ([@cebe](https://github.com/cebe))
+Hey y'all! Here's another `npm@6` release -- with `node@10` around the corner,
+this might well be the last prerelease before we tag `6.0.0`! There's two major
+features included with this release, along with a few miscellaneous fixes and
+changes.
-### DOCUMENTATION
+### EXTENDED `npm init` SCAFFOLDING
-* [`b019680db`](https://github.com/npm/npm/commit/b019680db78ae0a6dff2289dbfe9f61fccbbe824)
- [#10846](https://github.com/npm/npm/pull/10846)
- Remind users that they have to install missing `peerDependencies` manually.
- ([@ryanflorence](https://github.com/ryanflorence))
-* [`3aee5986a`](https://github.com/npm/npm/commit/3aee5986a65add2f815b24541b9f4b69d7fb445f)
- [#17898](https://github.com/npm/npm/pull/17898)
- Minor punctuation fixes to the README.
- ([@AndersDJohnson](https://github.com/AndersDJohnson))
-* [`e0d0a7e1d`](https://github.com/npm/npm/commit/e0d0a7e1dda2c43822b17eb71f4d51900575cc61)
- [#17832](https://github.com/npm/npm/pull/17832)
- Fix grammar, format, and spelling in documentation for `run-script`.
- ([@simonua](https://github.com/simonua))
-* [`3fd6a5f2f`](https://github.com/npm/npm/commit/3fd6a5f2f8802a9768dba2ec32c593b5db5a878d)
- [#17897](https://github.com/npm/npm/pull/17897)
- Add more info about using `files` with `npm pack`/`npm publish`.
- ([@davidjgoss](https://github.com/davidjgoss))
-* [`f00cdc6eb`](https://github.com/npm/npm/commit/f00cdc6eb90a0735bc3c516720de0b1428c79c31)
- [#17785](https://github.com/npm/npm/pull/17785)
- Add a note about filenames for certificates on Windows, which use a different
- extension and file type.
- ([@lgp1985](https://github.com/lgp1985))
-* [`0cea6f974`](https://github.com/npm/npm/commit/0cea6f9741243b1937abfa300c2a111d9ed79143)
- [#18022](https://github.com/npm/npm/pull/18022)
- Clarify usage for the `files` field in `package.json`.
- ([@xcambar](https://github.com/xcambar))
-* [`a0fdd1571`](https://github.com/npm/npm/commit/a0fdd15710971234cbc57086cd1a4dc037a39471)
- [#15234](https://github.com/npm/npm/pull/15234)
- Clarify the behavior of the `files` array in the package-json docs.
- ([@jbcpollak](https://github.com/jbcpollak))
-* [`cecd6aa5d`](https://github.com/npm/npm/commit/cecd6aa5d4dd04af765b26b749c1cd032f7eb913)
- [#18137](https://github.com/npm/npm/pull/18137)
- Clarify interaction between npmignore and files in package.json.
- ([@supertong](https://github.com/supertong))
-* [`6b8972039`](https://github.com/npm/npm/commit/6b89720396767961001e727fc985671ce88b901b)
- [#18044](https://github.com/npm/npm/pull/18044)
- Corrected the typo in package-locks docs.
- ([@vikramnr](https://github.com/vikramnr))
-* [`6e012924f`](https://github.com/npm/npm/commit/6e012924f99c475bc3637c86ab6a113875405fc7)
- [#17667](https://github.com/npm/npm/pull/17667)
- Fix description of package.json in npm-scripts docs.
- ([@tripu](https://github.com/tripu))
-
-### POSSIBLY INTERESTING DEPENDENCY UPDATES
-
-* [`48d84171a`](https://github.com/npm/npm/commit/48d84171a302fde2510b3f31e4a004c5a4d39c73)
- [`f60b05d63`](https://github.com/npm/npm/commit/f60b05d6307a7c46160ce98d6f3ccba89411c4ba)
- `semver@5.4.1` Perf improvements.
- ([@zkat](https://github.com/zkat))
-* [`f4650b5d4`](https://github.com/npm/npm/commit/f4650b5d4b2be2c04c229cc53aa930e260af9b4e)
- `write-file-atomic@2.3.0`:
- Serialize writes to the same file so that results are deterministic.
- Cleanup tempfiles when process is interrupted or killed.
- ([@ferm10n](https://github.com/ferm10n))
- ([@iarna](https://github.com/iarna))
+Thanks to the wonderful efforts of [@jdalton](https://github.com/jdalton) of
+lodash fame, `npm init` can now be used to invoke custom scaffolding tools!
-### CHORES
-
-* [`96d78df98`](https://github.com/npm/npm/commit/96d78df9843187bc53be2c93913e8567003ccb73)
- [`80e2f4960`](https://github.com/npm/npm/commit/80e2f4960691bc5dbd8320002e4d9143784b9ce9)
- [`4f49f687b`](https://github.com/npm/npm/commit/4f49f687bbd54b6a0e406936ae35593d8e971e1e)
- [`07d2296b1`](https://github.com/npm/npm/commit/07d2296b10e3d8d6f079eba3a61f0258501d7161)
- [`a267ab430`](https://github.com/npm/npm/commit/a267ab4309883012a9d55934533c5915e9842277)
- [#18176](https://github.com/npm/npm/pull/18176)
- [#18025](https://github.com/npm/npm/pull/18025)
- Move the lifecycle code out of npm into a separate library,
- [`npm-lifecycle`](https://github.com/npm/lifecycle). Shh, I didn't tell you this, but this
- portends to some pretty cool stuff to come very soon now.
- ([@mikesherov](https://github.com/mikesherov))
-* [`0933c7eaf`](https://github.com/npm/npm/commit/0933c7eaf9cfcdf56471fe4e71c403e2016973da)
- [#18025](https://github.com/npm/npm/pull/18025)
- Force Travis to use Precise instead of Trusty. We have issues with our
- couchdb setup and Trusty. =/
- ([@mikesherov](https://github.com/mikesherov))
-* [`afb086230`](https://github.com/npm/npm/commit/afb086230223f3c4fcddee4e958d18fce5db0ff9)
- [#18138](https://github.com/npm/npm/pull/18138)
- Fix typos in files-and-ignores test.
- ([@supertong](https://github.com/supertong))
-* [`3e6d11cde`](https://github.com/npm/npm/commit/3e6d11cde096b4ee7b07e7569b37186aa2115b1a)
- [#18175](https://github.com/npm/npm/pull/18175)
- Update dependencies to eliminate transitive dependencies with the WTFPL license, which
- some more serious corporate lawyery types aren't super comfortable with.
- ([@zkat](https://github.com/zkat))
-* [`ee4c9bd8a`](https://github.com/npm/npm/commit/ee4c9bd8ae574a0d6b24725ba6c7b718d8aaad8d)
- [#16474](https://github.com/npm/npm/pull/16474)
- The tests in `test/tap/lifecycle-signal.js`, as well as the features
- they are testing, are partially broken. This moves them from
- being skipped in CI to being disabled only for certain platforms.
- In particular, because `npm` spawns its lifecycle scripts in a
- shell, signals are not necessarily forwarded by the shell and
- won’t cause scripts to exit; also, shells may report the signal
- they receive using their exit status, rather than terminating
- themselves with a signal.
- ([@addaleax](https://github.com/addaleax))
-* [`9462e5d9c`](https://github.com/npm/npm/commit/9462e5d9cfbaa50218de6d0a630d6552e72ad0a8)
- [#16547](https://github.com/npm/npm/pull/16547)
- Remove unused file: bin/read-package-json.js
- ([@metux](https://github.com/metux))
-* [`0756d687d`](https://github.com/npm/npm/commit/0756d687d4ccfcd4a7fd83db0065eceb9261befb)
- [#16550](https://github.com/npm/npm/pull/16550)
- The build tools for the documentation need to be built/installed
- before the documents, even with parallel builds.
- Make has a simple mechanism which was made exactly for that:
- target dependencies.
- ([@metux](https://github.com/metux))
-
-## v5.3.0 (2017-07-12):
-
-As mentioned before, we're continuing to do relatively rapid, smaller releases
-as we keep working on stomping out `npm@5` issues! We've made a lot of progress
-since 5.0 already, and this release is no exception.
-
-### FEATURES
-
-* [`1e3a46944`](https://github.com/npm/npm/commit/1e3a469448b5db8376e6f64022c4c0c78cdb1686)
- [#17616](https://github.com/npm/npm/pull/17616)
- Add `--link` filter option to `npm ls`.
- ([@richardsimko](https://github.com/richardsimko))
-* [`33df0aaa`](https://github.com/npm/npm/commit/33df0aaaa7271dac982b86f2701d10152c4177c8)
- `libnpx@9.2.0`:
- * 4 new languages - Czech, Italian, Turkish, and Chinese (Traditional)! This means npx is available in 14 different languages!
- * New --node-arg option lets you pass CLI arguments directly to node when the target binary is found to be a Node.js script.
- ([@zkat](https://github.com/zkat))
+You can now do things like `npm init react-app` or `npm init esm` to scaffold an
+npm package by running `create-react-app` and `create-esm`, respectively. This
+also adds an `npm create` alias, to correspond to Yarn's `yarn create` feature,
+which inspired this.
-### BUGFIXES
+* [`008a83642`](https://github.com/npm/npm/commit/008a83642e04360e461f56da74b5557d5248a726) [`ed81d1426`](https://github.com/npm/npm/commit/ed81d1426776bcac47492cabef43f65e1d4ab536) [`833046e45`](https://github.com/npm/npm/commit/833046e45fe25f75daffd55caf25599a9f98c148)
+ [#20303](https://github.com/npm/npm/pull/20303)
+ Add an `npm init` feature that calls out to `npx` when invoked with positional
+ arguments. ([@jdalton](https://github.com/jdalton))
-* [`33df0aaa`](https://github.com/npm/npm/commit/33df0aaaa7271dac982b86f2701d10152c4177c8)
- `libnpx@9.2.0`:
- * npx should now work on (most) Windows installs. A couple of issues remain.
- * Prevent auto-fallback from going into an infinite loop when npx disappears.
- * `npx npx npx npx npx npx npx npx` works again.
- * `update-notifier` will no longer run for the npx bundled with npm.
- * `npx ` in a subdirectory of your project should be able to find your `node_modules/.bin` now. Oops
- ([@zkat](https://github.com/zkat))
-* [`8e979bf80`](https://github.com/npm/npm/commit/8e979bf80fb93233f19db003f08443e26cfc5e64)
- Revert change where npm stopped flattening modules that required peerDeps.
- This caused problems because folks were using peer deps to indicate that the
- target of the peer dep needed to be able to require the dependency and had
- been relying on the fact that peer deps didn't change the shape of the tree
- (as of npm@3).
- The fix that will actually work for people is for a peer dep to insist on
- never being installed deeper than the the thing it relies on. At the moment
- this is tricky because the thing the peer dep relies on may not yet have
- been added to the tree, so we don't know where it is.
- ([@iarna](https://github.com/iarna))
-* [`7f28a77f3`](https://github.com/npm/npm/commit/7f28a77f33ef501065f22e8d5e8cffee3195dccd)
- [#17733](https://github.com/npm/npm/pull/17733)
- Split remove and unbuild actions into two to get uninstall lifecycles and the
- removal of transitive symlinks during uninstallation to run in the right
- order.
- ([@iarna](https://github.com/iarna))
-* [`637f2548f`](https://github.com/npm/npm/commit/637f2548facae011eebf5e5c38bfe56a6c2db9fa)
- [#17748](https://github.com/npm/npm/pull/17748)
- When rolling back use symlink project-relative path, fixing some issues with
- `fs-vacuum` getting confused while removing symlinked things.
- ([@iarna](https://github.com/iarna))
-* [`f153b5b22`](https://github.com/npm/npm/commit/f153b5b22f647d4d403f5b8cecd2ce63ac75b07c)
- [#17706](https://github.com/npm/npm/pull/17706)
- Use semver to compare node versions in npm doctor instead of plain `>`
- comparison.
- ([@leo-shopify](https://github.com/leo-shopify))
-* [`542f7561`](https://github.com/npm/npm/commit/542f7561d173eca40eb8d838a16a0ed582fef989)
- [#17742](https://github.com/npm/npm/pull/17742)
- Fix issue where `npm version` would sometimes not commit package-locks.
- ([@markpeterfejes](https://github.com/markpeterfejes))
-* [`51a9e63d`](https://github.com/npm/npm/commit/51a9e63d31cb5ac52259dcf1c364004286072426)
- [#17777](https://github.com/npm/npm/pull/17777)
- Fix bug exposed by other bugfixes where the wrong package would be removed.
- ([@iarna](https://github.com/iarna))
+### DEPENDENCY AUDITING
-### DOCUMENTATION
+This version of npm adds a new command, `npm audit`, which will run a security
+audit of your project's dependency tree and notify you about any actions you may
+need to take.
-Have we mentioned we really like documentation patches? Keep sending them in!
-Small patches are just fine, and they're a great way to get started contributing
-to npm!
-
-* [`fb42d55a9`](https://github.com/npm/npm/commit/fb42d55a9a97afa5ab7db38b3b99088cf68684ea)
- [#17728](https://github.com/npm/npm/pull/17728)
- Document semver git urls in package.json docs.
- ([@sankethkatta](https://github.com/sankethkatta))
-* [`f398c700f`](https://github.com/npm/npm/commit/f398c700fb0f2f3665ebf45995a910ad16cd8d05)
- [#17684](https://github.com/npm/npm/pull/17684)
- Tweak heading hierarchy in package.json docs.
- ([@sonicdoe](https://github.com/sonicdoe))
-* [`d5ad65e50`](https://github.com/npm/npm/commit/d5ad65e50a573cdf9df4155225e869cd6c88ca5e)
- [#17691](https://github.com/npm/npm/pull/17691)
- Explicitly document `--no-save` flag for uninstall.
- ([@timneedham](https://github.com/timneedham))
-
-## v5.2.0 (2017-07-05):
-
-It's only been a couple of days but we've got some bug fixes we wanted to
-get out to you all. We also believe that
-[`npx`](https://medium.com/@maybekatz/introducing-npx-an-npm-package-runner-55f7d4bd282b) is ready to be bundled
-with npm, which we're really excited about!
-
-### npx!!!
-
-npx is a tool intended to help round out the experience of using packages
-from the npm registry — the same way npm makes it super easy to install and
-manage dependencies hosted on the registry, npx is meant to make it easy to
-use CLI tools and other executables hosted on the registry. It greatly
-simplifies a number of things that, until now, required a bit of ceremony to
-do with plain npm.
-
-![](https://cdn-images-1.medium.com/max/1600/1*OlIRsvVO5aK7ja9HmwXz_Q.gif)
-
-[@zkat](https://github.com/zkat) has a [great introduction post to npx](https://medium.com/@maybekatz/introducing-npx-an-npm-package-runner-55f7d4bd282b)
-that I highly recommend you give a read
-
-* [`fb040bee0`](https://github.com/npm/npm/commit/fb040bee0710759c60e45bf8fa2a3b8ddcf4212a)
- [#17685](https://github.com/npm/npm/pull/17685)
- Bundle npx with npm itself.
- ([@zkat](https://github.com/zkat))
+The registry-side services required for this command to work will be available
+on the main npm registry in the coming weeks. Until then, you won't get much out
+of trying to use this on the CLI.
-### BUG FIXES
+As part of this change, the npm CLI now sends scrubbed and cryptographically
+anonymized metadata about your dependency tree to your configured registry, to
+allow notifying you about the existence of critical security flaws. For details
+about how the CLI protects your privacy when it shares this metadata, see `npm
+help audit`, or [read the docs for `npm audit`
+online](https://github.com/npm/npm/blob/release-next/doc/cli/npm-audit.md). You
+can disable this altogether by doing `npm config set audit false`, but will no
+longer benefit from the service.
-* [`9fe905c39`](https://github.com/npm/npm/commit/9fe905c399d07a3c00c7b22035ddb6b7762731e6)
- [#17652](https://github.com/npm/npm/pull/17652)
- Fix max callstack exceeded loops with trees with circular links.
- ([@iarna](https://github.com/iarna))
-* [`c0a289b1b`](https://github.com/npm/npm/commit/c0a289b1ba6b99652c43a955b23acbf1de0b56ae)
- [#17606](https://github.com/npm/npm/pull/17606)
- Make sure that when write package.json and package-lock.json we always use unix path separators.
- ([@Standard8](https://github.com/Standard8))
-* [`1658b79ca`](https://github.com/npm/npm/commit/1658b79cad89ccece5ae5ce3c2f691d44b933116)
- [#17654](https://github.com/npm/npm/pull/17654)
- Make `npm outdated` show results for globals again. Previously it never thought they were out of date.
+* [`f4bc648ea`](https://github.com/npm/npm/commit/f4bc648ea7b19d63cc9878c9da2cb1312f6ce152)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ `npm-registry-fetch@1.1.0`
([@iarna](https://github.com/iarna))
-* [`06c154fd6`](https://github.com/npm/npm/commit/06c154fd653d18725d2e760ba825d43cdd807420)
- [#17678](https://github.com/npm/npm/pull/17678)
- Stop flattening modules that have peer dependencies. We're making this
- change to support scenarios where the module requiring a peer dependency
- is flattened but the peer dependency itself is not, due to conflicts. In
- those cases the module requiring the peer dep can't be flattened past the
- location its peer dep was placed in. This initial fix is naive, never
- flattening peer deps, and we can look into doing something more
- sophisticated later on.
+* [`594d16987`](https://github.com/npm/npm/commit/594d16987465014d573c51a49bba6886cc19f8e8)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ `npm-audit-report@1.0.5`
([@iarna](https://github.com/iarna))
-* [`88aafee8b`](https://github.com/npm/npm/commit/88aafee8b5b232b7eeb5690279a098d056575791)
- [#17677](https://github.com/npm/npm/pull/17677)
- There was an issue where updating a flattened dependency would sometimes
- unflatten it. This only happened when the dependency had dependencies
- that in turn required the original dependency.
+* [`8c77dde74`](https://github.com/npm/npm/commit/8c77dde74a9d8f9007667cd1732c3329e0d52617) [`1d8ac2492`](https://github.com/npm/npm/commit/1d8ac2492196c4752b2e41b23d5ddc92780aaa24) [`552ff6d64`](https://github.com/npm/npm/commit/552ff6d64a5e3bcecb33b2a861c49a3396adad6d) [`09c734803`](https://github.com/npm/npm/commit/09c73480329e75e44fb8e55ca522f798be68d448)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ Add new `npm audit` command.
([@iarna](https://github.com/iarna))
-* [`b58ec8eab`](https://github.com/npm/npm/commit/b58ec8eab3b4141e7f1b8b42d8cc24f716a804d8)
- [#17626](https://github.com/npm/npm/pull/17626)
- Integrators who were building their own copies of npm ran into issues because
- `make install` and https://npmjs.com/install.sh weren't aware that
- `npm install` creates links now when given a directory to work on. This does not impact folks
- installing npm with `npm install -g npm`.
+* [`be393a290`](https://github.com/npm/npm/commit/be393a290a5207dc75d3d70a32973afb3322306c)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ Temporarily suppress git metadata till there's an opt-in.
([@iarna](https://github.com/iarna))
-
-### DOC FIXES
-
-* [`10bef735e`](https://github.com/npm/npm/commit/10bef735e825acc8278827d34df415dfcd8c67d4)
- [#17645](https://github.com/npm/npm/pull/17645)
- Fix some github issue links in the 5.1.0 changelog
- ([@schmod](https://github.com/schmod))
-* [`85fa9dcb2`](https://github.com/npm/npm/commit/85fa9dcb2f0b4f51b515358e0184ec82a5845227)
- [#17634](https://github.com/npm/npm/pull/17634)
- Fix typo in package-lock docs.
- ([@sonicdoe](https://github.com/sonicdoe))
-* [`688699bef`](https://github.com/npm/npm/commit/688699befc2d147288c69a9405fb8354ecaebe36)
- [#17628](https://github.com/npm/npm/pull/17628)
- Recommend that folks looking for support join us on https://package.community/ or message
- [@npm_support](https://twitter.com/npm_support) on Twitter.
- ([@strugee](https://github.com/strugee))
-
-
-## v5.1.0 (2017-07-05):
-
-Hey y'all~
-
-We've got some goodies for you here, including `npm@5`'s first semver-minor
-release! This version includes a huge number of fixes, particularly for some of
-the critical bugs users were running into after upgrading npm. You should
-overall see a much more stable experience, and we're going to continue hacking
-on fixes for the time being. Semver-major releases, specially for tools like
-npm, are bound to cause some instability, and getting `npm@5` stable is the CLI
-team's top priority for now!
-
-Not that bugfixes are the only things that landed, either: between improvements
-that fell out of the bugfixes, and some really cool work by community members
-like [@mikesherov](https://github.com/mikesherov), `npm@5.1.0` is **_twice as
-fast_** as `npm@5.0.0` in some benchmarks. We're not stopping there, either: you
-can expect a steady stream of speed improvements over the course of the year.
-It's not _top_ priority, but we'll keep doing what we can to make sure npm saves
-its users as much time as possible.
-
-Hang on to your seats. At **100 commits**, this release is a bit of a doozy. 😎
-
-### FEATURES
-
-Semver-minor releases, of course, mean that there's a new feature somewhere,
-right? Here's what's bumping that number for us this time:
-
-* [`a09c1a69d`](https://github.com/npm/npm/commit/a09c1a69df05b753464cc1272cdccc6af0f4da5a)
- [#16687](https://github.com/npm/npm/pull/16687)
- Allow customizing the shell used to execute `run-script`s.
- ([@mmkal](https://github.com/mmkal))
-* [`4f45ba222`](https://github.com/npm/npm/commit/4f45ba222e2ac6dbe6d696cb7a8e678bbda7c839) [`a48958598`](https://github.com/npm/npm/commit/a489585985540deed4edc03418636c9e97aa9e40) [`901bef0e1`](https://github.com/npm/npm/commit/901bef0e1ea806fc08d8d58744a9f813b6c020ab)
- [#17508](https://github.com/npm/npm/pull/17508)
- Add a new `requires` field to `package-lock.json` with information about the
- _logical_ dependency tree. This includes references to the specific version
- each package is intended to see, and can be used for many things, such as
- [converting `package-lock.json` to other lockfile
- formats](https://twitter.com/maybekatz/status/880578566907248640), various
- optimizations, and verifying correctness of a package tree.
- ([@iarna](https://github.com/iarna))
-* [`47e8fc8eb`](https://github.com/npm/npm/commit/47e8fc8eb9b5faccef9e03ab991cf37458c16249)
- [#17508](https://github.com/npm/npm/pull/17508)
- Make `npm ls` take package locks (and shrinkwraps) into account. This means
- `npm ls` can now be used to see [which dependencies are
- missing](https://twitter.com/maybekatz/status/880446509547794437), so long as
- a package lock has been previously generated with it in.
- ([@iarna](https://github.com/iarna))
-* [`f0075e7ca`](https://github.com/npm/npm/commit/f0075e7caa3e151424a254d7809ae4489ed8df90)
- [#17508](https://github.com/npm/npm/pull/17508)
- Take `package.json` changes into account when running installs -- if you
- remove or add a dependency to `package.json` manually, npm will now pick that
- up and update your tree and package lock accordingly.
- ([@iarna](https://github.com/iarna))
-* [`83a5455aa`](https://github.com/npm/npm/commit/83a5455aac3c5cc2511ab504923b652b13bd66a0)
- [#17205](https://github.com/npm/npm/pull/17205)
- Add `npm udpate` as an alias for `npm update`, for symmetry with
- `install`/`isntall`.
- ([@gdassori](https://github.com/gdassori))
-* [`57225d394`](https://github.com/npm/npm/commit/57225d394b6174eb0be48393d8e18da0991f67b6)
- [#17120](https://github.com/npm/npm/pull/17120)
- npm will no longer warn about `preferGlobal`, and the option is now
- deprecated.
- ([@zkat](https://github.com/zkat))
-* [`82df7bb16`](https://github.com/npm/npm/commit/82df7bb16fc29c47a024db4a8c393e55f883744b)
- [#17351](https://github.com/npm/npm/pull/17351)
- As some of you may already know `npm build` doesn't do what a lot of people
- expect: It's mainly an npm plumbing command, and is part of the more familiar
- `npm rebuild` command. That said, a lot of users assume that this is the way
- to run an npm `run-script` named `build`, which is an incredibly common script
- name to use. To clarify things for users, and encourage them to use `npm run
- build` instead, npm will now warn if `npm build` is run without any arguments.
- ([@lennym](https://github.com/lennym))
-
-### PERFORMANCE
-
-* [`59f86ef90`](https://github.com/npm/npm/commit/59f86ef90a58d8dc925c9613f1c96e68bee5ec7b) [`43be9d222`](https://github.com/npm/npm/commit/43be9d2222b23ebb0a427ed91824ae217e6d077a) [`e906cdd98`](https://github.com/npm/npm/commit/e906cdd980b4722e66618ce295c682b9a8ffaf8f)
- [#16633](https://github.com/npm/npm/pull/16633)
- npm now parallelizes tarball extraction across multiple child process workers.
- This can significantly speed up installations, specially when installing from
- cache, and will improve with number of processors.
- ([@zkat](https://github.com/zkat))
-* [`e0849878d`](https://github.com/npm/npm/commit/e0849878dd248de8988c2ef3fc941054625712ca)
- [#17441](https://github.com/npm/npm/pull/17441)
- Avoid building environment for empty lifecycle scripts. This change alone
- accounted for as much as a 15% speed boost for npm installations by outright
- skipping entire steps of the installer when not needed.
- ([@mikesherov](https://github.com/mikesherov))
-* [`265c2544c`](https://github.com/npm/npm/commit/265c2544c8ded10854909243482e6437ed03c261)
- [npm/hosted-git-info#24](https://github.com/npm/hosted-git-info/pull/24)
- `hosted-git-info@2.5.0`: Add caching to `fromURL`, which gets called many,
- many times by the installer. This improved installation performance by around
- 10% on realistic application repositories.
- ([@mikesherov](https://github.com/mikesherov))
-* [`901d26cb`](https://github.com/npm/npm/commit/901d26cb656e7e773d9a38ef4eac9263b95e07c8)
- [npm/read-package-json#20](https://github.com/npm/read-package-json/pull/70)
- `read-package-json@2.0.9`: Speed up installs by as much as 20% by
- reintroducing a previously-removed cache and making it actually be correct
- this time around.
- ([@mikesherov](https://github.com/mikesherov))
-* [`44e37045d`](https://github.com/npm/npm/commit/44e37045d77bc40adf339b423d42bf5e9b4d4d91)
- Eliminate `Bluebird.promisifyAll` from our codebase.
+* [`8e713344f`](https://github.com/npm/npm/commit/8e713344f6e0828ddfb7733df20d75e95a5382d8)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ Document the new command.
([@iarna](https://github.com/iarna))
-* [`3b4681b53`](https://github.com/npm/npm/commit/3b4681b53db7757985223932072875d099694677)
- [#17508](https://github.com/npm/npm/pull/17508)
- Stop calling `addBundle` on locked deps, speeding up the
- `package-lock.json`-based fast path.
+*
+ [#20389](https://github.com/npm/npm/pull/20389)
+ Default audit to off when running the npm test suite itself.
([@iarna](https://github.com/iarna))
-### BUGFIXES
+### MORE `package-lock.json` FORMAT CHANGES?!
-* [#17508](https://github.com/npm/npm/pull/17508)
- This is a big PR that fixes a variety of issues when installing from package
- locks. If you were previously having issues with missing dependencies or
- unwanted removals, this might have fixed it:
- * It introduces a new `package-lock.json` field, called `requires`, which tracks which modules a given module requires.
- * It fixes [#16839](https://github.com/npm/npm/issues/16839) which was caused by not having this information available, particularly when git dependencies were involved.
- * It fixes [#16866](https://github.com/npm/npm/issues/16866), allowing the `package.json` to trump the `package-lock.json`.
- * `npm ls` now loads the shrinkwrap, which opens the door to showing a full tree of dependencies even when nothing is yet installed. (It doesn't do that yet though.)
- ([@iarna](https://github.com/iarna))
-* [`656544c31`](https://github.com/npm/npm/commit/656544c31cdef3cef64fc10c24f03a8ae2685e35) [`d21ab57c3`](https://github.com/npm/npm/commit/d21ab57c3ef4f01d41fb6c2103debe884a17dc22)
- [#16637](https://github.com/npm/npm/pull/16637)
- Fix some cases where `npm prune` was leaving some dependencies unpruned if
- to-be-pruned dependencies depended on them.
- ([@exogen](https://github.com/exogen))
-* [`394436b09`](https://github.com/npm/npm/commit/394436b098dcca2d252061f95c4eeb92c4a7027c)
- [#17552](https://github.com/npm/npm/pull/17552)
- Make `refresh-package-json` re-verify the package platform. This fixes an
- issue most notably experienced by Windows users using `create-react-app` where
- `fsevents` would not short-circuit and cause a crash during its
- otherwise-skipped native build phase.
- ([@zkat](https://github.com/zkat))
-* [`9e5a94354`](https://github.com/npm/npm/commit/9e5a943547b29c8d022192afd9398b3a136a7e5a)
- [#17590](https://github.com/npm/npm/pull/17590)
- Fix an issue where `npm@5` would crash when trying to remove packages
- installed with `npm@<5`.
- ([@iarna](https://github.com/iarna))
-* [`c3b586aaf`](https://github.com/npm/npm/commit/c3b586aafa9eabac572eb6e2b8a7266536dbc65b)
- [#17141](https://github.com/npm/npm/issues/17141)
- Don't update the package.json when modifying packages that don't go there.
- This was previously causing `package.json` to get a `"false": {}` field added.
- ([@iarna](https://github.com/iarna))
-* [`d04a23de2`](https://github.com/npm/npm/commit/d04a23de21dd9991b32029d839b71e10e07b400d) [`4a5b360d5`](https://github.com/npm/npm/commit/4a5b360d561f565703024085da0927ccafe8793e) [`d9e53db48`](https://github.com/npm/npm/commit/d9e53db48ca227b21bb67df48c9b3580cb390e9e)
- `pacote@2.7.38`:
- * [zkat/pacote#102](https://github.com/zkat/pacote/pull/102) Fix issue with tar extraction and special characters.
- * Enable loose semver parsing in some missing corner cases.
- ([@colinrotherham](https://github.com/colinrotherham), [@zkat](https://github.com/zkat), [@mcibique](https://github.com/mcibique))
-* [`e2f815f87`](https://github.com/npm/npm/commit/e2f815f87676b7c50b896e939cee15a01aa976e4)
- [#17104](https://github.com/npm/npm/pull/17104)
- Write an empty str and wait for flush to exit to reduce issues with npm
- exiting before all output is complete when it's a child process.
- ([@zkat](https://github.com/zkat))
-* [`835fcec60`](https://github.com/npm/npm/commit/835fcec601204971083aa3a281c3a9da6061a7c2)
- [#17060](https://github.com/npm/npm/pull/17060)
- Make git repos with prepare scripts always install with both dev and prod
- flags.
- ([@intellix](https://github.com/intellix))
-* [`f1dc8a175`](https://github.com/npm/npm/commit/f1dc8a175eed56f1ed23bd5773e5e10beaf6cb31)
- [#16879](https://github.com/npm/npm/pull/16879)
- Fix support for `always-auth` and `_auth`. They are now both available in both
- unscoped and registry-scoped configurations.
- ([@jozemlakar](https://github.com/jozemlakar))
-* [`ddd8a1ca2`](https://github.com/npm/npm/commit/ddd8a1ca2fa3377199af74ede9d0c1a406d19793)
- Serialize package specs to prevent `[object Object]` showing up in logs during
- extraction.
+* [`820f74ae2`](https://github.com/npm/npm/commit/820f74ae22b7feb875232d46901cc34e9ba995d6)
+ [#20384](https://github.com/npm/npm/pull/20384)
+ Add `from` field back into package-lock for git dependencies. This will give
+ npm the information it needs to figure out whether git deps are valid,
+ specially when running with legacy install metadata or in
+ `--package-lock-only` mode when there's no `node_modules`. This should help
+ remove a significant amount of git-related churn on the lock-file.
([@zkat](https://github.com/zkat))
-* [`99ef3b52c`](https://github.com/npm/npm/commit/99ef3b52caa7507e87a4257e622f8964b1c1f5f3)
- [#17505](https://github.com/npm/npm/pull/17505)
- Stop trying to commit updated `npm-shrinkwrap.json` and `package-lock.json` if
- they're `.gitignore`d.
- ([@zkat](https://github.com/zkat))
-* [`58be2ec59`](https://github.com/npm/npm/commit/58be2ec596dfb0353ad2570e6750e408339f1478)
- Make sure uid and gid are getting correctly set even when they're `0`. This
- should fix some Docker-related issues with bad permissions/broken ownership.
- ([@rgrove](https://github.com/rgrove))
- ([@zkat](https://github.com/zkat))
-* [`9d1e3b6fa`](https://github.com/npm/npm/commit/9d1e3b6fa01bb563d76018ee153259d9507658cf)
- [#17506](https://github.com/npm/npm/pull/17506)
- Skip writing package.json and locks if on-disk version is identical to the new
- one.
- ([@zkat](https://github.com/zkat))
-* [`3fc6477a8`](https://github.com/npm/npm/commit/3fc6477a89773786e6c43ef43a23e5cdc662ff8e)
- [#17592](https://github.com/npm/npm/pull/17592)
- Fix an issue where `npm install -g .` on a package with no `name` field would
- cause the entire global `node_modules` directory to be replaced with a symlink
- to `$CWD`. lol.
- ([@iarna](https://github.com/iarna))
-* [`06ba0a14a`](https://github.com/npm/npm/commit/06ba0a14a6c1c8cdcc8c062b68c8c63041b0cec0)
- [#17591](https://github.com/npm/npm/pull/17591)
- Fix spurious removal reporting: if you tried to remove something that didn't
- actually exist, npm would tell you it removed 1 package even though there was
- nothing to do.
- ([@iarna](https://github.com/iarna))
-* [`20ff05f8`](https://github.com/npm/npm/commit/20ff05f8fe0ad8c36e1323d30b63b4d2ff7e11ef)
- [#17629](https://github.com/npm/npm/pull/17629)
- When removing a link, keep dependencies installed inside of it instead of
- removing them, if the link is outside the scope of the current project. This
- fixes an issue where removing globally-linked packages would remove all their
- dependencies in the source directory, as well as some ergonomic issues when
- using links in other situations.
- ([@iarna](https://github.com/iarna))
-### DOCS
+### BUGFIXES
-* [`fd5fab595`](https://github.com/npm/npm/commit/fd5fab5955a20a9bb8c0e77092ada1435f73a8d2)
- [#16441](https://github.com/npm/npm/pull/16441)
- Add spec for `npm-shrinkwrap.json` and `package-lock.json` from RFC.
+* [`9d5d0a18a`](https://github.com/npm/npm/commit/9d5d0a18a5458655275056156b5aa001140ae4d7)
+ [#20358](https://github.com/npm/npm/pull/20358)
+ `npm install-test` (aka `npm it`) will no longer generate `package-lock.json`
+ when running with `--no-package-lock` or `package-lock=false`.
+ ([@raymondfeng](https://github.com/raymondfeng))
+* [`e4ed976e2`](https://github.com/npm/npm/commit/e4ed976e20b7d1114c920a9dc9faf351f89a31c9)
+ [`2facb35fb`](https://github.com/npm/npm/commit/2facb35fbfbbc415e693d350b67413a66ff96204)
+ [`9c1eb945b`](https://github.com/npm/npm/commit/9c1eb945be566e24cbbbf186b0437bdec4be53fc)
+ [#20390](https://github.com/npm/npm/pull/20390)
+ Fix a scenario where a git dependency had a comittish associated with it
+ that was not a complete commitid. `npm` would never consider that entry
+ in the `package.json` as matching the entry in the `package-lock.json` and
+ this resulted in inappropriate pruning or reinstallation of git
+ dependencies. This has been addressed in two ways, first, the addition of the
+ `from` field as described in [#20384](https://github.com/npm/npm/pull/20384) means
+ we can exactly match the `package.json`. Second, when that's missing (when working with
+ older `package-lock.json` files), we assume that the match is ok. (If
+ it's not, we'll fix it up when a real installation is done.)
([@iarna](https://github.com/iarna))
-* [`9589c1ccb`](https://github.com/npm/npm/commit/9589c1ccb3f794abaaa48c2a647ada311dd881ef)
- [#17451](https://github.com/npm/npm/pull/17451)
- Fix typo in changelog.
- ([@watilde](https://github.com/watilde))
-* [`f8e76d856`](https://github.com/npm/npm/commit/f8e76d8566ae1965e57d348df74edad0643b66a6)
- [#17370](https://github.com/npm/npm/pull/17370)
- Correct the default prefix config path for Windows operating systems in the
- documentation for npm folders.
- ([@kierendixon](https://github.com/kierendixon))
-* [`d0f3b5a12`](https://github.com/npm/npm/commit/d0f3b5a127718b0347c6622a2b9c28341c530d36)
- [#17369](https://github.com/npm/npm/pull/17369)
- Fix `npm-config` reference to `userconfig` & `globalconfig` environment
- variables.
- ([@racztiborzoltan](https://github.com/racztiborzoltan))
-* [`87629880a`](https://github.com/npm/npm/commit/87629880a71baec352c1b5345bc29268d6212467)
- [#17336](https://github.com/npm/npm/pull/17336)
- Remove note in docs about `prepublish` being entirely removed.
- ([@Hirse](https://github.com/Hirse))
-* [`a1058afd9`](https://github.com/npm/npm/commit/a1058afd9a7a569bd0ac65b86eadd4fe077a7221)
- [#17169](https://github.com/npm/npm/pull/17169)
- Document `--no-package-lock` flag.
- ([@leggsimon](https://github.com/leggsimon))
-* [`32fc6e41a`](https://github.com/npm/npm/commit/32fc6e41a2ce4dbcd5ce1e5f291e2e2efc779d48)
- [#17250](https://github.com/npm/npm/pull/17250)
- Fix a typo in the shrinkwrap docs.
- ([@Zarel](https://github.com/Zarel))
-* [`f19bd3c8c`](https://github.com/npm/npm/commit/f19bd3c8cbd37c8a99487d6b5035282580ac3e9d)
- [#17249](https://github.com/npm/npm/pull/17249)
- Fix a package-lock.json cross-reference link.
- ([@not-an-aardvark](https://github.com/not-an-aardvark))
-* [`153245edc`](https://github.com/npm/npm/commit/153245edc4845db670ada5e95ef384561706a751)
- [#17075](https://github.com/npm/npm/pull/17075/files)
- Fix a typo in `npm-config` docs.
- ([@KennethKinLum](https://github.com/KennethKinLum))
-* [`c9b534a14`](https://github.com/npm/npm/commit/c9b534a148818d1a97787c0dfdba5f64ce3618a6)
- [#17074](https://github.com/npm/npm/pull/17074)
- Clarify config documention with multiple boolean flags.
- ([@KennethKinLum](https://github.com/KennethKinLum))
-* [`e111b0a40`](https://github.com/npm/npm/commit/e111b0a40c4bc6691d7b8d67ddce5419e67bfd27)
- [#16768](https://github.com/npm/npm/pull/16768)
- Document the `-l` option to `npm config list`.
- ([@happylynx](https://github.com/happylynx))
-* [`5a803ebad`](https://github.com/npm/npm/commit/5a803ebadd61229bca3d64fb3ef1981729b2548e)
- [#16548](https://github.com/npm/npm/pull/16548)
- Fix permissions for documentation files. Some of them had `+x` set. (???)
- ([@metux](https://github.com/metux))
-* [`d57d4f48c`](https://github.com/npm/npm/commit/d57d4f48c6cd00fdf1e694eb49e9358071d8e105)
- [#17319](https://github.com/npm/npm/pull/17319)
- Document that the `--silent` option for `npm run-script` can be used to
- suppress `npm ERR!` output on errors.
- ([@styfle](https://github.com/styfle))
-
-### MISC
-
-Not all contributions need to be visible features, docs, or bugfixes! It's super
-helpful when community members go over our code and help clean it up, too!
-
-* [`9e5b76140`](https://github.com/npm/npm/commit/9e5b76140ffdb7dcd12aa402793644213fb8c5d7)
- [#17411](https://github.com/npm/npm/pull/17411)
- Convert all callback-style `move` usage to use Promises.
- ([@vramana](https://github.com/vramana))
-* [`0711c08f7`](https://github.com/npm/npm/commit/0711c08f779ac641ec42ecc96f604c8861008b28)
- [#17394](https://github.com/npm/npm/pull/17394)
- Remove unused argument in `deepSortObject`.
- ([@vramana](https://github.com/vramana))
-* [`7d650048c`](https://github.com/npm/npm/commit/7d650048c8ed5faa0486492f1eeb698e7383e32f)
- [#17563](https://github.com/npm/npm/pull/17563)
- Refactor some code to use `Object.assign`.
- ([@vramana](https://github.com/vramana))
-* [`993f673f0`](https://github.com/npm/npm/commit/993f673f056aea5f602ea04b1e697b027c267a2d)
- [#17600](https://github.com/npm/npm/pull/17600)
- Remove an old comment.
- ([@vramana](https://github.com/vramana))
-
-## v5.0.4 (2017-06-13):
-
-Hey y'all. This is another minor patch release with a variety of little fixes
-we've been accumulating~
-
-* [`f0a37ace9`](https://github.com/npm/npm/commit/f0a37ace9ab7879cab20f2b0fcd7840bfc305feb)
- Fix `npm doctor` when hitting registries without `ping`.
- ([@zkat](https://github.com/zkat))
-* [`64f0105e8`](https://github.com/npm/npm/commit/64f0105e81352b42b72900d83b437b90afc6d9ce)
- Fix invalid format error when setting cache-related headers.
- ([@zkat](https://github.com/zkat))
-* [`d2969c80e`](https://github.com/npm/npm/commit/d2969c80e4178faebf0f7c4cab6eb610dd953cc6)
- Fix spurious `EINTEGRITY` issue.
- ([@zkat](https://github.com/zkat))
-* [`800cb2b4e`](https://github.com/npm/npm/commit/800cb2b4e2d0bd00b5c9082a896f2110e907eb0b)
- [#17076](https://github.com/npm/npm/pull/17076)
- Use legacy `from` field to improve upgrade experience from legacy shrinkwraps
- and installs.
- ([@zkat](https://github.com/zkat))
-* [`4100d47ea`](https://github.com/npm/npm/commit/4100d47ea58b4966c02604f71350b5316108df6a)
- [#17007](https://github.com/npm/npm/pull/17007)
- Restore loose semver parsing to match older npm behavior when running into
- invalid semver ranges in dependencies.
- ([@zkat](https://github.com/zkat))
-* [`35316cce2`](https://github.com/npm/npm/commit/35316cce2ca2d8eb94161ec7fe7e8f7bec7b3aa7)
- [#17005](https://github.com/npm/npm/pull/17005)
- Emulate npm@4's behavior of simply marking the peerDep as invalid, instead of
- crashing.
- ([@zkat](https://github.com/zkat))
-* [`e7e8ee5c5`](https://github.com/npm/npm/commit/e7e8ee5c57c7238655677e118a8809b652019f53)
- [#16937](https://github.com/npm/npm/pull/16937)
- Workaround for separate bug where `requested` was somehow null.
- ([@forivall](https://github.com/forivall))
-* [`2d9629bb2`](https://github.com/npm/npm/commit/2d9629bb2043cff47eaad2654a64d2cef5725356)
- Better logging output for git errors.
- ([@zkat](https://github.com/zkat))
-* [`2235aea73`](https://github.com/npm/npm/commit/2235aea73569fb9711a06fa6344ef31247177dcd)
- More scp-url fixes: parsing only worked correctly when a committish was
- present.
- ([@zkat](https://github.com/zkat))
-* [`80c33cf5e`](https://github.com/npm/npm/commit/80c33cf5e6ef207450949764de41ea96538c636e)
- Standardize package permissions on tarball extraction, instead of using perms
- from the tarball. This matches previous npm behavior and fixes a number of
- incompatibilities in the wild.
- ([@zkat](https://github.com/zkat))
-* [`2b1e40efb`](https://github.com/npm/npm/commit/2b1e40efba0b3d1004259efa4275cf42144e3ce3)
- Limit shallow cloning to hosts which are known to support it.
- ([@zkat](https://github.com/zkat))
-
-## v5.0.3 (2017-06-05)
-Happy Monday, y'all! We've got another npm release for you with the fruits of
-our ongoing bugsquashing efforts. You can expect at least one more this week,
-but probably more -- and as we announced last week, we'll be merging fixes more
-rapidly into the `npmc` canary so you can get everything as soon as possible!
-Hope y'all are enjoying npm5 in the meantime, and don't hesitate to file issues
-for anything you find! The goal is to get this release rock-solid as soon as we
-can. 💚
+### DEPENDENCIES
-* [`6e12a5cc0`](https://github.com/npm/npm/commit/6e12a5cc022cb5a157a37df7283b6d7b3d49bdab)
- Bump several dependencies to get improvements and bugfixes:
- * `cacache`: content files (the tarballs) are now read-only.
- * `pacote`: fix failing clones with bad heads, send extra TLS-related opts to proxy, enable global auth configurations and `_auth`-based auth.
- * `ssri`: stop crashing with `can't call method find of undefined` when running into a weird `opts.integrity`/`opts.algorithms` conflict during verification.
- ([@zkat](https://github.com/zkat))
-* [`89cc8e3e1`](https://github.com/npm/npm/commit/89cc8e3e12dad67fd9844accf4d41deb4c180c5c)
- [#16917](https://github.com/npm/npm/pull/16917)
- Send `ca`, `cert` and `key` config through to network layer.
- ([@colinrotherham](https://github.com/colinrotherham))
-* [`6a9b51c67`](https://github.com/npm/npm/commit/6a9b51c67ba3df0372991631992748329b84f2e7)
- [#16929](https://github.com/npm/npm/pull/16929)
- Send `npm-session` header value with registry requests again.
- ([@zarenner](https://github.com/zarenner))
-* [`662a15ab7`](https://github.com/npm/npm/commit/662a15ab7e790e87f5e5a35252f05d5a4a0724a1)
- Fix `npm doctor` so it stop complaining about read-only content files in the
- cache.
- ([@zkat](https://github.com/zkat))
-* [`191d10a66`](https://github.com/npm/npm/commit/191d10a6616d72e26d89fd00f5a4f6158bfbc526)
- [#16918](https://github.com/npm/npm/pull/16918)
- Clarify prepublish deprecation message.
- ([@Hirse](https://github.com/Hirse))
-
-## v5.0.2 (2017-06-02)
-
-Here's another patch release, soon after the other!
-
-This particular release includes a slew of fixes to npm's git support, which was
-causing some issues for a chunk of people, specially those who were using
-self-hosted/Enterprise repos. All of those should be back in working condition
-now.
-
-There's another shiny thing you might wanna know about: npm has a Canary release
-now! The `npm5` experiment we did during our beta proved to be incredibly
-successful: users were able to have a tight feedback loop between reports and
-getting the bugfixes they needed, and the CLI team was able to roll out
-experimental patches and have the community try them out right away. So we want
-to keep doing that.
-
-From now on, you'll be able to install the 'npm canary' with `npm i -g npmc`.
-This release will be a separate binary (`npmc`. Because canary. Get it?), which
-will update independently of the main CLI. Most of the time, this will track
-`release-next` or something close to it. We might occasionally toss experimental
-branches in there to see if our more adventurous users run into anything
-interesting with it. For example, the current canary (`npmc@5.0.1-canary.6`)
-includes an [experimental multiproc
-branch](https://github.com/npm/npm/pull/16633) that parallelizes tarball
-extraction across multiple processes.
-
-If you find any issues while running the canary version, please report them and
-let us know it came from `npmc`! It would be tremendously helpful, and finding
-things early is a huge reason to have it there. Happy hacking!
-
-### A NOTE ABOUT THE ISSUE TRACKER
-
-Just a heads up: We're preparing to do a massive cleanup of the issue tracker.
-It's been a long time since it was something we could really keep up with, and
-we didn't have a process for dealing with it that could actually be sustainable.
-
-We're still sussing the details out, and we'll talk about it more when we're
-about to do it, but the plan is essentially to close old, abandoned issues and
-start over. We will also [add some automation](https://github.com/probot) around
-issue management so that things that we can't keep up with don't just stay
-around forever.
-
-Stay tuned!
-
-### GIT YOLO
-
-* [`1f26e9567`](https://github.com/npm/npm/commit/1f26e9567a6d14088704e121ebe787c38b6849a4)
- `pacote@2.7.27`: Fixes installing committishes that look like semver, even
- though they're not using the required `#semver:` syntax.
- ([@zkat](https://github.com/zkat))
-* [`85ea1e0b9`](https://github.com/npm/npm/commit/85ea1e0b9478551265d03d545e7dc750b9edf547)
- `npm-package-arg@5.1.1`: This includes the npa git-parsing patch to make it so
- non-hosted SCP-style identifiers are correctly handled. Previously, npa would
- mangle them (even though hosted-git-info is doing the right thing for them).
+* [`1c1f89b73`](https://github.com/npm/npm/commit/1c1f89b7319b2eef6adee2530c4619ac1c0d83cf)
+ `libnpx@10.2.0`
([@zkat](https://github.com/zkat))
-
-### COOL NEW OUTPUT
-
-The new summary output has been really well received! One downside that reared
-its head as more people used it, though, is that it doesn't really tell you
-anything about the toplevel versions it installed. So, if you did `npm i -g
-foo`, it would just say "added 1 package". This patch by
-[@rmg](https://github.com/rmg) keeps things concise while still telling you
-what you got! So now, you'll see something like this:
-
-```
-$ npm i -g foo bar
-+ foo@1.2.3
-+ bar@3.2.1
-added 234 packages in .005ms
-```
-
-* [`362f9fd5b`](https://github.com/npm/npm/commit/362f9fd5bec65301082416b4292b8fe3eb7f824a)
- [#16899](https://github.com/npm/npm/pull/16899)
- For every package that is given as an argument to install, print the name and
- version that was actually installed.
- ([@rmg](https://github.com/rmg))
-
-### OTHER BUGFIXES
-
-* [`a47593a98`](https://github.com/npm/npm/commit/a47593a98a402143081d7077d2ac677d13083010)
- [#16835](https://github.com/npm/npm/pull/16835)
- Fix a crash while installing with `--no-shrinkwrap`.
- ([@jacknagel](https://github.com/jacknagel))
-
-### DOC UPATES
-
-* [`89e0cb816`](https://github.com/npm/npm/commit/89e0cb8165dd9c3c7ac74d531617f367099608f4)
- [#16818](https://github.com/npm/npm/pull/16818)
- Fixes a spelling error in the docs. Because the CLI team has trouble spelling
- "package", I guess.
- ([@ankon](https://github.com/ankon))
-* [`c01fbc46e`](https://github.com/npm/npm/commit/c01fbc46e151bcfb359fd68dd7faa392789b4f55)
- [#16895](https://github.com/npm/npm/pull/16895)
- Remove `--save` from `npm init` instructions, since it's now the default.
- ([@jhwohlgemuth](https://github.com/jhwohlgemuth))
-* [`80c42d218`](https://github.com/npm/npm/commit/80c42d2181dd4d1b79fcee4e9233df268dfb30b7)
- Guard against cycles when inflating bundles, as symlinks are bundles now.
- ([@iarna](https://github.com/iarna))
-* [`7fe7f8665`](https://github.com/npm/npm/commit/7fe7f86658798db6667df89afc75588c0e43bc94)
- [#16674](https://github.com/npm/npm/issues/16674)
- Write the builtin config for `npmc`, not just `npm`. This is hardcoded for npm
- self-installations and is needed for Canary to work right.
+* [`242d8a647`](https://github.com/npm/npm/commit/242d8a6478b725778c00be8ba3dc85f367006a61)
+ `pacote@8.1.0`
([@zkat](https://github.com/zkat))
-### DEP UPDATES
-
-* [`63df4fcdd`](https://github.com/npm/npm/commit/63df4fcddc7445efb50cc7d8e09cdd45146d3e39)
- [#16894](https://github.com/npm/npm/pull/16894)
- [`node-gyp@3.6.2`](https://github.com/nodejs/node-gyp/blob/master/CHANGELOG.md#v362-2017-06-01):
- Fixes an issue parsing SDK versions on Windows, among other things.
- ([@refack](https://github.com/refack))
-* [`5bb15c3c4`](https://github.com/npm/npm/commit/5bb15c3c4f0d7d77c73fd6dafa38ac36549b6e00)
- `read-package-tree@5.1.6`: Fixes some racyness while reading the tree.
- ([@iarna](https://github.com/iarna))
-* [`a6f7a52e7`](https://github.com/npm/npm/commit/a6f7a52e7)
- `aproba@1.1.2`: Remove nested function declaration for speed up
- ([@mikesherov](https://github.com/mikesherov))
-
-## v5.0.1 (2017-05-31):
-
-Hey y'all! Hope you're enjoying the new npm!
-
-As you all know, fresh software that's gone through major overhauls tends to
-miss a lot of spots the old one used to handle well enough, and `npm@5` is no
-exception. The CLI team will be doing faster release cycles that go directly to
-the `latest` tag for a couple of weeks while 5 stabilizes a bit and we're
-confident the common low-hanging fruit people are running into are all taken
-care of.
+### DOCS
-With that said: this is our first patch release! The biggest focus is fixing up
-a number of git-related issues that folks ran into right out the door. It also
-fixes other things, like some proxy/auth-related issues, and even has a neat
-speed boost! (You can expect more speed bumps in the coming releases as pending
-work starts landing, too!)
+* [`a1c77d614`](https://github.com/npm/npm/commit/a1c77d614adb4fe6769631b646b817fd490d239c)
+ [#20331](https://github.com/npm/npm/pull/20331)
+ Fix broken link to 'private-modules' page. The redirect went away when the new
+ npm website went up, but the new URL is better anyway.
+ ([@vipranarayan14](https://github.com/vipranarayan14))
+* [`ad7a5962d`](https://github.com/npm/npm/commit/ad7a5962d758efcbcfbd9fda9a3d8b38ddbf89a1)
+ [#20279](https://github.com/npm/npm/pull/20279)
+ Document the `--if-present` option for `npm run-script`.
+ ([@aleclarson](https://github.com/aleclarson))
-Thanks everyone who's been reporting issues and submitting patches!
+## v6.0.0-next.1 (2018-04-12):
-### BUGFIXES
+### NEW FEATURES
-* [`e61e68dac`](https://github.com/npm/npm/commit/e61e68dac4fa51c0540a064204a75b19f8052e58)
- [#16762](https://github.com/npm/npm/pull/16762)
- Make `npm publish` obey the `--tag` flag again.
+* [`a9e722118`](https://github.com/npm/npm/commit/a9e7221181dc88e14820d0677acccf0648ac3c5a)
+ [#20256](https://github.com/npm/npm/pull/20256)
+ Add support for managing npm webhooks. This brings over functionality
+ previously provided by the [`wombat`](https://www.npmjs.com/package/wombat) CLI.
([@zkat](https://github.com/zkat))
-* [`923fd58d3`](https://github.com/npm/npm/commit/923fd58d312f40f8c17b232ad1dfc8e2ff622dbd)
- [#16749](https://github.com/npm/npm/pull/16749)
- Speed up installations by nearly 20% by... removing one line of code. (hah)
- ([@mikesherov](https://github.com/mikesherov))
-* [`9aac984cb`](https://github.com/npm/npm/commit/9aac984cbbfef22182ee42b51a193c0b47146ad6)
- Guard against a particular failure mode for a bug still being hunted down.
+* [`8a1a64203`](https://github.com/npm/npm/commit/8a1a64203cca3f30999ea9e160eb63662478dcee)
+ [#20126](https://github.com/npm/npm/pull/20126)
+ Add `npm cit` command that's equivalent of `npm ci && npm t` that's equivalent of `npm it`.
+ ([@SimenB](https://github.com/SimenB))
+* [`fe867aaf1`](https://github.com/npm/npm/commit/fe867aaf19e924322fe58ed0cf0a570297a96559)
+ [`49d18b4d8`](https://github.com/npm/npm/commit/49d18b4d87d8050024f8c5d7a0f61fc2514917b1)
+ [`ff6b31f77`](https://github.com/npm/npm/commit/ff6b31f775f532bb8748e8ef85911ffb35a8c646)
+ [`78eab3cda`](https://github.com/npm/npm/commit/78eab3cdab6876728798f876d569badfc74ce68f)
+ The `requires` field in your lock-file will be upgraded to use ranges from
+ versions on your first use of npm.
([@iarna](https://github.com/iarna))
-* [`80ab521f1`](https://github.com/npm/npm/commit/80ab521f18d34df109de0c5dc9eb1cde5ff6d7e8)
- Pull in dependency updates for various core deps:
- * New `pacote` fixes several git-related bugs.
- * `ssri` update fixes crash on early node@4 versions.
- * `make-fetch-happen` update fixes proxy authentication issue.
- * `npm-user-validate` adds regex for blocking usernames with illegal chars.
- ([@zkat](https://github.com/zkat))
-* [`7e5ce87b8`](https://github.com/npm/npm/commit/7e5ce87b84880c7433ee4c07d2dd6ce8806df436)
- `pacote@2.7.26`:
- Fixes various other git issues related to commit hashes.
+* [`cf4d7b4de`](https://github.com/npm/npm/commit/cf4d7b4de6fa241a656e58f662af0f8d7cd57d21)
+ [#20257](https://github.com/npm/npm/pull/20257)
+ Add shasum and integrity to the new `npm view` output.
([@zkat](https://github.com/zkat))
-* [`acbe85bfc`](https://github.com/npm/npm/commit/acbe85bfc1a68d19ca339a3fb71da0cffbf58926)
- [#16791](https://github.com/npm/npm/pull/16791)
- `npm view` was calling `cb` prematurely and giving partial output when called
- in a child process.
- ([@zkat](https://github.com/zkat))
-* [`ebafe48af`](https://github.com/npm/npm/commit/ebafe48af91f702ccefc8c619d52fed3b8dfd3c7)
- [#16750](https://github.com/npm/npm/pull/16750)
- Hamilpatch the Musical: Talk less, complete more.
- ([@aredridel](https://github.com/aredridel))
-
-### DOCUMENTATION
-
-* [`dc2823a6c`](https://github.com/npm/npm/commit/dc2823a6c5fc098041e61515c643570819d059d2)
- [#16799](https://github.com/npm/npm/pull/16799)
- Document that `package-lock.json` is never allowed in tarballs.
- ([@sonicdoe](https://github.com/sonicdoe))
-* [`f3cb84b44`](https://github.com/npm/npm/commit/f3cb84b446c51d628ee0033cdf13752c15b31a29)
- [#16771](https://github.com/npm/npm/pull/16771)
- Fix `npm -l` usage information for the `test` command.
- ([@grawlinson](https://github.com/grawlinson))
-
-### OTHER CHANGES
-
-* [`661262309`](https://github.com/npm/npm/commit/66126230912ab5ab35287b40a9908e036fa73994)
- [#16756](https://github.com/npm/npm/pull/16756)
- remove unused argument
- ([@Aladdin-ADD](https://github.com/Aladdin-ADD))
-* [`c3e0b4287`](https://github.com/npm/npm/commit/c3e0b4287ea69735cc367aa7bb7e7aa9a6d9804b)
- [#16296](https://github.com/npm/npm/pull/16296)
- preserve same name convention for command
- ([@desfero](https://github.com/desfero))
-* [`9f814831d`](https://github.com/npm/npm/commit/9f814831d330dde7702973186aea06caaa77ff31)
- [#16757](https://github.com/npm/npm/pull/16757)
- remove unused argument
- ([@Aladdin-ADD](https://github.com/Aladdin-ADD))
-* [`3cb843239`](https://github.com/npm/npm/commit/3cb8432397b3666d88c31131dbb4599016a983ff)
- minor linter fix
- ([@zkat](https://github.com/zkat))
-
-## v5.0.0 (2017-05-25)
-
-Wowowowowow npm@5!
-
-This release marks months of hard work for the young, scrappy, and hungry CLI
-team, and includes some changes we've been hoping to do for literally years.
-npm@5 takes npm a pretty big step forward, significantly improving its
-performance in almost all common situations, fixing a bunch of old errors due to
-the architecture, and just generally making it more robust and fault-tolerant.
-It comes with changes to make life easier for people doing monorepos, for users
-who want consistency/security guarantees, and brings semver support to git
-dependencies. See below for all the deets!
-
-### Breaking Changes
-
-* Existing npm caches will no longer be used: you will have to redownload any cached packages. There is no tool or intention to reuse old caches. ([#15666](https://github.com/npm/npm/pull/15666))
-
-* `npm install ./packages/subdir` will now create a symlink instead of a regular installation. `file://path/to/tarball.tgz` will not change -- only directories are symlinked. ([#15900](https://github.com/npm/npm/pull/15900))
-
-* npm will now scold you if you capitalize its name. seriously it will fight you.
-
-* [npm will `--save` by default now](https://twitter.com/maybekatz/status/859229741676625920). Additionally, `package-lock.json` will be automatically created unless an `npm-shrinkwrap.json` exists. ([#15666](https://github.com/npm/npm/pull/15666))
-
-* Git dependencies support semver through `user/repo#semver:^1.2.3` ([#15308](https://github.com/npm/npm/pull/15308)) ([#15666](https://github.com/npm/npm/pull/15666)) ([@sankethkatta](https://github.com/sankethkatta))
-
-* Git dependencies with `prepare` scripts will have their `devDependencies` installed, and `npm install` run in their directory before being packed.
-
-* `npm cache` commands have been rewritten and don't really work anything like they did before. ([#15666](https://github.com/npm/npm/pull/15666))
-
-* `--cache-min` and `--cache-max` have been deprecated. ([#15666](https://github.com/npm/npm/pull/15666))
-
-* Running npm while offline will no longer insist on retrying network requests. npm will now immediately fall back to cache if possible, or fail. ([#15666](https://github.com/npm/npm/pull/15666))
-
-* package locks no longer exclude `optionalDependencies` that failed to build. This means package-lock.json and npm-shrinkwrap.json should now be cross-platform. ([#15900](https://github.com/npm/npm/pull/15900))
-
-* If you generated your package lock against registry A, and you switch to registry B, npm will now try to [install the packages from registry B, instead of A](https://twitter.com/maybekatz/status/862834964932435969). If you want to use different registries for different packages, use scope-specific registries (`npm config set @myscope:registry=https://myownregist.ry/packages/`). Different registries for different unscoped packages are not supported anymore.
-
-* Shrinkwrap and package-lock no longer warn and exit without saving the lockfile.
-
-* Local tarballs can now only be installed if they have a file extensions `.tar`, `.tar.gz`, or `.tgz`.
-
-* A new loglevel, `notice`, has been added and set as default.
-* One binary to rule them all: `./cli.js` has been removed in favor of `./bin/npm-cli.js`. In case you were doing something with `./cli.js` itself. ([#12096](https://github.com/npm/npm/pull/12096)) ([@watilde](https://github.com/watilde))
-
-* Stub file removed ([#16204](https://github.com/npm/npm/pull/16204)) ([@watilde](https://github.com/watilde))
-
-* The "extremely legacy" `_token` couchToken has been removed. ([#12986](https://github.com/npm/npm/pull/12986))
-
-### Feature Summary
-
-#### Installer changes
-
-* A new, standardised lockfile feature meant for cross-package-manager compatibility (`package-lock.json`), and a new format and semantics for shrinkwrap. ([#16441](https://github.com/npm/npm/pull/16441))
-
-* `--save` is no longer necessary. All installs will be saved by default. You can prevent saving with `--no-save`. Installing optional and dev deps is unchanged: use `-D/--save-dev` and `-O/--save-optional` if you want them saved into those fields instead. Note that since npm@3, npm will automatically update npm-shrinkwrap.json when you save: this will also be true for `package-lock.json`. ([#15666](https://github.com/npm/npm/pull/15666))
-
-* Installing a package directory now ends up creating a symlink and does the Right Thing™ as far as saving to and installing from the package lock goes. If you have a monorepo, this might make things much easier to work with, and probably a lot faster too. 😁 ([#15900](https://github.com/npm/npm/pull/15900))
-
-* Project-level (toplevel) `preinstall` scripts now run before anything else, and can modify `node_modules` before the CLI reads it.
-
-* Two new scripts have been added, `prepack` and `postpack`, which will run on both `npm pack` and `npm publish`, but NOT on `npm install` (without arguments). Combined with the fact that `prepublishOnly` is run before the tarball is generated, this should round out the general story as far as putzing around with your code before publication.
+### BUG FIXES
-* Git dependencies with `prepare` scripts will now [have their devDependencies installed, and their prepare script executed](https://twitter.com/maybekatz/status/860363896443371520) as if under `npm pack`.
+* [`685764308`](https://github.com/npm/npm/commit/685764308e05ff0ddb9943b22ca77b3a56d5c026)
+ Fix a bug where OTPs passed in via the commandline would have leading
+ zeros deleted resulted in authentication failures.
+ ([@iarna](https://github.com/iarna))
+* [`8f3faa323`](https://github.com/npm/npm/commit/8f3faa3234b2d2fcd2cb05712a80c3e4133c8f45)
+ [`6800f76ff`](https://github.com/npm/npm/commit/6800f76ffcd674742ba8944f11f6b0aa55f4b612)
+ [`ec90c06c7`](https://github.com/npm/npm/commit/ec90c06c78134eb2618612ac72288054825ea941)
+ [`825b5d2c6`](https://github.com/npm/npm/commit/825b5d2c60e620da5459d9dc13d4f911294a7ec2)
+ [`4785f13fb`](https://github.com/npm/npm/commit/4785f13fb69f33a8c624ecc8a2be5c5d0d7c94fc)
+ [`bd16485f5`](https://github.com/npm/npm/commit/bd16485f5b3087625e13773f7251d66547d6807d)
+ Restore the ability to bundle dependencies that are uninstallable from the
+ registry. This also eliminates needless registry lookups for bundled
+ dependencies.
+
+ Fixed a bug where attempting to install a dependency that is bundled
+ inside another module without reinstalling that module would result in
+ ENOENT errors.
+ ([@iarna](https://github.com/iarna))
+* [`429498a8c`](https://github.com/npm/npm/commit/429498a8c8d4414bf242be6a3f3a08f9a2adcdf9)
+ [#20029](https://github.com/npm/npm/pull/20029)
+ Allow packages with non-registry specifiers to follow the fast path that
+ the we use with the lock-file for registry specifiers. This will improve install time
+ especially when operating only on the package-lock (`--package-lock-only`).
+ ([@zkat](https://github.com/zkat))
+
+ Fix the a bug where `npm i --only=prod` could remove development
+ dependencies from lock-file.
+ ([@iarna](https://github.com/iarna))
+* [`834b46ff4`](https://github.com/npm/npm/commit/834b46ff48ade4ab4e557566c10e83199d8778c6)
+ [#20122](https://github.com/npm/npm/pull/20122)
+ Improve the update-notifier messaging (borrowing ideas from pnpm) and
+ eliminate false positives.
+ ([@zkat](https://github.com/zkat))
+* [`f9de7ef3a`](https://github.com/npm/npm/commit/f9de7ef3a1089ceb2610cd27bbd4b4bc2979c4de)
+ [#20154](https://github.com/npm/npm/pull/20154)
+ Let version succeed when `package-lock.json` is gitignored.
+ ([@nwoltman](https://github.com/nwoltman))
+* [`f8ec52073`](https://github.com/npm/npm/commit/f8ec520732bda687bc58d9da0873dadb2d65ca96)
+ [#20212](https://github.com/npm/npm/pull/20212)
+ Ensure that we only create an `etc` directory if we are actually going to write files to it.
+ ([@buddydvd](https://github.com/buddydvd))
+* [`ab489b753`](https://github.com/npm/npm/commit/ab489b75362348f412c002cf795a31dea6420ef0)
+ [#20140](https://github.com/npm/npm/pull/20140)
+ Note in documentation that `package-lock.json` version gets touched by `npm version`.
+ ([@srl295](https://github.com/srl295))
+* [`857c2138d`](https://github.com/npm/npm/commit/857c2138dae768ea9798782baa916b1840ab13e8)
+ [#20032](https://github.com/npm/npm/pull/20032)
+ Fix bug where unauthenticated errors would get reported as both 404s and
+ 401s, i.e. `npm ERR! 404 Registry returned 401`. In these cases the error
+ message will now be much more informative.
+ ([@iarna](https://github.com/iarna))
+* [`d2d290bca`](https://github.com/npm/npm/commit/d2d290bcaa85e44a4b08cc40cb4791dd4f81dfc4)
+ [#20082](https://github.com/npm/npm/pull/20082)
+ Allow optional @ prefix on scope with `npm team` commands for parity with other commands.
+ ([@bcoe](https://github.com/bcoe))
+* [`b5babf0a9`](https://github.com/npm/npm/commit/b5babf0a9aa1e47fad8a07cc83245bd510842047)
+ [#19580](https://github.com/npm/npm/pull/19580)
+ Improve messaging when two-factor authentication is required while publishing.
+ ([@jdeniau](https://github.com/jdeniau))
+* [`471ee1c5b`](https://github.com/npm/npm/commit/471ee1c5b58631fe2e936e32480f3f5ed6438536)
+ [`0da38b7b4`](https://github.com/npm/npm/commit/0da38b7b4aff0464c60ad12e0253fd389efd5086)
+ Fix a bug where optional status of a dependency was not being saved to
+ the package-lock on the initial install.
+ ([@iarna](https://github.com/iarna))
+* [`b3f98d8ba`](https://github.com/npm/npm/commit/b3f98d8ba242a7238f0f9a90ceea840b7b7070af)
+ [`9dea95e31`](https://github.com/npm/npm/commit/9dea95e319169647bea967e732ae4c8212608f53)
+ Ensure that `--no-optional` does not remove optional dependencies from the lock-file.
+ ([@iarna](https://github.com/iarna))
+
+### MISCELLANEOUS
+
+* [`ec6b12099`](https://github.com/npm/npm/commit/ec6b120995c9c1d17ff84bf0217ba5741365af2d)
+ Exclude all tests from the published version of npm itself.
+ ([@iarna](https://github.com/iarna))
-* Git dependencies now support semver-based matching: `npm install git://github.com/npm/npm#semver:^5` (#15308, #15666)
+### DEPENDENCY UPDATES
-* `node-gyp` now supports `node-gyp.cmd` on Windows ([#14568](https://github.com/npm/npm/pull/14568))
+* [`73dc97455`](https://github.com/npm/npm/commit/73dc974555217207fb384e39d049da19be2f79ba)
+ [zkat/cipm#46](https://github.com/zkat/cipm/pull/46)
+ `libcipm@1.6.2`:
+ Detect binding.gyp for default install lifecycle. Let's `npm ci` work on projects that
+ have their own C code.
+ ([@caleblloyd](https://github.com/caleblloyd))
+* [`77c3f7a00`](https://github.com/npm/npm/commit/77c3f7a0091f689661f61182cd361465e2d695d5)
+ `iferr@1.0.0`
+* [`dce733e37`](https://github.com/npm/npm/commit/dce733e37687c21cb1a658f06197c609ac39c793)
+ [zkat/json-parse-better-errors#1](https://github.com/zkat/json-parse-better-errors/pull/1)
+ `json-parse-better-errors@1.0.2`
+ ([@Hoishin](https://github.com/Hoishin))
+* [`c52765ff3`](https://github.com/npm/npm/commit/c52765ff32d195842133baf146d647760eb8d0cd)
+ `readable-stream@2.3.6`
+ ([@mcollina](https://github.com/mcollina))
+* [`e160adf9f`](https://github.com/npm/npm/commit/e160adf9fce09f226f66e0892cc3fa45f254b5e8)
+ `update-notifier@2.4.0`
+ ([@sindersorhus](https://github.com/sindersorhus))
+* [`9a9d7809e`](https://github.com/npm/npm/commit/9a9d7809e30d1add21b760804be4a829e3c7e39e)
+ `marked@0.3.1`
+ ([@joshbruce](https://github.com/joshbruce))
+* [`f2fbd8577`](https://github.com/npm/npm/commit/f2fbd857797cf5c12a68a6fb0ff0609d373198b3)
+ [#20256](https://github.com/npm/npm/pull/20256)
+ `figgy-pudding@2.0.1`
+ ([@zkat](https://github.com/zkat))
+* [`44972d53d`](https://github.com/npm/npm/commit/44972d53df2e0f0cc22d527ac88045066205dbbf)
+ [#20256](https://github.com/npm/npm/pull/20256)
+ `libnpmhook@3.0.0`
+ ([@zkat](https://github.com/zkat))
+* [`cfe562c58`](https://github.com/npm/npm/commit/cfe562c5803db08a8d88957828a2cd1cc51a8dd5)
+ [#20276](https://github.com/npm/npm/pull/20276)
+ `node-gyp@3.6.2`
+* [`3c0bbcb8e`](https://github.com/npm/npm/commit/3c0bbcb8e5440a3b90fabcce85d7a1d31e2ecbe7)
+ [zkat/npx#172](https://github.com/zkat/npx/pull/172)
+ `libnpx@10.1.1`
+ ([@jdalton](https://github.com/jdalton))
+* [`0573d91e5`](https://github.com/npm/npm/commit/0573d91e57c068635a3ad4187b9792afd7b5e22f)
+ [zkat/cacache#128](https://github.com/zkat/cacache/pull/128)
+ `cacache@11.0.1`
+ ([@zkat](https://github.com/zkat))
+* [`396afa99f`](https://github.com/npm/npm/commit/396afa99f61561424866d5c8dd7aedd6f91d611a)
+ `figgy-pudding@3.1.0`
+ ([@zkat](https://github.com/zkat))
+* [`e7f869c36`](https://github.com/npm/npm/commit/e7f869c36ec1dacb630e5ab749eb3bb466193f01)
+ `pacote@8.0.0`
+ ([@zkat](https://github.com/zkat))
+* [`77dac72df`](https://github.com/npm/npm/commit/77dac72dfdb6add66ec859a949b1d2d788a379b7)
+ `ssri@6.0.0`
+ ([@zkat](https://github.com/zkat))
+* [`0b802f2a0`](https://github.com/npm/npm/commit/0b802f2a0bfa15c6af8074ebf9347f07bccdbcc7)
+ `retry@0.12.0`
+ ([@iarna](https://github.com/iarna))
+* [`4781b64bc`](https://github.com/npm/npm/commit/4781b64bcc47d4e7fb7025fd6517cde044f6b5e1)
+ `libnpmhook@4.0.1`
+ ([@zkat](https://github.com/zkat))
+* [`7bdbaeea6`](https://github.com/npm/npm/commit/7bdbaeea61853280f00c8443a3b2d6e6b893ada9)
+ `npm-package-arg@6.1.0`
+ ([@zkat](https://github.com/zkat))
+* [`5f2bf4222`](https://github.com/npm/npm/commit/5f2bf4222004117eb38c44ace961bd15a779fd66)
+ `read-package-tree@5.2.1`
+ ([@zkat](https://github.com/zkat))
+
+## v6.0.0-0 (2018-03-23):
+
+Sometimes major releases are a big splash, sometimes they're something
+smaller. This is the latter kind. That said, we expect to keep this in
+release candidate status until Node 10 ships at the end of April. There
+will likely be a few more features for the 6.0.0 release line between now
+and then. We do expect to have a bigger one later this year though, so keep
+an eye out for `npm@7`!
+
+### *BREAKING* AVOID DEPRECATED
+
+When selecting versions to install, we now avoid deprecated versions if
+possible. For example:
-* npm no longer blasts your screen with the whole installed tree. Instead, you'll see a summary report of the install that is much kinder on your shell real-estate. Specially for large projects. ([#15914](https://github.com/npm/npm/pull/15914)):
```
-$ npm install
-npm added 125, removed 32, updated 148 and moved 5 packages in 5.032s.
-$
+Module: example
+Versions:
+1.0.0
+1.1.0
+1.1.2
+1.1.3 (deprecated)
+1.2.0 (latest)
```
-* `--parseable` and `--json` now work more consistently across various commands, particularly `install` and `ls`.
-
-* Indentation is now [detected and preserved](https://twitter.com/maybekatz/status/860690502932340737) for `package.json`, `package-lock.json`, and `npm-shrinkwrap.json`. If the package lock is missing, it will default to `package.json`'s current indentation.
-
-#### Publishing
+If you ask `npm` to install `example@~1.1.0`, `npm` will now give you `1.1.2`.
-* New [publishes will now include *both* `sha512`](https://twitter.com/maybekatz/status/863201943082065920) and `sha1` checksums. Versions of npm from 5 onwards will use the strongest algorithm available to verify downloads. [npm/npm-registry-client#157](https://github.com/npm/npm-registry-client/pull/157)
+By contrast, if you installed `example@~1.1.3` then you'd get `1.1.3`, as
+it's the only version that can match the range.
-#### Cache Rewrite!
-
-We've been talking about rewriting the cache for a loooong time. So here it is.
-Lots of exciting stuff ahead. The rewrite will also enable some exciting future
-features, but we'll talk about those when they're actually in the works. #15666
-is the main PR for all these changes. Additional PRs/commits are linked inline.
+* [`78bebc0ce`](https://github.com/npm/npm/commit/78bebc0cedc4ce75c974c47b61791e6ca1ccfd7e)
+ [#20151](https://github.com/npm/npm/pull/20151)
+ Skip deprecated versions when possible.
+ ([@zkat](https://github.com/zkat))
-* Package metadata, package download, and caching infrastructure replaced.
+### *BREAKING* UPDATE AND OUTDATED
-* It's a bit faster. [Hopefully it will be noticeable](https://twitter.com/maybekatz/status/865393382260056064). 🤔
+When `npm install` is finding a version to install, it first checks to see
+if the specifier you requested matches the `latest` tag. If it doesn't,
+then it looks for the highest version that does. This means you can do
+release candidates on tags other than `latest` and users won't see them
+unless they ask for them. Promoting them is as easy as setting the `latest`
+tag to point at them.
-* With the shrinkwrap and package-lock changes, tarballs will be looked up in the cache by content address (and verified with it).
+Historically `npm update` and `npm outdated` worked differently. They just
+looked for the most recent thing that matched the semver range, disregarding
+the `latest` tag. We're changing it to match `npm install`'s behavior.
-* Corrupted cache entries will [automatically be removed and re-fetched](https://twitter.com/maybekatz/status/854933138182557696) on integrity check failure.
+* [`3aaa6ef42`](https://github.com/npm/npm/commit/3aaa6ef427b7a34ebc49cd656e188b5befc22bae)
+ Make update and outdated respect latest interaction with semver as install does.
+ ([@iarna](https://github.com/iarna))
+* [`e5fbbd2c9`](https://github.com/npm/npm/commit/e5fbbd2c999ab9c7ec15b30d8b4eb596d614c715)
+ `npm-pick-manifest@2.1.0`
+ ([@iarna](https://github.com/iarna))
-* npm CLI now supports tarball hashes with any hash function supported by Node.js. That is, it will [use `sha512` for tarballs from registries that send a `sha512` checksum as the tarball hash](https://twitter.com/maybekatz/status/858137093624573953). Publishing with `sha512` is added by [npm/npm-registry-client#157](https://github.com/npm/npm-registry-client/pull/157) and may be backfilled by the registry for older entries.
+### PLUS ONE SMALLER PATCH
-* Remote tarball requests are now cached. This means that even if you're missing the `integrity` field in your shrinkwrap or package-lock, npm will be able to install from the cache.
+Technically this is a bug fix, but the change in behavior is enough of an
+edge case that I held off on bringing it in until a major version.
-* Downloads for large packages are streamed in and out of disk. npm is now able to install packages of """any""" size without running out of memory. Support for publishing them is pending (due to registry limitations).
+When we extract a binary and it starts with a shebang (or "hash bang"), that
+is, something like:
-* [Automatic fallback-to-offline mode](https://twitter.com/maybekatz/status/854176565587984384). npm will seamlessly use your cache if you are offline, or if you lose access to a particular registry (for example, if you can no longer access a private npm repo, or if your git host is unavailable).
+```
+#!/usr/bin/env node
+```
-* A new `--prefer-offline` option will make npm skip any conditional requests (304 checks) for stale cache data, and *only* hit the network if something is missing from the cache.
+If the file has Windows line endings we strip them off of the first line.
+The reason for this is that shebangs are only used in Unix-like environments
+and the files with them can't be run if the shebang has a Windows line ending.
-* A new `--prefer-online` option that will force npm to revalidate cached data (with 304 checks), ignoring any staleness checks, and refreshing the cache with revalidated, fresh data.
+Previously we converted ALL line endings from Windows to Unix. With this
+patch we only convert the line with the shebang. (Node.js works just fine
+with either set of line endings.)
-* A new `--offline` option will force npm to use the cache or exit. It will error with an `ENOTCACHED` code if anything it tries to install isn't already in the cache.
+* [`814658371`](https://github.com/npm/npm/commit/814658371bc7b820b23bc138e2b90499d5dda7b1)
+ [`7265198eb`](https://github.com/npm/npm/commit/7265198ebb32d35937f4ff484b0167870725b054)
+ `bin-links@1.1.2`:
+ Only rewrite the CR after a shebang (if any) when fixing up CR/LFs.
+ ([@iarna](https://github.com/iarna))
-* A new `npm cache verify` command that will garbage collect your cache, reducing disk usage for things you don't need (-handwave-), and will do full integrity verification on both the index and the content. This is also hooked into `npm doctor` as part of its larger suite of checking tools.
+### *BREAKING* SUPPORTED NODE VERSIONS
-* The new cache is *very* fault tolerant and supports concurrent access.
- * Multiple npm processes will not corrupt a shared cache.
- * Corrupted data will not be installed. Data is checked on both insertion and extraction, and treated as if it were missing if found to be corrupted. I will literally bake you a cookie if you manage to corrupt the cache in such a way that you end up with the wrong data in your installation (installer bugs notwithstanding).
- * `npm cache clear` is no longer useful for anything except clearing up disk space.
+Per our supported Node.js policy, we're dropping support for both Node 4 and
+Node 7, which are no longer supported by the Node.js project.
-* Package metadata is cached separately per registry and package type: you can't have package name conflicts between locally-installed packages, private repo packages, and public repo packages. Identical tarball data will still be shared/deduplicated as long as their hashes match.
+* [`077cbe917`](https://github.com/npm/npm/commit/077cbe917930ed9a0c066e10934d540e1edb6245)
+ Drop support for Node 4 and Node 7.
+ ([@iarna](https://github.com/iarna))
-* HTTP cache-related headers and features are "fully" (lol) supported for both metadata and tarball requests -- if you have your own registry, you can define your own cache settings the CLI will obey!
+### DEPENDENCIES
-* `prepublishOnly` now runs *before* the tarball to publish is created, after `prepare` has run.
+* [`478fbe2d0`](https://github.com/npm/npm/commit/478fbe2d0bce1534b1867e0b80310863cfacc01a)
+ `iferr@1.0.0`
+* [`b18d88178`](https://github.com/npm/npm/commit/b18d88178a4cf333afd896245a7850f2f5fb740b)
+ `query-string@6.0.0`
+* [`e02fa7497`](https://github.com/npm/npm/commit/e02fa7497f89623dc155debd0143aa54994ace74)
+ `is-cidr@2.0.5`
+* [`c8f8564be`](https://github.com/npm/npm/commit/c8f8564be6f644e202fccd9e3de01d64f346d870)
+ [`311e55512`](https://github.com/npm/npm/commit/311e5551243d67bf9f0d168322378061339ecff8)
+ `standard@11.0.1`
diff --git a/deps/npm/Makefile b/deps/npm/Makefile
index 42b7beda933770..4e00647a19cf08 100644
--- a/deps/npm/Makefile
+++ b/deps/npm/Makefile
@@ -65,9 +65,9 @@ dev: install
link: uninstall
node bin/npm-cli.js link -f
-clean: markedclean marked-manclean doc-clean uninstall
+clean: markedclean marked-manclean doc-clean
rm -rf npmrc
- node bin/npm-cli.js cache clean
+ node bin/npm-cli.js cache clean --force
uninstall:
node bin/npm-cli.js rm npm -g -f
diff --git a/deps/npm/README.md b/deps/npm/README.md
index d394af73dd244f..21bdfdb33f1519 100644
--- a/deps/npm/README.md
+++ b/deps/npm/README.md
@@ -11,9 +11,9 @@ Much more info available via `npm help` once it's installed.
## IMPORTANT
-**You need node v4 or higher to run this program.**
+**You need node v6 or higher to run this program.**
-To install an old **and unsupported** version of npm that works on node v0.12
+To install an old **and unsupported** version of npm that works on node v5
and prior, clone the git repo and dig through the old tags and branches.
**npm is configured to use npm, Inc.'s public package registry at
diff --git a/deps/npm/bin/npm-cli.js b/deps/npm/bin/npm-cli.js
index e2c013b5df8637..d7c14bc4b2cd02 100755
--- a/deps/npm/bin/npm-cli.js
+++ b/deps/npm/bin/npm-cli.js
@@ -1,7 +1,7 @@
#!/usr/bin/env node
;(function () { // wrapper in case we're in module_context mode
// windows: running "npm blah" in this folder will invoke WSH, not node.
- /*global WScript*/
+ /* global WScript */
if (typeof WScript !== 'undefined') {
WScript.echo(
'npm does not work when run\n' +
@@ -25,17 +25,10 @@
unsupported.checkForUnsupportedNode()
- if (!unsupported.checkVersion(process.version).unsupported) {
- var updater = require('update-notifier')
- var pkg = require('../package.json')
- updater({pkg: pkg}).notify({defer: true})
- }
-
var path = require('path')
var npm = require('../lib/npm.js')
var npmconf = require('../lib/config/core.js')
var errorHandler = require('../lib/utils/error-handler.js')
- var output = require('../lib/utils/output.js')
var configDefs = npmconf.defs
var shorthands = configDefs.shorthands
@@ -81,10 +74,70 @@
conf._exit = true
npm.load(conf, function (er) {
if (er) return errorHandler(er)
+ if (!unsupported.checkVersion(process.version).unsupported) {
+ const pkg = require('../package.json')
+ let notifier = require('update-notifier')({pkg})
+ if (
+ notifier.update &&
+ notifier.update.latest !== pkg.version
+ ) {
+ const color = require('ansicolors')
+ const useColor = npm.config.get('color')
+ const useUnicode = npm.config.get('unicode')
+ const old = notifier.update.current
+ const latest = notifier.update.latest
+ let type = notifier.update.type
+ if (useColor) {
+ switch (type) {
+ case 'major':
+ type = color.red(type)
+ break
+ case 'minor':
+ type = color.yellow(type)
+ break
+ case 'patch':
+ type = color.green(type)
+ break
+ }
+ }
+ const changelog = `https://github.com/npm/npm/releases/tag/v${latest}`
+ notifier.notify({
+ message: `New ${type} version of ${pkg.name} available! ${
+ useColor ? color.red(old) : old
+ } ${useUnicode ? '→' : '->'} ${
+ useColor ? color.green(latest) : latest
+ }\n` +
+ `${
+ useColor ? color.yellow('Changelog:') : 'Changelog:'
+ } ${
+ useColor ? color.cyan(changelog) : changelog
+ }\n` +
+ `Run ${
+ useColor
+ ? color.green(`npm install -g ${pkg.name}`)
+ : `npm i -g ${pkg.name}`
+ } to update!`
+ })
+ }
+ }
npm.commands[npm.command](npm.argv, function (err) {
- // https://www.youtube.com/watch?v=7nfPu8qTiQU
- if (!err && npm.config.get('ham-it-up') && !npm.config.get('json') && !npm.config.get('parseable') && npm.command !== 'completion') {
- output('\n 🎵 I Have the Honour to Be Your Obedient Servant,🎵 ~ npm 📜🖋\n')
+ // https://genius.com/Lin-manuel-miranda-your-obedient-servant-lyrics
+ if (
+ !err &&
+ npm.config.get('ham-it-up') &&
+ !npm.config.get('json') &&
+ !npm.config.get('parseable') &&
+ npm.command !== 'completion'
+ ) {
+ console.error(
+ `\n ${
+ npm.config.get('unicode') ? '🎵 ' : ''
+ } I Have the Honour to Be Your Obedient Servant,${
+ npm.config.get('unicode') ? '🎵 ' : ''
+ } ~ npm ${
+ npm.config.get('unicode') ? '📜🖋 ' : ''
+ }\n`
+ )
}
errorHandler.apply(this, arguments)
})
diff --git a/deps/npm/bin/npx b/deps/npm/bin/npx
index a49c608bab89ba..261e339850da5e 100644
--- a/deps/npm/bin/npx
+++ b/deps/npm/bin/npx
@@ -12,18 +12,19 @@ if ! [ -x "$NODE_EXE" ]; then
NODE_EXE=node
fi
+NPM_CLI_JS="$basedir/node_modules/npm/bin/npm-cli.js"
NPX_CLI_JS="$basedir/node_modules/npm/bin/npx-cli.js"
case `uname` in
*MINGW*)
- NPM_PREFIX=`"$NODE_EXE" "$NPX_CLI_JS" prefix -g`
+ NPM_PREFIX=`"$NODE_EXE" "$NPM_CLI_JS" prefix -g`
NPM_PREFIX_NPX_CLI_JS="$NPM_PREFIX/node_modules/npm/bin/npx-cli.js"
if [ -f "$NPM_PREFIX_NPX_CLI_JS" ]; then
NPX_CLI_JS="$NPM_PREFIX_NPX_CLI_JS"
fi
;;
*CYGWIN*)
- NPM_PREFIX=`"$NODE_EXE" "$NPX_CLI_JS" prefix -g`
+ NPM_PREFIX=`"$NODE_EXE" "$NPM_CLI_JS" prefix -g`
NPM_PREFIX_NPX_CLI_JS="$NPM_PREFIX/node_modules/npm/bin/npx-cli.js"
if [ -f "$NPM_PREFIX_NPX_CLI_JS" ]; then
NPX_CLI_JS="$NPM_PREFIX_NPX_CLI_JS"
diff --git a/deps/npm/bin/npx.cmd b/deps/npm/bin/npx.cmd
index 02fcbd9ffc2325..9339ebd0652820 100644
--- a/deps/npm/bin/npx.cmd
+++ b/deps/npm/bin/npx.cmd
@@ -8,8 +8,9 @@ IF NOT EXIST "%NODE_EXE%" (
SET "NODE_EXE=node"
)
+SET "NPM_CLI_JS=%~dp0\node_modules\npm\bin\npm-cli.js"
SET "NPX_CLI_JS=%~dp0\node_modules\npm\bin\npx-cli.js"
-FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPX_CLI_JS%" prefix -g') DO (
+FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_CLI_JS%" prefix -g') DO (
SET "NPM_PREFIX_NPX_CLI_JS=%%F\node_modules\npm\bin\npx-cli.js"
)
IF EXIST "%NPM_PREFIX_NPX_CLI_JS%" (
diff --git a/deps/npm/changelogs/CHANGELOG-5.md b/deps/npm/changelogs/CHANGELOG-5.md
new file mode 100644
index 00000000000000..b94243ae7582a9
--- /dev/null
+++ b/deps/npm/changelogs/CHANGELOG-5.md
@@ -0,0 +1,2360 @@
+## v5.10.0 (2018-05-10):
+
+### AUDIT SHOULDN'T WAIT FOREVER
+
+This will likely be reduced further with the goal that the audit process
+shouldn't noticibly slow down your builds regardless of your network
+situation.
+
+* [`3dcc240db`](https://github.com/npm/npm/commit/3dcc240dba5258532990534f1bd8a25d1698b0bf)
+ Timeout audit requests eventually.
+ ([@iarna](https://github.com/iarna))
+
+
+## v5.10.0-next.1 (2018-05-07):
+
+### EXTENDED `npm init` SCAFFOLDING
+
+Thanks to the wonderful efforts of [@jdalton](https://github.com/jdalton) of
+lodash fame, `npm init` can now be used to invoke custom scaffolding tools!
+
+You can now do things like `npm init react-app` or `npm init esm` to scaffold an
+npm package by running `create-react-app` and `create-esm`, respectively. This
+also adds an `npm create` alias, to correspond to Yarn's `yarn create` feature,
+which inspired this.
+
+* [`adc009ed4`](https://github.com/npm/npm/commit/adc009ed4114ed1e692f8ef15123af6040615cee)
+ [`f363edd04`](https://github.com/npm/npm/commit/f363edd04f474fa64e4d97228c0b2a7858f21e7c)
+ [`f03b45fb2`](https://github.com/npm/npm/commit/f03b45fb217df066c3cb7715f9c0469d84e5aa8e)
+ [`13adcbb52`](https://github.com/npm/npm/commit/13adcbb527fb8214e5f2233706c6b72ce072f3fa)
+ [#20303](https://github.com/npm/npm/pull/20303)
+ [#20372](https://github.com/npm/npm/pull/20372)
+ Add an `npm init` feature that calls out to `npx` when invoked with positional
+ arguments. ([@jdalton](https://github.com/jdalton))
+
+### DEPENDENCY AUDITING
+
+This version of npm adds a new command, `npm audit`, which will run a security
+audit of your project's dependency tree and notify you about any actions you may
+need to take.
+
+The registry-side services required for this command to work will be available
+on the main npm registry in the coming weeks. Until then, you won't get much out
+of trying to use this on the CLI.
+
+As part of this change, the npm CLI now sends scrubbed and cryptographically
+anonymized metadata about your dependency tree to your configured registry, to
+allow notifying you about the existence of critical security flaws. For details
+about how the CLI protects your privacy when it shares this metadata, see `npm
+help audit`, or [read the docs for `npm audit`
+online](https://github.com/npm/npm/blob/release-next/doc/cli/npm-audit.md). You
+can disable this altogether by doing `npm config set audit false`, but will no
+longer benefit from the service.
+
+* [`c81dfb91b`](https://github.com/npm/npm/commit/c81dfb91bc031f1f979fc200bb66718a7e8e1551)
+ `npm-registry-fetch@1.1.1`
+ ([@iarna](https://github.com/iarna))
+* [`b096f44a9`](https://github.com/npm/npm/commit/b096f44a96d185c45305b9b6a5f26d3ccbbf759d)
+ `npm-audit-report@1.0.9`
+ ([@iarna](https://github.com/iarna))
+* [`43b20b204`](https://github.com/npm/npm/commit/43b20b204ff9a86319350988d6774397b7da4593)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ Add new `npm audit` command.
+ ([@iarna](https://github.com/iarna))
+* [`49ddb3f56`](https://github.com/npm/npm/commit/49ddb3f5669e90785217a639f936f4e38390eea2)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ Temporarily suppress git metadata till there's an opt-in.
+ ([@iarna](https://github.com/iarna))
+* [`5f1129c4b`](https://github.com/npm/npm/commit/5f1129c4b072172c72cf9cff501885e2c11998ea)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ Document the new command.
+ ([@iarna](https://github.com/iarna))
+* [`9a07b379d`](https://github.com/npm/npm/commit/9a07b379d24d089687867ca34df6e1e6189c72f1)
+ [#20389](https://github.com/npm/npm/pull/20389)
+ Default audit to off when running the npm test suite itself.
+ ([@iarna](https://github.com/iarna))
+* [`a6e2f1284`](https://github.com/npm/npm/commit/a6e2f12849b84709d89b3dc4f096e8c6f7db7ebb)
+ Make sure we hide stream errors on background audit submissions. Previously some classes
+ of error could end up being displayed (harmlessly) during installs.
+ ([@iarna](https://github.com/iarna))
+* [`aadbf3f46`](https://github.com/npm/npm/commit/aadbf3f4695e75b236ee502cbe41e51aec318dc3)
+ Include session and scope in requests (as we do in other requests to the registry).
+ ([@iarna](https://github.com/iarna))
+* [`7d43ddf63`](https://github.com/npm/npm/commit/7d43ddf6366d3bfc18ea9ccef8c7b8e43d3b79f5)
+ Exit with non-zero status when vulnerabilities are found. So you can have `npm audit` as a test or prepublish step!
+ ([@iarna](https://github.com/iarna))
+* [`bc3fc55fa`](https://github.com/npm/npm/commit/bc3fc55fae648da8efaf1be5b86078f0f736282e)
+ Verify lockfile integrity before running. You'd get an error either way, but this way it's
+ faster and can give you more concrete instructions on how to fix it.
+ ([@iarna](https://github.com/iarna))
+* [`2ac8edd42`](https://github.com/npm/npm/commit/2ac8edd4248f2393b35896f0300b530e7666bb0e)
+ Refuse to run in global mode. Audits require a lockfile and globals don't have one. Yet.
+ ([@iarna](https://github.com/iarna))
+
+### CTRL-C OUT DURING PACKAGE EXTRACTION AS MUCH AS YOU WANT!
+
+* [`663d8b5e5`](https://github.com/npm/npm/commit/663d8b5e5427c2243149d2dd6968faa117e9db3f)
+ [npm/lockfile#29](https://github.com/npm/lockfile/pull/29)
+ `lockfile@1.0.4`:
+ Switches to `signal-exit` to detect abnormal exits and remove locks.
+ ([@Redsandro](https://github.com/Redsandro))
+
+### SHRONKWRAPS AND LACKFILES
+
+If a published modules had legacy `npm-shrinkwrap.json` we were saving
+ordinary registry dependencies (`name@version`) to your `package-lock.json`
+as `https://` URLs instead of versions.
+
+* [`36f998411`](https://github.com/npm/npm/commit/36f9984113e39d7b190010a2d0694ee025924dcb)
+ When saving the lock-file compute how the dependency is being required instead of using
+ `_resolved` in the `package.json`. This fixes the bug that was converting
+ registry dependencies into `https://` dependencies.
+ ([@iarna](https://github.com/iarna))
+* [`113e1a3af`](https://github.com/npm/npm/commit/113e1a3af2f487c753b8871d51924682283c89fc)
+ When encountering a `https://` URL in our lockfiles that point at our default registry, extract
+ the version and use them as registry dependencies. This lets us heal
+ `package-lock.json` files produced by 6.0.0
+ ([@iarna](https://github.com/iarna))
+
+### MORE `package-lock.json` FORMAT CHANGES?!
+
+* [`074502916`](https://github.com/npm/npm/commit/0745029168dfdfee0d1823137550e6ebccf741a5)
+ [#20384](https://github.com/npm/npm/pull/20384)
+ Add `from` field back into package-lock for git dependencies. This will give
+ npm the information it needs to figure out whether git deps are valid,
+ specially when running with legacy install metadata or in
+ `--package-lock-only` mode when there's no `node_modules`. This should help
+ remove a significant amount of git-related churn on the lock-file.
+ ([@zkat](https://github.com/zkat))
+
+### DOCUMENTATION IMPROVEMENTS
+
+* [`e0235ebb6`](https://github.com/npm/npm/commit/e0235ebb6e560f0114b8babedb6949385ab9bd57)
+ [#20384](https://github.com/npm/npm/pull/20384)
+ Update the lock-file spec doc to mention that we now generate the from field for `git`-type dependencies.
+ ([@watilde](https://github.com/watilde))
+* [`35de04676`](https://github.com/npm/npm/commit/35de04676a567ef11e1dd031d566231021d8aff2)
+ [#20408](https://github.com/npm/npm/pull/20408)
+ Describe what the colors in outdated mean.
+ ([@teameh](https://github.com/teameh))
+
+### BUGFIXES
+
+* [`1b535cb9d`](https://github.com/npm/npm/commit/1b535cb9d4a556840aeab2682cc8973495c9919a)
+ [#20358](https://github.com/npm/npm/pull/20358)
+ `npm install-test` (aka `npm it`) will no longer generate `package-lock.json`
+ when running with `--no-package-lock` or `package-lock=false`.
+ ([@raymondfeng](https://github.com/raymondfeng))
+* [`268f7ac50`](https://github.com/npm/npm/commit/268f7ac508cda352d61df63a2ae7148c54bdff7c)
+ [`5f84ebdb6`](https://github.com/npm/npm/commit/5f84ebdb66e35486d1dec1ca29e9ba0e4c5b6d5f)
+ [`c12e61431`](https://github.com/npm/npm/commit/c12e61431ecf4f77e56dc8aa55c41d5d7eeaacad)
+ [#20390](https://github.com/npm/npm/pull/20390)
+ Fix a scenario where a git dependency had a comittish associated with it
+ that was not a complete commitid. `npm` would never consider that entry
+ in the `package.json` as matching the entry in the `package-lock.json` and
+ this resulted in inappropriate pruning or reinstallation of git
+ dependencies. This has been addressed in two ways, first, the addition of the
+ `from` field as described in [#20384](https://github.com/npm/npm/pull/20384) means
+ we can exactly match the `package.json`. Second, when that's missing (when working with
+ older `package-lock.json` files), we assume that the match is ok. (If
+ it's not, we'll fix it up when a real installation is done.)
+ ([@iarna](https://github.com/iarna))
+
+### DOCS
+
+* [`7b13bf5e3`](https://github.com/npm/npm/commit/7b13bf5e373e2ae2466ecaa3fd6dcba67a97f462)
+ [#20331](https://github.com/npm/npm/pull/20331)
+ Fix broken link to 'private-modules' page. The redirect went away when the new
+ npm website went up, but the new URL is better anyway.
+ ([@vipranarayan14](https://github.com/vipranarayan14))
+* [`1c4ffddce`](https://github.com/npm/npm/commit/1c4ffddce05c25ef51e254dfc6a9a97e03c711ce)
+ [#20279](https://github.com/npm/npm/pull/20279)
+ Document the `--if-present` option for `npm run-script`.
+ ([@aleclarson](https://github.com/aleclarson))
+
+### DEPENDENCY UPDATES
+
+* [`815d91ce0`](https://github.com/npm/npm/commit/815d91ce0e8044775e884c1dab93052da57f6650)
+ `libnpx@10.2.0`
+ ([@zkat](https://github.com/zkat))
+* [`02715f19f`](https://github.com/npm/npm/commit/02715f19fbcdecec8990b92fc60b1a022c59613b)
+ `update-notifier@2.5.0`
+ ([@alexccl](https://github.com/alexccl))
+* [`08c4ddd9e`](https://github.com/npm/npm/commit/08c4ddd9eb560aa6408a1bb1c1d2d9aa6ba46ba0)
+ `tar@4.4.2`
+ ([@isaacs](https://github.com/isaacs))
+* [`53718cb12`](https://github.com/npm/npm/commit/53718cb126956851850839b4d7d3041d4e9a80d0)
+ `tap@11.1.4`
+ ([@isaacs](https://github.com/isaacs))
+* [`0a20cf546`](https://github.com/npm/npm/commit/0a20cf546a246ac12b5fe2b6235ffb8649336ec4)
+ `safe-buffer@5.1.2`
+ ([@feross](https://github.com/feross))
+* [`e8c8e844c`](https://github.com/npm/npm/commit/e8c8e844c194351fe2d65cf3af79ef318bbc8bec)
+ `retry@0.12.0`
+ ([@tim-kos](https://github.com/tim-kos))
+* [`76c7f21bd`](https://github.com/npm/npm/commit/76c7f21bd04407d529edc4a76deaa85a2d6b6e6f)
+ `read-package-tree@5.2.1`
+ ([@zkat](https://github.com/zkat))
+* [`c8b0aa07b`](https://github.com/npm/npm/commit/c8b0aa07b34a0b0f8bc85154da75d9fb458eb504)
+ `query-string@6.1.0`
+ ([@sindresorhus](https://github.com/sindresorhus))
+* [`abfd366b4`](https://github.com/npm/npm/commit/abfd366b4709325f954f2b1ee5bd475330aab828)
+ `npm-package-arg@6.1.0`
+ ([@zkat](https://github.com/zkat))
+* [`bd29baf83`](https://github.com/npm/npm/commit/bd29baf834c3e16a9b3d7b60cdb4f462889800bf)
+ `lock-verify@2.0.2`
+ ([@iarna](https://github.com/iarna))
+
+## v5.10.0-next.0 (2018-04-12):
+
+### NEW FEATURES
+
+* [`32ec2f54b`](https://github.com/npm/npm/commit/32ec2f54b2ad7370f2fd17e6e2fbbb2487c81266)
+ [#20257](https://github.com/npm/npm/pull/20257)
+ Add shasum and integrity to the new `npm view` output.
+ ([@zkat](https://github.com/zkat))
+* [`a22153be2`](https://github.com/npm/npm/commit/a22153be239dfd99d87a1a1c7d2c3700db0bebf3)
+ [#20126](https://github.com/npm/npm/pull/20126)
+ Add `npm cit` command that's equivalent of `npm ci && npm t` that's equivalent of `npm it`.
+ ([@SimenB](https://github.com/SimenB))
+
+### BUG FIXES
+
+* [`089aeaf44`](https://github.com/npm/npm/commit/089aeaf4479f286b1ce62716c6442382ff0f2150)
+ Fix a bug where OTPs passed in via the commandline would have leading
+ zeros deleted resulted in authentication failures.
+ ([@iarna](https://github.com/iarna))
+* [`6eaa860ea`](https://github.com/npm/npm/commit/6eaa860ead3222a6dbd6d370b4271e7bf242b30b)
+ Eliminate direct use of `new Buffer` in `npm`. While the use of it in `npm` was safe, there
+ are two other reasons for this change:
+
+ 1. Node 10 emits warnings about its use.
+ 2. Users who require npm as a library (which they definitely should not do)
+ can call the functions that call `new Buffer` in unsafe ways, if they try
+ really hard.
+
+ ([@iarna](https://github.com/iarna))
+
+* [`85900a294`](https://github.com/npm/npm/commit/85900a2944fed14bc8f59c48856fb797faaafedc)
+ Starting with 5.8.0 the `requires` section of the lock-file saved version ranges instead of
+ specific versions. Due to a bug, further actions on the same lock-file would result in the
+ range being switched back to a version. This corrects that, keeping ranges when they appear.
+ ([@iarna](https://github.com/iarna))
+* [`0dffa9c2a`](https://github.com/npm/npm/commit/0dffa9c2ae20b669f65c8e596dafd63e52248250)
+ [`609d6f6e1`](https://github.com/npm/npm/commit/609d6f6e1b39330b64ca4677a531819f2143a283)
+ [`08f81aa94`](https://github.com/npm/npm/commit/08f81aa94171987a8e1b71a87034e7b028bb9fc7)
+ [`f8b76e076`](https://github.com/npm/npm/commit/f8b76e0764b606e2c129cbaa66e48ac6a3ebdf8a)
+ [`6d609822d`](https://github.com/npm/npm/commit/6d609822d00da7ab8bd05c24ec4925094ecaef53)
+ [`59d080a22`](https://github.com/npm/npm/commit/59d080a22f7314a8e4df6e4f85c84777c1e4be42)
+ Restore the ability to bundle dependencies that are uninstallable from the
+ registry. This also eliminates needless registry lookups for bundled
+ dependencies.
+
+ Fixed a bug where attempting to install a dependency that is bundled
+ inside another module without reinstalling that module would result in
+ ENOENT errors.
+ ([@iarna](https://github.com/iarna))
+* [`db846c2d5`](https://github.com/npm/npm/commit/db846c2d57399f277829036f9d96cd767088097e)
+ [#20029](https://github.com/npm/npm/pull/20029)
+ Allow packages with non-registry specifiers to follow the fast path that
+ the we use with the lock-file for registry specifiers. This will improve install time
+ especially when operating only on the package-lock (`--package-lock-only`).
+
+ ([@zkat](https://github.com/zkat))
+
+ Fix the a bug where `npm i --only=prod` could remove development
+ dependencies from lock-file.
+ ([@iarna](https://github.com/iarna))
+* [`3e12d2407`](https://github.com/npm/npm/commit/3e12d2407446661d3dd226b03a2b6055b7932140)
+ [#20122](https://github.com/npm/npm/pull/20122)
+ Improve the update-notifier messaging (borrowing ideas from pnpm) and
+ eliminate false positives.
+ ([@zkat](https://github.com/zkat))
+* [`f18be9b39`](https://github.com/npm/npm/commit/f18be9b39888d05c7f98946c53214f40914f6284)
+ [#20154](https://github.com/npm/npm/pull/20154)
+ Let version succeed when `package-lock.json` is gitignored.
+ ([@nwoltman](https://github.com/nwoltman))
+* [`ced29253d`](https://github.com/npm/npm/commit/ced29253df6c6d67e4bf47ca83e042db4fb19034)
+ [#20212](https://github.com/npm/npm/pull/20212)
+ Ensure that we only create an `etc` directory if we are actually going to write files to it.
+ ([@buddydvd](https://github.com/buddydvd))
+* [`8e21b19a8`](https://github.com/npm/npm/commit/8e21b19a8c5e7d71cb51f3cc6a8bfaf7749ac2c5)
+ [#20140](https://github.com/npm/npm/pull/20140)
+ Note in documentation that `package-lock.json` version gets touched by `npm version`.
+ ([@srl295](https://github.com/srl295))
+* [`5d17c87d8`](https://github.com/npm/npm/commit/5d17c87d8d27caeac71f291fbd62628f2765fda2)
+ [#20032](https://github.com/npm/npm/pull/20032)
+ Fix bug where unauthenticated errors would get reported as both 404s and
+ 401s, i.e. `npm ERR! 404 Registry returned 401`. In these cases the error
+ message will now be much more informative.
+ ([@iarna](https://github.com/iarna))
+* [`05ff6c9b1`](https://github.com/npm/npm/commit/05ff6c9b14cb095988b768830e51789d6b6b8e6e)
+ [#20082](https://github.com/npm/npm/pull/20082)
+ Allow optional @ prefix on scope with `npm team` commands for parity with other commands.
+ ([@bcoe](https://github.com/bcoe))
+* [`6bef53891`](https://github.com/npm/npm/commit/6bef538919825b8cd2e738333bdd7b6ca2e2e0e3)
+ [#19580](https://github.com/npm/npm/pull/19580)
+ Improve messaging when two-factor authentication is required while publishing.
+ ([@jdeniau](https://github.com/jdeniau))
+* [`155dab2bd`](https://github.com/npm/npm/commit/155dab2bd7b06724eca190abadd89c9f03f85446)
+ Fix a bug where optional status of a dependency was not being saved to
+ the package-lock on the initial install.
+ ([@iarna](https://github.com/iarna))
+* [`8d6a4cafc`](https://github.com/npm/npm/commit/8d6a4cafc2e6963d9ec7c828e1af6f2abc12e7f3)
+ [`a0937e9af`](https://github.com/npm/npm/commit/a0937e9afe126dce7a746c1a6270b1ac69f2a9b3)
+ Ensure that `--no-optional` does not remove optional dependencies from the lock-file.
+ ([@iarna](https://github.com/iarna))
+
+### DEPENDENCY UPDATES
+
+* [`8baa37551`](https://github.com/npm/npm/commit/8baa37551945bc329a6faf793ec5e3e2feff489b)
+ [zkat/cipm#46](https://github.com/zkat/cipm/pull/46)
+ `libcipm@1.6.2`:
+ Detect binding.gyp for default install lifecycle. Let's `npm ci` work on projects that
+ have their own C code.
+ ([@caleblloyd](https://github.com/caleblloyd))
+* [`323f74242`](https://github.com/npm/npm/commit/323f74242066c989f7faf94fb848ff8f3b677619)
+ [zkat/json-parse-better-errors#1](https://github.com/zkat/json-parse-better-errors/pull/1)
+ `json-parse-better-errors@1.0.2`
+ ([@Hoishin](https://github.com/Hoishin))
+* [`d0cf1f11e`](https://github.com/npm/npm/commit/d0cf1f11e5947446f74881a3d15d6a504baea619)
+ `readable-stream@2.3.6`
+ ([@mcollina](https://github.com/mcollina))
+* [`9e9fdba5e`](https://github.com/npm/npm/commit/9e9fdba5e7b7f3a1dd73530dadb96d9e3445c48d)
+ `update-notifier@2.4.0`
+ ([@sindersorhus](https://github.com/sindersorhus))
+* [`57fa33870`](https://github.com/npm/npm/commit/57fa338706ab122ab7e13d2206016289c5bdacf3)
+ `marked@0.3.1`
+ ([@joshbruce](https://github.com/joshbruce))
+* [`d2b20d34b`](https://github.com/npm/npm/commit/d2b20d34b60f35eecf0d51cd1f05de79b0e15096)
+ [#20276](https://github.com/npm/npm/pull/20276)
+ `node-gyp@3.6.2`
+* [`2b5700679`](https://github.com/npm/npm/commit/2b5700679fce9ee0c24c4509618709a4a35a3d27)
+ [zkat/npx#172](https://github.com/zkat/npx/pull/172)
+ `libnpx@10.1.1`
+ ([@jdalton](https://github.com/jdalton))
+
+## v5.9.0 (2018-03-23):
+
+Coming to you this week are a fancy new package view, pack/publish previews
+and a handful of bug fixes! Let's get right in!
+
+### NEW PACKAGE VIEW
+
+There's a new `npm view` in town. You might it as `npm info` or `npm show`.
+The new output gives you a nicely summarized view that for most packages
+fits on one screen. If you ask it for `--json` you'll still get the same
+results, so your scripts should still work fine.
+
+* [`143cdbf13`](https://github.com/npm/npm/commit/143cdbf1327f7d92ccae405bc05d95d28939a837)
+ [#19910](https://github.com/npm/npm/pull/19910)
+ Add humanized default view.
+ ([@zkat](https://github.com/zkat))
+* [`ca84be91c`](https://github.com/npm/npm/commit/ca84be91c434fb7fa472ee4c0b7341414acf52b5)
+ [#19910](https://github.com/npm/npm/pull/19910)
+ `tiny-relative-date@1.3.0`
+ ([@zkat](https://github.com/zkat))
+* [`9a5807c4f`](https://github.com/npm/npm/commit/9a5807c4f813c49b854170b6111c099b3054faa2)
+ [#19910](https://github.com/npm/npm/pull/19910)
+ `cli-columns@3.1.2`
+ ([@zkat](https://github.com/zkat))
+* [`23b4a4fac`](https://github.com/npm/npm/commit/23b4a4fac0fbfe8e03e2f65d9f674f163643d15d)
+ [#19910](https://github.com/npm/npm/pull/19910)
+ `byte-size@4.0.2`
+
+### PACK AND PUBLISH PREVIEWS
+
+The `npm pack` and `npm publish` commands print out a summary of the files
+included in the package. They also both now take the `--dry-run` flag, so
+you can double check your `.npmignore` settings before doing a publish.
+
+* [`116e9d827`](https://github.com/npm/npm/commit/116e9d8271d04536522a7f02de1dde6f91ca5e6e)
+ [#19908](https://github.com/npm/npm/pull/19908)
+ Add package previews to pack and publish. Also add --dry-run and --json
+ flags.
+ ([@zkat](https://github.com/zkat))
+
+### MERGE CONFLICT, SMERGE CONFLICT
+
+If you resolve a `package-lock.json` merge conflict with `npm install` we
+now suggest you setup a merge driver to handle these automatically for you.
+If you're reading this and you'd like to set it up now, run:
+
+```console
+npx npm-merge-driver install -g
+```
+
+* [`5ebe99719`](https://github.com/npm/npm/commit/5ebe99719d11fedeeec7a55f1b389dcf556f32f3)
+ [#20071](https://github.com/npm/npm/pull/20071)
+ suggest installing the merge driver
+ ([@zkat](https://github.com/zkat))
+
+### MISC BITS
+
+* [`a05e27b71`](https://github.com/npm/npm/commit/a05e27b7104f9a79f5941e7458c4658872e5e0cd)
+ Going forward, record requested ranges not versions in the package-lock.
+ ([@iarna](https://github.com/iarna))
+* [`f721eec59`](https://github.com/npm/npm/commit/f721eec599df4bdf046d248e0f50822d436654b4)
+ Add 10 to Node.js supported version list. It's not out yet, but soon my pretties...
+ ([@iarna](https://github.com/iarna))
+
+### DEPENDENCY UPDATES
+
+* [`40aabb94e`](https://github.com/npm/npm/commit/40aabb94e3f24a9feabb9c490403e10ec9dc254f)
+ `libcipm@1.6.1`:
+ Fix bugs on docker and with some `prepare` scripts and `npm ci`.
+ Fix a bug where script hooks wouldn't be called with `npm ci`.
+ Fix a bug where `npm ci` and `--prefix` weren't compatible.
+ ([@isaacseymour](https://github.com/isaacseymour))
+ ([@umarov](https://github.com/umarov))
+ ([@mikeshirov](https://github.com/mikeshirov))
+ ([@billjanitsch](https://github.com/billjanitsch))
+* [`a85372e67`](https://github.com/npm/npm/commit/a85372e671eab46e62caa46631baa30900e32114)
+ `tar@4.4.1`:
+ Switch to safe-buffer and Buffer.from.
+ ([@isaacs](https://github.com/isaacs))
+ ([@ChALkeR](https://github.com/ChALkeR))
+* [`588eabd23`](https://github.com/npm/npm/commit/588eabd23fa04420269b9326cab26d974d9c151f)
+ `lru-cache@4.1.2`:
+* [`07f27ee89`](https://github.com/npm/npm/commit/07f27ee898f3c3199e75427017f2b6a189b1a85b)
+ `qrcode-terminal@0.12.0`:
+* [`01e4e29bc`](https://github.com/npm/npm/commit/01e4e29bc879bdaa0e92f0b58e3725a41377d21c)
+ `request@2.85.0`
+* [`344ba8819`](https://github.com/npm/npm/commit/344ba8819f485c72e1c7ac3e656d7e9210ccf607)
+ `worker-farm@1.6.0`
+* [`dc6df1bc4`](https://github.com/npm/npm/commit/dc6df1bc4677164b9ba638e87c1185b857744720)
+ `validate-npm-package-license@3.0.3`
+* [`97a976696`](https://github.com/npm/npm/commit/97a9766962ab5125af3b2a1f7b4ef550a2e3599b)
+ `ssri@5.3.0`
+* [`9b629d0c6`](https://github.com/npm/npm/commit/9b629d0c69599635ee066cb71fcc1b0155317f19)
+ `query-string@5.1.1`
+
+## v5.8.0 (2018-03-08):
+
+Hey again, everyone! While last release was focused largely around PRs from the
+CLI team, this release is mostly pulling in community PRs in npm itself and its
+dependencies! We've got a good chunk of wonderful contributions for y'all, and
+even new features and performance improvements! 🎉
+
+We're hoping to continue our biweekly (as in every-other-week biweekly) release
+schedule from now on, so you should be seeing more steady npm releases from here
+on out. And that's good, 'cause we've got a _ton_ of new stuff on our roadmap
+for this year. Keep an eye out for exciting news. 👀
+
+### FEATURES
+
+* [`2f513fe1c`](https://github.com/npm/npm/commit/2f513fe1ce6db055b04a63fe4360212a83f77b34)
+ [#19904](https://github.com/npm/npm/pull/19904)
+ Make a best-attempt at preserving line ending style when saving
+ `package.json`/`package-lock.json`/`npm-shrinkwrap.json`. This goes
+ hand-in-hand with a previous patch to preserve detected indentation style.
+ ([@tuananh](https://github.com/tuananh))
+* [`d3cfd41a2`](https://github.com/npm/npm/commit/d3cfd41a28253db5a18260f68642513cbbc93e3b)
+ `pacote@7.6.1` ([@zkat](https://github.com/zkat))
+ * Enable `file:`-based `resolved` URIs in `package-lock.json`.
+ * Retry git-based operations on certain types of failure.
+* [`ecfbb16dc`](https://github.com/npm/npm/commit/ecfbb16dc705f28aa61b3223bdbf9e47230a0fa4)
+ [#19929](https://github.com/npm/npm/pull/19929)
+ Add support for the [`NO_COLOR` standard](http://no-color.org). This gives a
+ cross-application, consistent way of disabling ANSI color code output. Note
+ that npm already supported this through `--no-color` or
+ `npm_config_color='false'` configurations, so this is just another way to do
+ it.
+ ([@chneukirchen](https://github.com/chneukirchen))
+* [`fc8761daf`](https://github.com/npm/npm/commit/fc8761daf1e8749481457973890fa516eb96a195)
+ [#19629](https://github.com/npm/npm/pull/19629)
+ Give more detailed, contextual information when npm fails to parse
+ `package-lock.json` and `npm-shrinkwrap.json`, instead of saying `JSON parse
+ error` and leaving you out in the cold.
+ ([@JoshuaKGoldberg](https://github.com/JoshuaKGoldberg))
+* [`1d368e1e6`](https://github.com/npm/npm/commit/1d368e1e63229f236b9dbabf628989fa3aa98bdb)
+ [#19157](https://github.com/npm/npm/pull/19157)
+ Add `--no-proxy` config option. Previously, you needed to use the `NO_PROXY`
+ environment variable to use this feature -- now it's an actual npm option.
+ ([@Saturate](https://github.com/Saturate))
+* [`f0e998daa`](https://github.com/npm/npm/commit/f0e998daa049810d5f928615132250021e46451d)
+ [#18426](https://github.com/npm/npm/pull/18426)
+ Do environment variable replacement in config files even for config keys or
+ fragments of keys.
+ ([@misak113](https://github.com/misak113))
+* [`9847c82a8`](https://github.com/npm/npm/commit/9847c82a8528cfdf5968e9bb00abd8ed47903b5c)
+ [#18384](https://github.com/npm/npm/pull/18384)
+ Better error messaging and suggestions when users get `EPERM`/`EACCES` errors.
+ ([@chrisjpatty](https://github.com/chrisjpatty))
+* [`b9d0c0c01`](https://github.com/npm/npm/commit/b9d0c0c0173542a8d741a9a17b9fb34fbaf5068e)
+ [#19448](https://github.com/npm/npm/pull/19448)
+ Holiday celebrations now include all JavaScripters, not just Node developers.
+ ([@isaacs](https://github.com/isaacs))
+
+### NPM CI
+
+I hope y'all have been having fun with `npm ci` so far! Since this is the first
+release since that went out, we've had a few fixes and improvements now that
+folks have actually gotten their hands on it! Benchmarks have been super
+promising so far, and I've gotten messages from a lot of you saying you've sped
+up your CI work by **2-5x** in some cases! Have a good example? Tell us on
+Twitter!
+
+`npm ci` is, right now, [the fastest
+installer](http://blog.npmjs.org/post/171556855892/introducing-npm-ci-for-faster-more-reliable)
+you can use in CI situations, so go check it out if you haven't already! We'll
+continue doing performance improvements on it, and a lot of those will help make
+`npm install` fast as well. 🏎😎
+
+* [`0d7f203d9`](https://github.com/npm/npm/commit/0d7f203d9e86cc6c8d69107689ea60fc7cbab424)
+ `libcipm@1.6.0`
+ ([@zkat](https://github.com/zkat))
+
+This `libcipm` release includes a number of improvements:
+
+* **PERFORMANCE** Reduce calls to `read-package-json` and separate JSON update phase from man/bin linking phase. `npm ci` should be noticeably faster.
+* **FEATURE** Progress bar now fills up as packages are installed, instead of sitting there doing nothing.
+* **BUGFIX** Add support for `--only` and `--also` options.
+* **BUFGIX** Linking binaries and running scripts in parallel was causing packages to sometimes clobber each other when hoisted, as well as potentially running too many run-scripts in parallel. This is now a serial operation, and it turns out to have had relatively little actual performance impact.
+* **BUGFIX** Stop adding `_from` to directory deps (aka `file:packages/my-dep`).
+
+### BUGFIXES
+
+* [`58d2aa58d`](https://github.com/npm/npm/commit/58d2aa58d5f9c4db49f57a5f33952b3106778669)
+ [#20027](https://github.com/npm/npm/pull/20027)
+ Use a specific mtime when packing tarballs instead of the beginning of epoch
+ time. This should allow `npm pack` to generate tarballs with identical hashes
+ for identical contents, while fixing issues with some `zip` implementations
+ that do not support pre-1980 timestamps.
+ ([@isaacs](https://github.com/isaacs))
+* [`4f319de1d`](https://github.com/npm/npm/commit/4f319de1d6e8aca5fb68f78023425233da4f07f6)
+ Don't fall back to couch adduser if we didn't try couch login.
+ ([@iarna](https://github.com/iarna))
+* [`c8230c9bb`](https://github.com/npm/npm/commit/c8230c9bbd596156a4a8cfe62f2370f81d22bd9f)
+ [#19608](https://github.com/npm/npm/pull/19608)
+ Fix issue where using the npm-bundled `npx` on Windows was invoking `npx
+ prefix` (and downloading that package).
+ ([@laggingreflex](https://github.com/laggingreflex))
+* [`d70c01970`](https://github.com/npm/npm/commit/d70c01970311f4e84b35eef8559c114136a9ebc7)
+ [#18953](https://github.com/npm/npm/pull/18953)
+ Avoid using code that depends on `node@>=4` in the `unsupported` check, so npm
+ can report the issue normally instead of syntax-crashing.
+ ([@deployable](https://github.com/deployable))
+
+### DOCUMENTATION
+
+* [`4477ca2d9`](https://github.com/npm/npm/commit/4477ca2d993088ac40ef5cf39d1f9c68be3d6252)
+ `marked@0.3.17`: Fixes issue preventing correct rendering of backticked
+ strings. man pages should be rendering correctly now instead of having empty
+ spaces wherever backticks were used.
+ ([@joshbruce](https://github.com/joshbruce))
+* [`71076ebda`](https://github.com/npm/npm/commit/71076ebdaddd04f2bf330fe668f15750bcff00ea)
+ [#19950](https://github.com/npm/npm/pull/19950)
+ Add a note to install --production.
+ ([@kyranet](https://github.com/kyranet))
+* [`3a33400b8`](https://github.com/npm/npm/commit/3a33400b89a8dd00fa9a49fcb57a8add36f79fa6)
+ [#19957](https://github.com/npm/npm/pull/19957)
+ nudge around some details in ci docs
+ ([@zkat](https://github.com/zkat))
+* [`06038246a`](https://github.com/npm/npm/commit/06038246a3fa58d6f42bb4ab897aa534ff6ed282)
+ [#19893](https://github.com/npm/npm/pull/19893)
+ Add a common open reason to the issue template.
+ ([@MrStonedOne](https://github.com/MrStonedOne))
+* [`7376dd8af`](https://github.com/npm/npm/commit/7376dd8afb654929adade126b4925461aa52da12)
+ [#19870](https://github.com/npm/npm/pull/19870)
+ Fix typo in `npm-config.md`
+ ([@joebowbeer](https://github.com/joebowbeer))
+* [`5390ed4fa`](https://github.com/npm/npm/commit/5390ed4fa2b480f7c58fff6ee670120149ec2d45)
+ [#19858](https://github.com/npm/npm/pull/19858)
+ Fix documented default value for config save option. It was still documented
+ as `false`, even though `npm@5.0.0` set it to `true` by default.
+ ([@nalinbhardwaj](https://github.com/nalinbhardwaj))
+* [`dc36d850a`](https://github.com/npm/npm/commit/dc36d850a1d763f71a98c99db05ca875dab124ed)
+ [#19552](https://github.com/npm/npm/pull/19552)
+ Rework `npm update` docs now that `--save` is on by default.
+ ([@selbekk](https://github.com/selbekk))
+* [`5ec5dffc8`](https://github.com/npm/npm/commit/5ec5dffc80527d9330388ff82926dd890f4945af)
+ [#19726](https://github.com/npm/npm/pull/19726)
+ Clarify that `name` and `version` fields are optional if your package is not
+ supposed to be installable as a dependency.
+ ([@ngarnier](https://github.com/ngarnier))
+* [`046500994`](https://github.com/npm/npm/commit/0465009942d6423f878c1359e91972fa5990f996)
+ [#19676](https://github.com/npm/npm/pull/19676)
+ Fix documented cache location on Windows.
+ ([@VladRassokhin](https://github.com/VladRassokhin))
+* [`ffa84cd0f`](https://github.com/npm/npm/commit/ffa84cd0f43c07858506764b4151ba6af11ea120)
+ [#19475](https://github.com/npm/npm/pull/19475)
+ Added example for `homepage` field from `package.json`.
+ ([@cg-cnu](https://github.com/cg-cnu))
+* [`de72d9a18`](https://github.com/npm/npm/commit/de72d9a18ae650ebaee0fdd6694fc89b1cbe8e95)
+ [#19307](https://github.com/npm/npm/pull/19307)
+ Document the `requires` field in `npm help package-lock.json`.
+ ([@jcrben](https://github.com/jcrben))
+* [`35c4abded`](https://github.com/npm/npm/commit/35c4abdedfa622f27e8ee47aa6e293f435323623)
+ [#18976](https://github.com/npm/npm/pull/18976)
+ Typo fix in coding style documentation.
+ ([@rinfan](https://github.com/rinfan))
+* [`0616fd22a`](https://github.com/npm/npm/commit/0616fd22a4e4f2b2998bb70d86d269756aab64be)
+ [#19216](https://github.com/npm/npm/pull/19216)
+ Add `edit` section to description in `npm-team.md`.
+ ([@WispProxy](https://github.com/WispProxy))
+* [`c2bbaaa58`](https://github.com/npm/npm/commit/c2bbaaa582d024cc48b410757efbb81d95837d43)
+ [#19194](https://github.com/npm/npm/pull/19194)
+ Tiny style fix in `npm.md`.
+ ([@WispProxy](https://github.com/WispProxy))
+* [`dcdfdcbb0`](https://github.com/npm/npm/commit/dcdfdcbb0035ef3290bd0912f562e26f6fc4ea94)
+ [#19192](https://github.com/npm/npm/pull/19192)
+ Document `--development` flag in `npm-ls.md`.
+ ([@WispProxy](https://github.com/WispProxy))
+* [`d7ff07135`](https://github.com/npm/npm/commit/d7ff07135a685dd89c15e29d6a28fca33cf448b0)
+ [#18514](https://github.com/npm/npm/pull/18514)
+ Make it so `javascript` -> `JavaScript`. This is important.
+ ([@masonpawsey](https://github.com/masonpawsey))
+* [`7a8705113`](https://github.com/npm/npm/commit/7a870511327d31e8921d6afa845ec8065c60064b)
+ [#18407](https://github.com/npm/npm/pull/18407)
+ Clarify the mechanics of the `file` field in `package.json` a bit.
+ ([@bmacnaughton](https://github.com/bmacnaughton))
+* [`b2a1cf084`](https://github.com/npm/npm/commit/b2a1cf0844ceaeb51ed04f3ae81678527ec9ae68)
+ [#18382](https://github.com/npm/npm/pull/18382)
+ Document the [`browser`
+ field](https://github.com/defunctzombie/package-browser-field-spec) in
+ `package.json`.
+ ([@mxstbr](https://github.com/mxstbr))
+
+### MISC
+
+* [`b8a48a959`](https://github.com/npm/npm/commit/b8a48a9595b379cfc2a2c576f61062120ea0caf7)
+ [#19907](https://github.com/npm/npm/pull/19907)
+ Consolidate code for stringifying `package.json` and package locks. Also adds
+ tests have been added to test that `package[-lock].json` files are written to
+ disk with their original line endings.
+ ([@nwoltman](https://github.com/nwoltman))
+* [`b4f707d9f`](https://github.com/npm/npm/commit/b4f707d9f543f0995ed5811827a892fc8b2192b5)
+ [#19879](https://github.com/npm/npm/pull/19879)
+ Remove unused devDependency `nock` from `.gitignore`.
+ ([@watilde](https://github.com/watilde))
+* [`8150dd5f7`](https://github.com/npm/npm/commit/8150dd5f72520eb143f75e44787a5775bd8b8ebc)
+ [#16540](https://github.com/npm/npm/pull/16540)
+ Stop doing an `uninstall` when using `make clean`.
+ ([@metux](https://github.com/metux))
+
+### OTHER DEPENDENCY BUMPS
+
+* [`ab237a2a5`](https://github.com/npm/npm/commit/ab237a2a5dcf70ee490e2f0322dfedb1560251d4)
+ `init-package-json@1.10.3`
+ ([@zkat](https://github.com/zkat))
+* [`f6d668941`](https://github.com/npm/npm/commit/f6d6689414f00a67a1f34afc6791bdc7d7be4d9b)
+ `npm-lifecycle@2.0.1`
+ ([@zkat](https://github.com/zkat))
+* [`882bfbdfa`](https://github.com/npm/npm/commit/882bfbdfaa3eb09b35875e648545cb6967f72562)
+ `npm-registry-client@8.5.1`
+ ([@zkat](https://github.com/zkat))
+* [`6ae38055b`](https://github.com/npm/npm/commit/6ae38055ba69db5785ee6c394372de0333763822)
+ `read-package-json@2.0.1`: Support git packed refs `--all` mode.
+ ([@zkat](https://github.com/zkat))
+* [`89db703ae`](https://github.com/npm/npm/commit/89db703ae4e25b9fb6c9d7c5119520107a23a752)
+ `readable-stream@2.3.5`
+ ([@mcollina](https://github.com/mcollina))
+* [`634dfa5f4`](https://github.com/npm/npm/commit/634dfa5f476b7954b136105a8f9489f5631085a3)
+ `worker-farm@1.5.4`
+ ([@rvagg](https://github.com/rvagg))
+* [`92ad34439`](https://github.com/npm/npm/commit/92ad344399f7a23e308d0f3f02547656a47ae6c5)
+ `hosted-git-info@2.6.0`
+ ([@zkat](https://github.com/zkat))
+* [`75279c488`](https://github.com/npm/npm/commit/75279c4884d02bd7d451b66616e320eb8cb03bcb)
+ `tar@4.4.0`
+ ([@isaacs](https://github.com/isaacs))
+* [`228aba276`](https://github.com/npm/npm/commit/228aba276b19c987cd5989f9bb9ffbe25edb4030)
+ `write-file-atomic@2.3.0`
+ ([@iarna](https://github.com/iarna))
+* [`006e9d272`](https://github.com/npm/npm/commit/006e9d272914fc3ba016f110b1411dd20f8a937d)
+ `libnpx@10.0.1`
+ ([@zkat](https://github.com/zkat))
+* [`9985561e6`](https://github.com/npm/npm/commit/9985561e666473deeb352c1d4252adf17c2fa01d)
+ `mississippi@3.0.0`
+ ([@bcomnes](https://github.com/bcomnes))
+* [`1dc6b3b52`](https://github.com/npm/npm/commit/1dc6b3b525967bc8526aa4765e987136cb570e8e)
+ `tap@11.1.2`
+ ([@isaacs](https://github.com/isaacs))
+
+## v5.7.1 (2018-02-22):
+
+This release reverts a patch that could cause some ownership changes on system
+files when running from some directories when also using `sudo`. 😲
+
+Thankfully, it only affected users running `npm@next`, which is part of our
+staggered release system, which we use to prevent issues like this from going
+out into the wider world before we can catch them. Users on `latest` would have
+never seen this!
+
+The original patch was added to increase consistency and reliability of methods
+npm uses to avoid writing files as `root` in places it shouldn't, but the change
+was applied in places that should have used regular `mkdirp`. This release
+reverts that patch.
+
+* [`74e149da6`](https://github.com/npm/npm/commit/74e149da6efe6ed89477faa81fef08eee7999ad0)
+ [`#19883`](https://github.com/npm/npm/issue/19883)
+ Revert "*: Switch from mkdirp to correctMkdir to preserve perms and owners"
+ This reverts commit [`94227e15`](https://github.com/npm/npm/commit/94227e15eeced836b3d7b3d2b5e5cc41d4959cff).
+ ([@zkat](https://github.com/zkat))
+
+## v5.7.0 (2018-02-20):
+
+Hey y'all, it's been a while. Expect our release rate to increase back to
+normal here, as we've got a lot in the pipeline. Right now we've got a
+bunch of things from folks at npm. In the next release we'll be focusing on
+user contributions and there are a lot of them queued up!
+
+This release brings a bunch of exciting new features and bug fixes.
+
+### PACKAGE-LOCK GIT MERGE CONFLICT RESOLUTION
+
+Allow `npm install` to fix `package-lock.json` and `npm-shrinkwrap.json`
+files that have merge conflicts in them without your having to edit them.
+It works in conjunction with
+[`npm-merge-driver`](https://www.npmjs.com/package/npm-merge-driver) to
+entirely eliminate package-lock merge conflicts.
+
+* [`e27674c22`](https://github.com/npm/npm/commit/e27674c221dc17473f23bffa50123e49a021ae34)
+ Automatically resolve merge conflicts in lock-files.
+ ([@zkat](https://github.com/zkat))
+
+### NPM CI
+
+The new `npm ci` command installs from your lock-file ONLY. If your
+`package.json` and your lock-file are out of sync then it will report an error.
+
+It works by throwing away your `node_modules` and recreating it from scratch.
+
+Beyond guaranteeing you that you'll only get what is in your lock-file it's
+also much faster (2x-10x!) than `npm install` when you don't start with a
+`node_modules`.
+
+As you may take from the name, we expect it to be a big boon to continuous
+integration environments. We also expect that folks who do production
+deploys from git tags will see major gains.
+
+* [`5e4de9c99`](https://github.com/npm/npm/commit/5e4de9c99c934e25ef7b9c788244cc3c993da559)
+ Add new `npm ci` installer.
+ ([@zkat](https://github.com/zkat))
+
+### OTHER NEW FEATURES
+
+* [`4d418c21b`](https://github.com/npm/npm/commit/4d418c21b051f23a3b6fb085449fdf4bf4f826f5)
+ [#19817](https://github.com/npm/npm/pull/19817)
+ Include contributor count in installation summary.
+ ([@kemitchell](https://github.com/kemitchell))
+* [`17079c2a8`](https://github.com/npm/npm/commit/17079c2a880d3a6f8a67c8f17eedc7eb51b8f0f8)
+ Require password to change email through `npm profile`.
+ ([@iarna](https://github.com/iarna))
+* [`e7c5d226a`](https://github.com/npm/npm/commit/e7c5d226ac0ad3da0e38f16721c710909d0a9847)
+ [`4f5327c05`](https://github.com/npm/npm/commit/4f5327c0556764aa1bbc9b58b1a8c8a84136c56a)
+ [#19780](https://github.com/npm/npm/pull/19780)
+ Add support for web-based logins. This is not yet available on the registry, however.
+ ([@isaacs](https://github.com/isaacs))
+
+### BIG FIXES TO PRUNING
+
+* [`827951590`](https://github.com/npm/npm/commit/8279515903cfa3026cf7096189485cdf29f74a8f)
+ Handle running `npm install package-name` with a `node_modules` containing
+ packages without sufficient metadata to verify their origin. The only way
+ to get install packages like this is to use a non-`npm` package manager.
+ Previously `npm` removed any packages that it couldn't verify. Now it
+ will leave them untouched as long as you're not asking for a full install.
+ On a full install they will be reinstalled (but the same versions will be
+ maintained).
+
+ This will fix problems for folks who are using a third party package
+ manager to install packages that have `postinstall` scripts that run
+ `npm install`.
+ ([@iarna](https://github.com/iarna))
+* [`3b305ee71`](https://github.com/npm/npm/commit/3b305ee71e2bf852ff3037366a1774b8c5fcc0a5)
+ Only auto-prune on installs that will create a lock-file. This restores
+ `npm@4` compatible behavior when the lock-file is disabled. When using a
+ lock-file `npm` will continue to remove anything in your `node_modules`
+ that's not in your lock-file. ([@iarna](https://github.com/iarna))
+* [`cec5be542`](https://github.com/npm/npm/commit/cec5be5427f7f5106a905de8630e1243e9b36ef4)
+ Fix bug where `npm prune --production` would remove dev deps from the lock
+ file. It will now only remove them from `node_modules` not from your lock
+ file.
+ ([@iarna](https://github.com/iarna))
+* [`857dab03f`](https://github.com/npm/npm/commit/857dab03f2d58586b45d41d3e5af0fb2d4e824d0)
+ Fix bug where git dependencies would be removed or reinstalled when
+ installing other dependencies.
+ ([@iarna](https://github.com/iarna))
+
+### BUG FIXES TO TOKENS AND PROFILES
+
+* [`a66e0cd03`](https://github.com/npm/npm/commit/a66e0cd0314893b745e6b9f6ca1708019b1d7aa3)
+ For CIDR filtered tokens, allow comma separated CIDR ranges, as documented. Previously
+ you could only pass in multiple cidr ranges with multiple `--cidr` command line options.
+ ([@iarna](https://github.com/iarna))
+* [`d259ab014`](https://github.com/npm/npm/commit/d259ab014748634a89cad5b20eb7a40f3223c0d5)
+ Fix token revocation when an OTP is required. Previously you had to pass
+ it in via `--otp`. Now it will prompt you for an OTP like other
+ `npm token` commands.
+ ([@iarna](https://github.com/iarna))
+* [`f8b1f6aec`](https://github.com/npm/npm/commit/f8b1f6aecadd3b9953c2b8b05d15f3a9cff67cfd)
+ Update token and profile commands to support legacy (username/password) authentication.
+ (The npm registry uses tokens, not username/password pairs, to authenticate commands.)
+ ([@iarna](https://github.com/iarna))
+
+### OTHER BUG FIXES
+
+* [`6954dfc19`](https://github.com/npm/npm/commit/6954dfc192f88ac263f1fcc66cf820a21f4379f1)
+ Fix a bug where packages would get pushed deeper into the tree when upgrading without
+ an existing copy on disk. Having packages deeper in the tree ordinarily is harmless but
+ is not when peerDependencies are in play.
+ ([@iarna](https://github.com/iarna))
+* [`1ca916a1e`](https://github.com/npm/npm/commit/1ca916a1e9cf94691d1ff2e5e9d0204cfaba39e1)
+ Fix bug where when switching from a linked module to a non-linked module, the dependencies
+ of the module wouldn't be installed on the first run of `npm install`.
+ ([@iarna](https://github.com/iarna))
+* [`8c120ebb2`](https://github.com/npm/npm/commit/8c120ebb28e87bc6fe08a3fad1bb87b50026a33a)
+ Fix integrity matching to eliminate spurious EINTEGRITY errors.
+ ([@zkat](https://github.com/zkat))
+* [`94227e15e`](https://github.com/npm/npm/commit/94227e15eeced836b3d7b3d2b5e5cc41d4959cff)
+ More consistently make directories using perm and ownership preserving features.
+ ([@iarna](https://github.com/iarna))
+
+### DEPENDENCY UPDATES
+
+* [`364b23c7f`](https://github.com/npm/npm/commit/364b23c7f8a231c0df3866d6a8bde4d3f37bbc00)
+ [`f2049f9e7`](https://github.com/npm/npm/commit/f2049f9e7992e6edcfce8619b59746789367150f)
+ `cacache@10.0.4`
+ ([@zkat](https://github.com/zkat))
+* [`d183d7675`](https://github.com/npm/npm/commit/d183d76757e8a29d63a999d7fb4edcc1486c25c1)
+ `find-npm-prefix@1.0.2`:
+ ([@iarna](https://github.com/iarna))
+* [`ffd6ea62c`](https://github.com/npm/npm/commit/ffd6ea62ce583baff38cf4901cf599639bc193c8)
+ `fs-minipass@1.2.5`
+* [`ee63b8a31`](https://github.com/npm/npm/commit/ee63b8a311ac53b0cf2efa79babe61a2c4083ef6)
+ `ini@1.3.5`
+ ([@isaacs](https://github.com/isaacs))
+* [`6f73f5509`](https://github.com/npm/npm/commit/6f73f5509e9e8d606526565c7ceb71c62642466e)
+ `JSONStream@1.3.2`
+ ([@dominictarr](https://github.com/dominictarr))
+* [`26cd64869`](https://github.com/npm/npm/commit/26cd648697c1324979289e381fe837f9837f3874)
+ [`9bc6230cf`](https://github.com/npm/npm/commit/9bc6230cf34a09b7e4358145ff0ac3c69c23c3f6)
+ `libcipm@1.3.3`
+ ([@zkat](https://github.com/zkat))
+* [`21a39be42`](https://github.com/npm/npm/commit/21a39be4241a60a898d11a5967f3fc9868ef70c9)
+ `marked@0.3.1`:5
+ ([@joshbruce](https://github.com/joshbruce))
+* [`dabdf57b2`](https://github.com/npm/npm/commit/dabdf57b2d60d665728894b4c1397b35aa9d41c0)
+ `mississippi@2.0.0`
+* [`2594c5867`](https://github.com/npm/npm/commit/2594c586723023edb1db172779afb2cbf8b30c08)
+ `npm-registry-couchapp@2.7.1`
+ ([@iarna](https://github.com/iarna))
+* [`8abb3f230`](https://github.com/npm/npm/commit/8abb3f230f119fe054353e70cb26248fc05db0b9)
+ `osenv@0.1.5`
+ ([@isaacs](https://github.com/isaacs))
+* [`11a0b00bd`](https://github.com/npm/npm/commit/11a0b00bd3c18625075dcdf4a5cb6500b33c6265)
+ `pacote@7.3.3`
+ ([@zkat](https://github.com/zkat))
+* [`9b6bdb2c7`](https://github.com/npm/npm/commit/9b6bdb2c77e49f6d473e70de4cd83c58d7147965)
+ `query-string@5.1.0`
+ ([@sindresorhus](https://github.com/sindresorhus))
+* [`d6d17d6b5`](https://github.com/npm/npm/commit/d6d17d6b532cf4c3461b1cf2e0404f7c62c47ec4)
+ `readable-stream@2.3.4`
+ ([@mcollina](https://github.com/mcollina))
+* [`51370aad5`](https://github.com/npm/npm/commit/51370aad561b368ccc95c1c935c67c8cd2844d40)
+ `semver@5.5.0`
+ ([@isaacs](https://github.com/isaacs))
+* [`0db14bac7`](https://github.com/npm/npm/commit/0db14bac762dd59c3fe17c20ee96d2426257cdd5)
+ [`81da938ab`](https://github.com/npm/npm/commit/81da938ab6efb881123cdcb44f7f84551924c988)
+ [`9999e83f8`](https://github.com/npm/npm/commit/9999e83f87c957113a12a6bf014a2099d720d716)
+ `ssri@5.2.4`
+ ([@zkat](https://github.com/zkat))
+* [`f526992ab`](https://github.com/npm/npm/commit/f526992ab6f7322a0b3a8d460dc48a2aa4a59a33)
+ `tap@11.1.1`
+ ([@isaacs](https://github.com/isaacs))
+* [`be096b409`](https://github.com/npm/npm/commit/be096b4090e2a33ae057912d28fadc5a53bd3391)
+ [`dc3059522`](https://github.com/npm/npm/commit/dc3059522758470adc225f0651be72c274bd29ef)
+ `tar@4.3.3`
+* [`6b552daac`](https://github.com/npm/npm/commit/6b552daac952f413ed0e2df762024ad219a8dc0a)
+ `uuid@3.2.1`
+ ([@broofa](https://github.com/broofa))
+* [`8c9011b72`](https://github.com/npm/npm/commit/8c9011b724ad96060e7e82d9470e9cc3bb64e9c6)
+ `worker-farm@1.5.2`
+ ([@rvagg](https://github.com/rvagg))
+
+
+## v5.6.0 (2017-11-27):
+
+### Features!
+
+You may have noticed this is a semver-minor bump. Wondering why? This is why!
+
+* [`bc263c3fd`](https://github.com/npm/npm/commit/bc263c3fde6ff4b04deee132d0a9d89379e28c27)
+ [#19054](https://github.com/npm/npm/pull/19054)
+ **Fully cross-platform `package-lock.json`**. Installing a failing optional
+ dependency on one platform no longer removes it from the dependency tree,
+ meaning that `package-lock.json` should now be generated consistently across
+ platforms! 🎉
+ ([@iarna](https://github.com/iarna))
+* [`f94fcbc50`](https://github.com/npm/npm/commit/f94fcbc50d8aec7350164df898d1e12a1e3da77f)
+ [#19160](https://github.com/npm/npm/pull/19160)
+ Add `--package-lock-only` config option. This makes it so you can generate a
+ target `package-lock.json` without performing a full install of
+ `node_modules`.
+ ([@alopezsanchez](https://github.com/alopezsanchez))
+* [`66d18280c`](https://github.com/npm/npm/commit/66d18280ca320f880f4377cf80a8052491bbccbe)
+ [#19104](https://github.com/npm/npm/pull/19104)
+ Add new `--node-options` config to pass through a custom `NODE_OPTIONS` for
+ lifecycle scripts.
+ ([@bmeck](https://github.com/bmeck))
+* [`114d518c7`](https://github.com/npm/npm/commit/114d518c75732c42acbef3acab36ba1d0fd724e2)
+ Ignore mtime when packing tarballs: This means that doing `npm pack` on the
+ same repository should yield two tarballs with the same checksum. This will
+ also help prevent cache bloat when using git dependencies. In the future, this
+ will allow npm to explicitly cache git dependencies.
+ ([@isaacs](https://github.com/isaacs))
+
+### Node 9
+
+Previously, it turns out npm broke on the latest Node, `node@9`. We went ahead
+and fixed it up so y'all should be able to use the latest npm again!
+
+* [`4ca695819`](https://github.com/npm/npm/commit/4ca6958196ae41cef179473e3f7dbed9df9a32f1)
+ `minizlib@1.0.4`: `Fix node@9` incompatibility.
+ ([@isaacs](https://github.com/isaacs))
+* [`c851bb503`](https://github.com/npm/npm/commit/c851bb503a756b7cd48d12ef0e12f39e6f30c577)
+ `tar@4.0.2`: Fix `node@9` incompatibility.
+ ([@isaacs](https://github.com/isaacs))
+* [`6caf23096`](https://github.com/npm/npm/commit/6caf2309613d14ce77923ad3d1275cb89c6cf223)
+ Remove "unsupported" warning for Node 9 now that things are fixed.
+ ([@iarna](https://github.com/iarna))
+* [`1930b0f8c`](https://github.com/npm/npm/commit/1930b0f8c44373301edc9fb6ccdf7efcb350fa42)
+ Update test matrix with `node@8` LTS and `node@9`.
+ ([@iarna](https://github.com/iarna))
+
+### Bug Fixes
+
+* [`b70321733`](https://github.com/npm/npm/commit/b7032173361665a12c9e4200bdc3f0eb4dee682f)
+ [#18881](https://github.com/npm/npm/pull/18881)
+ When dealing with a `node_modules` that was created with older versions of npm
+ (and thus older versions of npa) we need to gracefully handle older spec
+ entries. Failing to do so results in us treating those packages as if they
+ were http remote deps, which results in invalid lock files with `version` set
+ to tarball URLs. This should now be fixed.
+ ([@iarna](https://github.com/iarna))
+* [`2f9c5dd00`](https://github.com/npm/npm/commit/2f9c5dd0046a53ece3482e92a412413f5aed6955)
+ [#18880](https://github.com/npm/npm/pull/18880)
+ Stop overwriting version in package data on disk. This is another safeguard
+ against the version overwriting that's plagued some folks upgrading from older
+ package-locks.
+ ([@iarna](https://github.com/iarna))
+ ([@joshclow](https://github.com/joshclow))
+* [`a93e0a51d`](https://github.com/npm/npm/commit/a93e0a51d3dafc31c809ca28cd7dfa71b2836f86)
+ [#18846](https://github.com/npm/npm/pull/18846)
+ Correctly save transitive dependencies when using `npm update` in
+ `package-lock.json`.
+ ([@iarna](https://github.com/iarna))
+* [`fdde7b649`](https://github.com/npm/npm/commit/fdde7b649987b2acd9a37ef203f1e263fdf6fece)
+ [#18825](https://github.com/npm/npm/pull/18825)
+ Fix typo and concatenation in error handling.
+ ([@alulsh](https://github.com/alulsh))
+* [`be67de7b9`](https://github.com/npm/npm/commit/be67de7b90790cef0a9f63f91c2f1a00942205ee)
+ [#18711](https://github.com/npm/npm/pull/18711)
+ Upgrade to bearer tokens from legacy auth when enabling 2FA.
+ ([@iarna](https://github.com/iarna))
+* [`bfdf0fd39`](https://github.com/npm/npm/commit/bfdf0fd39646b03db8e543e2bec7092da7880596)
+ [#19033](https://github.com/npm/npm/pull/19033)
+ Fix issue where files with `@` signs in their names would not get included
+ when packing tarballs.
+ ([@zkat](https://github.com/zkat))
+* [`b65b89bde`](https://github.com/npm/npm/commit/b65b89bdeaa65516f3e13afdb6e9aeb22d8508f4)
+ [#19048](https://github.com/npm/npm/pull/19048)
+ Fix problem where `npm login` was ignoring various networking-related options,
+ such as custom certs.
+ ([@wejendorp](https://github.com/wejendorp))
+* [`8c194b86e`](https://github.com/npm/npm/commit/8c194b86ec9617e2bcc31f30ee4772469a0bb440)
+ `npm-packlist@1.1.10`: Include `node_modules/` directories not in the root.
+ ([@isaacs](https://github.com/isaacs))
+* [`d7ef6a20b`](https://github.com/npm/npm/commit/d7ef6a20b44e968cb92babab1beb51f99110781d)
+ `libnpx@9.7.1`: Fix some *nix binary path escaping issues.
+ ([@zkat](https://github.com/zkat))
+* [`981828466`](https://github.com/npm/npm/commit/981828466a5936c70abcccea319b227c443e812b)
+ `cacache@10.0.1`: Fix fallback to `copy-concurrently` when file move fails.
+ This might fix permissions and such issues on platforms that were getting
+ weird filesystem errors during install.
+ ([@karolba](https://github.com/karolba))
+* [`a0be6bafb`](https://github.com/npm/npm/commit/a0be6bafb6dd7acb3e7b717c27c8575a2215bfff)
+ `pacote@7.0.2`: Includes a bunch of fixes, specially for issues around git
+ dependencies. Shasum-related errors should be way less common now, too.
+ ([@zkat](https://github.com/zkat))
+* [`b80d650de`](https://github.com/npm/npm/commit/b80d650def417645d2525863e9f17af57a917b42)
+ [#19163](https://github.com/npm/npm/pull/19163)
+ Fix a number of git and tarball specs and checksum errors.
+ ([@zkat](https://github.com/zkat))
+* [`cac225025`](https://github.com/npm/npm/commit/cac225025fa06cd055286e75541138cd95f52def)
+ [#19054](https://github.com/npm/npm/pull/19054)
+ Don't count failed optionals when summarizing installed packages.
+ ([@iarna](https://github.com/iarna))
+
+### UX
+
+* [`b1ec2885c`](https://github.com/npm/npm/commit/b1ec2885c43f8038c4e05b83253041992fdfe382)
+ [#18326](https://github.com/npm/npm/pull/18326)
+ Stop truncating output of `npm view`. This means, for example, that you no
+ longer need to use `--json` when a package has a lot of versions, to see the
+ whole list.
+ ([@SimenB](https://github.com/SimenB))
+* [`55a124e0a`](https://github.com/npm/npm/commit/55a124e0aa6097cb46f1484f666444b2a445ba57)
+ [#18884](https://github.com/npm/npm/pull/18884)
+ Profile UX improvements: better messaging on unexpected responses, and stop
+ claiming we set passwords to null when resetting them.
+ ([@iarna](https://github.com/iarna))
+* [`635481c61`](https://github.com/npm/npm/commit/635481c6143bbe10a6f89747795bf4b83f75a7e9)
+ [#18844](https://github.com/npm/npm/pull/18844)
+ Improve error messaging for OTP/2FA.
+ ([@iarna](https://github.com/iarna))
+* [`52b142ed5`](https://github.com/npm/npm/commit/52b142ed5e0f13f23c99209932e8de3f7649fd47)
+ [#19054](https://github.com/npm/npm/pull/19054)
+ Stop running the same rollback multiple times. This should address issues
+ where Windows users saw strange failures when `fsevents` failed to install.
+ ([@iarna](https://github.com/iarna))
+* [`798428b0b`](https://github.com/npm/npm/commit/798428b0b7b6cfd6ce98041c45fc0a36396e170c)
+ [#19172](https://github.com/npm/npm/pull/19172)
+ `bin-links@1.1.0`: Log the fact line endings are being changed upon install.
+ ([@marcosscriven](https://github.com/marcosscriven))
+
+### Refactors
+
+Usually, we don't include internal refactor stuff in our release notes, but it's
+worth calling out some of them because they're part of a larger effort the CLI
+team and associates are undertaking to modularize npm itself so other package
+managers and associated tools can reuse all that code!
+
+* [`9d22c96b7`](https://github.com/npm/npm/commit/9d22c96b7160729c8126a38dcf554611b9e3ba87)
+ [#18500](https://github.com/npm/npm/pull/18500)
+ Extract bin-links and gentle-fs to a separate library. This will allow
+ external tools to do bin linking and certain fs operations in an
+ npm-compatible way!
+ ([@mikesherov](https://github.com/mikesherov))
+* [`015a7803b`](https://github.com/npm/npm/commit/015a7803b7b63bc8543882196d987b92b461932d)
+ [#18883](https://github.com/npm/npm/pull/18883)
+ Capture logging from log events on the process global. This allows npm to use
+ npmlog to report logging from external libraries like `npm-profile`.
+ ([@iarna](https://github.com/iarna))
+* [`c930e98ad`](https://github.com/npm/npm/commit/c930e98adc03cef357ae5716269a04d74744a852)
+ `npm-lifecycle@2.0.0`: Use our own `node-gyp`. This means npm no longer needs
+ to pull some maneuvers to make sure `node-gyp` is in the right place, and that
+ external packages using `npm-lifecycle` will get working native builds without
+ having to do their own `node-gyp` maneuvers.
+ ([@zkochan](https://github.com/zkochan))
+* [`876f0c8f3`](https://github.com/npm/npm/commit/876f0c8f341f8915e338b409f4b8616bb5263500) [`829893d61`](https://github.com/npm/npm/commit/829893d617bf81bba0d1ce4ea303f76ea37a2b2d)
+ [#19099](https://github.com/npm/npm/pull/19099)
+ `find-npm-prefix@1.0.1`: npm's prefix-finding logic is now a standalone
+ module. That is, the logic that figures out where the root of your project is
+ if you've `cd`'d into a subdirectory. Did you know you can run `npm install`
+ from these subdirectories, and it'll only affect the root? It works like git!
+ ([@iarna](https://github.com/iarna))
+
+### Docs
+
+* [`7ae12b21c`](https://github.com/npm/npm/commit/7ae12b21cc841f76417d3bb13b74f177319d4deb)
+ [#18823](https://github.com/npm/npm/pull/18823)
+ Fix spelling of the word authenticator. Because English is hard.
+ ([@tmcw](https://github.com/tmcw))
+* [`5dfc3ab7b`](https://github.com/npm/npm/commit/5dfc3ab7bc2cb0fa7d9a8c00aa95fecdd14d7ae1)
+ [#18742](https://github.com/npm/npm/pull/18742)
+ Explicitly state 'github:foo/bar' as a valid shorthand for hosted git specs.
+ ([@felicio](https://github.com/felicio))
+* [`a9dc098a6`](https://github.com/npm/npm/commit/a9dc098a6eb7a87895f52a101ac0d41492da698e)
+ [#18679](https://github.com/npm/npm/pull/18679)
+ Add some documentation about the `script-shell` config.
+ ([@gszabo](https://github.com/gszabo))
+* [`24d7734d1`](https://github.com/npm/npm/commit/24d7734d1a1e906c83c53b6d1853af8dc758a998)
+ [#18571](https://github.com/npm/npm/pull/18571)
+ Change `verboten` to `forbidden`.
+ ([@devmount](https://github.com/devmount))
+* [`a8a45668f`](https://github.com/npm/npm/commit/a8a45668fb9b8eb84234fe89234bdcdf644ead58)
+ [#18568](https://github.com/npm/npm/pull/18568)
+ Improve wording for the docs for the "engines" section of package.json files.
+ ([@apitman](https://github.com/apitman))
+* [`dbc7e5b60`](https://github.com/npm/npm/commit/dbc7e5b602870330a8cdaf63bd303cd9050f792f)
+ [#19118](https://github.com/npm/npm/pull/19118)
+ Use valid JSON in example for bundledDependencies.
+ ([@charmander](https://github.com/charmander))
+* [`779339485`](https://github.com/npm/npm/commit/779339485bab5137d0fdc68d1ed6fa987aa8965a)
+ [#19162](https://github.com/npm/npm/pull/19162)
+ Remove trailing white space from `npm access` docs.
+ ([@WispProxy](https://github.com/WispProxy))
+
+### Dependency Bumps
+
+* [`0e7cac941`](https://github.com/npm/npm/commit/0e7cac9413ff1104cf242cc3006f42aa1c2ab63f)
+ `bluebird@3.5.1`
+ ([@petkaantonov](https://github.com/petkaantonov))
+* [`c4d5887d9`](https://github.com/npm/npm/commit/c4d5887d978849ddbe2673630de657f141ae5bcf)
+ `update-notifier@2.3.0`
+ ([@sindresorhus](https://github.com/sindresorhus))
+* [`eb19a9691`](https://github.com/npm/npm/commit/eb19a9691cf76fbc9c5b66aa7aadb5d905af467a)
+ `npm-package-arg@6.0.0`
+ ([@zkat](https://github.com/zkat))
+* [`91d5dca96`](https://github.com/npm/npm/commit/91d5dca96772bc5c45511ddcbeeb2685c7ea68e8)
+ `npm-profile@2.0.5`
+ ([@iarna](https://github.com/iarna))
+* [`8de66c46e`](https://github.com/npm/npm/commit/8de66c46e57e4b449c9540c8ecafbc4fd58faff5)
+ `ssri@5.0.0`
+ ([@zkat](https://github.com/zkat))
+* [`cfbc3ea69`](https://github.com/npm/npm/commit/cfbc3ea69a8c62dc8e8543193c3ac472631dcef9)
+ `worker-farm@1.5.1`
+ ([@rvagg](https://github.com/rvagg))
+* [`60c228160`](https://github.com/npm/npm/commit/60c228160f22d41c2b36745166c9e8c2d84fee58)
+ `query-string@5.0.1`
+ ([@sindresorhus](https://github.com/sindresorhus))
+* [`72cad8c66`](https://github.com/npm/npm/commit/72cad8c664efd8eb1bec9a418bccd6c6ca9290de)
+ `copy-concurrently@1.0.5`
+ ([@iarna](https://github.com/iarna))
+
+## v5.5.1 (2017-10-04):
+
+A very quick, record time, patch release, of a bug fix to a (sigh) last minute bug fix.
+
+* [`e628e058b`](https://github.com/npm/npm/commit/e628e058b)
+ Fix login to properly recognize OTP request and store bearer tokens.
+ ([@iarna](https://github.com/iarna))
+
+## v5.5.0 (2017-10-04):
+
+Hey y'all, this is a big new feature release! We've got some security
+related goodies plus a some quality-of-life improvements for anyone who uses
+the public registry (so, virtually everyone).
+
+The changes largely came together in one piece, so I'm just gonna leave the commit line here:
+
+* [`f6ebf5e8b`](https://github.com/npm/npm/commit/f6ebf5e8bd6a212c7661e248c62c423f2b54d978)
+ [`f97ad6a38`](https://github.com/npm/npm/commit/f97ad6a38412581d059108ea29be470acb4fa510)
+ [`f644018e6`](https://github.com/npm/npm/commit/f644018e6ef1ff7523c6ec60ae55a24e87a9d9ae)
+ [`8af91528c`](https://github.com/npm/npm/commit/8af91528ce6277cd3a8c7ca8c8102671baf10d2f)
+ [`346a34260`](https://github.com/npm/npm/commit/346a34260b5fba7de62717135f3e083cc4820853)
+ Two factor authentication, profile editing and token management.
+ ([@iarna](https://github.com/iarna))
+
+### TWO FACTOR AUTHENTICATION
+
+You can now enable two-factor authentication for your npm account. You can
+even do it from the CLI. In fact, you have to, for the time being:
+
+```
+npm profile enable-tfa
+```
+
+With the default two-factor authentication mode you'll be prompted to enter
+a one-time password when logging in, when publishing and when modifying access rights to
+your modules.
+
+### TOKEN MANAGEMENT
+
+You can now create, list and delete authentication tokens from the comfort
+of the command line. Authentication tokens created this way can have NEW
+restrictions placed on them. For instance, you can create a `read-only`
+token to give to your CI. It will be able to download your private modules
+but it won't be able to publish or modify modules. You can also create
+tokens that can only be used from certain network addresses. This way you
+can lock down access to your corporate VPN or other trusted machines.
+
+Deleting tokens isn't new, you could [do it via the
+website](https://www.npmjs.com/settings/tokens) but now you can do it via
+the CLI as well.
+
+### CHANGE YOUR PASSWORD, SET YOUR EMAIL
+
+You can finally change your password from the CLI with `npm profile set
+password`! You can also update your email address with `npm profile set
+email `. If you change your email address we'll send you a new
+verification email so you verify that its yours.
+
+### AND EVERYTHING ELSE ON YOUR PROFILE
+
+You can also update all of the other attributes of your profile that
+previously you could only update via the website: `fullname`, `homepage`,
+`freenode`, `twitter` and `github`.
+
+### AVAILABLE STAND ALONE
+
+All of these features were implemented in a stand alone library, so if you
+have use for them in your own project you can find them in
+[npm-profile](https://www.npmjs.com/package/npm-profile) on the registry.
+There's also a little mini-cli written just for it at
+[npm-profile-cli](https://www.npmjs.com/package/npm-profile-cli). You might
+also be interested in the [API
+documentation](https://github.com/npm/registry/tree/master/docs) for these
+new features: [user profile editing](https://github.com/npm/registry/blob/master/docs/user/profile.md) and
+[authentication](https://github.com/npm/registry/blob/master/docs/user/authentication.md).
+
+### BUG FIXES
+
+* [`5ee55dc71`](https://github.com/npm/npm/commit/5ee55dc71b8b74b8418c3d5ec17483a07b3b6777)
+ install.sh: Drop support for upgrading from npm@1 as npm@5 can't run on
+ any Node.js version that ships npm@1. This fixes an issue some folks were seeing when trying
+ to upgrade using `curl | http://npmjs.com/install.sh`.
+ ([@iarna](https://github.com/iarna))
+* [`5cad1699a`](https://github.com/npm/npm/commit/5cad1699a7a0fc85ac7f77a95087a9647f75e344)
+ `npm-lifecycle@1.0.3` Fix a bug where when more than one lifecycle script
+ got queued to run, npm would crash.
+ ([@zkat](https://github.com/zkat))
+* [`cd256cbb2`](https://github.com/npm/npm/commit/cd256cbb2f97fcbcb82237e94b66eac80e493626)
+ `npm-packlist@1.1.9` Fix a bug where test directories would always be
+ excluded from published modules.
+ ([@isaacs](https://github.com/isaacs))
+* [`2a11f0215`](https://github.com/npm/npm/commit/2a11f021561acb1eb1ad4ad45ad955793b1eb4af)
+ Fix formatting of unsupported version warning
+ ([@iarna](https://github.com/iarna))
+
+### DEPENDENCY UPDATES
+
+* [`6d2a285a5`](https://github.com/npm/npm/commit/6d2a285a58655f10834f64d38449eb1f3c8b6c47)
+ `npm-registry-client@8.5.0`
+* [`69e64e27b`](https://github.com/npm/npm/commit/69e64e27bf58efd0b76b3cf6e8182c77f8cc452f)
+ `request@2.83.0`
+* [`34e0f4209`](https://github.com/npm/npm/commit/34e0f42090f6153eb5462f742e402813e4da56c8)
+ `abbrev@1.1.1`
+* [`10d31739d`](https://github.com/npm/npm/commit/10d31739d39765f1f0249f688bd934ffad92f872)
+ `aproba@1.2.0`
+* [`2b02e86c0`](https://github.com/npm/npm/commit/2b02e86c06cf2a5fe7146404f5bfd27f190ee4f4)
+ `meant@1.0.1`
+* [`b81fff808`](https://github.com/npm/npm/commit/b81fff808ee269361d3dcf38c1b6019f1708ae02)
+ `rimraf@2.6.2`:
+ Fixes a long standing bug in rimraf's attempts to work around Windows limitations
+ where it owns a file and can change its perms but can't remove it without
+ first changing its perms. This _may_ be an improvement for Windows users of npm under
+ some circumstances.
+ ([@isaacs](https://github.com/isaacs))
+
+## v5.4.2 (2017-09-14):
+
+This is a small bug fix release wrapping up most of the issues introduced with 5.4.0.
+
+### Bugs
+
+* [`0b28ac72d`](https://github.com/npm/npm/commit/0b28ac72d29132e9b761717aba20506854465865)
+ [#18458](https://github.com/npm/npm/pull/18458)
+ Fix a bug on Windows where rolling back of failed optional dependencies would fail.
+ ([@marcins](https://github.com/marcins))
+* [`3a1b29991`](https://github.com/npm/npm/commit/3a1b299913ce94fdf25ed3ae5c88fe6699b04e24)
+ `write-file-atomic@2.1.0` Revert update of `write-file-atomic`. There were changes made to it
+ that were resulting in EACCES errors for many users.
+ ([@iarna](https://github.com/iarna))
+* [`cd8687e12`](https://github.com/npm/npm/commit/cd8687e1257f59a253436d69e8d79a29c85d00c8)
+ Fix a bug where if npm decided it needed to move a module during an upgrade it would strip
+ out much of the `package.json`. This would result in broken trees after package updates.
+* [`5bd0244ee`](https://github.com/npm/npm/commit/5bd0244eec347ce435e88ff12148c35da7c69efe)
+ [#18385](https://github.com/npm/npm/pull/18385)
+ Fix `npm outdated` when run on non-registry dependencies.
+ ([@joshclow](https://github.com/joshclow))
+ ([@iarna](https://github.com/iarna))
+
+### Ux
+
+* [`339f17b1e`](https://github.com/npm/npm/commit/339f17b1e6816eccff7df97875db33917eccdd13)
+ Report unsupported node versions with greater granularity.
+ ([@iarna](https://github.com/iarna))
+
+### Docs
+
+* [`b2ab6f43b`](https://github.com/npm/npm/commit/b2ab6f43b8ae645134238acd8dd3083e5ba8846e)
+ [#18397](https://github.com/npm/npm/pull/18397)
+ Document that the default loglevel with `npm@5` is `notice`.
+ ([@KenanY](https://github.com/KenanY))
+* [`e5aedcd82`](https://github.com/npm/npm/commit/e5aedcd82af81fa9e222f9210f6f890c72a18dd3)
+ [#18372](https://github.com/npm/npm/pull/18372)
+ In npm-config documentation, note that env vars use \_ in place of -.
+ ([@jakubholynet](https://github.com/jakubholynet))
+
+## v5.4.1 (2017-09-06):
+
+This is a very small bug fix release to fix a problem where permissions on
+installed binaries were being set incorrectly.
+
+* [`767ff6eee`](https://github.com/npm/npm/commit/767ff6eee7fa3a0f42ad677dedc0ec1f0dc15e7c)
+ [zkat/pacote#117](https://github.com/zkat/pacote/pull/117)
+ [#18324](https://github.com/npm/npm/issues/18324)
+ `pacote@6.0.2`
+ ([@zkat](https://github.com/zkat))
+
+## v5.4.0 (2017-08-22):
+
+Here's another ~~small~~ big release, with a ~~handful~~ bunch of fixes and
+a couple of ~~small~~ new features! This release has been incubating rather
+longer than usual and it's grown quite a bit in that time. I'm also excited
+to say that it has contributions from **27** different folks, which is a new
+record for us. Our previous record was 5.1.0 at 21. Before that the record
+had been held by 1.3.16 since _December of 2013_.
+
+![chart of contributor counts by version, showing an increasing rate over time and spikes mid in the 1.x series and later at 5.x](https://pbs.twimg.com/media/DH38rbZUwAAf9hS.jpg)
+
+If you can't get enough of the bleeding edge, I encourage you to check out
+our canary release of npm. Get it with `npm install -g npmc`. It's going to
+be seeing some exciting stuff in the next couple of weeks, starting with a
+rewriten `npm dedupe`, but moving on to… well, you'll just have to wait and
+find out.
+
+### PERFORMANCE
+
+* [`d080379f6`](https://github.com/npm/npm/commit/d080379f620c716afa2c1d2e2ffc0a1ac3459194)
+ `pacote@6.0.1` Updates extract to use tar@4, which is much faster than the
+ older tar@2. It reduces install times by as much as 10%.
+ ([@zkat](https://github.com/zkat))
+* [`4cd6a1774`](https://github.com/npm/npm/commit/4cd6a1774f774506323cae5685c9ca9a10deab63)
+ [`0195c0a8c`](https://github.com/npm/npm/commit/0195c0a8cdf816834c2f737372194ddc576c451d)
+ [#16804](https://github.com/npm/npm/pull/16804)
+ `tar@4.0.1` Update publish to use tar@4. tar@4 brings many advantages
+ over tar@2: It's faster, better tested and easier to work with. It also
+ produces exactly the same byte-for-byte output when producing tarballs
+ from the same set of files. This will have some nice carry on effects for
+ things like caching builds from git. And finally, last but certainly not
+ least, upgrading to it also let's us finally eliminate `fstream`—if
+ you know what that is you'll know why we're so relieved.
+ ([@isaacs](https://github.com/isaacs))
+
+### FEATURES
+
+* [`1ac470dd2`](https://github.com/npm/npm/commit/1ac470dd283cc7758dc37721dd6331d5b316dc99)
+ [#10382](https://github.com/npm/npm/pull/10382)
+ If you make a typo when writing a command now, npm will print a brief "did you
+ mean..." message with some possible alternatives to what you meant.
+ ([@watilde](https://github.com/watilde))
+* [`20c46228d`](https://github.com/npm/npm/commit/20c46228d8f9243910f8c343f4830d52455d754e)
+ [#12356](https://github.com/npm/npm/pull/12356)
+ When running lifecycle scripts, `INIT_CWD` will now contain the original
+ working directory that npm was executed from. Remember that you can use `npm
+ run-script` even if you're not inside your package root directory!
+ ([@MichaelQQ](https://github.com/MichaelQQ))
+* [`be91e1726`](https://github.com/npm/npm/commit/be91e1726e9c21c4532723e4f413b73a93dd53d1)
+ [`4e7c41f4a`](https://github.com/npm/npm/commit/4e7c41f4a29744a9976cc22c77eee9d44172f21e)
+ `libnpx@9.6.0`: Fixes a number of issues on Windows and adds support for
+ several more languages: Korean, Norwegian (bokmål and nynorsk), Ukrainian,
+ Serbian, Bahasa Indonesia, Polish, Dutch and Arabic.
+ ([@zkat](https://github.com/zkat))
+* [`2dec601c6`](https://github.com/npm/npm/commit/2dec601c6d5a576751d50efbcf76eaef4deff31e)
+ [#17142](https://github.com/npm/npm/pull/17142)
+ Add the new `commit-hooks` option to `npm version` so that you can disable commit
+ hooks when committing the version bump.
+ ([@faazshift](https://github.com/faazshift))
+* [`bde151902`](https://github.com/npm/npm/commit/bde15190230b5c62dbd98095311eab71f6b52321)
+ [#14461](https://github.com/npm/npm/pull/14461)
+ Make output from `npm ping` clear as to its success or failure.
+ ([@legodude17](https://github.com/legodude17))
+
+### BUGFIXES
+
+* [`b6d5549d2`](https://github.com/npm/npm/commit/b6d5549d2c2d38dd0e4319c56b69ad137f0d50cd)
+ [#17844](https://github.com/npm/npm/pull/17844)
+ Make package-lock.json sorting locale-agnostic. Previously, sorting would vary
+ by locale, due to using `localeCompare` for key sorting. This'll give you
+ a little package-lock.json churn as it reshuffles things, sorry!
+ ([@LotharSee](https://github.com/LotharSee))
+* [`44b98b9dd`](https://github.com/npm/npm/commit/44b98b9ddcfcccf68967fdf106fca52bf0c3da4b)
+ [#17919](https://github.com/npm/npm/pull/17919)
+ Fix a crash where `npm prune --production` would fail while removing `.bin`.
+ ([@fasterthanlime](https://github.com/fasterthanlime))
+* [`c3d1d3ba8`](https://github.com/npm/npm/commit/c3d1d3ba82aa41dfb2bd135e6cdc59f8d33cd9fb)
+ [#17816](https://github.com/npm/npm/pull/17816)
+ Fail more smoothly when attempting to install an invalid package name.
+ ([@SamuelMarks](https://github.com/SamuelMarks))
+* [`55ac2fca8`](https://github.com/npm/npm/commit/55ac2fca81bf08338302dc7dc2070494e71add5c)
+ [#12784](https://github.com/npm/npm/pull/12784)
+ Guard against stack overflows when marking packages as failed.
+ ([@vtravieso](https://github.com/vtravieso))
+* [`597cc0e4b`](https://github.com/npm/npm/commit/597cc0e4b5e6ee719014e3171d4e966df42a275c)
+ [#15087](https://github.com/npm/npm/pull/15087)
+ Stop outputting progressbars or using color on dumb terminals.
+ ([@iarna](https://github.com/iarna))
+* [`7a7710ba7`](https://github.com/npm/npm/commit/7a7710ba72e6f82414653c2e7e91fea9a1aba7e2)
+ [#15088](https://github.com/npm/npm/pull/15088)
+ Don't exclude modules that are both dev & prod when using `npm ls --production`.
+ ([@iarna](https://github.com/iarna))
+* [`867df2b02`](https://github.com/npm/npm/commit/867df2b0214689822b87b51578e347f353be97e8)
+ [#18164](https://github.com/npm/npm/pull/18164)
+ Only do multiple procs on OSX for now. We've seen a handful of issues
+ relating to this in Docker and in on Windows with antivirus.
+ ([@zkat](https://github.com/zkat))
+* [`23540af7b`](https://github.com/npm/npm/commit/23540af7b0ec5f12bbdc1558745c8c4f0861042b)
+ [#18117](https://github.com/npm/npm/pull/18117)
+ Some package managers would write spaces to the \_from field in package.json's in the
+ form of `name @spec`. This was causing npm to fail to interpret them. We now handle that
+ correctly and doubly make sure we don't do that ourselves.
+ ([@IgorNadj](https://github.com/IgorNadj))
+* [`0ef320cb4`](https://github.com/npm/npm/commit/0ef320cb40222693b7367b97c60ddffabc2d58c5)
+ [#16634](https://github.com/npm/npm/pull/16634)
+ Convert any bin script with a shbang a the start to Unix line-endings. (These sorts of scripts
+ are not compatible with Windows line-endings even on Windows.)
+ ([@ScottFreeCode](https://github.com/ScottFreeCode))
+* [`71191ca22`](https://github.com/npm/npm/commit/71191ca2227694355c49dfb187104f68df5126bd)
+ [#16476](https://github.com/npm/npm/pull/16476)
+ `npm-lifecycle@1.0.2` Running an install with `--ignore-scripts` was resulting in the
+ the package object being mutated to have the lifecycle scripts removed from it and that
+ in turn was being written out to disk, causing further problems. This fixes that:
+ No more mutation, no more unexpected changes.
+ ([@addaleax](https://github.com/addaleax))
+* [`459fa9d51`](https://github.com/npm/npm/commit/459fa9d51600904ee75ed6267b159367a1209793)
+ [npm/read-package-json#74](https://github.com/npm/read-package-json/pull/74)
+ [#17802](https://github.com/npm/npm/pull/17802)
+ `read-package-json@2.0.1` Use unix-style slashes for generated bin
+ entries, which lets them be cross platform even when produced on Windows.
+ ([@iarna](https://github.com/iarna))
+* [`5ec72ab5b`](https://github.com/npm/npm/commit/5ec72ab5b27c5c83cee9ff568cf75a9479d4b83a)
+ [#18229](https://github.com/npm/npm/pull/18229)
+ Make install.sh find nodejs on debian.
+ ([@cebe](https://github.com/cebe))
+
+### DOCUMENTATION
+
+* [`b019680db`](https://github.com/npm/npm/commit/b019680db78ae0a6dff2289dbfe9f61fccbbe824)
+ [#10846](https://github.com/npm/npm/pull/10846)
+ Remind users that they have to install missing `peerDependencies` manually.
+ ([@ryanflorence](https://github.com/ryanflorence))
+* [`3aee5986a`](https://github.com/npm/npm/commit/3aee5986a65add2f815b24541b9f4b69d7fb445f)
+ [#17898](https://github.com/npm/npm/pull/17898)
+ Minor punctuation fixes to the README.
+ ([@AndersDJohnson](https://github.com/AndersDJohnson))
+* [`e0d0a7e1d`](https://github.com/npm/npm/commit/e0d0a7e1dda2c43822b17eb71f4d51900575cc61)
+ [#17832](https://github.com/npm/npm/pull/17832)
+ Fix grammar, format, and spelling in documentation for `run-script`.
+ ([@simonua](https://github.com/simonua))
+* [`3fd6a5f2f`](https://github.com/npm/npm/commit/3fd6a5f2f8802a9768dba2ec32c593b5db5a878d)
+ [#17897](https://github.com/npm/npm/pull/17897)
+ Add more info about using `files` with `npm pack`/`npm publish`.
+ ([@davidjgoss](https://github.com/davidjgoss))
+* [`f00cdc6eb`](https://github.com/npm/npm/commit/f00cdc6eb90a0735bc3c516720de0b1428c79c31)
+ [#17785](https://github.com/npm/npm/pull/17785)
+ Add a note about filenames for certificates on Windows, which use a different
+ extension and file type.
+ ([@lgp1985](https://github.com/lgp1985))
+* [`0cea6f974`](https://github.com/npm/npm/commit/0cea6f9741243b1937abfa300c2a111d9ed79143)
+ [#18022](https://github.com/npm/npm/pull/18022)
+ Clarify usage for the `files` field in `package.json`.
+ ([@xcambar](https://github.com/xcambar))
+* [`a0fdd1571`](https://github.com/npm/npm/commit/a0fdd15710971234cbc57086cd1a4dc037a39471)
+ [#15234](https://github.com/npm/npm/pull/15234)
+ Clarify the behavior of the `files` array in the package-json docs.
+ ([@jbcpollak](https://github.com/jbcpollak))
+* [`cecd6aa5d`](https://github.com/npm/npm/commit/cecd6aa5d4dd04af765b26b749c1cd032f7eb913)
+ [#18137](https://github.com/npm/npm/pull/18137)
+ Clarify interaction between npmignore and files in package.json.
+ ([@supertong](https://github.com/supertong))
+* [`6b8972039`](https://github.com/npm/npm/commit/6b89720396767961001e727fc985671ce88b901b)
+ [#18044](https://github.com/npm/npm/pull/18044)
+ Corrected the typo in package-locks docs.
+ ([@vikramnr](https://github.com/vikramnr))
+* [`6e012924f`](https://github.com/npm/npm/commit/6e012924f99c475bc3637c86ab6a113875405fc7)
+ [#17667](https://github.com/npm/npm/pull/17667)
+ Fix description of package.json in npm-scripts docs.
+ ([@tripu](https://github.com/tripu))
+
+### POSSIBLY INTERESTING DEPENDENCY UPDATES
+
+* [`48d84171a`](https://github.com/npm/npm/commit/48d84171a302fde2510b3f31e4a004c5a4d39c73)
+ [`f60b05d63`](https://github.com/npm/npm/commit/f60b05d6307a7c46160ce98d6f3ccba89411c4ba)
+ `semver@5.4.1` Perf improvements.
+ ([@zkat](https://github.com/zkat))
+* [`f4650b5d4`](https://github.com/npm/npm/commit/f4650b5d4b2be2c04c229cc53aa930e260af9b4e)
+ `write-file-atomic@2.3.0`:
+ Serialize writes to the same file so that results are deterministic.
+ Cleanup tempfiles when process is interrupted or killed.
+ ([@ferm10n](https://github.com/ferm10n))
+ ([@iarna](https://github.com/iarna))
+
+### CHORES
+
+* [`96d78df98`](https://github.com/npm/npm/commit/96d78df9843187bc53be2c93913e8567003ccb73)
+ [`80e2f4960`](https://github.com/npm/npm/commit/80e2f4960691bc5dbd8320002e4d9143784b9ce9)
+ [`4f49f687b`](https://github.com/npm/npm/commit/4f49f687bbd54b6a0e406936ae35593d8e971e1e)
+ [`07d2296b1`](https://github.com/npm/npm/commit/07d2296b10e3d8d6f079eba3a61f0258501d7161)
+ [`a267ab430`](https://github.com/npm/npm/commit/a267ab4309883012a9d55934533c5915e9842277)
+ [#18176](https://github.com/npm/npm/pull/18176)
+ [#18025](https://github.com/npm/npm/pull/18025)
+ Move the lifecycle code out of npm into a separate library,
+ [`npm-lifecycle`](https://github.com/npm/lifecycle). Shh, I didn't tell you this, but this
+ portends to some pretty cool stuff to come very soon now.
+ ([@mikesherov](https://github.com/mikesherov))
+* [`0933c7eaf`](https://github.com/npm/npm/commit/0933c7eaf9cfcdf56471fe4e71c403e2016973da)
+ [#18025](https://github.com/npm/npm/pull/18025)
+ Force Travis to use Precise instead of Trusty. We have issues with our
+ couchdb setup and Trusty. =/
+ ([@mikesherov](https://github.com/mikesherov))
+* [`afb086230`](https://github.com/npm/npm/commit/afb086230223f3c4fcddee4e958d18fce5db0ff9)
+ [#18138](https://github.com/npm/npm/pull/18138)
+ Fix typos in files-and-ignores test.
+ ([@supertong](https://github.com/supertong))
+* [`3e6d11cde`](https://github.com/npm/npm/commit/3e6d11cde096b4ee7b07e7569b37186aa2115b1a)
+ [#18175](https://github.com/npm/npm/pull/18175)
+ Update dependencies to eliminate transitive dependencies with the WTFPL license, which
+ some more serious corporate lawyery types aren't super comfortable with.
+ ([@zkat](https://github.com/zkat))
+* [`ee4c9bd8a`](https://github.com/npm/npm/commit/ee4c9bd8ae574a0d6b24725ba6c7b718d8aaad8d)
+ [#16474](https://github.com/npm/npm/pull/16474)
+ The tests in `test/tap/lifecycle-signal.js`, as well as the features
+ they are testing, are partially broken. This moves them from
+ being skipped in CI to being disabled only for certain platforms.
+ In particular, because `npm` spawns its lifecycle scripts in a
+ shell, signals are not necessarily forwarded by the shell and
+ won’t cause scripts to exit; also, shells may report the signal
+ they receive using their exit status, rather than terminating
+ themselves with a signal.
+ ([@addaleax](https://github.com/addaleax))
+* [`9462e5d9c`](https://github.com/npm/npm/commit/9462e5d9cfbaa50218de6d0a630d6552e72ad0a8)
+ [#16547](https://github.com/npm/npm/pull/16547)
+ Remove unused file: bin/read-package-json.js
+ ([@metux](https://github.com/metux))
+* [`0756d687d`](https://github.com/npm/npm/commit/0756d687d4ccfcd4a7fd83db0065eceb9261befb)
+ [#16550](https://github.com/npm/npm/pull/16550)
+ The build tools for the documentation need to be built/installed
+ before the documents, even with parallel builds.
+ Make has a simple mechanism which was made exactly for that:
+ target dependencies.
+ ([@metux](https://github.com/metux))
+
+## v5.3.0 (2017-07-12):
+
+As mentioned before, we're continuing to do relatively rapid, smaller releases
+as we keep working on stomping out `npm@5` issues! We've made a lot of progress
+since 5.0 already, and this release is no exception.
+
+### FEATURES
+
+* [`1e3a46944`](https://github.com/npm/npm/commit/1e3a469448b5db8376e6f64022c4c0c78cdb1686)
+ [#17616](https://github.com/npm/npm/pull/17616)
+ Add `--link` filter option to `npm ls`.
+ ([@richardsimko](https://github.com/richardsimko))
+* [`33df0aaa`](https://github.com/npm/npm/commit/33df0aaaa7271dac982b86f2701d10152c4177c8)
+ `libnpx@9.2.0`:
+ * 4 new languages - Czech, Italian, Turkish, and Chinese (Traditional)! This means npx is available in 14 different languages!
+ * New --node-arg option lets you pass CLI arguments directly to node when the target binary is found to be a Node.js script.
+ ([@zkat](https://github.com/zkat))
+
+### BUGFIXES
+
+* [`33df0aaa`](https://github.com/npm/npm/commit/33df0aaaa7271dac982b86f2701d10152c4177c8)
+ `libnpx@9.2.0`:
+ * npx should now work on (most) Windows installs. A couple of issues remain.
+ * Prevent auto-fallback from going into an infinite loop when npx disappears.
+ * `npx npx npx npx npx npx npx npx` works again.
+ * `update-notifier` will no longer run for the npx bundled with npm.
+ * `npx ` in a subdirectory of your project should be able to find your `node_modules/.bin` now. Oops
+ ([@zkat](https://github.com/zkat))
+* [`8e979bf80`](https://github.com/npm/npm/commit/8e979bf80fb93233f19db003f08443e26cfc5e64)
+ Revert change where npm stopped flattening modules that required peerDeps.
+ This caused problems because folks were using peer deps to indicate that the
+ target of the peer dep needed to be able to require the dependency and had
+ been relying on the fact that peer deps didn't change the shape of the tree
+ (as of npm@3).
+ The fix that will actually work for people is for a peer dep to insist on
+ never being installed deeper than the the thing it relies on. At the moment
+ this is tricky because the thing the peer dep relies on may not yet have
+ been added to the tree, so we don't know where it is.
+ ([@iarna](https://github.com/iarna))
+* [`7f28a77f3`](https://github.com/npm/npm/commit/7f28a77f33ef501065f22e8d5e8cffee3195dccd)
+ [#17733](https://github.com/npm/npm/pull/17733)
+ Split remove and unbuild actions into two to get uninstall lifecycles and the
+ removal of transitive symlinks during uninstallation to run in the right
+ order.
+ ([@iarna](https://github.com/iarna))
+* [`637f2548f`](https://github.com/npm/npm/commit/637f2548facae011eebf5e5c38bfe56a6c2db9fa)
+ [#17748](https://github.com/npm/npm/pull/17748)
+ When rolling back use symlink project-relative path, fixing some issues with
+ `fs-vacuum` getting confused while removing symlinked things.
+ ([@iarna](https://github.com/iarna))
+* [`f153b5b22`](https://github.com/npm/npm/commit/f153b5b22f647d4d403f5b8cecd2ce63ac75b07c)
+ [#17706](https://github.com/npm/npm/pull/17706)
+ Use semver to compare node versions in npm doctor instead of plain `>`
+ comparison.
+ ([@leo-shopify](https://github.com/leo-shopify))
+* [`542f7561`](https://github.com/npm/npm/commit/542f7561d173eca40eb8d838a16a0ed582fef989)
+ [#17742](https://github.com/npm/npm/pull/17742)
+ Fix issue where `npm version` would sometimes not commit package-locks.
+ ([@markpeterfejes](https://github.com/markpeterfejes))
+* [`51a9e63d`](https://github.com/npm/npm/commit/51a9e63d31cb5ac52259dcf1c364004286072426)
+ [#17777](https://github.com/npm/npm/pull/17777)
+ Fix bug exposed by other bugfixes where the wrong package would be removed.
+ ([@iarna](https://github.com/iarna))
+
+### DOCUMENTATION
+
+Have we mentioned we really like documentation patches? Keep sending them in!
+Small patches are just fine, and they're a great way to get started contributing
+to npm!
+
+* [`fb42d55a9`](https://github.com/npm/npm/commit/fb42d55a9a97afa5ab7db38b3b99088cf68684ea)
+ [#17728](https://github.com/npm/npm/pull/17728)
+ Document semver git urls in package.json docs.
+ ([@sankethkatta](https://github.com/sankethkatta))
+* [`f398c700f`](https://github.com/npm/npm/commit/f398c700fb0f2f3665ebf45995a910ad16cd8d05)
+ [#17684](https://github.com/npm/npm/pull/17684)
+ Tweak heading hierarchy in package.json docs.
+ ([@sonicdoe](https://github.com/sonicdoe))
+* [`d5ad65e50`](https://github.com/npm/npm/commit/d5ad65e50a573cdf9df4155225e869cd6c88ca5e)
+ [#17691](https://github.com/npm/npm/pull/17691)
+ Explicitly document `--no-save` flag for uninstall.
+ ([@timneedham](https://github.com/timneedham))
+
+## v5.2.0 (2017-07-05):
+
+It's only been a couple of days but we've got some bug fixes we wanted to
+get out to you all. We also believe that
+[`npx`](https://medium.com/@maybekatz/introducing-npx-an-npm-package-runner-55f7d4bd282b) is ready to be bundled
+with npm, which we're really excited about!
+
+### npx!!!
+
+npx is a tool intended to help round out the experience of using packages
+from the npm registry — the same way npm makes it super easy to install and
+manage dependencies hosted on the registry, npx is meant to make it easy to
+use CLI tools and other executables hosted on the registry. It greatly
+simplifies a number of things that, until now, required a bit of ceremony to
+do with plain npm.
+
+![](https://cdn-images-1.medium.com/max/1600/1*OlIRsvVO5aK7ja9HmwXz_Q.gif)
+
+[@zkat](https://github.com/zkat) has a [great introduction post to npx](https://medium.com/@maybekatz/introducing-npx-an-npm-package-runner-55f7d4bd282b)
+that I highly recommend you give a read
+
+* [`fb040bee0`](https://github.com/npm/npm/commit/fb040bee0710759c60e45bf8fa2a3b8ddcf4212a)
+ [#17685](https://github.com/npm/npm/pull/17685)
+ Bundle npx with npm itself.
+ ([@zkat](https://github.com/zkat))
+
+### BUG FIXES
+
+* [`9fe905c39`](https://github.com/npm/npm/commit/9fe905c399d07a3c00c7b22035ddb6b7762731e6)
+ [#17652](https://github.com/npm/npm/pull/17652)
+ Fix max callstack exceeded loops with trees with circular links.
+ ([@iarna](https://github.com/iarna))
+* [`c0a289b1b`](https://github.com/npm/npm/commit/c0a289b1ba6b99652c43a955b23acbf1de0b56ae)
+ [#17606](https://github.com/npm/npm/pull/17606)
+ Make sure that when write package.json and package-lock.json we always use unix path separators.
+ ([@Standard8](https://github.com/Standard8))
+* [`1658b79ca`](https://github.com/npm/npm/commit/1658b79cad89ccece5ae5ce3c2f691d44b933116)
+ [#17654](https://github.com/npm/npm/pull/17654)
+ Make `npm outdated` show results for globals again. Previously it never thought they were out of date.
+ ([@iarna](https://github.com/iarna))
+* [`06c154fd6`](https://github.com/npm/npm/commit/06c154fd653d18725d2e760ba825d43cdd807420)
+ [#17678](https://github.com/npm/npm/pull/17678)
+ Stop flattening modules that have peer dependencies. We're making this
+ change to support scenarios where the module requiring a peer dependency
+ is flattened but the peer dependency itself is not, due to conflicts. In
+ those cases the module requiring the peer dep can't be flattened past the
+ location its peer dep was placed in. This initial fix is naive, never
+ flattening peer deps, and we can look into doing something more
+ sophisticated later on.
+ ([@iarna](https://github.com/iarna))
+* [`88aafee8b`](https://github.com/npm/npm/commit/88aafee8b5b232b7eeb5690279a098d056575791)
+ [#17677](https://github.com/npm/npm/pull/17677)
+ There was an issue where updating a flattened dependency would sometimes
+ unflatten it. This only happened when the dependency had dependencies
+ that in turn required the original dependency.
+ ([@iarna](https://github.com/iarna))
+* [`b58ec8eab`](https://github.com/npm/npm/commit/b58ec8eab3b4141e7f1b8b42d8cc24f716a804d8)
+ [#17626](https://github.com/npm/npm/pull/17626)
+ Integrators who were building their own copies of npm ran into issues because
+ `make install` and https://npmjs.com/install.sh weren't aware that
+ `npm install` creates links now when given a directory to work on. This does not impact folks
+ installing npm with `npm install -g npm`.
+ ([@iarna](https://github.com/iarna))
+
+### DOC FIXES
+
+* [`10bef735e`](https://github.com/npm/npm/commit/10bef735e825acc8278827d34df415dfcd8c67d4)
+ [#17645](https://github.com/npm/npm/pull/17645)
+ Fix some github issue links in the 5.1.0 changelog
+ ([@schmod](https://github.com/schmod))
+* [`85fa9dcb2`](https://github.com/npm/npm/commit/85fa9dcb2f0b4f51b515358e0184ec82a5845227)
+ [#17634](https://github.com/npm/npm/pull/17634)
+ Fix typo in package-lock docs.
+ ([@sonicdoe](https://github.com/sonicdoe))
+* [`688699bef`](https://github.com/npm/npm/commit/688699befc2d147288c69a9405fb8354ecaebe36)
+ [#17628](https://github.com/npm/npm/pull/17628)
+ Recommend that folks looking for support join us on https://package.community/ or message
+ [@npm_support](https://twitter.com/npm_support) on Twitter.
+ ([@strugee](https://github.com/strugee))
+
+
+## v5.1.0 (2017-07-05):
+
+Hey y'all~
+
+We've got some goodies for you here, including `npm@5`'s first semver-minor
+release! This version includes a huge number of fixes, particularly for some of
+the critical bugs users were running into after upgrading npm. You should
+overall see a much more stable experience, and we're going to continue hacking
+on fixes for the time being. Semver-major releases, specially for tools like
+npm, are bound to cause some instability, and getting `npm@5` stable is the CLI
+team's top priority for now!
+
+Not that bugfixes are the only things that landed, either: between improvements
+that fell out of the bugfixes, and some really cool work by community members
+like [@mikesherov](https://github.com/mikesherov), `npm@5.1.0` is **_twice as
+fast_** as `npm@5.0.0` in some benchmarks. We're not stopping there, either: you
+can expect a steady stream of speed improvements over the course of the year.
+It's not _top_ priority, but we'll keep doing what we can to make sure npm saves
+its users as much time as possible.
+
+Hang on to your seats. At **100 commits**, this release is a bit of a doozy. 😎
+
+### FEATURES
+
+Semver-minor releases, of course, mean that there's a new feature somewhere,
+right? Here's what's bumping that number for us this time:
+
+* [`a09c1a69d`](https://github.com/npm/npm/commit/a09c1a69df05b753464cc1272cdccc6af0f4da5a)
+ [#16687](https://github.com/npm/npm/pull/16687)
+ Allow customizing the shell used to execute `run-script`s.
+ ([@mmkal](https://github.com/mmkal))
+* [`4f45ba222`](https://github.com/npm/npm/commit/4f45ba222e2ac6dbe6d696cb7a8e678bbda7c839) [`a48958598`](https://github.com/npm/npm/commit/a489585985540deed4edc03418636c9e97aa9e40) [`901bef0e1`](https://github.com/npm/npm/commit/901bef0e1ea806fc08d8d58744a9f813b6c020ab)
+ [#17508](https://github.com/npm/npm/pull/17508)
+ Add a new `requires` field to `package-lock.json` with information about the
+ _logical_ dependency tree. This includes references to the specific version
+ each package is intended to see, and can be used for many things, such as
+ [converting `package-lock.json` to other lockfile
+ formats](https://twitter.com/maybekatz/status/880578566907248640), various
+ optimizations, and verifying correctness of a package tree.
+ ([@iarna](https://github.com/iarna))
+* [`47e8fc8eb`](https://github.com/npm/npm/commit/47e8fc8eb9b5faccef9e03ab991cf37458c16249)
+ [#17508](https://github.com/npm/npm/pull/17508)
+ Make `npm ls` take package locks (and shrinkwraps) into account. This means
+ `npm ls` can now be used to see [which dependencies are
+ missing](https://twitter.com/maybekatz/status/880446509547794437), so long as
+ a package lock has been previously generated with it in.
+ ([@iarna](https://github.com/iarna))
+* [`f0075e7ca`](https://github.com/npm/npm/commit/f0075e7caa3e151424a254d7809ae4489ed8df90)
+ [#17508](https://github.com/npm/npm/pull/17508)
+ Take `package.json` changes into account when running installs -- if you
+ remove or add a dependency to `package.json` manually, npm will now pick that
+ up and update your tree and package lock accordingly.
+ ([@iarna](https://github.com/iarna))
+* [`83a5455aa`](https://github.com/npm/npm/commit/83a5455aac3c5cc2511ab504923b652b13bd66a0)
+ [#17205](https://github.com/npm/npm/pull/17205)
+ Add `npm udpate` as an alias for `npm update`, for symmetry with
+ `install`/`isntall`.
+ ([@gdassori](https://github.com/gdassori))
+* [`57225d394`](https://github.com/npm/npm/commit/57225d394b6174eb0be48393d8e18da0991f67b6)
+ [#17120](https://github.com/npm/npm/pull/17120)
+ npm will no longer warn about `preferGlobal`, and the option is now
+ deprecated.
+ ([@zkat](https://github.com/zkat))
+* [`82df7bb16`](https://github.com/npm/npm/commit/82df7bb16fc29c47a024db4a8c393e55f883744b)
+ [#17351](https://github.com/npm/npm/pull/17351)
+ As some of you may already know `npm build` doesn't do what a lot of people
+ expect: It's mainly an npm plumbing command, and is part of the more familiar
+ `npm rebuild` command. That said, a lot of users assume that this is the way
+ to run an npm `run-script` named `build`, which is an incredibly common script
+ name to use. To clarify things for users, and encourage them to use `npm run
+ build` instead, npm will now warn if `npm build` is run without any arguments.
+ ([@lennym](https://github.com/lennym))
+
+### PERFORMANCE
+
+* [`59f86ef90`](https://github.com/npm/npm/commit/59f86ef90a58d8dc925c9613f1c96e68bee5ec7b) [`43be9d222`](https://github.com/npm/npm/commit/43be9d2222b23ebb0a427ed91824ae217e6d077a) [`e906cdd98`](https://github.com/npm/npm/commit/e906cdd980b4722e66618ce295c682b9a8ffaf8f)
+ [#16633](https://github.com/npm/npm/pull/16633)
+ npm now parallelizes tarball extraction across multiple child process workers.
+ This can significantly speed up installations, specially when installing from
+ cache, and will improve with number of processors.
+ ([@zkat](https://github.com/zkat))
+* [`e0849878d`](https://github.com/npm/npm/commit/e0849878dd248de8988c2ef3fc941054625712ca)
+ [#17441](https://github.com/npm/npm/pull/17441)
+ Avoid building environment for empty lifecycle scripts. This change alone
+ accounted for as much as a 15% speed boost for npm installations by outright
+ skipping entire steps of the installer when not needed.
+ ([@mikesherov](https://github.com/mikesherov))
+* [`265c2544c`](https://github.com/npm/npm/commit/265c2544c8ded10854909243482e6437ed03c261)
+ [npm/hosted-git-info#24](https://github.com/npm/hosted-git-info/pull/24)
+ `hosted-git-info@2.5.0`: Add caching to `fromURL`, which gets called many,
+ many times by the installer. This improved installation performance by around
+ 10% on realistic application repositories.
+ ([@mikesherov](https://github.com/mikesherov))
+* [`901d26cb`](https://github.com/npm/npm/commit/901d26cb656e7e773d9a38ef4eac9263b95e07c8)
+ [npm/read-package-json#20](https://github.com/npm/read-package-json/pull/70)
+ `read-package-json@2.0.9`: Speed up installs by as much as 20% by
+ reintroducing a previously-removed cache and making it actually be correct
+ this time around.
+ ([@mikesherov](https://github.com/mikesherov))
+* [`44e37045d`](https://github.com/npm/npm/commit/44e37045d77bc40adf339b423d42bf5e9b4d4d91)
+ Eliminate `Bluebird.promisifyAll` from our codebase.
+ ([@iarna](https://github.com/iarna))
+* [`3b4681b53`](https://github.com/npm/npm/commit/3b4681b53db7757985223932072875d099694677)
+ [#17508](https://github.com/npm/npm/pull/17508)
+ Stop calling `addBundle` on locked deps, speeding up the
+ `package-lock.json`-based fast path.
+ ([@iarna](https://github.com/iarna))
+
+### BUGFIXES
+
+* [#17508](https://github.com/npm/npm/pull/17508)
+ This is a big PR that fixes a variety of issues when installing from package
+ locks. If you were previously having issues with missing dependencies or
+ unwanted removals, this might have fixed it:
+ * It introduces a new `package-lock.json` field, called `requires`, which tracks which modules a given module requires.
+ * It fixes [#16839](https://github.com/npm/npm/issues/16839) which was caused by not having this information available, particularly when git dependencies were involved.
+ * It fixes [#16866](https://github.com/npm/npm/issues/16866), allowing the `package.json` to trump the `package-lock.json`.
+ * `npm ls` now loads the shrinkwrap, which opens the door to showing a full tree of dependencies even when nothing is yet installed. (It doesn't do that yet though.)
+ ([@iarna](https://github.com/iarna))
+* [`656544c31`](https://github.com/npm/npm/commit/656544c31cdef3cef64fc10c24f03a8ae2685e35) [`d21ab57c3`](https://github.com/npm/npm/commit/d21ab57c3ef4f01d41fb6c2103debe884a17dc22)
+ [#16637](https://github.com/npm/npm/pull/16637)
+ Fix some cases where `npm prune` was leaving some dependencies unpruned if
+ to-be-pruned dependencies depended on them.
+ ([@exogen](https://github.com/exogen))
+* [`394436b09`](https://github.com/npm/npm/commit/394436b098dcca2d252061f95c4eeb92c4a7027c)
+ [#17552](https://github.com/npm/npm/pull/17552)
+ Make `refresh-package-json` re-verify the package platform. This fixes an
+ issue most notably experienced by Windows users using `create-react-app` where
+ `fsevents` would not short-circuit and cause a crash during its
+ otherwise-skipped native build phase.
+ ([@zkat](https://github.com/zkat))
+* [`9e5a94354`](https://github.com/npm/npm/commit/9e5a943547b29c8d022192afd9398b3a136a7e5a)
+ [#17590](https://github.com/npm/npm/pull/17590)
+ Fix an issue where `npm@5` would crash when trying to remove packages
+ installed with `npm@<5`.
+ ([@iarna](https://github.com/iarna))
+* [`c3b586aaf`](https://github.com/npm/npm/commit/c3b586aafa9eabac572eb6e2b8a7266536dbc65b)
+ [#17141](https://github.com/npm/npm/issues/17141)
+ Don't update the package.json when modifying packages that don't go there.
+ This was previously causing `package.json` to get a `"false": {}` field added.
+ ([@iarna](https://github.com/iarna))
+* [`d04a23de2`](https://github.com/npm/npm/commit/d04a23de21dd9991b32029d839b71e10e07b400d) [`4a5b360d5`](https://github.com/npm/npm/commit/4a5b360d561f565703024085da0927ccafe8793e) [`d9e53db48`](https://github.com/npm/npm/commit/d9e53db48ca227b21bb67df48c9b3580cb390e9e)
+ `pacote@2.7.38`:
+ * [zkat/pacote#102](https://github.com/zkat/pacote/pull/102) Fix issue with tar extraction and special characters.
+ * Enable loose semver parsing in some missing corner cases.
+ ([@colinrotherham](https://github.com/colinrotherham), [@zkat](https://github.com/zkat), [@mcibique](https://github.com/mcibique))
+* [`e2f815f87`](https://github.com/npm/npm/commit/e2f815f87676b7c50b896e939cee15a01aa976e4)
+ [#17104](https://github.com/npm/npm/pull/17104)
+ Write an empty str and wait for flush to exit to reduce issues with npm
+ exiting before all output is complete when it's a child process.
+ ([@zkat](https://github.com/zkat))
+* [`835fcec60`](https://github.com/npm/npm/commit/835fcec601204971083aa3a281c3a9da6061a7c2)
+ [#17060](https://github.com/npm/npm/pull/17060)
+ Make git repos with prepare scripts always install with both dev and prod
+ flags.
+ ([@intellix](https://github.com/intellix))
+* [`f1dc8a175`](https://github.com/npm/npm/commit/f1dc8a175eed56f1ed23bd5773e5e10beaf6cb31)
+ [#16879](https://github.com/npm/npm/pull/16879)
+ Fix support for `always-auth` and `_auth`. They are now both available in both
+ unscoped and registry-scoped configurations.
+ ([@jozemlakar](https://github.com/jozemlakar))
+* [`ddd8a1ca2`](https://github.com/npm/npm/commit/ddd8a1ca2fa3377199af74ede9d0c1a406d19793)
+ Serialize package specs to prevent `[object Object]` showing up in logs during
+ extraction.
+ ([@zkat](https://github.com/zkat))
+* [`99ef3b52c`](https://github.com/npm/npm/commit/99ef3b52caa7507e87a4257e622f8964b1c1f5f3)
+ [#17505](https://github.com/npm/npm/pull/17505)
+ Stop trying to commit updated `npm-shrinkwrap.json` and `package-lock.json` if
+ they're `.gitignore`d.
+ ([@zkat](https://github.com/zkat))
+* [`58be2ec59`](https://github.com/npm/npm/commit/58be2ec596dfb0353ad2570e6750e408339f1478)
+ Make sure uid and gid are getting correctly set even when they're `0`. This
+ should fix some Docker-related issues with bad permissions/broken ownership.
+ ([@rgrove](https://github.com/rgrove))
+ ([@zkat](https://github.com/zkat))
+* [`9d1e3b6fa`](https://github.com/npm/npm/commit/9d1e3b6fa01bb563d76018ee153259d9507658cf)
+ [#17506](https://github.com/npm/npm/pull/17506)
+ Skip writing package.json and locks if on-disk version is identical to the new
+ one.
+ ([@zkat](https://github.com/zkat))
+* [`3fc6477a8`](https://github.com/npm/npm/commit/3fc6477a89773786e6c43ef43a23e5cdc662ff8e)
+ [#17592](https://github.com/npm/npm/pull/17592)
+ Fix an issue where `npm install -g .` on a package with no `name` field would
+ cause the entire global `node_modules` directory to be replaced with a symlink
+ to `$CWD`. lol.
+ ([@iarna](https://github.com/iarna))
+* [`06ba0a14a`](https://github.com/npm/npm/commit/06ba0a14a6c1c8cdcc8c062b68c8c63041b0cec0)
+ [#17591](https://github.com/npm/npm/pull/17591)
+ Fix spurious removal reporting: if you tried to remove something that didn't
+ actually exist, npm would tell you it removed 1 package even though there was
+ nothing to do.
+ ([@iarna](https://github.com/iarna))
+* [`20ff05f8`](https://github.com/npm/npm/commit/20ff05f8fe0ad8c36e1323d30b63b4d2ff7e11ef)
+ [#17629](https://github.com/npm/npm/pull/17629)
+ When removing a link, keep dependencies installed inside of it instead of
+ removing them, if the link is outside the scope of the current project. This
+ fixes an issue where removing globally-linked packages would remove all their
+ dependencies in the source directory, as well as some ergonomic issues when
+ using links in other situations.
+ ([@iarna](https://github.com/iarna))
+
+### DOCS
+
+* [`fd5fab595`](https://github.com/npm/npm/commit/fd5fab5955a20a9bb8c0e77092ada1435f73a8d2)
+ [#16441](https://github.com/npm/npm/pull/16441)
+ Add spec for `npm-shrinkwrap.json` and `package-lock.json` from RFC.
+ ([@iarna](https://github.com/iarna))
+* [`9589c1ccb`](https://github.com/npm/npm/commit/9589c1ccb3f794abaaa48c2a647ada311dd881ef)
+ [#17451](https://github.com/npm/npm/pull/17451)
+ Fix typo in changelog.
+ ([@watilde](https://github.com/watilde))
+* [`f8e76d856`](https://github.com/npm/npm/commit/f8e76d8566ae1965e57d348df74edad0643b66a6)
+ [#17370](https://github.com/npm/npm/pull/17370)
+ Correct the default prefix config path for Windows operating systems in the
+ documentation for npm folders.
+ ([@kierendixon](https://github.com/kierendixon))
+* [`d0f3b5a12`](https://github.com/npm/npm/commit/d0f3b5a127718b0347c6622a2b9c28341c530d36)
+ [#17369](https://github.com/npm/npm/pull/17369)
+ Fix `npm-config` reference to `userconfig` & `globalconfig` environment
+ variables.
+ ([@racztiborzoltan](https://github.com/racztiborzoltan))
+* [`87629880a`](https://github.com/npm/npm/commit/87629880a71baec352c1b5345bc29268d6212467)
+ [#17336](https://github.com/npm/npm/pull/17336)
+ Remove note in docs about `prepublish` being entirely removed.
+ ([@Hirse](https://github.com/Hirse))
+* [`a1058afd9`](https://github.com/npm/npm/commit/a1058afd9a7a569bd0ac65b86eadd4fe077a7221)
+ [#17169](https://github.com/npm/npm/pull/17169)
+ Document `--no-package-lock` flag.
+ ([@leggsimon](https://github.com/leggsimon))
+* [`32fc6e41a`](https://github.com/npm/npm/commit/32fc6e41a2ce4dbcd5ce1e5f291e2e2efc779d48)
+ [#17250](https://github.com/npm/npm/pull/17250)
+ Fix a typo in the shrinkwrap docs.
+ ([@Zarel](https://github.com/Zarel))
+* [`f19bd3c8c`](https://github.com/npm/npm/commit/f19bd3c8cbd37c8a99487d6b5035282580ac3e9d)
+ [#17249](https://github.com/npm/npm/pull/17249)
+ Fix a package-lock.json cross-reference link.
+ ([@not-an-aardvark](https://github.com/not-an-aardvark))
+* [`153245edc`](https://github.com/npm/npm/commit/153245edc4845db670ada5e95ef384561706a751)
+ [#17075](https://github.com/npm/npm/pull/17075/files)
+ Fix a typo in `npm-config` docs.
+ ([@KennethKinLum](https://github.com/KennethKinLum))
+* [`c9b534a14`](https://github.com/npm/npm/commit/c9b534a148818d1a97787c0dfdba5f64ce3618a6)
+ [#17074](https://github.com/npm/npm/pull/17074)
+ Clarify config documention with multiple boolean flags.
+ ([@KennethKinLum](https://github.com/KennethKinLum))
+* [`e111b0a40`](https://github.com/npm/npm/commit/e111b0a40c4bc6691d7b8d67ddce5419e67bfd27)
+ [#16768](https://github.com/npm/npm/pull/16768)
+ Document the `-l` option to `npm config list`.
+ ([@happylynx](https://github.com/happylynx))
+* [`5a803ebad`](https://github.com/npm/npm/commit/5a803ebadd61229bca3d64fb3ef1981729b2548e)
+ [#16548](https://github.com/npm/npm/pull/16548)
+ Fix permissions for documentation files. Some of them had `+x` set. (???)
+ ([@metux](https://github.com/metux))
+* [`d57d4f48c`](https://github.com/npm/npm/commit/d57d4f48c6cd00fdf1e694eb49e9358071d8e105)
+ [#17319](https://github.com/npm/npm/pull/17319)
+ Document that the `--silent` option for `npm run-script` can be used to
+ suppress `npm ERR!` output on errors.
+ ([@styfle](https://github.com/styfle))
+
+### MISC
+
+Not all contributions need to be visible features, docs, or bugfixes! It's super
+helpful when community members go over our code and help clean it up, too!
+
+* [`9e5b76140`](https://github.com/npm/npm/commit/9e5b76140ffdb7dcd12aa402793644213fb8c5d7)
+ [#17411](https://github.com/npm/npm/pull/17411)
+ Convert all callback-style `move` usage to use Promises.
+ ([@vramana](https://github.com/vramana))
+* [`0711c08f7`](https://github.com/npm/npm/commit/0711c08f779ac641ec42ecc96f604c8861008b28)
+ [#17394](https://github.com/npm/npm/pull/17394)
+ Remove unused argument in `deepSortObject`.
+ ([@vramana](https://github.com/vramana))
+* [`7d650048c`](https://github.com/npm/npm/commit/7d650048c8ed5faa0486492f1eeb698e7383e32f)
+ [#17563](https://github.com/npm/npm/pull/17563)
+ Refactor some code to use `Object.assign`.
+ ([@vramana](https://github.com/vramana))
+* [`993f673f0`](https://github.com/npm/npm/commit/993f673f056aea5f602ea04b1e697b027c267a2d)
+ [#17600](https://github.com/npm/npm/pull/17600)
+ Remove an old comment.
+ ([@vramana](https://github.com/vramana))
+
+## v5.0.4 (2017-06-13):
+
+Hey y'all. This is another minor patch release with a variety of little fixes
+we've been accumulating~
+
+* [`f0a37ace9`](https://github.com/npm/npm/commit/f0a37ace9ab7879cab20f2b0fcd7840bfc305feb)
+ Fix `npm doctor` when hitting registries without `ping`.
+ ([@zkat](https://github.com/zkat))
+* [`64f0105e8`](https://github.com/npm/npm/commit/64f0105e81352b42b72900d83b437b90afc6d9ce)
+ Fix invalid format error when setting cache-related headers.
+ ([@zkat](https://github.com/zkat))
+* [`d2969c80e`](https://github.com/npm/npm/commit/d2969c80e4178faebf0f7c4cab6eb610dd953cc6)
+ Fix spurious `EINTEGRITY` issue.
+ ([@zkat](https://github.com/zkat))
+* [`800cb2b4e`](https://github.com/npm/npm/commit/800cb2b4e2d0bd00b5c9082a896f2110e907eb0b)
+ [#17076](https://github.com/npm/npm/pull/17076)
+ Use legacy `from` field to improve upgrade experience from legacy shrinkwraps
+ and installs.
+ ([@zkat](https://github.com/zkat))
+* [`4100d47ea`](https://github.com/npm/npm/commit/4100d47ea58b4966c02604f71350b5316108df6a)
+ [#17007](https://github.com/npm/npm/pull/17007)
+ Restore loose semver parsing to match older npm behavior when running into
+ invalid semver ranges in dependencies.
+ ([@zkat](https://github.com/zkat))
+* [`35316cce2`](https://github.com/npm/npm/commit/35316cce2ca2d8eb94161ec7fe7e8f7bec7b3aa7)
+ [#17005](https://github.com/npm/npm/pull/17005)
+ Emulate npm@4's behavior of simply marking the peerDep as invalid, instead of
+ crashing.
+ ([@zkat](https://github.com/zkat))
+* [`e7e8ee5c5`](https://github.com/npm/npm/commit/e7e8ee5c57c7238655677e118a8809b652019f53)
+ [#16937](https://github.com/npm/npm/pull/16937)
+ Workaround for separate bug where `requested` was somehow null.
+ ([@forivall](https://github.com/forivall))
+* [`2d9629bb2`](https://github.com/npm/npm/commit/2d9629bb2043cff47eaad2654a64d2cef5725356)
+ Better logging output for git errors.
+ ([@zkat](https://github.com/zkat))
+* [`2235aea73`](https://github.com/npm/npm/commit/2235aea73569fb9711a06fa6344ef31247177dcd)
+ More scp-url fixes: parsing only worked correctly when a committish was
+ present.
+ ([@zkat](https://github.com/zkat))
+* [`80c33cf5e`](https://github.com/npm/npm/commit/80c33cf5e6ef207450949764de41ea96538c636e)
+ Standardize package permissions on tarball extraction, instead of using perms
+ from the tarball. This matches previous npm behavior and fixes a number of
+ incompatibilities in the wild.
+ ([@zkat](https://github.com/zkat))
+* [`2b1e40efb`](https://github.com/npm/npm/commit/2b1e40efba0b3d1004259efa4275cf42144e3ce3)
+ Limit shallow cloning to hosts which are known to support it.
+ ([@zkat](https://github.com/zkat))
+
+## v5.0.3 (2017-06-05)
+
+Happy Monday, y'all! We've got another npm release for you with the fruits of
+our ongoing bugsquashing efforts. You can expect at least one more this week,
+but probably more -- and as we announced last week, we'll be merging fixes more
+rapidly into the `npmc` canary so you can get everything as soon as possible!
+
+Hope y'all are enjoying npm5 in the meantime, and don't hesitate to file issues
+for anything you find! The goal is to get this release rock-solid as soon as we
+can. 💚
+
+* [`6e12a5cc0`](https://github.com/npm/npm/commit/6e12a5cc022cb5a157a37df7283b6d7b3d49bdab)
+ Bump several dependencies to get improvements and bugfixes:
+ * `cacache`: content files (the tarballs) are now read-only.
+ * `pacote`: fix failing clones with bad heads, send extra TLS-related opts to proxy, enable global auth configurations and `_auth`-based auth.
+ * `ssri`: stop crashing with `can't call method find of undefined` when running into a weird `opts.integrity`/`opts.algorithms` conflict during verification.
+ ([@zkat](https://github.com/zkat))
+* [`89cc8e3e1`](https://github.com/npm/npm/commit/89cc8e3e12dad67fd9844accf4d41deb4c180c5c)
+ [#16917](https://github.com/npm/npm/pull/16917)
+ Send `ca`, `cert` and `key` config through to network layer.
+ ([@colinrotherham](https://github.com/colinrotherham))
+* [`6a9b51c67`](https://github.com/npm/npm/commit/6a9b51c67ba3df0372991631992748329b84f2e7)
+ [#16929](https://github.com/npm/npm/pull/16929)
+ Send `npm-session` header value with registry requests again.
+ ([@zarenner](https://github.com/zarenner))
+* [`662a15ab7`](https://github.com/npm/npm/commit/662a15ab7e790e87f5e5a35252f05d5a4a0724a1)
+ Fix `npm doctor` so it stop complaining about read-only content files in the
+ cache.
+ ([@zkat](https://github.com/zkat))
+* [`191d10a66`](https://github.com/npm/npm/commit/191d10a6616d72e26d89fd00f5a4f6158bfbc526)
+ [#16918](https://github.com/npm/npm/pull/16918)
+ Clarify prepublish deprecation message.
+ ([@Hirse](https://github.com/Hirse))
+
+## v5.0.2 (2017-06-02)
+
+Here's another patch release, soon after the other!
+
+This particular release includes a slew of fixes to npm's git support, which was
+causing some issues for a chunk of people, specially those who were using
+self-hosted/Enterprise repos. All of those should be back in working condition
+now.
+
+There's another shiny thing you might wanna know about: npm has a Canary release
+now! The `npm5` experiment we did during our beta proved to be incredibly
+successful: users were able to have a tight feedback loop between reports and
+getting the bugfixes they needed, and the CLI team was able to roll out
+experimental patches and have the community try them out right away. So we want
+to keep doing that.
+
+From now on, you'll be able to install the 'npm canary' with `npm i -g npmc`.
+This release will be a separate binary (`npmc`. Because canary. Get it?), which
+will update independently of the main CLI. Most of the time, this will track
+`release-next` or something close to it. We might occasionally toss experimental
+branches in there to see if our more adventurous users run into anything
+interesting with it. For example, the current canary (`npmc@5.0.1-canary.6`)
+includes an [experimental multiproc
+branch](https://github.com/npm/npm/pull/16633) that parallelizes tarball
+extraction across multiple processes.
+
+If you find any issues while running the canary version, please report them and
+let us know it came from `npmc`! It would be tremendously helpful, and finding
+things early is a huge reason to have it there. Happy hacking!
+
+### A NOTE ABOUT THE ISSUE TRACKER
+
+Just a heads up: We're preparing to do a massive cleanup of the issue tracker.
+It's been a long time since it was something we could really keep up with, and
+we didn't have a process for dealing with it that could actually be sustainable.
+
+We're still sussing the details out, and we'll talk about it more when we're
+about to do it, but the plan is essentially to close old, abandoned issues and
+start over. We will also [add some automation](https://github.com/probot) around
+issue management so that things that we can't keep up with don't just stay
+around forever.
+
+Stay tuned!
+
+### GIT YOLO
+
+* [`1f26e9567`](https://github.com/npm/npm/commit/1f26e9567a6d14088704e121ebe787c38b6849a4)
+ `pacote@2.7.27`: Fixes installing committishes that look like semver, even
+ though they're not using the required `#semver:` syntax.
+ ([@zkat](https://github.com/zkat))
+* [`85ea1e0b9`](https://github.com/npm/npm/commit/85ea1e0b9478551265d03d545e7dc750b9edf547)
+ `npm-package-arg@5.1.1`: This includes the npa git-parsing patch to make it so
+ non-hosted SCP-style identifiers are correctly handled. Previously, npa would
+ mangle them (even though hosted-git-info is doing the right thing for them).
+ ([@zkat](https://github.com/zkat))
+
+### COOL NEW OUTPUT
+
+The new summary output has been really well received! One downside that reared
+its head as more people used it, though, is that it doesn't really tell you
+anything about the toplevel versions it installed. So, if you did `npm i -g
+foo`, it would just say "added 1 package". This patch by
+[@rmg](https://github.com/rmg) keeps things concise while still telling you
+what you got! So now, you'll see something like this:
+
+```
+$ npm i -g foo bar
++ foo@1.2.3
++ bar@3.2.1
+added 234 packages in .005ms
+```
+
+* [`362f9fd5b`](https://github.com/npm/npm/commit/362f9fd5bec65301082416b4292b8fe3eb7f824a)
+ [#16899](https://github.com/npm/npm/pull/16899)
+ For every package that is given as an argument to install, print the name and
+ version that was actually installed.
+ ([@rmg](https://github.com/rmg))
+
+### OTHER BUGFIXES
+
+* [`a47593a98`](https://github.com/npm/npm/commit/a47593a98a402143081d7077d2ac677d13083010)
+ [#16835](https://github.com/npm/npm/pull/16835)
+ Fix a crash while installing with `--no-shrinkwrap`.
+ ([@jacknagel](https://github.com/jacknagel))
+
+### DOC UPATES
+
+* [`89e0cb816`](https://github.com/npm/npm/commit/89e0cb8165dd9c3c7ac74d531617f367099608f4)
+ [#16818](https://github.com/npm/npm/pull/16818)
+ Fixes a spelling error in the docs. Because the CLI team has trouble spelling
+ "package", I guess.
+ ([@ankon](https://github.com/ankon))
+* [`c01fbc46e`](https://github.com/npm/npm/commit/c01fbc46e151bcfb359fd68dd7faa392789b4f55)
+ [#16895](https://github.com/npm/npm/pull/16895)
+ Remove `--save` from `npm init` instructions, since it's now the default.
+ ([@jhwohlgemuth](https://github.com/jhwohlgemuth))
+* [`80c42d218`](https://github.com/npm/npm/commit/80c42d2181dd4d1b79fcee4e9233df268dfb30b7)
+ Guard against cycles when inflating bundles, as symlinks are bundles now.
+ ([@iarna](https://github.com/iarna))
+* [`7fe7f8665`](https://github.com/npm/npm/commit/7fe7f86658798db6667df89afc75588c0e43bc94)
+ [#16674](https://github.com/npm/npm/issues/16674)
+ Write the builtin config for `npmc`, not just `npm`. This is hardcoded for npm
+ self-installations and is needed for Canary to work right.
+ ([@zkat](https://github.com/zkat))
+
+### DEP UPDATES
+
+* [`63df4fcdd`](https://github.com/npm/npm/commit/63df4fcddc7445efb50cc7d8e09cdd45146d3e39)
+ [#16894](https://github.com/npm/npm/pull/16894)
+ [`node-gyp@3.6.2`](https://github.com/nodejs/node-gyp/blob/master/CHANGELOG.md#v362-2017-06-01):
+ Fixes an issue parsing SDK versions on Windows, among other things.
+ ([@refack](https://github.com/refack))
+* [`5bb15c3c4`](https://github.com/npm/npm/commit/5bb15c3c4f0d7d77c73fd6dafa38ac36549b6e00)
+ `read-package-tree@5.1.6`: Fixes some racyness while reading the tree.
+ ([@iarna](https://github.com/iarna))
+* [`a6f7a52e7`](https://github.com/npm/npm/commit/a6f7a52e7)
+ `aproba@1.1.2`: Remove nested function declaration for speed up
+ ([@mikesherov](https://github.com/mikesherov))
+
+## v5.0.1 (2017-05-31):
+
+Hey y'all! Hope you're enjoying the new npm!
+
+As you all know, fresh software that's gone through major overhauls tends to
+miss a lot of spots the old one used to handle well enough, and `npm@5` is no
+exception. The CLI team will be doing faster release cycles that go directly to
+the `latest` tag for a couple of weeks while 5 stabilizes a bit and we're
+confident the common low-hanging fruit people are running into are all taken
+care of.
+
+With that said: this is our first patch release! The biggest focus is fixing up
+a number of git-related issues that folks ran into right out the door. It also
+fixes other things, like some proxy/auth-related issues, and even has a neat
+speed boost! (You can expect more speed bumps in the coming releases as pending
+work starts landing, too!)
+
+Thanks everyone who's been reporting issues and submitting patches!
+
+### BUGFIXES
+
+* [`e61e68dac`](https://github.com/npm/npm/commit/e61e68dac4fa51c0540a064204a75b19f8052e58)
+ [#16762](https://github.com/npm/npm/pull/16762)
+ Make `npm publish` obey the `--tag` flag again.
+ ([@zkat](https://github.com/zkat))
+* [`923fd58d3`](https://github.com/npm/npm/commit/923fd58d312f40f8c17b232ad1dfc8e2ff622dbd)
+ [#16749](https://github.com/npm/npm/pull/16749)
+ Speed up installations by nearly 20% by... removing one line of code. (hah)
+ ([@mikesherov](https://github.com/mikesherov))
+* [`9aac984cb`](https://github.com/npm/npm/commit/9aac984cbbfef22182ee42b51a193c0b47146ad6)
+ Guard against a particular failure mode for a bug still being hunted down.
+ ([@iarna](https://github.com/iarna))
+* [`80ab521f1`](https://github.com/npm/npm/commit/80ab521f18d34df109de0c5dc9eb1cde5ff6d7e8)
+ Pull in dependency updates for various core deps:
+ * New `pacote` fixes several git-related bugs.
+ * `ssri` update fixes crash on early node@4 versions.
+ * `make-fetch-happen` update fixes proxy authentication issue.
+ * `npm-user-validate` adds regex for blocking usernames with illegal chars.
+ ([@zkat](https://github.com/zkat))
+* [`7e5ce87b8`](https://github.com/npm/npm/commit/7e5ce87b84880c7433ee4c07d2dd6ce8806df436)
+ `pacote@2.7.26`:
+ Fixes various other git issues related to commit hashes.
+ ([@zkat](https://github.com/zkat))
+* [`acbe85bfc`](https://github.com/npm/npm/commit/acbe85bfc1a68d19ca339a3fb71da0cffbf58926)
+ [#16791](https://github.com/npm/npm/pull/16791)
+ `npm view` was calling `cb` prematurely and giving partial output when called
+ in a child process.
+ ([@zkat](https://github.com/zkat))
+* [`ebafe48af`](https://github.com/npm/npm/commit/ebafe48af91f702ccefc8c619d52fed3b8dfd3c7)
+ [#16750](https://github.com/npm/npm/pull/16750)
+ Hamilpatch the Musical: Talk less, complete more.
+ ([@aredridel](https://github.com/aredridel))
+
+### DOCUMENTATION
+
+* [`dc2823a6c`](https://github.com/npm/npm/commit/dc2823a6c5fc098041e61515c643570819d059d2)
+ [#16799](https://github.com/npm/npm/pull/16799)
+ Document that `package-lock.json` is never allowed in tarballs.
+ ([@sonicdoe](https://github.com/sonicdoe))
+* [`f3cb84b44`](https://github.com/npm/npm/commit/f3cb84b446c51d628ee0033cdf13752c15b31a29)
+ [#16771](https://github.com/npm/npm/pull/16771)
+ Fix `npm -l` usage information for the `test` command.
+ ([@grawlinson](https://github.com/grawlinson))
+
+### OTHER CHANGES
+
+* [`661262309`](https://github.com/npm/npm/commit/66126230912ab5ab35287b40a9908e036fa73994)
+ [#16756](https://github.com/npm/npm/pull/16756)
+ remove unused argument
+ ([@Aladdin-ADD](https://github.com/Aladdin-ADD))
+* [`c3e0b4287`](https://github.com/npm/npm/commit/c3e0b4287ea69735cc367aa7bb7e7aa9a6d9804b)
+ [#16296](https://github.com/npm/npm/pull/16296)
+ preserve same name convention for command
+ ([@desfero](https://github.com/desfero))
+* [`9f814831d`](https://github.com/npm/npm/commit/9f814831d330dde7702973186aea06caaa77ff31)
+ [#16757](https://github.com/npm/npm/pull/16757)
+ remove unused argument
+ ([@Aladdin-ADD](https://github.com/Aladdin-ADD))
+* [`3cb843239`](https://github.com/npm/npm/commit/3cb8432397b3666d88c31131dbb4599016a983ff)
+ minor linter fix
+ ([@zkat](https://github.com/zkat))
+
+## v5.0.0 (2017-05-25)
+
+Wowowowowow npm@5!
+
+This release marks months of hard work for the young, scrappy, and hungry CLI
+team, and includes some changes we've been hoping to do for literally years.
+npm@5 takes npm a pretty big step forward, significantly improving its
+performance in almost all common situations, fixing a bunch of old errors due to
+the architecture, and just generally making it more robust and fault-tolerant.
+It comes with changes to make life easier for people doing monorepos, for users
+who want consistency/security guarantees, and brings semver support to git
+dependencies. See below for all the deets!
+
+### Breaking Changes
+
+* Existing npm caches will no longer be used: you will have to redownload any cached packages. There is no tool or intention to reuse old caches. ([#15666](https://github.com/npm/npm/pull/15666))
+
+* `npm install ./packages/subdir` will now create a symlink instead of a regular installation. `file://path/to/tarball.tgz` will not change -- only directories are symlinked. ([#15900](https://github.com/npm/npm/pull/15900))
+
+* npm will now scold you if you capitalize its name. seriously it will fight you.
+
+* [npm will `--save` by default now](https://twitter.com/maybekatz/status/859229741676625920). Additionally, `package-lock.json` will be automatically created unless an `npm-shrinkwrap.json` exists. ([#15666](https://github.com/npm/npm/pull/15666))
+
+* Git dependencies support semver through `user/repo#semver:^1.2.3` ([#15308](https://github.com/npm/npm/pull/15308)) ([#15666](https://github.com/npm/npm/pull/15666)) ([@sankethkatta](https://github.com/sankethkatta))
+
+* Git dependencies with `prepare` scripts will have their `devDependencies` installed, and `npm install` run in their directory before being packed.
+
+* `npm cache` commands have been rewritten and don't really work anything like they did before. ([#15666](https://github.com/npm/npm/pull/15666))
+
+* `--cache-min` and `--cache-max` have been deprecated. ([#15666](https://github.com/npm/npm/pull/15666))
+
+* Running npm while offline will no longer insist on retrying network requests. npm will now immediately fall back to cache if possible, or fail. ([#15666](https://github.com/npm/npm/pull/15666))
+
+* package locks no longer exclude `optionalDependencies` that failed to build. This means package-lock.json and npm-shrinkwrap.json should now be cross-platform. ([#15900](https://github.com/npm/npm/pull/15900))
+
+* If you generated your package lock against registry A, and you switch to registry B, npm will now try to [install the packages from registry B, instead of A](https://twitter.com/maybekatz/status/862834964932435969). If you want to use different registries for different packages, use scope-specific registries (`npm config set @myscope:registry=https://myownregist.ry/packages/`). Different registries for different unscoped packages are not supported anymore.
+
+* Shrinkwrap and package-lock no longer warn and exit without saving the lockfile.
+
+* Local tarballs can now only be installed if they have a file extensions `.tar`, `.tar.gz`, or `.tgz`.
+
+* A new loglevel, `notice`, has been added and set as default.
+
+* One binary to rule them all: `./cli.js` has been removed in favor of `./bin/npm-cli.js`. In case you were doing something with `./cli.js` itself. ([#12096](https://github.com/npm/npm/pull/12096)) ([@watilde](https://github.com/watilde))
+
+* Stub file removed ([#16204](https://github.com/npm/npm/pull/16204)) ([@watilde](https://github.com/watilde))
+
+* The "extremely legacy" `_token` couchToken has been removed. ([#12986](https://github.com/npm/npm/pull/12986))
+
+### Feature Summary
+
+#### Installer changes
+
+* A new, standardised lockfile feature meant for cross-package-manager compatibility (`package-lock.json`), and a new format and semantics for shrinkwrap. ([#16441](https://github.com/npm/npm/pull/16441))
+
+* `--save` is no longer necessary. All installs will be saved by default. You can prevent saving with `--no-save`. Installing optional and dev deps is unchanged: use `-D/--save-dev` and `-O/--save-optional` if you want them saved into those fields instead. Note that since npm@3, npm will automatically update npm-shrinkwrap.json when you save: this will also be true for `package-lock.json`. ([#15666](https://github.com/npm/npm/pull/15666))
+
+* Installing a package directory now ends up creating a symlink and does the Right Thing™ as far as saving to and installing from the package lock goes. If you have a monorepo, this might make things much easier to work with, and probably a lot faster too. 😁 ([#15900](https://github.com/npm/npm/pull/15900))
+
+* Project-level (toplevel) `preinstall` scripts now run before anything else, and can modify `node_modules` before the CLI reads it.
+
+* Two new scripts have been added, `prepack` and `postpack`, which will run on both `npm pack` and `npm publish`, but NOT on `npm install` (without arguments). Combined with the fact that `prepublishOnly` is run before the tarball is generated, this should round out the general story as far as putzing around with your code before publication.
+
+* Git dependencies with `prepare` scripts will now [have their devDependencies installed, and their prepare script executed](https://twitter.com/maybekatz/status/860363896443371520) as if under `npm pack`.
+
+* Git dependencies now support semver-based matching: `npm install git://github.com/npm/npm#semver:^5` (#15308, #15666)
+
+* `node-gyp` now supports `node-gyp.cmd` on Windows ([#14568](https://github.com/npm/npm/pull/14568))
+
+* npm no longer blasts your screen with the whole installed tree. Instead, you'll see a summary report of the install that is much kinder on your shell real-estate. Specially for large projects. ([#15914](https://github.com/npm/npm/pull/15914)):
+```
+$ npm install
+npm added 125, removed 32, updated 148 and moved 5 packages in 5.032s.
+$
+```
+
+* `--parseable` and `--json` now work more consistently across various commands, particularly `install` and `ls`.
+
+* Indentation is now [detected and preserved](https://twitter.com/maybekatz/status/860690502932340737) for `package.json`, `package-lock.json`, and `npm-shrinkwrap.json`. If the package lock is missing, it will default to `package.json`'s current indentation.
+
+#### Publishing
+
+* New [publishes will now include *both* `sha512`](https://twitter.com/maybekatz/status/863201943082065920) and `sha1` checksums. Versions of npm from 5 onwards will use the strongest algorithm available to verify downloads. [npm/npm-registry-client#157](https://github.com/npm/npm-registry-client/pull/157)
+
+#### Cache Rewrite!
+
+We've been talking about rewriting the cache for a loooong time. So here it is.
+Lots of exciting stuff ahead. The rewrite will also enable some exciting future
+features, but we'll talk about those when they're actually in the works. #15666
+is the main PR for all these changes. Additional PRs/commits are linked inline.
+
+* Package metadata, package download, and caching infrastructure replaced.
+
+* It's a bit faster. [Hopefully it will be noticeable](https://twitter.com/maybekatz/status/865393382260056064). 🤔
+
+* With the shrinkwrap and package-lock changes, tarballs will be looked up in the cache by content address (and verified with it).
+
+* Corrupted cache entries will [automatically be removed and re-fetched](https://twitter.com/maybekatz/status/854933138182557696) on integrity check failure.
+
+* npm CLI now supports tarball hashes with any hash function supported by Node.js. That is, it will [use `sha512` for tarballs from registries that send a `sha512` checksum as the tarball hash](https://twitter.com/maybekatz/status/858137093624573953). Publishing with `sha512` is added by [npm/npm-registry-client#157](https://github.com/npm/npm-registry-client/pull/157) and may be backfilled by the registry for older entries.
+
+* Remote tarball requests are now cached. This means that even if you're missing the `integrity` field in your shrinkwrap or package-lock, npm will be able to install from the cache.
+
+* Downloads for large packages are streamed in and out of disk. npm is now able to install packages of """any""" size without running out of memory. Support for publishing them is pending (due to registry limitations).
+
+* [Automatic fallback-to-offline mode](https://twitter.com/maybekatz/status/854176565587984384). npm will seamlessly use your cache if you are offline, or if you lose access to a particular registry (for example, if you can no longer access a private npm repo, or if your git host is unavailable).
+
+* A new `--prefer-offline` option will make npm skip any conditional requests (304 checks) for stale cache data, and *only* hit the network if something is missing from the cache.
+
+* A new `--prefer-online` option that will force npm to revalidate cached data (with 304 checks), ignoring any staleness checks, and refreshing the cache with revalidated, fresh data.
+
+* A new `--offline` option will force npm to use the cache or exit. It will error with an `ENOTCACHED` code if anything it tries to install isn't already in the cache.
+
+* A new `npm cache verify` command that will garbage collect your cache, reducing disk usage for things you don't need (-handwave-), and will do full integrity verification on both the index and the content. This is also hooked into `npm doctor` as part of its larger suite of checking tools.
+
+* The new cache is *very* fault tolerant and supports concurrent access.
+ * Multiple npm processes will not corrupt a shared cache.
+ * Corrupted data will not be installed. Data is checked on both insertion and extraction, and treated as if it were missing if found to be corrupted. I will literally bake you a cookie if you manage to corrupt the cache in such a way that you end up with the wrong data in your installation (installer bugs notwithstanding).
+ * `npm cache clear` is no longer useful for anything except clearing up disk space.
+
+* Package metadata is cached separately per registry and package type: you can't have package name conflicts between locally-installed packages, private repo packages, and public repo packages. Identical tarball data will still be shared/deduplicated as long as their hashes match.
+
+* HTTP cache-related headers and features are "fully" (lol) supported for both metadata and tarball requests -- if you have your own registry, you can define your own cache settings the CLI will obey!
+
+* `prepublishOnly` now runs *before* the tarball to publish is created, after `prepare` has run.
diff --git a/deps/npm/doc/cli/npm-audit.md b/deps/npm/doc/cli/npm-audit.md
new file mode 100644
index 00000000000000..3bb13259d7746a
--- /dev/null
+++ b/deps/npm/doc/cli/npm-audit.md
@@ -0,0 +1,94 @@
+npm-audit(1) -- Run a security audit
+====================================
+
+## SYNOPSIS
+
+ npm audit [--json]
+ npm audit fix [--force|--package-lock-only|--dry-run|--production|--only=dev]
+
+## EXAMPLES
+
+Scan your project for vulnerabilities and automatically install any compatible
+updates to vulnerable dependencies:
+```
+$ npm audit fix
+```
+
+Run `audit fix` without modifying `node_modules`, but still updating the
+pkglock:
+```
+$ npm audit fix --package-lock-only
+```
+
+Skip updating `devDependencies`:
+```
+$ npm audit fix --only=prod
+```
+
+Have `audit fix` install semver-major updates to toplevel dependencies, not just
+semver-compatible ones:
+```
+$ npm audit fix --force
+```
+
+Do a dry run to get an idea of what `audit fix` will do, and _also_ output
+install information in JSON format:
+```
+$ npm audit fix --dry-run --json
+```
+
+Scan your project for vulnerabilities and just show the details, without fixing
+anything:
+```
+$ npm audit
+```
+
+Get the detailed audit report in JSON format:
+```
+$ npm audit --json
+```
+
+## DESCRIPTION
+
+The audit command submits a description of the dependencies configured in
+your project to your default registry and asks for a report of known
+vulnerabilities. The report returned includes instructions on how to act on
+this information.
+
+You can also have npm automatically fix the vulnerabilities by running `npm
+audit fix`. Note that some vulnerabilities cannot be fixed automatically and
+will require manual intervention or review. Also note that since `npm audit fix`
+runs a full-fledged `npm install` under the hood, all configs that apply to the
+installer will also apply to `npm install` -- so things like `npm audit fix
+--package-lock-only` will work as expected.
+
+## CONTENT SUBMITTED
+
+* npm_version
+* node_version
+* platform
+* node_env
+* A scrubbed version of your package-lock.json or npm-shrinkwrap.json
+
+### SCRUBBING
+
+In order to ensure that potentially sensitive information is not included in
+the audit data bundle, some dependencies may have their names (and sometimes
+versions) replaced with opaque non-reversible identifiers. It is done for
+the following dependency types:
+
+* Any module referencing a scope that is configured for a non-default
+ registry has its name scrubbed. (That is, a scope you did a `npm login --scope=@ourscope` for.)
+* All git dependencies have their names and specifiers scrubbed.
+* All remote tarball dependencies have their names and specifiers scrubbed.
+* All local directory and tarball dependencies have their names and specifiers scrubbed.
+
+The non-reversible identifiers are a sha256 of a session-specific UUID and the
+value being replaced, ensuring a consistent value within the payload that is
+different between runs.
+
+## SEE ALSO
+
+* npm-install(1)
+* package-locks(5)
+* config(7)
diff --git a/deps/npm/doc/cli/npm-ci.md b/deps/npm/doc/cli/npm-ci.md
new file mode 100644
index 00000000000000..b1406e36a55875
--- /dev/null
+++ b/deps/npm/doc/cli/npm-ci.md
@@ -0,0 +1,58 @@
+npm-ci(1) -- Install a project with a clean slate
+===================================
+
+## SYNOPSIS
+
+ npm ci
+
+## EXAMPLE
+
+Make sure you have a package-lock and an up-to-date install:
+
+```
+$ cd ./my/npm/project
+$ npm install
+added 154 packages in 10s
+$ ls | grep package-lock
+```
+
+Run `npm ci` in that project
+
+```
+$ npm ci
+added 154 packages in 5s
+```
+
+Configure Travis to build using `npm ci` instead of `npm install`:
+
+```
+# .travis.yml
+install:
+- npm ci
+# keep the npm cache around to speed up installs
+cache:
+ directories:
+ - "$HOME/.npm"
+```
+
+## DESCRIPTION
+
+This command is similar to `npm-install(1)`, except it's meant to be used in
+automated environments such as test platforms, continuous integration, and
+deployment. It can be significantly faster than a regular npm install by
+skipping certain user-oriented features. It is also more strict than a regular
+install, which can help catch errors or inconsistencies caused by the
+incrementally-installed local environments of most npm users.
+
+In short, the main differences between using `npm install` and `npm ci` are:
+
+* The project **must** have an existing `package-lock.json` or `npm-shrinkwrap.json`.
+* If dependencies in the package lock do not match those in `package.json`, `npm ci` will exit with an error, instead of updating the package lock.
+* `npm ci` can only install entire projects at a time: individual dependencies cannot be added with this command.
+* If a `node_modules` is already present, it will be automatically removed before `npm ci` begins its install.
+* It will never write to `package.json` or any of the package-locks: installs are essentially frozen.
+
+## SEE ALSO
+
+* npm-install(1)
+* npm-package-locks(5)
diff --git a/deps/npm/doc/cli/npm-hook.md b/deps/npm/doc/cli/npm-hook.md
new file mode 100644
index 00000000000000..34deecaf921bfd
--- /dev/null
+++ b/deps/npm/doc/cli/npm-hook.md
@@ -0,0 +1,72 @@
+npm-hook(1) -- Manage registry hooks
+===================================
+
+## SYNOPSIS
+
+ npm hook ls [pkg]
+ npm hook add
+ npm hook update [secret]
+ npm hook rm
+
+## EXAMPLE
+
+Add a hook to watch a package for changes:
+```
+$ npm hook add lodash https://example.com/ my-shared-secret
+```
+
+Add a hook to watch packages belonging to the user `substack`:
+```
+$ npm hook add ~substack https://example.com/ my-shared-secret
+```
+
+Add a hook to watch packages in the scope `@npm`
+```
+$ npm hook add @npm https://example.com/ my-shared-secret
+```
+
+List all your active hooks:
+```
+$ npm hook ls
+```
+
+List your active hooks for the `lodash` package:
+```
+$ npm hook ls lodash
+```
+
+Update an existing hook's url:
+```
+$ npm hook update id-deadbeef https://my-new-website.here/
+```
+
+Remove a hook:
+```
+$ npm hook rm id-deadbeef
+```
+
+## DESCRIPTION
+
+Allows you to manage [npm
+hooks](http://blog.npmjs.org/post/145260155635/introducing-hooks-get-notifications-of-npm),
+including adding, removing, listing, and updating.
+
+Hooks allow you to configure URL endpoints that will be notified whenever a
+change happens to any of the supported entity types. Three different types of
+entities can be watched by hooks: packages, owners, and scopes.
+
+To create a package hook, simply reference the package name.
+
+To create an owner hook, prefix the owner name with `~` (as in, `~youruser`).
+
+To create a scope hook, prefix the scope name with `@` (as in, `@yourscope`).
+
+The hook `id` used by `update` and `rm` are the IDs listed in `npm hook ls` for
+that particular hook.
+
+The shared secret will be sent along to the URL endpoint so you can verify the
+request came from your own configured hook.
+
+## SEE ALSO
+
+* ["Introducing Hooks" blog post](http://blog.npmjs.org/post/145260155635/introducing-hooks-get-notifications-of-npm)
diff --git a/deps/npm/doc/cli/npm-init.md b/deps/npm/doc/cli/npm-init.md
index ec4c25bedaab44..b91bcafae83774 100644
--- a/deps/npm/doc/cli/npm-init.md
+++ b/deps/npm/doc/cli/npm-init.md
@@ -1,34 +1,62 @@
-npm-init(1) -- Interactively create a package.json file
+npm-init(1) -- create a package.json file
=======================================================
## SYNOPSIS
- npm init [-f|--force|-y|--yes]
+ npm init [--force|-f|--yes|-y|--scope]
+ npm init <@scope> (same as `npx <@scope>/create`)
+ npm init [<@scope>/] (same as `npx [<@scope>/]create-`)
-## DESCRIPTION
+## EXAMPLES
+
+Create a new React-based project using [`create-react-app`](https://npm.im/create-react-app):
+```
+$ npm init react-app ./my-react-app
+```
-This will ask you a bunch of questions, and then write a package.json for you.
+Create a new `esm`-compatible package using [`create-esm`](https://npm.im/create-esm):
+```
+$ mkdir my-esm-lib && cd my-esm-lib
+$ npm init esm --yes
+```
-It attempts to make reasonable guesses about what you want things to be set to,
-and then writes a package.json file with the options you've selected.
+Generate a plain old package.json using legacy init:
+```
+$ mkdir my-npm-pkg && cd my-npm-pkg
+$ git init
+$ npm init
+```
-If you already have a package.json file, it'll read that first, and default to
-the options in there.
+Generate it without having it ask any questions:
+```
+$ npm init -y
+```
+
+## DESCRIPTION
-It is strictly additive, so it does not delete options from your package.json
-without a really good reason to do so.
+`npm init ` can be used to set up a new or existing npm package.
-If you invoke it with `-f`, `--force`, `-y`, or `--yes`, it will use only
-defaults and not prompt you for any options.
+`initializer` in this case is an npm package named `create-`, which
+will be installed by [`npx(1)`](https://npm.im/npx), and then have its main bin
+executed -- presumably creating or updating `package.json` and running any other
+initialization-related operations.
-## CONFIGURATION
+The init command is transformed to a corresponding `npx` operation as follows:
-### scope
+* `npm init foo` -> `npx create-foo`
+* `npm init @usr/foo` -> `npx @usr/create-foo`
+* `npm init @usr` -> `npx @usr/create`
-* Default: none
-* Type: String
+Any additional options will be passed directly to the command, so `npm init foo
+--hello` will map to `npx create-foo --hello`.
-The scope under which the new module should be created.
+If the initializer is omitted (by just calling `npm init`), init will fall back
+to legacy init behavior. It will ask you a bunch of questions, and then write a
+package.json for you. It will attempt to make reasonable guesses based on
+existing fields, dependencies, and options selected. It is strictly additive, so
+it will keep any fields and values that were already set. You can also use
+`-y`/`--yes` to skip the questionnaire altogether. If you pass `--scope`, it
+will create a scoped package.
## SEE ALSO
diff --git a/deps/npm/doc/cli/npm-install-ci-test.md b/deps/npm/doc/cli/npm-install-ci-test.md
new file mode 100644
index 00000000000000..4cbab9144e48fa
--- /dev/null
+++ b/deps/npm/doc/cli/npm-install-ci-test.md
@@ -0,0 +1,16 @@
+# npm install-ci-test(1) -- Install a project with a clean slate and run tests
+
+## SYNOPSIS
+
+ npm install-ci-test
+
+ alias: npm cit
+
+## DESCRIPTION
+
+This command runs an `npm ci` followed immediately by an `npm test`.
+
+## SEE ALSO
+
+- npm-ci(1)
+- npm-test(1)
diff --git a/deps/npm/doc/cli/npm-install.md b/deps/npm/doc/cli/npm-install.md
index 0489ddf94e046e..6c8d327dc8504f 100644
--- a/deps/npm/doc/cli/npm-install.md
+++ b/deps/npm/doc/cli/npm-install.md
@@ -55,6 +55,9 @@ after packing it up into a tarball (b).
is set to `production`), npm will not install modules listed in
`devDependencies`.
+ > NOTE: The `--production` flag has no particular meaning when adding a
+ dependency to a project.
+
* `npm install `:
Install the package in the directory as a symlink in the current project.
@@ -347,7 +350,8 @@ The `--no-shrinkwrap` argument, which will ignore an available
package lock or shrinkwrap file and use the package.json instead.
The `--no-package-lock` argument will prevent npm from creating a
-`package-lock.json` file.
+`package-lock.json` file. When running with package-lock's disabled npm
+will not automatically prune your node modules when installing.
The `--nodedir=/path/to/node/source` argument will allow npm to find the
node source code so that npm can compile native modules.
@@ -355,6 +359,9 @@ node source code so that npm can compile native modules.
The `--only={prod[uction]|dev[elopment]}` argument will cause either only
`devDependencies` or only non-`devDependencies` to be installed regardless of the `NODE_ENV`.
+The `--no-audit` argument can be used to disable sending of audit reports to
+the configured registries. See `npm-audit(1)` for details on what is sent.
+
See `npm-config(7)`. Many of the configuration params have some
effect on installation, since that's most of what npm does.
@@ -430,6 +437,7 @@ affects a real use-case, it will be investigated.
* npm-folders(5)
* npm-update(1)
+* npm-audit(1)
* npm-link(1)
* npm-rebuild(1)
* npm-scripts(7)
diff --git a/deps/npm/doc/cli/npm-ls.md b/deps/npm/doc/cli/npm-ls.md
index e665a735c3237e..7b10a19d69b2c9 100644
--- a/deps/npm/doc/cli/npm-ls.md
+++ b/deps/npm/doc/cli/npm-ls.md
@@ -76,7 +76,7 @@ Max display depth of the dependency tree.
Display only the dependency tree for packages in `dependencies`.
-### dev
+### dev / development
* Type: Boolean
* Default: false
diff --git a/deps/npm/doc/cli/npm-outdated.md b/deps/npm/doc/cli/npm-outdated.md
index 0792be24a76c0d..ad0d003ceef4ee 100644
--- a/deps/npm/doc/cli/npm-outdated.md
+++ b/deps/npm/doc/cli/npm-outdated.md
@@ -27,6 +27,8 @@ In the output:
* `package type` (when using `--long` / `-l`) tells you whether this package is
a `dependency` or a `devDependency`. Packages not included in `package.json`
are always marked `dependencies`.
+* Red means there's a newer version matching your semver requirements, so you should update now.
+* Yellow indicates that there's a newer version above your semver requirements (usually new major, or new 0.x minor) so proceed with caution.
### An example
diff --git a/deps/npm/doc/cli/npm-prune.md b/deps/npm/doc/cli/npm-prune.md
index c7f340ca7b8632..0dde2442511228 100644
--- a/deps/npm/doc/cli/npm-prune.md
+++ b/deps/npm/doc/cli/npm-prune.md
@@ -3,7 +3,7 @@ npm-prune(1) -- Remove extraneous packages
## SYNOPSIS
- npm prune [[<@scope>/]...] [--production]
+ npm prune [[<@scope>/]...] [--production] [--dry-run] [--json]
## DESCRIPTION
@@ -16,9 +16,21 @@ package's dependencies list.
If the `--production` flag is specified or the `NODE_ENV` environment
variable is set to `production`, this command will remove the packages
-specified in your `devDependencies`. Setting `--production=false` will
+specified in your `devDependencies`. Setting `--no-production` will
negate `NODE_ENV` being set to `production`.
+If the `--dry-run` flag is used then no changes will actually be made.
+
+If the `--json` flag is used then the changes `npm prune` made (or would
+have made with `--dry-run`) are printed as a JSON object.
+
+In normal operation with package-locks enabled, extraneous modules are
+pruned automatically when modules are installed and you'll only need
+this command with the `--production` flag.
+
+If you've disabled package-locks then extraneous modules will not be removed
+and it's up to you to run `npm prune` from time-to-time to remove them.
+
## SEE ALSO
* npm-uninstall(1)
diff --git a/deps/npm/doc/cli/npm-run-script.md b/deps/npm/doc/cli/npm-run-script.md
index ee907d8c73021b..dc2c93ef94968b 100644
--- a/deps/npm/doc/cli/npm-run-script.md
+++ b/deps/npm/doc/cli/npm-run-script.md
@@ -68,6 +68,10 @@ you will be given a warning to run `npm install`, just in case you've forgotten.
You can use the `--silent` flag to prevent showing `npm ERR!` output on error.
+You can use the `--if-present` flag to avoid exiting with a non-zero exit code
+when the script is undefined. This lets you run potentially undefined scripts
+without breaking the execution chain.
+
## SEE ALSO
* npm-scripts(7)
diff --git a/deps/npm/doc/cli/npm-team.md b/deps/npm/doc/cli/npm-team.md
index 5a8b4b63e34c56..9e01a451c7945a 100644
--- a/deps/npm/doc/cli/npm-team.md
+++ b/deps/npm/doc/cli/npm-team.md
@@ -34,6 +34,9 @@ when operating on them, separated by a colon (`:`). That is, if you have a
under that organization. If performed on a team, it will instead return a list
of all users belonging to that particular team.
+* edit:
+ Edit a current team.
+
## DETAILS
`npm team` always operates directly on the current registry, configurable from
diff --git a/deps/npm/doc/cli/npm-update.md b/deps/npm/doc/cli/npm-update.md
index d6ec30d2ae6154..b6cf2af78b815b 100644
--- a/deps/npm/doc/cli/npm-update.md
+++ b/deps/npm/doc/cli/npm-update.md
@@ -26,6 +26,10 @@ As of `npm@2.6.1`, the `npm update` will only inspect top-level packages.
Prior versions of `npm` would also recursively inspect all dependencies.
To get the old behavior, use `npm --depth 9999 update`.
+As of `npm@5.0.0`, the `npm update` will change `package.json` to save the
+new version as the minimum required dependency. To get the old behavior,
+use `npm update --no-save`.
+
## EXAMPLES
IMPORTANT VERSION NOTE: these examples assume `npm@2.6.1` or later. For
@@ -104,30 +108,6 @@ If the dependence were on `^0.4.0`:
Then `npm update` will install `dep1@0.4.1`, because that is the highest-sorting
version that satisfies `^0.4.0` (`>= 0.4.0 <0.5.0`)
-### Recording Updates with `--save`
-
-When you want to update a package and save the new version as
-the minimum required dependency in `package.json`, you can use
-`npm update -S` or `npm update --save`. For example if
-`package.json` contains:
-
-```
-"dependencies": {
- "dep1": "^1.1.1"
-}
-```
-
-Then `npm update --save` will install `dep1@1.2.2` (i.e., `latest`),
-and `package.json` will be modified:
-
-```
-"dependencies": {
- "dep1": "^1.2.2"
-}
-```
-
-Note that `npm` will only write an updated version to `package.json`
-if it installs a new package.
### Updating Globally-Installed Packages
diff --git a/deps/npm/doc/cli/npm-version.md b/deps/npm/doc/cli/npm-version.md
index 1381b8be4bc4e2..f1a9bfccda6695 100644
--- a/deps/npm/doc/cli/npm-version.md
+++ b/deps/npm/doc/cli/npm-version.md
@@ -12,7 +12,7 @@ npm-version(1) -- Bump a package version
## DESCRIPTION
Run this in a package directory to bump the version and write the new
-data back to `package.json` and, if present, `npm-shrinkwrap.json`.
+data back to `package.json`, `package-lock.json`, and, if present, `npm-shrinkwrap.json`.
The `newversion` argument should be a valid semver string, a
valid second argument to [semver.inc](https://github.com/npm/node-semver#functions) (one of `patch`, `minor`, `major`,
diff --git a/deps/npm/doc/cli/npm.md b/deps/npm/doc/cli/npm.md
index ec867e5f9e9aaa..e41e7252e36e06 100644
--- a/deps/npm/doc/cli/npm.md
+++ b/deps/npm/doc/cli/npm.md
@@ -93,7 +93,7 @@ npm is extremely configurable. It reads its configuration options from
* Command line switches:
Set a config with `--key val`. All keys take a value, even if they
are booleans (the config parser doesn't know what the options are at
- the time of parsing.) If no value is provided, then the option is set
+ the time of parsing). If no value is provided, then the option is set
to boolean `true`.
* Environment Variables:
Set any config by prefixing the name in an environment variable with
diff --git a/deps/npm/doc/files/npm-folders.md b/deps/npm/doc/files/npm-folders.md
index 74c78834435f92..456cb58bc89e1d 100644
--- a/deps/npm/doc/files/npm-folders.md
+++ b/deps/npm/doc/files/npm-folders.md
@@ -68,7 +68,7 @@ Man pages are not installed on Windows systems.
### Cache
See `npm-cache(1)`. Cache files are stored in `~/.npm` on Posix, or
-`~/npm-cache` on Windows.
+`%AppData%/npm-cache` on Windows.
This is controlled by the `cache` configuration param.
diff --git a/deps/npm/doc/files/npm-package-locks.md b/deps/npm/doc/files/npm-package-locks.md
index c57fc85658e729..cbb62bdc3841cb 100644
--- a/deps/npm/doc/files/npm-package-locks.md
+++ b/deps/npm/doc/files/npm-package-locks.md
@@ -136,6 +136,25 @@ on. Additionally, the diffs from these changes are human-readable and will
inform you of any changes npm has made to your `node_modules`, so you can notice
if any transitive dependencies were updated, hoisted, etc.
+### Resolving lockfile conflicts
+
+Occasionally, two separate npm install will create package locks that cause
+merge conflicts in source control systems. As of `npm@5.7.0`, these conflicts
+can be resolved by manually fixing any `package.json` conflicts, and then
+running `npm install [--package-lock-only]` again. npm will automatically
+resolve any conflicts for you and write a merged package lock that includes all
+the dependencies from both branches in a reasonable tree. If
+`--package-lock-only` is provided, it will do this without also modifying your
+local `node_modules/`.
+
+To make this process seamless on git, consider installing
+[`npm-merge-driver`](https://npm.im/npm-merge-driver), which will teach git how
+to do this itself without any user interaction. In short: `$ npx
+npm-merge-driver install -g` will let you do this, and even works with
+pre-`npm@5.7.0` versions of npm 5, albeit a bit more noisily. Note that if
+`package.json` itself conflicts, you will have to resolve that by hand and run
+`npm install` manually, even with the merge driver.
+
## SEE ALSO
* https://medium.com/@sdboyer/so-you-want-to-write-a-package-manager-4ae9c17d9527
diff --git a/deps/npm/doc/files/package-lock.json.md b/deps/npm/doc/files/package-lock.json.md
index 4c134fc229ecb1..1b4ba934971177 100644
--- a/deps/npm/doc/files/package-lock.json.md
+++ b/deps/npm/doc/files/package-lock.json.md
@@ -120,6 +120,15 @@ transitive dependency of a non-optional dependency of the top level.
All optional dependencies should be included even if they're uninstallable
on the current platform.
+
+#### requires
+
+This is a mapping of module name to version. This is a list of everything
+this module requires, regardless of where it will be installed. The version
+should match via normal matching rules a dependency either in our
+`dependencies` or in a level higher than us.
+
+
#### dependencies
The dependencies of this dependency, exactly as at the top level.
@@ -128,5 +137,6 @@ The dependencies of this dependency, exactly as at the top level.
* npm-shrinkwrap(1)
* npm-shrinkwrap.json(5)
+* npm-package-locks(5)
* package.json(5)
* npm-install(1)
diff --git a/deps/npm/doc/files/package.json.md b/deps/npm/doc/files/package.json.md
index d91984d1d483b9..2ad3bcf68ceffd 100644
--- a/deps/npm/doc/files/package.json.md
+++ b/deps/npm/doc/files/package.json.md
@@ -11,11 +11,11 @@ settings described in `npm-config(7)`.
## name
-The *most* important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
+If you plan to publish your package, the *most* important things in your
+package.json are the name and version fields as they will be required. The name
+and version together form an identifier that is assumed to be completely unique.
+Changes to the package should come along with changes to the version. If you don't
+plan to publish your package, the name and version fields are optional.
The name is what your thing is called.
@@ -44,11 +44,11 @@ A name can be optionally prefixed by a scope, e.g. `@myorg/mypackage`. See
## version
-The *most* important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
+If you plan to publish your package, the *most* important things in your
+package.json are the name and version fields as they will be required. The name
+and version together form an identifier that is assumed to be completely unique.
+Changes to the package should come along with changes to the version. If you don't
+plan to publish your package, the name and version fields are optional.
Version must be parseable by
[node-semver](https://github.com/isaacs/node-semver), which is bundled
@@ -70,6 +70,10 @@ discover your package as it's listed in `npm search`.
The url to the project homepage.
+Example:
+
+ "homepage": "https://github.com/owner/project#readme"
+
## bugs
The url to your project's issue tracker and / or the email address to which
@@ -168,13 +172,15 @@ npm also sets a top-level "maintainers" field with your npm user info.
## files
-The optional "files" field is an array of file patterns that describes
+The optional `files` field is an array of file patterns that describes
the entries to be included when your package is installed as a
-dependency. If the files array is omitted, everything except
-automatically-excluded files will be included in your publish. If you
-name a folder in the array, then it will also include the files inside
-that folder (unless they would be ignored by another rule in this
-section.).
+dependency. File patterns follow a similar syntax to `.gitignore`, but
+reversed: including a file, directory, or glob pattern (`*`, `**/*`, and such)
+will make it so that file is included in the tarball when it's packed. Omitting
+the field will make it default to `["*"]`, which means it will include all files.
+
+Some special files and directories are also included or excluded regardless of
+whether they exist in the `files` array (see below).
You can also provide a `.npmignore` file in the root of your package or
in subdirectories, which will keep files from being included. At the
@@ -226,6 +232,12 @@ This should be a module ID relative to the root of your package folder.
For most modules, it makes the most sense to have a main script and often not
much else.
+## browser
+
+If your module is meant to be used client-side the browser field should be
+used instead of the main field. This is helpful to hint users that it might
+rely on primitives that aren't available in Node.js modules. (e.g. `window`)
+
## bin
A lot of packages have one or more executable files that they'd like to
@@ -745,8 +757,8 @@ especially handy if you want to set the tag, registry or access, so that
you can ensure that a given package is not tagged with "latest", published
to the global public registry or that a scoped module is private by default.
-Any config values can be overridden, but of course only "tag", "registry" and
-"access" probably matter for the purposes of publishing.
+Any config values can be overridden, but only "tag", "registry" and "access"
+probably matter for the purposes of publishing.
See `npm-config(7)` to see the list of config options that can be
overridden.
diff --git a/deps/npm/doc/misc/npm-coding-style.md b/deps/npm/doc/misc/npm-coding-style.md
index e6837bfbf3eb82..1199f63fcc3f03 100644
--- a/deps/npm/doc/misc/npm-coding-style.md
+++ b/deps/npm/doc/misc/npm-coding-style.md
@@ -115,7 +115,7 @@ Good:
## Whitespace
-Put a single space in front of ( for anything other than a function call.
+Put a single space in front of `(` for anything other than a function call.
Also use a single space wherever it makes things more readable.
Don't leave trailing whitespace at the end of lines. Don't indent empty
diff --git a/deps/npm/doc/misc/npm-config.md b/deps/npm/doc/misc/npm-config.md
index 0ab041891820a3..a82c8ee2206127 100644
--- a/deps/npm/doc/misc/npm-config.md
+++ b/deps/npm/doc/misc/npm-config.md
@@ -155,6 +155,15 @@ even for `GET` requests.
When "dev" or "development" and running local `npm shrinkwrap`,
`npm outdated`, or `npm update`, is an alias for `--dev`.
+### audit
+
+* Default: true
+* Type: Boolean
+
+When "true" submit audit reports alongside `npm install` runs to the default
+registry and all registries configured for scopes. See the documentation
+for npm-audit(1) for details on what is submitted.
+
### auth-type
* Default: `'legacy'`
@@ -284,6 +293,9 @@ This is a list of CIDR address to be used when configuring limited access tokens
If false, never shows colors. If `"always"` then always shows colors.
If true, then only prints color codes for tty file descriptors.
+This option can also be changed using the environment: colors are
+disabled when the environment variable `NO_COLOR` is set to any value.
+
### depth
* Default: Infinity
@@ -672,6 +684,13 @@ impact how lifecycle scripts are called.
The node version to use when checking a package's `engines` map.
+### no-proxy
+
+* Default: null
+* Type: String or Array
+
+A comma-separated string or an array of domain extensions that a proxy should not be used for.
+
### offline
* Default: false
@@ -731,6 +750,10 @@ when publishing or changing package permissions with `npm access`.
If set to false, then ignore `package-lock.json` files when installing. This
will also prevent _writing_ `package-lock.json` if `save` is true.
+When package package-locks are disabled, automatic pruning of extraneous
+modules will also be disabled. To remove extraneous modules with
+package-locks disabled use `npm prune`.
+
This option is an alias for `--shrinkwrap`.
### package-lock-only
@@ -738,7 +761,7 @@ This option is an alias for `--shrinkwrap`.
* Default: false
* Type: Boolean
-If set to true, it will update only the `package-json`,
+If set to true, it will update only the `package-lock.json`,
instead of checking `node_modules` and downloading dependencies.
### parseable
@@ -835,7 +858,7 @@ Remove failed installs.
### save
-* Default: false
+* Default: true
* Type: Boolean
Save installed packages to a package.json file as dependencies.
diff --git a/deps/npm/doc/misc/npm-developers.md b/deps/npm/doc/misc/npm-developers.md
index 2f54b98fb9e817..55c8d9b08d1316 100644
--- a/deps/npm/doc/misc/npm-developers.md
+++ b/deps/npm/doc/misc/npm-developers.md
@@ -57,7 +57,7 @@ least, you need:
use the name to specify that it runs on node, or is in JavaScript.
You can use the "engines" field to explicitly state the versions of
node (or whatever else) that your program requires, and it's pretty
- well assumed that it's javascript.
+ well assumed that it's JavaScript.
It does not necessarily need to match your github repository name.
diff --git a/deps/npm/doc/misc/npm-index.md b/deps/npm/doc/misc/npm-index.md
index 64fb25de2e284e..efbf2784ff0934 100644
--- a/deps/npm/doc/misc/npm-index.md
+++ b/deps/npm/doc/misc/npm-index.md
@@ -21,6 +21,10 @@ Set access level on published packages
Add a registry user account
+### npm-audit(1)
+
+Run a security audit
+
### npm-bin(1)
Display npm bin folder
@@ -41,6 +45,10 @@ REMOVED
Manipulates packages cache
+### npm-ci(1)
+
+Install a project with a clean slate
+
### npm-completion(1)
Tab Completion for npm
@@ -85,9 +93,17 @@ Search npm help documentation
Get help on npm
+### npm-hook(1)
+
+Manage registry hooks
+
### npm-init(1)
-Interactively create a package.json file
+create a package.json file
+
+### npm-install-ci-test(1)
+
+Install a project with a clean slate and run tests
### npm-install-test(1)
diff --git a/deps/npm/doc/misc/npm-scope.md b/deps/npm/doc/misc/npm-scope.md
index 940c1dbb58cc1b..a65af92bcdcb69 100644
--- a/deps/npm/doc/misc/npm-scope.md
+++ b/deps/npm/doc/misc/npm-scope.md
@@ -75,7 +75,7 @@ to `public` as if you had run `npm access public` after publishing.
### Publishing private scoped packages to the npm registry
To publish a private scoped package to the npm registry, you must have
-an [npm Private Modules](https://www.npmjs.com/private-modules)
+an [npm Private Modules](https://docs.npmjs.com/private-modules/intro)
account.
You can then publish the module with `npm publish` or `npm publish
diff --git a/deps/npm/doc/misc/semver.md b/deps/npm/doc/misc/semver.md
index 993621a6fd46c8..ab6f72c13e6c2c 100644
--- a/deps/npm/doc/misc/semver.md
+++ b/deps/npm/doc/misc/semver.md
@@ -20,6 +20,8 @@ semver.clean(' =v1.2.3 ') // '1.2.3'
semver.satisfies('1.2.3', '1.x || >=2.5.0 || 5.0.0 - 7.2.3') // true
semver.gt('1.2.3', '9.8.7') // false
semver.lt('1.2.3', '9.8.7') // true
+semver.valid(semver.coerce('v2')) // '2.0.0'
+semver.valid(semver.coerce('42.6.7.9.3-alpha')) // '42.6.7'
```
As a command-line utility:
@@ -52,6 +54,10 @@ Options:
-l --loose
Interpret versions and ranges loosely
+-c --coerce
+ Coerce a string into SemVer if possible
+ (does not imply --loose)
+
Program exits successfully if any valid version satisfies
all supplied ranges, and prints all satisfying versions.
@@ -364,3 +370,19 @@ satisfy the range.
If you want to know if a version satisfies or does not satisfy a
range, use the `satisfies(version, range)` function.
+
+### Coercion
+
+* `coerce(version)`: Coerces a string to semver if possible
+
+This aims to provide a very forgiving translation of a non-semver
+string to semver. It looks for the first digit in a string, and
+consumes all remaining characters which satisfy at least a partial semver
+(e.g., `1`, `1.2`, `1.2.3`) up to the max permitted length (256 characters).
+Longer versions are simply truncated (`4.6.3.9.2-alpha2` becomes `4.6.3`).
+All surrounding text is simply ignored (`v3.4 replaces v3.3.1` becomes `3.4.0`).
+Only text which lacks digits will fail coercion (`version one` is not valid).
+The maximum length for any semver component considered for coercion is 16 characters;
+longer components will be ignored (`10000000000000000.4.7.4` becomes `4.7.4`).
+The maximum value for any semver component is `Integer.MAX_SAFE_INTEGER || (2**53 - 1)`;
+higher value components are invalid (`9999999999999999.4.7.4` is likely invalid).
diff --git a/deps/npm/doc/spec/package-lock.md b/deps/npm/doc/spec/package-lock.md
index e7a714113946d4..e1cc6941aee3ed 100644
--- a/deps/npm/doc/spec/package-lock.md
+++ b/deps/npm/doc/spec/package-lock.md
@@ -107,10 +107,10 @@ transitive dependency of a non-optional dependency of the top level.
All optional dependencies should be included even if they're uninstallable
on the current platform.
-#### from *(deprecated)*
+#### from
This is a record of what specifier was used to originally install this
-package. This should not be included in new `package-lock.json` files.
+package. This should be used only for git dependencies.
#### requires
diff --git a/deps/npm/html/doc/README.html b/deps/npm/html/doc/README.html
index 48f8433f62ecba..f7a482f4658921 100644
--- a/deps/npm/html/doc/README.html
+++ b/deps/npm/html/doc/README.html
@@ -15,8 +15,8 @@ SYNOPSIS
This is just enough info to get you up and running.
Much more info available via npm help
once it's installed.
IMPORTANT
-You need node v4 or higher to run this program.
-To install an old and unsupported version of npm that works on node v0.12
+
You need node v6 or higher to run this program.
+To install an old and unsupported version of npm that works on node v5
and prior, clone the git repo and dig through the old tags and branches.
npm is configured to use npm, Inc.'s public package registry at
https://registry.npmjs.org by default.
@@ -127,5 +127,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-access.html b/deps/npm/html/doc/cli/npm-access.html
index 5fb7cfb0029da5..bbc9b1814b20ab 100644
--- a/deps/npm/html/doc/cli/npm-access.html
+++ b/deps/npm/html/doc/cli/npm-access.html
@@ -86,5 +86,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-adduser.html b/deps/npm/html/doc/cli/npm-adduser.html
index 90d247f5f5ed66..629130d14f663f 100644
--- a/deps/npm/html/doc/cli/npm-adduser.html
+++ b/deps/npm/html/doc/cli/npm-adduser.html
@@ -81,5 +81,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-audit.html b/deps/npm/html/doc/cli/npm-audit.html
new file mode 100644
index 00000000000000..e7e9c74b02cc70
--- /dev/null
+++ b/deps/npm/html/doc/cli/npm-audit.html
@@ -0,0 +1,88 @@
+
+
+ npm-audit
+
+
+
+
+
+
+
+
+npm-audit
Run a security audit
+SYNOPSIS
+npm audit [--json]
+npm audit fix [--force|--package-lock-only|--dry-run|--production|--only=dev]
+
EXAMPLES
+Scan your project for vulnerabilities and automatically install any compatible
+updates to vulnerable dependencies:
+$ npm audit fix
+
Run audit fix
without modifying node_modules
, but still updating the
+pkglock:
+$ npm audit fix --package-lock-only
+
Skip updating devDependencies
:
+$ npm audit fix --only=prod
+
Have audit fix
install semver-major updates to toplevel dependencies, not just
+semver-compatible ones:
+$ npm audit fix --force
+
Do a dry run to get an idea of what audit fix
will do, and also output
+install information in JSON format:
+$ npm audit fix --dry-run --json
+
Scan your project for vulnerabilities and just show the details, without fixing
+anything:
+$ npm audit
+
Get the detailed audit report in JSON format:
+$ npm audit --json
+
DESCRIPTION
+The audit command submits a description of the dependencies configured in
+your project to your default registry and asks for a report of known
+vulnerabilities. The report returned includes instructions on how to act on
+this information.
+You can also have npm automatically fix the vulnerabilities by running npm
+audit fix
. Note that some vulnerabilities cannot be fixed automatically and
+will require manual intervention or review. Also note that since npm audit fix
+runs a full-fledged npm install
under the hood, all configs that apply to the
+installer will also apply to npm install
-- so things like npm audit fix
+--package-lock-only
will work as expected.
+CONTENT SUBMITTED
+
+- npm_version
+- node_version
+- platform
+- node_env
+- A scrubbed version of your package-lock.json or npm-shrinkwrap.json
+
+SCRUBBING
+In order to ensure that potentially sensitive information is not included in
+the audit data bundle, some dependencies may have their names (and sometimes
+versions) replaced with opaque non-reversible identifiers. It is done for
+the following dependency types:
+
+- Any module referencing a scope that is configured for a non-default
+registry has its name scrubbed. (That is, a scope you did a
npm login --scope=@ourscope
for.)
+- All git dependencies have their names and specifiers scrubbed.
+- All remote tarball dependencies have their names and specifiers scrubbed.
+- All local directory and tarball dependencies have their names and specifiers scrubbed.
+
+The non-reversible identifiers are a sha256 of a session-specific UUID and the
+value being replaced, ensuring a consistent value within the payload that is
+different between runs.
+SEE ALSO
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/deps/npm/html/doc/cli/npm-bin.html b/deps/npm/html/doc/cli/npm-bin.html
index 677f621a9730f6..75cd0fef715db2 100644
--- a/deps/npm/html/doc/cli/npm-bin.html
+++ b/deps/npm/html/doc/cli/npm-bin.html
@@ -35,5 +35,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-bugs.html b/deps/npm/html/doc/cli/npm-bugs.html
index 3437dd4380ba39..c5d564941ae07c 100644
--- a/deps/npm/html/doc/cli/npm-bugs.html
+++ b/deps/npm/html/doc/cli/npm-bugs.html
@@ -55,5 +55,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-build.html b/deps/npm/html/doc/cli/npm-build.html
index 51544a4532bf5c..ffdbfed446b899 100644
--- a/deps/npm/html/doc/cli/npm-build.html
+++ b/deps/npm/html/doc/cli/npm-build.html
@@ -40,5 +40,5 @@ DESCRIPTION
-
+
diff --git a/deps/npm/html/doc/cli/npm-bundle.html b/deps/npm/html/doc/cli/npm-bundle.html
index 94cf6ed12b4ae0..cc6494ba6f2a86 100644
--- a/deps/npm/html/doc/cli/npm-bundle.html
+++ b/deps/npm/html/doc/cli/npm-bundle.html
@@ -31,5 +31,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-cache.html b/deps/npm/html/doc/cli/npm-cache.html
index 71d5297a9cf9d6..8f3b4d2b1e567c 100644
--- a/deps/npm/html/doc/cli/npm-cache.html
+++ b/deps/npm/html/doc/cli/npm-cache.html
@@ -89,5 +89,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-ci.html b/deps/npm/html/doc/cli/npm-ci.html
new file mode 100644
index 00000000000000..82791325f1c498
--- /dev/null
+++ b/deps/npm/html/doc/cli/npm-ci.html
@@ -0,0 +1,64 @@
+
+
+ npm-ci
+
+
+
+
+
+
+
+
+npm-ci
Install a project with a clean slate
+SYNOPSIS
+npm ci
+
EXAMPLE
+Make sure you have a package-lock and an up-to-date install:
+$ cd ./my/npm/project
+$ npm install
+added 154 packages in 10s
+$ ls | grep package-lock
+
Run npm ci
in that project
+$ npm ci
+added 154 packages in 5s
+
Configure Travis to build using npm ci
instead of npm install
:
+# .travis.yml
+install:
+- npm ci
+# keep the npm cache around to speed up installs
+cache:
+ directories:
+ - "$HOME/.npm"
+
DESCRIPTION
+This command is similar to npm-install(1)
, except it's meant to be used in
+automated environments such as test platforms, continuous integration, and
+deployment. It can be significantly faster than a regular npm install by
+skipping certain user-oriented features. It is also more strict than a regular
+install, which can help catch errors or inconsistencies caused by the
+incrementally-installed local environments of most npm users.
+In short, the main differences between using npm install
and npm ci
are:
+
+- The project must have an existing
package-lock.json
or npm-shrinkwrap.json
.
+- If dependencies in the package lock do not match those in
package.json
, npm ci
will exit with an error, instead of updating the package lock.
+npm ci
can only install entire projects at a time: individual dependencies cannot be added with this command.
+- If a
node_modules
is already present, it will be automatically removed before npm ci
begins its install.
+- It will never write to
package.json
or any of the package-locks: installs are essentially frozen.
+
+SEE ALSO
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/deps/npm/html/doc/cli/npm-completion.html b/deps/npm/html/doc/cli/npm-completion.html
index 7a37048a8a7cc8..381ce6ba8f460f 100644
--- a/deps/npm/html/doc/cli/npm-completion.html
+++ b/deps/npm/html/doc/cli/npm-completion.html
@@ -43,5 +43,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-config.html b/deps/npm/html/doc/cli/npm-config.html
index ccacfe9c39e490..dad4fb527fc641 100644
--- a/deps/npm/html/doc/cli/npm-config.html
+++ b/deps/npm/html/doc/cli/npm-config.html
@@ -68,5 +68,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-dedupe.html b/deps/npm/html/doc/cli/npm-dedupe.html
index e21605193f0106..6e78044137ad1a 100644
--- a/deps/npm/html/doc/cli/npm-dedupe.html
+++ b/deps/npm/html/doc/cli/npm-dedupe.html
@@ -61,5 +61,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-deprecate.html b/deps/npm/html/doc/cli/npm-deprecate.html
index f82a6b6d18f76c..7f6af91be868ed 100644
--- a/deps/npm/html/doc/cli/npm-deprecate.html
+++ b/deps/npm/html/doc/cli/npm-deprecate.html
@@ -38,5 +38,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-dist-tag.html b/deps/npm/html/doc/cli/npm-dist-tag.html
index 6f8bc9744f2389..0a2b2861dc5a58 100644
--- a/deps/npm/html/doc/cli/npm-dist-tag.html
+++ b/deps/npm/html/doc/cli/npm-dist-tag.html
@@ -88,5 +88,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-docs.html b/deps/npm/html/doc/cli/npm-docs.html
index 165159af15f912..43763b2cc26af0 100644
--- a/deps/npm/html/doc/cli/npm-docs.html
+++ b/deps/npm/html/doc/cli/npm-docs.html
@@ -56,5 +56,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-doctor.html b/deps/npm/html/doc/cli/npm-doctor.html
index 8eba9f172d792f..5d3dff52450452 100644
--- a/deps/npm/html/doc/cli/npm-doctor.html
+++ b/deps/npm/html/doc/cli/npm-doctor.html
@@ -32,7 +32,7 @@ SYNOPSIS
better than an old version.
npm doctor
verifies the following items in your environment, and if there are
any recommended changes, it will display them.
-npm ping
+npm ping
By default, npm installs from the primary npm registry, registry.npmjs.org
.
npm doctor
hits a special ping endpoint within the registry. This can also be
checked with npm ping
. If this check fails, you may be using a proxy that
@@ -42,7 +42,7 @@
npm ping
what that is by running npm config get registry
), and if you're using a
private registry that doesn't support the /whoami
endpoint supported by the
primary registry, this check may fail.
-npm -v
+npm -v
While Node.js may come bundled with a particular version of npm, it's the
policy of the CLI team that we recommend all users run npm@latest
if they
can. As the CLI is maintained by a small team of contributors, there are only
@@ -50,21 +50,21 @@
npm -v
releases typically only receive critical security and regression fixes. The
team believes that the latest tested version of npm is almost always likely to
be the most functional and defect-free version of npm.
-node -v
+node -v
For most users, in most circumstances, the best version of Node will be the
latest long-term support (LTS) release. Those of you who want access to new
ECMAscript features or bleeding-edge changes to Node's standard library may be
running a newer version, and some of you may be required to run an older
version of Node because of enterprise change control policies. That's OK! But
in general, the npm team recommends that most users run Node.js LTS.
-npm config get registry
+npm config get registry
Some of you may be installing from private package registries for your project
or company. That's great! Others of you may be following tutorials or
StackOverflow questions in an effort to troubleshoot problems you may be
having. Sometimes, this may entail changing the registry you're pointing at.
This part of npm doctor
just lets you, and maybe whoever's helping you with
support, know that you're not using the default registry.
-which git
+which git
While it's documented in the README, it may not be obvious that npm needs Git
installed to do many of the things that it does. Also, in some cases
– especially on Windows – you may have Git set up in such a way that it's not
@@ -103,4 +103,4 @@
SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-edit.html b/deps/npm/html/doc/cli/npm-edit.html
index 651990084dd4dd..3d0b4a1bdcd158 100644
--- a/deps/npm/html/doc/cli/npm-edit.html
+++ b/deps/npm/html/doc/cli/npm-edit.html
@@ -49,5 +49,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-explore.html b/deps/npm/html/doc/cli/npm-explore.html
index bab3a861ec25f1..4d5628ddbf144d 100644
--- a/deps/npm/html/doc/cli/npm-explore.html
+++ b/deps/npm/html/doc/cli/npm-explore.html
@@ -49,5 +49,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-help-search.html b/deps/npm/html/doc/cli/npm-help-search.html
index 01b1ff62d2516a..06204f99c41877 100644
--- a/deps/npm/html/doc/cli/npm-help-search.html
+++ b/deps/npm/html/doc/cli/npm-help-search.html
@@ -45,5 +45,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-help.html b/deps/npm/html/doc/cli/npm-help.html
index 8adf3b3843c425..9301975467aafb 100644
--- a/deps/npm/html/doc/cli/npm-help.html
+++ b/deps/npm/html/doc/cli/npm-help.html
@@ -50,5 +50,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-hook.html b/deps/npm/html/doc/cli/npm-hook.html
new file mode 100644
index 00000000000000..b4e513f2fc82b1
--- /dev/null
+++ b/deps/npm/html/doc/cli/npm-hook.html
@@ -0,0 +1,63 @@
+
+
+ npm-hook
+
+
+
+
+
+
+
+
+npm-hook
Manage registry hooks
+SYNOPSIS
+npm hook ls [pkg]
+npm hook add <entity> <url> <secret>
+npm hook update <id> <url> [secret]
+npm hook rm <id>
+
EXAMPLE
+Add a hook to watch a package for changes:
+$ npm hook add lodash https://example.com/ my-shared-secret
+
Add a hook to watch packages belonging to the user substack
:
+$ npm hook add ~substack https://example.com/ my-shared-secret
+
Add a hook to watch packages in the scope @npm
+$ npm hook add @npm https://example.com/ my-shared-secret
+
List all your active hooks:
+$ npm hook ls
+
List your active hooks for the lodash
package:
+$ npm hook ls lodash
+
Update an existing hook's url:
+$ npm hook update id-deadbeef https://my-new-website.here/
+
Remove a hook:
+$ npm hook rm id-deadbeef
+
DESCRIPTION
+Allows you to manage npm
+hooks,
+including adding, removing, listing, and updating.
+Hooks allow you to configure URL endpoints that will be notified whenever a
+change happens to any of the supported entity types. Three different types of
+entities can be watched by hooks: packages, owners, and scopes.
+To create a package hook, simply reference the package name.
+To create an owner hook, prefix the owner name with ~
(as in, ~youruser
).
+To create a scope hook, prefix the scope name with @
(as in, @yourscope
).
+The hook id
used by update
and rm
are the IDs listed in npm hook ls
for
+that particular hook.
+The shared secret will be sent along to the URL endpoint so you can verify the
+request came from your own configured hook.
+SEE ALSO
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/deps/npm/html/doc/cli/npm-init.html b/deps/npm/html/doc/cli/npm-init.html
index 115c9b2185adc1..4e405c2ccf4999 100644
--- a/deps/npm/html/doc/cli/npm-init.html
+++ b/deps/npm/html/doc/cli/npm-init.html
@@ -9,26 +9,44 @@
-npm-init
Interactively create a package.json file
+npm-init
create a package.json file
SYNOPSIS
-npm init [-f|--force|-y|--yes]
+npm init [--force|-f|--yes|-y|--scope]
+npm init <@scope> (same as `npx <@scope>/create`)
+npm init [<@scope>/]<name> (same as `npx [<@scope>/]create-<name>`)
+
EXAMPLES
+Create a new React-based project using create-react-app
:
+$ npm init react-app ./my-react-app
+
Create a new esm
-compatible package using create-esm
:
+$ mkdir my-esm-lib && cd my-esm-lib
+$ npm init esm --yes
+
Generate a plain old package.json using legacy init:
+$ mkdir my-npm-pkg && cd my-npm-pkg
+$ git init
+$ npm init
+
Generate it without having it ask any questions:
+$ npm init -y
DESCRIPTION
-This will ask you a bunch of questions, and then write a package.json for you.
-It attempts to make reasonable guesses about what you want things to be set to,
-and then writes a package.json file with the options you've selected.
-If you already have a package.json file, it'll read that first, and default to
-the options in there.
-It is strictly additive, so it does not delete options from your package.json
-without a really good reason to do so.
-If you invoke it with -f
, --force
, -y
, or --yes
, it will use only
-defaults and not prompt you for any options.
-CONFIGURATION
-scope
+npm init <initializer>
can be used to set up a new or existing npm package.
+initializer
in this case is an npm package named create-<initializer>
, which
+will be installed by npx(1)
, and then have its main bin
+executed -- presumably creating or updating package.json
and running any other
+initialization-related operations.
+The init command is transformed to a corresponding npx
operation as follows:
-- Default: none
-- Type: String
+npm init foo
-> npx create-foo
+npm init @usr/foo
-> npx @usr/create-foo
+npm init @usr
-> npx @usr/create
-The scope under which the new module should be created.
+Any additional options will be passed directly to the command, so npm init foo
+--hello
will map to npx create-foo --hello
.
+If the initializer is omitted (by just calling npm init
), init will fall back
+to legacy init behavior. It will ask you a bunch of questions, and then write a
+package.json for you. It will attempt to make reasonable guesses based on
+existing fields, dependencies, and options selected. It is strictly additive, so
+it will keep any fields and values that were already set. You can also use
+-y
/--yes
to skip the questionnaire altogether. If you pass --scope
, it
+will create a scoped package.
SEE ALSO
- https://github.com/isaacs/init-package-json
@@ -48,5 +66,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-install-ci-test.html b/deps/npm/html/doc/cli/npm-install-ci-test.html
new file mode 100644
index 00000000000000..537a0263bfa6f0
--- /dev/null
+++ b/deps/npm/html/doc/cli/npm-install-ci-test.html
@@ -0,0 +1,36 @@
+
+
+ npm-install-ci-test
+
+
+
+
+
+
+
+
+npm install-ci-test
Install a project with a clean slate and run tests
+SYNOPSIS
+npm install-ci-test
+
+alias: npm cit
+
DESCRIPTION
+This command runs an npm ci
followed immediately by an npm test
.
+SEE ALSO
+
+- npm-ci(1)
+- npm-test(1)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/deps/npm/html/doc/cli/npm-install-test.html b/deps/npm/html/doc/cli/npm-install-test.html
index 71262400b3d716..beb2d312a9af3e 100644
--- a/deps/npm/html/doc/cli/npm-install-test.html
+++ b/deps/npm/html/doc/cli/npm-install-test.html
@@ -42,5 +42,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-install.html b/deps/npm/html/doc/cli/npm-install.html
index 5989cc25a10dc8..5bc9cd985bfd5f 100644
--- a/deps/npm/html/doc/cli/npm-install.html
+++ b/deps/npm/html/doc/cli/npm-install.html
@@ -54,6 +54,10 @@ SYNOPSIS
With the --production
flag (or when the NODE_ENV
environment variable
is set to production
), npm will not install modules listed in
devDependencies
.
+
+NOTE: The --production
flag has no particular meaning when adding a
+ dependency to a project.
+
npm install <folder>
:
Install the package in the directory as a symlink in the current project.
@@ -281,11 +285,14 @@
SYNOPSIS
The --no-shrinkwrap
argument, which will ignore an available
package lock or shrinkwrap file and use the package.json instead.
The --no-package-lock
argument will prevent npm from creating a
-package-lock.json
file.
+package-lock.json
file. When running with package-lock's disabled npm
+will not automatically prune your node modules when installing.
The --nodedir=/path/to/node/source
argument will allow npm to find the
node source code so that npm can compile native modules.
The --only={prod[uction]|dev[elopment]}
argument will cause either only
devDependencies
or only non-devDependencies
to be installed regardless of the NODE_ENV
.
+The --no-audit
argument can be used to disable sending of audit reports to
+the configured registries. See npm-audit(1)
for details on what is sent.
See npm-config(7)
. Many of the configuration params have some
effect on installation, since that's most of what npm does.
ALGORITHM
@@ -344,6 +351,7 @@ SEE ALSO
- npm-folders(5)
- npm-update(1)
+- npm-audit(1)
- npm-link(1)
- npm-rebuild(1)
- npm-scripts(7)
@@ -369,5 +377,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-link.html b/deps/npm/html/doc/cli/npm-link.html
index 57a6ae86731520..b84aad751dd938 100644
--- a/deps/npm/html/doc/cli/npm-link.html
+++ b/deps/npm/html/doc/cli/npm-link.html
@@ -74,5 +74,5 @@ SYNOPSIS
-
+
diff --git a/deps/npm/html/doc/cli/npm-logout.html b/deps/npm/html/doc/cli/npm-logout.html
index a06341b2d2dd19..3929410fa11fa1 100644
--- a/deps/npm/html/doc/cli/npm-logout.html
+++ b/deps/npm/html/doc/cli/npm-logout.html
@@ -51,5 +51,5 @@ scope
-
+
diff --git a/deps/npm/html/doc/cli/npm-ls.html b/deps/npm/html/doc/cli/npm-ls.html
index 4ba0917179dc32..cfbe4ee303022d 100644
--- a/deps/npm/html/doc/cli/npm-ls.html
+++ b/deps/npm/html/doc/cli/npm-ls.html
@@ -21,7 +21,7 @@ SYNOPSIS
limit the results to only the paths to the packages named. Note that
nested packages will also show the paths to the specified packages.
For example, running npm ls promzard
in npm's source tree will show:
-
npm@5.6.0 /path/to/npm
+npm@6.1.0 /path/to/npm
└─┬ init-package-json@0.0.4
└── promzard@0.1.5
It will print out extraneous, missing, and invalid packages.
@@ -68,7 +68,7 @@ prod / production
- Default: false
Display only the dependency tree for packages in dependencies
.
-dev
+dev / development
- Type: Boolean
- Default: false
@@ -110,5 +110,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-outdated.html b/deps/npm/html/doc/cli/npm-outdated.html
index d59e0548a3e85c..319f1ae45fd1d8 100644
--- a/deps/npm/html/doc/cli/npm-outdated.html
+++ b/deps/npm/html/doc/cli/npm-outdated.html
@@ -32,6 +32,8 @@ SYNOPSIS
package type
(when using --long
/ -l
) tells you whether this package is
a dependency
or a devDependency
. Packages not included in package.json
are always marked dependencies
.
+- Red means there's a newer version matching your semver requirements, so you should update now.
+- Yellow indicates that there's a newer version above your semver requirements (usually new major, or new 0.x minor) so proceed with caution.
An example
$ npm outdated
@@ -58,10 +60,9 @@ An example
something immutable, like a commit SHA), or it might not, so npm outdated
and
npm update
have to fetch Git repos to check. This is why currently doing a
reinstall of a Git dependency always forces a new clone and install.
-npm@3.5.2
is marked as "wanted", but "latest" is npm@3.5.1
because npm
-uses dist-tags to manage its latest
and next
release channels. npm update
-will install the newest version, but npm install npm
(with no semver range)
-will install whatever's tagged as latest
.
+`npm@3.5.2is marked as "wanted", but "latest" is
npm@3.5.1because npm
+uses dist-tags to manage its
latestand
nextrelease channels.
npm updatewill install the _newest_ version, but
npm install npm(with no semver range)
+will install whatever's tagged as
latest`.
once
is just plain out of date. Reinstalling node_modules
from scratch or
running npm update
will bring it up to spec.
@@ -116,5 +117,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-owner.html b/deps/npm/html/doc/cli/npm-owner.html
index 6b28ab48d15c74..1c1ce66534c684 100644
--- a/deps/npm/html/doc/cli/npm-owner.html
+++ b/deps/npm/html/doc/cli/npm-owner.html
@@ -54,5 +54,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-pack.html b/deps/npm/html/doc/cli/npm-pack.html
index 35e6670bef21e5..d3a560f14c7b28 100644
--- a/deps/npm/html/doc/cli/npm-pack.html
+++ b/deps/npm/html/doc/cli/npm-pack.html
@@ -41,5 +41,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-ping.html b/deps/npm/html/doc/cli/npm-ping.html
index 4b67c2686e9e17..0e0d2afc7e6177 100644
--- a/deps/npm/html/doc/cli/npm-ping.html
+++ b/deps/npm/html/doc/cli/npm-ping.html
@@ -36,5 +36,5 @@ SYNOPSIS
-
+
diff --git a/deps/npm/html/doc/cli/npm-prefix.html b/deps/npm/html/doc/cli/npm-prefix.html
index ebb2f6a3c60cff..d9cdfd9782c960 100644
--- a/deps/npm/html/doc/cli/npm-prefix.html
+++ b/deps/npm/html/doc/cli/npm-prefix.html
@@ -38,5 +38,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-profile.html b/deps/npm/html/doc/cli/npm-profile.html
index 3d952205f435d5..60fece551e760c 100644
--- a/deps/npm/html/doc/cli/npm-profile.html
+++ b/deps/npm/html/doc/cli/npm-profile.html
@@ -90,4 +90,4 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-prune.html b/deps/npm/html/doc/cli/npm-prune.html
index f71aa0c212fbc8..1c3ce7eb0218f6 100644
--- a/deps/npm/html/doc/cli/npm-prune.html
+++ b/deps/npm/html/doc/cli/npm-prune.html
@@ -11,7 +11,7 @@
npm-prune
Remove extraneous packages
SYNOPSIS
-npm prune [[<@scope>/]<pkg>...] [--production]
+npm prune [[<@scope>/]<pkg>...] [--production] [--dry-run] [--json]
DESCRIPTION
This command removes "extraneous" packages. If a package name is
provided, then only packages matching one of the supplied names are
@@ -20,8 +20,16 @@
SYNOPSIS
package's dependencies list.
If the --production
flag is specified or the NODE_ENV
environment
variable is set to production
, this command will remove the packages
-specified in your devDependencies
. Setting --production=false
will
+specified in your devDependencies
. Setting --no-production
will
negate NODE_ENV
being set to production
.
+If the --dry-run
flag is used then no changes will actually be made.
+If the --json
flag is used then the changes npm prune
made (or would
+have made with --dry-run
) are printed as a JSON object.
+In normal operation with package-locks enabled, extraneous modules are
+pruned automatically when modules are installed and you'll only need
+this command with the --production
flag.
+If you've disabled package-locks then extraneous modules will not be removed
+and it's up to you to run npm prune
from time-to-time to remove them.
SEE ALSO
- npm-uninstall(1)
@@ -40,5 +48,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-publish.html b/deps/npm/html/doc/cli/npm-publish.html
index c8a0b691e1364e..5a3c8b8f1630dd 100644
--- a/deps/npm/html/doc/cli/npm-publish.html
+++ b/deps/npm/html/doc/cli/npm-publish.html
@@ -85,5 +85,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-rebuild.html b/deps/npm/html/doc/cli/npm-rebuild.html
index 136192342a4b2f..4361ac43c177c7 100644
--- a/deps/npm/html/doc/cli/npm-rebuild.html
+++ b/deps/npm/html/doc/cli/npm-rebuild.html
@@ -35,5 +35,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-repo.html b/deps/npm/html/doc/cli/npm-repo.html
index 12e6b1748efbd2..e11513ceb0f60d 100644
--- a/deps/npm/html/doc/cli/npm-repo.html
+++ b/deps/npm/html/doc/cli/npm-repo.html
@@ -41,5 +41,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-restart.html b/deps/npm/html/doc/cli/npm-restart.html
index 4f9aacecf1d68a..918d331de4f0db 100644
--- a/deps/npm/html/doc/cli/npm-restart.html
+++ b/deps/npm/html/doc/cli/npm-restart.html
@@ -53,5 +53,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-root.html b/deps/npm/html/doc/cli/npm-root.html
index a4e9aa9bd63505..c97d05bdcd7294 100644
--- a/deps/npm/html/doc/cli/npm-root.html
+++ b/deps/npm/html/doc/cli/npm-root.html
@@ -35,5 +35,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-run-script.html b/deps/npm/html/doc/cli/npm-run-script.html
index 489fbccb093d72..c3ed88b8f13aed 100644
--- a/deps/npm/html/doc/cli/npm-run-script.html
+++ b/deps/npm/html/doc/cli/npm-run-script.html
@@ -59,6 +59,9 @@ SYNOPSIS
If you try to run a script without having a node_modules
directory and it fails,
you will be given a warning to run npm install
, just in case you've forgotten.
You can use the --silent
flag to prevent showing npm ERR!
output on error.
+You can use the --if-present
flag to avoid exiting with a non-zero exit code
+when the script is undefined. This lets you run potentially undefined scripts
+without breaking the execution chain.
SEE ALSO
- npm-scripts(7)
@@ -80,5 +83,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-search.html b/deps/npm/html/doc/cli/npm-search.html
index df759928a739a2..30a47caf7d81c2 100644
--- a/deps/npm/html/doc/cli/npm-search.html
+++ b/deps/npm/html/doc/cli/npm-search.html
@@ -109,5 +109,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-shrinkwrap.html b/deps/npm/html/doc/cli/npm-shrinkwrap.html
index 629f5b69a7b0fa..b4a740e413c293 100644
--- a/deps/npm/html/doc/cli/npm-shrinkwrap.html
+++ b/deps/npm/html/doc/cli/npm-shrinkwrap.html
@@ -41,5 +41,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-star.html b/deps/npm/html/doc/cli/npm-star.html
index a957ff479f4d88..ef57f2254c3c01 100644
--- a/deps/npm/html/doc/cli/npm-star.html
+++ b/deps/npm/html/doc/cli/npm-star.html
@@ -36,5 +36,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-stars.html b/deps/npm/html/doc/cli/npm-stars.html
index ff6dbfb3143de4..9b28be20e025c2 100644
--- a/deps/npm/html/doc/cli/npm-stars.html
+++ b/deps/npm/html/doc/cli/npm-stars.html
@@ -36,5 +36,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-start.html b/deps/npm/html/doc/cli/npm-start.html
index 0c0dfb3ae1ea70..258673ccfd2a64 100644
--- a/deps/npm/html/doc/cli/npm-start.html
+++ b/deps/npm/html/doc/cli/npm-start.html
@@ -39,5 +39,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-stop.html b/deps/npm/html/doc/cli/npm-stop.html
index 9c04332e681ffd..88ce21fd9dacfa 100644
--- a/deps/npm/html/doc/cli/npm-stop.html
+++ b/deps/npm/html/doc/cli/npm-stop.html
@@ -34,5 +34,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-team.html b/deps/npm/html/doc/cli/npm-team.html
index 81d74fa0a7faa6..9c89f72947a7c8 100644
--- a/deps/npm/html/doc/cli/npm-team.html
+++ b/deps/npm/html/doc/cli/npm-team.html
@@ -39,6 +39,9 @@ SYNOPSIS
under that organization. If performed on a team, it will instead return a list
of all users belonging to that particular team.
+edit:
+Edit a current team.
+
DETAILS
npm team
always operates directly on the current registry, configurable from
@@ -67,5 +70,5 @@
SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-test.html b/deps/npm/html/doc/cli/npm-test.html
index 280e69f3a18ed9..4abe4569529cb1 100644
--- a/deps/npm/html/doc/cli/npm-test.html
+++ b/deps/npm/html/doc/cli/npm-test.html
@@ -36,5 +36,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-token.html b/deps/npm/html/doc/cli/npm-token.html
index 8ec2f5fbec22b7..c39e39779afe3e 100644
--- a/deps/npm/html/doc/cli/npm-token.html
+++ b/deps/npm/html/doc/cli/npm-token.html
@@ -73,4 +73,4 @@ SYNOPSIS
-
+
diff --git a/deps/npm/html/doc/cli/npm-uninstall.html b/deps/npm/html/doc/cli/npm-uninstall.html
index dd430d07966eaf..9a6b4ec1d70195 100644
--- a/deps/npm/html/doc/cli/npm-uninstall.html
+++ b/deps/npm/html/doc/cli/npm-uninstall.html
@@ -63,5 +63,5 @@ SYNOPSIS
-
+
diff --git a/deps/npm/html/doc/cli/npm-unpublish.html b/deps/npm/html/doc/cli/npm-unpublish.html
index 721de2828ffbc3..72e84ce862fb36 100644
--- a/deps/npm/html/doc/cli/npm-unpublish.html
+++ b/deps/npm/html/doc/cli/npm-unpublish.html
@@ -29,7 +29,7 @@ DESCRIPTION
With the default registry (registry.npmjs.org
), unpublish is
only allowed with versions published in the last 24 hours. If you
are trying to unpublish a version published longer ago than that,
-contact support@npmjs.com.
+contact support@npmjs.com.
The scope is optional and follows the usual rules for npm-scope(7)
.
SEE ALSO
@@ -51,5 +51,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-update.html b/deps/npm/html/doc/cli/npm-update.html
index ddaf4104df1c98..5b3f2a585db5f3 100644
--- a/deps/npm/html/doc/cli/npm-update.html
+++ b/deps/npm/html/doc/cli/npm-update.html
@@ -24,12 +24,15 @@ SYNOPSIS
packages.
If no package name is specified, all packages in the specified location (global
or local) will be updated.
-As of npm@2.6.1
, the npm update
will only inspect top-level packages.
-Prior versions of npm
would also recursively inspect all dependencies.
-To get the old behavior, use npm --depth 9999 update
.
+As of `npm@2.6.1, the
npm updatewill only inspect top-level packages.
+Prior versions of
npmwould also recursively inspect all dependencies.
+To get the old behavior, use
npm --depth 9999 update`.
+As of `npm@5.0.0, the
npm updatewill change
package.jsonto save the
+new version as the minimum required dependency. To get the old behavior,
+use
npm update --no-save`.
EXAMPLES
-IMPORTANT VERSION NOTE: these examples assume npm@2.6.1
or later. For
-older versions of npm
, you must specify --depth 0
to get the behavior
+
IMPORTANT VERSION NOTE: these examples assume `npm@2.6.1or later. For
+older versions of
npm, you must specify
--depth 0` to get the behavior
described below.
For the examples below, assume that the current package is app
and it depends
on dependencies, dep1
(dep2
, .. etc.). The published versions of dep1
are:
@@ -52,45 +55,28 @@ EXAMPLES
"dependencies": {
"dep1": "^1.1.1"
}
-
Then npm update
will install dep1@1.2.2
, because 1.2.2
is latest
and
-1.2.2
satisfies ^1.1.1
.
+
Then npm update
will install `dep1@1.2.2, because
1.2.2is
latestand
1.2.2satisfies
^1.1.1`.
Tilde Dependencies
However, if app
's package.json
contains:
"dependencies": {
"dep1": "~1.1.1"
}
-
In this case, running npm update
will install dep1@1.1.2
. Even though the latest
-tag points to 1.2.2
, this version does not satisfy ~1.1.1
, which is equivalent
-to >=1.1.1 <1.2.0
. So the highest-sorting version that satisfies ~1.1.1
is used,
-which is 1.1.2
.
+
In this case, running npm update
will install `dep1@1.1.2. Even though the
latesttag points to
1.2.2, this version does not satisfy
~1.1.1, which is equivalent
+to
>=1.1.1 <1.2.0. So the highest-sorting version that satisfies
~1.1.1is used,
+which is
1.1.2`.
Caret Dependencies below 1.0.0
Suppose app
has a caret dependency on a version below 1.0.0
, for example:
"dependencies": {
"dep1": "^0.2.0"
}
-
npm update
will install dep1@0.2.0
, because there are no other
-versions which satisfy ^0.2.0
.
+
npm update
will install `dep1@0.2.0, because there are no other
+versions which satisfy
^0.2.0`.
If the dependence were on ^0.4.0
:
"dependencies": {
"dep1": "^0.4.0"
}
-
Then npm update
will install dep1@0.4.1
, because that is the highest-sorting
-version that satisfies ^0.4.0
(>= 0.4.0 <0.5.0
)
-Recording Updates with --save
-When you want to update a package and save the new version as
-the minimum required dependency in package.json
, you can use
-npm update -S
or npm update --save
. For example if
-package.json
contains:
-"dependencies": {
- "dep1": "^1.1.1"
-}
-
Then npm update --save
will install dep1@1.2.2
(i.e., latest
),
-and package.json
will be modified:
-"dependencies": {
- "dep1": "^1.2.2"
-}
-
Note that npm
will only write an updated version to package.json
-if it installs a new package.
+Then npm update
will install `dep1@0.4.1, because that is the highest-sorting
+version that satisfies
^0.4.0(
>= 0.4.0 <0.5.0`)
Updating Globally-Installed Packages
npm update -g
will apply the update
action to each globally installed
package that is outdated
-- that is, has a version that is different from
@@ -118,5 +104,5 @@
SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-version.html b/deps/npm/html/doc/cli/npm-version.html
index e8da71b67a0938..3349206a768b40 100644
--- a/deps/npm/html/doc/cli/npm-version.html
+++ b/deps/npm/html/doc/cli/npm-version.html
@@ -18,7 +18,7 @@ SYNOPSIS
'npm ls' to inspect current package/dependency versions
DESCRIPTION
Run this in a package directory to bump the version and write the new
-data back to package.json
and, if present, npm-shrinkwrap.json
.
+data back to package.json
, package-lock.json
, and, if present, npm-shrinkwrap.json
.
The newversion
argument should be a valid semver string, a
valid second argument to semver.inc (one of patch
, minor
, major
,
prepatch
, preminor
, premajor
, prerelease
), or from-git
. In the second case,
@@ -120,5 +120,5 @@
SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-view.html b/deps/npm/html/doc/cli/npm-view.html
index a94ea56271e91e..bde97a8e15f784 100644
--- a/deps/npm/html/doc/cli/npm-view.html
+++ b/deps/npm/html/doc/cli/npm-view.html
@@ -86,5 +86,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm-whoami.html b/deps/npm/html/doc/cli/npm-whoami.html
index 5995b1e11c572f..3fe3ff115c6a84 100644
--- a/deps/npm/html/doc/cli/npm-whoami.html
+++ b/deps/npm/html/doc/cli/npm-whoami.html
@@ -33,5 +33,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/cli/npm.html b/deps/npm/html/doc/cli/npm.html
index 52f4a22544f00e..50114e79e7dfc8 100644
--- a/deps/npm/html/doc/cli/npm.html
+++ b/deps/npm/html/doc/cli/npm.html
@@ -13,7 +13,7 @@ npm
javascript package manager
SYNOPSIS
npm <command> [args]
VERSION
-5.6.0
+6.1.0
DESCRIPTION
npm is the package manager for the Node JavaScript platform. It puts
modules in place so that node can find them, and manages dependency
@@ -79,7 +79,7 @@
CONFIGURATION
- Command line switches:
Set a config with --key val
. All keys take a value, even if they
are booleans (the config parser doesn't know what the options are at
-the time of parsing.) If no value is provided, then the option is set
+the time of parsing). If no value is provided, then the option is set
to boolean true
.
- Environment Variables:
Set any config by prefixing the name in an environment variable with
npm_config_
. For example, export npm_config_key=val
.
@@ -126,7 +126,7 @@ AUTHOR
Isaac Z. Schlueter ::
isaacs ::
@izs ::
-i@izs.me
+i@izs.me
SEE ALSO
- npm-help(1)
@@ -150,5 +150,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/files/npm-folders.html b/deps/npm/html/doc/files/npm-folders.html
index ff8a247b5a8fbc..0f85f255b20330 100644
--- a/deps/npm/html/doc/files/npm-folders.html
+++ b/deps/npm/html/doc/files/npm-folders.html
@@ -58,7 +58,7 @@ Man Pages
Man pages are not installed on Windows systems.
Cache
See npm-cache(1)
. Cache files are stored in ~/.npm
on Posix, or
-~/npm-cache
on Windows.
+%AppData%/npm-cache
on Windows.
This is controlled by the cache
configuration param.
Temp Files
Temporary files are stored by default in the folder specified by the
@@ -135,15 +135,15 @@
Example
`-- baz (1.2.3) <---[D]
`-- node_modules
`-- quux (3.2.0) <---[E]
-Since foo depends directly on bar@1.2.3
and baz@1.2.3
, those are
-installed in foo's node_modules
folder.
+Since foo depends directly on `bar@1.2.3and
baz@1.2.3, those are
+installed in foo's
node_modules` folder.
Even though the latest copy of blerg is 1.3.7, foo has a specific
dependency on version 1.2.5. So, that gets installed at [A]. Since the
-parent installation of blerg satisfies bar's dependency on blerg@1.x
,
+parent installation of blerg satisfies bar's dependency on `blerg@1.x`,
it does not install another copy under [B].
Bar [B] also has dependencies on baz and asdf, so those are installed in
-bar's node_modules
folder. Because it depends on baz@2.x
, it cannot
-re-use the baz@1.2.3
installed in the parent node_modules
folder [D],
+bar's node_modules
folder. Because it depends on `baz@2.x, it cannot
+re-use the
baz@1.2.3installed in the parent
node_modules` folder [D],
and must install its own copy [C].
Underneath bar, the baz -> quux -> bar
dependency creates a cycle.
However, because bar is already in quux's ancestry [B], it does not
@@ -181,5 +181,5 @@
SEE ALSO
-
+
diff --git a/deps/npm/html/doc/files/npm-global.html b/deps/npm/html/doc/files/npm-global.html
index ff8a247b5a8fbc..0f85f255b20330 100644
--- a/deps/npm/html/doc/files/npm-global.html
+++ b/deps/npm/html/doc/files/npm-global.html
@@ -58,7 +58,7 @@ Man Pages
Man pages are not installed on Windows systems.
Cache
See npm-cache(1)
. Cache files are stored in ~/.npm
on Posix, or
-~/npm-cache
on Windows.
+%AppData%/npm-cache
on Windows.
This is controlled by the cache
configuration param.
Temp Files
Temporary files are stored by default in the folder specified by the
@@ -135,15 +135,15 @@
Example
`-- baz (1.2.3) <---[D]
`-- node_modules
`-- quux (3.2.0) <---[E]
-Since foo depends directly on bar@1.2.3
and baz@1.2.3
, those are
-installed in foo's node_modules
folder.
+Since foo depends directly on `bar@1.2.3and
baz@1.2.3, those are
+installed in foo's
node_modules` folder.
Even though the latest copy of blerg is 1.3.7, foo has a specific
dependency on version 1.2.5. So, that gets installed at [A]. Since the
-parent installation of blerg satisfies bar's dependency on blerg@1.x
,
+parent installation of blerg satisfies bar's dependency on `blerg@1.x`,
it does not install another copy under [B].
Bar [B] also has dependencies on baz and asdf, so those are installed in
-bar's node_modules
folder. Because it depends on baz@2.x
, it cannot
-re-use the baz@1.2.3
installed in the parent node_modules
folder [D],
+bar's node_modules
folder. Because it depends on `baz@2.x, it cannot
+re-use the
baz@1.2.3installed in the parent
node_modules` folder [D],
and must install its own copy [C].
Underneath bar, the baz -> quux -> bar
dependency creates a cycle.
However, because bar is already in quux's ancestry [B], it does not
@@ -181,5 +181,5 @@
SEE ALSO
-
+
diff --git a/deps/npm/html/doc/files/npm-json.html b/deps/npm/html/doc/files/npm-json.html
index 3a6e77c9812970..42e47069f2766f 100644
--- a/deps/npm/html/doc/files/npm-json.html
+++ b/deps/npm/html/doc/files/npm-json.html
@@ -16,11 +16,11 @@ DESCRIPTION
A lot of the behavior described in this document is affected by the config
settings described in npm-config(7)
.
name
-The most important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
+If you plan to publish your package, the most important things in your
+package.json are the name and version fields as they will be required. The name
+and version together form an identifier that is assumed to be completely unique.
+Changes to the package should come along with changes to the version. If you don't
+plan to publish your package, the name and version fields are optional.
The name is what your thing is called.
Some rules:
@@ -45,11 +45,11 @@ name
A name can be optionally prefixed by a scope, e.g. @myorg/mypackage
. See
npm-scope(7)
for more detail.
version
-The most important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
+If you plan to publish your package, the most important things in your
+package.json are the name and version fields as they will be required. The name
+and version together form an identifier that is assumed to be completely unique.
+Changes to the package should come along with changes to the version. If you don't
+plan to publish your package, the name and version fields are optional.
Version must be parseable by
node-semver, which is bundled
with npm as a dependency. (npm install semver
to use it yourself.)
@@ -62,7 +62,9 @@ keywords
discover your package as it's listed in npm search
.
homepage
The url to the project homepage.
-bugs
+Example:
+
"homepage": "https://github.com/owner/project#readme"
+
bugs
The url to your project's issue tracker and / or the email address to which
issues should be reported. These are helpful for people who encounter issues
with your package.
@@ -129,13 +131,14 @@ people fields: author, contributors
Both email and url are optional either way.
npm also sets a top-level "maintainers" field with your npm user info.
files
-The optional "files" field is an array of file patterns that describes
+
The optional files
field is an array of file patterns that describes
the entries to be included when your package is installed as a
-dependency. If the files array is omitted, everything except
-automatically-excluded files will be included in your publish. If you
-name a folder in the array, then it will also include the files inside
-that folder (unless they would be ignored by another rule in this
-section.).
+dependency. File patterns follow a similar syntax to .gitignore
, but
+reversed: including a file, directory, or glob pattern (*
, **/*
, and such)
+will make it so that file is included in the tarball when it's packed. Omitting
+the field will make it default to ["*"]
, which means it will include all files.
+Some special files and directories are also included or excluded regardless of
+whether they exist in the files
array (see below).
You can also provide a .npmignore
file in the root of your package or
in subdirectories, which will keep files from being included. At the
root of your package it will not override the "files" field, but in
@@ -179,6 +182,10 @@
main
This should be a module ID relative to the root of your package folder.
For most modules, it makes the most sense to have a main script and often not
much else.
+browser
+If your module is meant to be used client-side the browser field should be
+used instead of the main field. This is helpful to hint users that it might
+rely on primitives that aren't available in Node.js modules. (e.g. window
)
bin
A lot of packages have one or more executable files that they'd like to
install into the PATH. npm makes this pretty easy (in fact, it uses this
@@ -557,8 +564,8 @@
publishConfig
especially handy if you want to set the tag, registry or access, so that
you can ensure that a given package is not tagged with "latest", published
to the global public registry or that a scoped module is private by default.
-Any config values can be overridden, but of course only "tag", "registry" and
-"access" probably matter for the purposes of publishing.
+Any config values can be overridden, but only "tag", "registry" and "access"
+probably matter for the purposes of publishing.
See npm-config(7)
to see the list of config options that can be
overridden.
DEFAULT VALUES
@@ -603,5 +610,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/files/npm-package-locks.html b/deps/npm/html/doc/files/npm-package-locks.html
index 775c6b4ca2a0de..fe9115c14a61e4 100644
--- a/deps/npm/html/doc/files/npm-package-locks.html
+++ b/deps/npm/html/doc/files/npm-package-locks.html
@@ -53,7 +53,7 @@ DESCRIPTION
A@0.1.0
`-- B@0.0.1
`-- C@0.0.1
-
However, if B@0.0.2 is published, then a fresh npm install A
will
+
However, if B@0.0.2 is published, then a fresh npm install A
will
install:
A@0.1.0
`-- B@0.0.2
@@ -61,7 +61,7 @@ DESCRIPTION
assuming the new version did not modify B's dependencies. Of course,
the new version of B could include a new version of C and any number
of new dependencies. If such changes are undesirable, the author of A
-could specify a dependency on B@0.0.1. However, if A's author and B's
+could specify a dependency on B@0.0.1. However, if A's author and B's
author are not the same person, there's no way for A's author to say
that he or she does not want to pull in newly published versions of C
when B hasn't changed at all.
@@ -125,6 +125,19 @@ DESCRIPTION
on. Additionally, the diffs from these changes are human-readable and will
inform you of any changes npm has made to your node_modules
, so you can notice
if any transitive dependencies were updated, hoisted, etc.
+Resolving lockfile conflicts
+Occasionally, two separate npm install will create package locks that cause
+merge conflicts in source control systems. As of `npm@5.7.0, these conflicts
+can be resolved by manually fixing any
package.jsonconflicts, and then
+running
npm install [--package-lock-only]again. npm will automatically
+resolve any conflicts for you and write a merged package lock that includes all
+the dependencies from both branches in a reasonable tree. If
--package-lock-onlyis provided, it will do this without also modifying your
+local
node_modules/`.
+To make this process seamless on git, consider installing
+npm-merge-driver
, which will teach git how
+to do this itself without any user interaction. In short: $ npx
+npm-merge-driver install -g
will let you do this, and even works with
+pre-`npm@5.7.0versions of npm 5, albeit a bit more noisily. Note that if
package.jsonitself conflicts, you will have to resolve that by hand and run
npm install` manually, even with the merge driver.
SEE ALSO
- https://medium.com/@sdboyer/so-you-want-to-write-a-package-manager-4ae9c17d9527
@@ -145,4 +158,4 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/files/npm-shrinkwrap.json.html b/deps/npm/html/doc/files/npm-shrinkwrap.json.html
index 50718ad9fd5795..1fca199c38e5cd 100644
--- a/deps/npm/html/doc/files/npm-shrinkwrap.json.html
+++ b/deps/npm/html/doc/files/npm-shrinkwrap.json.html
@@ -42,4 +42,4 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/files/npmrc.html b/deps/npm/html/doc/files/npmrc.html
index 7441c92b7eda28..e821a43090b3de 100644
--- a/deps/npm/html/doc/files/npmrc.html
+++ b/deps/npm/html/doc/files/npmrc.html
@@ -85,5 +85,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/files/package-lock.json.html b/deps/npm/html/doc/files/package-lock.json.html
index 3f6a2e21f56d12..fcce7979d703a3 100644
--- a/deps/npm/html/doc/files/package-lock.json.html
+++ b/deps/npm/html/doc/files/package-lock.json.html
@@ -103,12 +103,18 @@ optional
transitive dependency of a non-optional dependency of the top level.
All optional dependencies should be included even if they're uninstallable
on the current platform.
+requires
+This is a mapping of module name to version. This is a list of everything
+this module requires, regardless of where it will be installed. The version
+should match via normal matching rules a dependency either in our
+dependencies
or in a level higher than us.
dependencies
The dependencies of this dependency, exactly as at the top level.
SEE ALSO
@@ -124,4 +130,4 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/files/package.json.html b/deps/npm/html/doc/files/package.json.html
index 3a6e77c9812970..42e47069f2766f 100644
--- a/deps/npm/html/doc/files/package.json.html
+++ b/deps/npm/html/doc/files/package.json.html
@@ -16,11 +16,11 @@ DESCRIPTION
A lot of the behavior described in this document is affected by the config
settings described in npm-config(7)
.
name
-The most important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
+If you plan to publish your package, the most important things in your
+package.json are the name and version fields as they will be required. The name
+and version together form an identifier that is assumed to be completely unique.
+Changes to the package should come along with changes to the version. If you don't
+plan to publish your package, the name and version fields are optional.
The name is what your thing is called.
Some rules:
@@ -45,11 +45,11 @@ name
A name can be optionally prefixed by a scope, e.g. @myorg/mypackage
. See
npm-scope(7)
for more detail.
version
-The most important things in your package.json are the name and version fields.
-Those are actually required, and your package won't install without
-them. The name and version together form an identifier that is assumed
-to be completely unique. Changes to the package should come along with
-changes to the version.
+If you plan to publish your package, the most important things in your
+package.json are the name and version fields as they will be required. The name
+and version together form an identifier that is assumed to be completely unique.
+Changes to the package should come along with changes to the version. If you don't
+plan to publish your package, the name and version fields are optional.
Version must be parseable by
node-semver, which is bundled
with npm as a dependency. (npm install semver
to use it yourself.)
@@ -62,7 +62,9 @@ keywords
discover your package as it's listed in npm search
.
homepage
The url to the project homepage.
-bugs
+Example:
+
"homepage": "https://github.com/owner/project#readme"
+
bugs
The url to your project's issue tracker and / or the email address to which
issues should be reported. These are helpful for people who encounter issues
with your package.
@@ -129,13 +131,14 @@ people fields: author, contributors
Both email and url are optional either way.
npm also sets a top-level "maintainers" field with your npm user info.
files
-The optional "files" field is an array of file patterns that describes
+
The optional files
field is an array of file patterns that describes
the entries to be included when your package is installed as a
-dependency. If the files array is omitted, everything except
-automatically-excluded files will be included in your publish. If you
-name a folder in the array, then it will also include the files inside
-that folder (unless they would be ignored by another rule in this
-section.).
+dependency. File patterns follow a similar syntax to .gitignore
, but
+reversed: including a file, directory, or glob pattern (*
, **/*
, and such)
+will make it so that file is included in the tarball when it's packed. Omitting
+the field will make it default to ["*"]
, which means it will include all files.
+Some special files and directories are also included or excluded regardless of
+whether they exist in the files
array (see below).
You can also provide a .npmignore
file in the root of your package or
in subdirectories, which will keep files from being included. At the
root of your package it will not override the "files" field, but in
@@ -179,6 +182,10 @@
main
This should be a module ID relative to the root of your package folder.
For most modules, it makes the most sense to have a main script and often not
much else.
+browser
+If your module is meant to be used client-side the browser field should be
+used instead of the main field. This is helpful to hint users that it might
+rely on primitives that aren't available in Node.js modules. (e.g. window
)
bin
A lot of packages have one or more executable files that they'd like to
install into the PATH. npm makes this pretty easy (in fact, it uses this
@@ -557,8 +564,8 @@
publishConfig
especially handy if you want to set the tag, registry or access, so that
you can ensure that a given package is not tagged with "latest", published
to the global public registry or that a scoped module is private by default.
-Any config values can be overridden, but of course only "tag", "registry" and
-"access" probably matter for the purposes of publishing.
+Any config values can be overridden, but only "tag", "registry" and "access"
+probably matter for the purposes of publishing.
See npm-config(7)
to see the list of config options that can be
overridden.
DEFAULT VALUES
@@ -603,5 +610,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/index.html b/deps/npm/html/doc/index.html
index 914307420c84d5..7a0db0c538dd17 100644
--- a/deps/npm/html/doc/index.html
+++ b/deps/npm/html/doc/index.html
@@ -20,6 +20,8 @@ npm-access(1)
Set access level on published packages
npm-adduser(1)
Add a registry user account
+npm-audit(1)
+Run a security audit
npm-bin(1)
Display npm bin folder
npm-bugs(1)
@@ -30,6 +32,8 @@ npm-bundle(1)
REMOVED
npm-cache(1)
Manipulates packages cache
+npm-ci(1)
+Install a project with a clean slate
npm-completion(1)
Tab Completion for npm
npm-config(1)
@@ -52,8 +56,12 @@ npm-help-search(1
Search npm help documentation
npm-help(1)
Get help on npm
+npm-hook(1)
+Manage registry hooks
npm-init(1)
-Interactively create a package.json file
+create a package.json file
+npm-install-ci-test(1)
+Install a project with a clean slate and run tests
npm-install-test(1)
Install package(s) and run tests
npm-install(1)
@@ -172,5 +180,5 @@ semver(7)
-
+
diff --git a/deps/npm/html/doc/misc/npm-coding-style.html b/deps/npm/html/doc/misc/npm-coding-style.html
index f96dd270bfa7ff..204556e25a7640 100644
--- a/deps/npm/html/doc/misc/npm-coding-style.html
+++ b/deps/npm/html/doc/misc/npm-coding-style.html
@@ -91,7 +91,7 @@ Comma First
var ok = 'String contains "double" quotes'
var alsoOk = "String contains 'single' quotes or apostrophe"
Whitespace
-Put a single space in front of ( for anything other than a function call.
+
Put a single space in front of (
for anything other than a function call.
Also use a single space wherever it makes things more readable.
Don't leave trailing whitespace at the end of lines. Don't indent empty
lines. Don't use more spaces than are helpful.
@@ -153,5 +153,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/misc/npm-config.html b/deps/npm/html/doc/misc/npm-config.html
index a23b10727af0f7..0abd19a970d88a 100644
--- a/deps/npm/html/doc/misc/npm-config.html
+++ b/deps/npm/html/doc/misc/npm-config.html
@@ -134,6 +134,14 @@ also
When "dev" or "development" and running local npm shrinkwrap
,
npm outdated
, or npm update
, is an alias for --dev
.
+audit
+
+- Default: true
+- Type: Boolean
+
+When "true" submit audit reports alongside npm install
runs to the default
+registry and all registries configured for scopes. See the documentation
+for npm-audit(1) for details on what is submitted.
auth-type
- Default:
'legacy'
@@ -239,6 +247,8 @@ color
If false, never shows colors. If "always"
then always shows colors.
If true, then only prints color codes for tty file descriptors.
+This option can also be changed using the environment: colors are
+disabled when the environment variable NO_COLOR
is set to any value.
depth
- Default: Infinity
@@ -560,7 +570,7 @@ message
Any "%s" in the message will be replaced with the version number.
metrics-registry
-- Default: The value of
registry
(which defaults to "https://registry.npmjs.org/")
+- Default: The value of
registry
(which defaults to "https://registry.npmjs.org/")
- Type: String
The registry you want to send cli metrics to if send-metrics
is true.
@@ -578,6 +588,12 @@ node-version
- Type: semver or false
The node version to use when checking a package's engines
map.
+no-proxy
+
+- Default: null
+- Type: String or Array
+
+A comma-separated string or an array of domain extensions that a proxy should not be used for.
offline
- Default: false
@@ -628,13 +644,16 @@ package-lock
If set to false, then ignore package-lock.json
files when installing. This
will also prevent writing package-lock.json
if save
is true.
+When package package-locks are disabled, automatic pruning of extraneous
+modules will also be disabled. To remove extraneous modules with
+package-locks disabled use npm prune
.
This option is an alias for --shrinkwrap
.
package-lock-only
- Default: false
- Type: Boolean
-If set to true, it will update only the package-json
,
+
If set to true, it will update only the package-lock.json
,
instead of checking node_modules
and downloading dependencies.
parseable
@@ -718,7 +737,7 @@ rollback
Remove failed installs.
save
-- Default: false
+- Default: true
- Type: Boolean
Save installed packages to a package.json file as dependencies.
@@ -1024,5 +1043,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/misc/npm-developers.html b/deps/npm/html/doc/misc/npm-developers.html
index bdf212ed4b1859..526bcc6d34586a 100644
--- a/deps/npm/html/doc/misc/npm-developers.html
+++ b/deps/npm/html/doc/misc/npm-developers.html
@@ -20,7 +20,7 @@ About These Documents
These are man pages. If you install npm, you should be able to
then do man npm-thing
to get the documentation on a particular
topic, or npm help thing
to see the same information.
-What is a package
+What is a package
A package is:
- a) a folder containing a program described by a package.json file
@@ -53,7 +53,7 @@ The package.json File
use the name to specify that it runs on node, or is in JavaScript.
You can use the "engines" field to explicitly state the versions of
node (or whatever else) that your program requires, and it's pretty
-well assumed that it's javascript.
+well assumed that it's JavaScript.
It does not necessarily need to match your github repository name.
So, node-foo
and bar-js
are bad names. foo
or bar
are better.
@@ -204,5 +204,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/misc/npm-disputes.html b/deps/npm/html/doc/misc/npm-disputes.html
index fdf53fcad0c460..543a60197928cb 100644
--- a/deps/npm/html/doc/misc/npm-disputes.html
+++ b/deps/npm/html/doc/misc/npm-disputes.html
@@ -20,7 +20,7 @@ npm-disputes
Handling Module
TL;DR
- Get the author email with
npm owner ls <pkgname>
-- Email the author, CC support@npmjs.com
+- Email the author, CC support@npmjs.com
- After a few weeks, if there's no resolution, we'll sort it out.
Don't squat on package names. Publish code or move out of the way.
@@ -44,7 +44,7 @@ DESCRIPTION
really has to be updated. Alice works for Foo Inc, the makers of the
critically acclaimed and widely-marketed foo
JavaScript toolkit framework.
They publish it to npm as foojs
, but people are routinely confused when
-npm install
foo`` is some different thing.
+npm install
foo
is some different thing.
Yusuf writes a parser for the widely-known foo
file format, because he
needs it for work. Then, he gets a new job, and never updates the prototype.
Later on, Alice writes a much more complete foo
parser, but can't publish,
@@ -55,12 +55,12 @@
DESCRIPTION
- Alice emails Yusuf, explaining the situation as respectfully as possible,
and what she would like to do with the module name. She adds the npm support
-staff support@npmjs.com to the CC list of the email. Mention in the email
+staff support@npmjs.com to the CC list of the email. Mention in the email
that Yusuf can run npm owner
add alice foo
to add Alice as an owner of the
foo package.
- After a reasonable amount of time, if Yusuf has not responded, or if Yusuf
and Alice can't come to any sort of resolution, email support
-support@npmjs.com and we'll sort it out. ("Reasonable" is usually at least
+support@npmjs.com and we'll sort it out. ("Reasonable" is usually at least
4 weeks.)
REASONING
@@ -96,12 +96,12 @@ EXCEPTIONS
Code of Conduct such as hateful
language, pornographic content, or harassment.
-If you see bad behavior like this, please report it to abuse@npmjs.com right
+
If you see bad behavior like this, please report it to abuse@npmjs.com right
away. You are never expected to resolve abusive behavior on your own. We are
here to help.
TRADEMARKS
If you think another npm publisher is infringing your trademark, such as by
-using a confusingly similar package name, email abuse@npmjs.com with a link to
+using a confusingly similar package name, email abuse@npmjs.com with a link to
the package or user account on https://npmjs.com. Attach a
copy of your trademark registration certificate.
If we see that the package's publisher is intentionally misleading others by
@@ -134,5 +134,5 @@
SEE ALSO
-
+
diff --git a/deps/npm/html/doc/misc/npm-index.html b/deps/npm/html/doc/misc/npm-index.html
index 927748e176c958..d3c382a2034e2d 100644
--- a/deps/npm/html/doc/misc/npm-index.html
+++ b/deps/npm/html/doc/misc/npm-index.html
@@ -20,6 +20,8 @@ npm-access(1)
Set access level on published packages
npm-adduser(1)
Add a registry user account
+npm-audit(1)
+Run a security audit
npm-bin(1)
Display npm bin folder
npm-bugs(1)
@@ -30,6 +32,8 @@ npm-bundle(1)
REMOVED
npm-cache(1)
Manipulates packages cache
+npm-ci(1)
+Install a project with a clean slate
npm-completion(1)
Tab Completion for npm
npm-config(1)
@@ -52,8 +56,12 @@ npm-help-searc
Search npm help documentation
npm-help(1)
Get help on npm
+npm-hook(1)
+Manage registry hooks
npm-init(1)
-Interactively create a package.json file
+create a package.json file
+npm-install-ci-test(1)
+Install a project with a clean slate and run tests
npm-install-test(1)
Install package(s) and run tests
npm-install(1)
@@ -172,5 +180,5 @@ semver(7)
-
+
diff --git a/deps/npm/html/doc/misc/npm-orgs.html b/deps/npm/html/doc/misc/npm-orgs.html
index 5a11a10ca812a8..3ed6709f33f89e 100644
--- a/deps/npm/html/doc/misc/npm-orgs.html
+++ b/deps/npm/html/doc/misc/npm-orgs.html
@@ -86,5 +86,5 @@ Team Admins create teams
-
+
diff --git a/deps/npm/html/doc/misc/npm-registry.html b/deps/npm/html/doc/misc/npm-registry.html
index cfa610d0e8d481..f3f9704a874801 100644
--- a/deps/npm/html/doc/misc/npm-registry.html
+++ b/deps/npm/html/doc/misc/npm-registry.html
@@ -90,5 +90,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/misc/npm-scope.html b/deps/npm/html/doc/misc/npm-scope.html
index e610f3e9e36784..7c285406b22add 100644
--- a/deps/npm/html/doc/misc/npm-scope.html
+++ b/deps/npm/html/doc/misc/npm-scope.html
@@ -60,7 +60,7 @@ Publishin
to public
as if you had run npm access public
after publishing.
Publishing private scoped packages to the npm registry
To publish a private scoped package to the npm registry, you must have
-an npm Private Modules
+an npm Private Modules
account.
You can then publish the module with npm publish
or npm publish
--access restricted
, and it will be present in the npm registry, with
@@ -99,5 +99,5 @@
SEE ALSO
-
+
diff --git a/deps/npm/html/doc/misc/npm-scripts.html b/deps/npm/html/doc/misc/npm-scripts.html
index bc43c028f106ad..43b0ca63e0fde5 100644
--- a/deps/npm/html/doc/misc/npm-scripts.html
+++ b/deps/npm/html/doc/misc/npm-scripts.html
@@ -64,15 +64,15 @@ DESCRIPTION
-- npm run `.
PREPUBLISH AND PREPARE
DEPRECATION NOTE
-Since npm@1.1.71
, the npm CLI has run the prepublish
script for both npm
-publish
and npm install
, because it's a convenient way to prepare a package
+
Since `npm@1.1.71, the npm CLI has run the
prepublishscript for both
npm
+publishand
npm install, because it's a convenient way to prepare a package
for use (some common use cases are described in the section below). It has
-also turned out to be, in practice, very
-confusing. As of npm@4.0.0
, a new
-event has been introduced, prepare
, that preserves this existing behavior. A
-new event, prepublishOnly
has been added as a transitional strategy to
+also turned out to be, in practice, [very
+confusing](https://github.com/npm/npm/issues/10074). As of
npm@4.0.0, a new
+event has been introduced,
prepare, that preserves this existing behavior. A
+_new_ event,
prepublishOnlyhas been added as a transitional strategy to
allow users to avoid the confusing behavior of existing npm versions and only
-run on npm publish
(for instance, running the tests one last time to ensure
+run on
npm publish` (for instance, running the tests one last time to ensure
they're in good shape).
See https://github.com/npm/npm/issues/10074 for a much lengthier
justification, with further reading, for this change.
@@ -239,5 +239,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/misc/removing-npm.html b/deps/npm/html/doc/misc/removing-npm.html
index 1727455c627b47..15077119ab9a69 100644
--- a/deps/npm/html/doc/misc/removing-npm.html
+++ b/deps/npm/html/doc/misc/removing-npm.html
@@ -57,5 +57,5 @@ SEE ALSO
-
+
diff --git a/deps/npm/html/doc/misc/semver.html b/deps/npm/html/doc/misc/semver.html
index afe72d3099907b..b3a69fbce33366 100644
--- a/deps/npm/html/doc/misc/semver.html
+++ b/deps/npm/html/doc/misc/semver.html
@@ -24,6 +24,8 @@ Usage
semver.satisfies('1.2.3', '1.x || >=2.5.0 || 5.0.0 - 7.2.3') // true
semver.gt('1.2.3', '9.8.7') // false
semver.lt('1.2.3', '9.8.7') // true
+semver.valid(semver.coerce('v2')) // '2.0.0'
+semver.valid(semver.coerce('42.6.7.9.3-alpha')) // '42.6.7'
As a command-line utility:
$ semver -h
@@ -53,6 +55,10 @@ Usage
-l --loose
Interpret versions and ranges loosely
+-c --coerce
+ Coerce a string into SemVer if possible
+ (does not imply --loose)
+
Program exits successfully if any valid version satisfies
all supplied ranges, and prints all satisfying versions.
@@ -133,7 +139,7 @@ Advanced Range Syntax
deterministic ways.
Advanced ranges may be combined in the same way as primitive
comparators using white space or ||
.
-Hyphen Ranges X.Y.Z - A.B.C
+Hyphen Ranges X.Y.Z - A.B.C
Specifies an inclusive set.
1.2.3 - 2.3.4
:= >=1.2.3 <=2.3.4
@@ -166,7 +172,7 @@ X-Ranges 1.2.x
1.X
1
:= 1.x.x
:= >=1.0.0 <2.0.0
1.2
:= 1.2.x
:= >=1.2.0 <1.3.0
-Tilde Ranges ~1.2.3
~1.2
~1
+Tilde Ranges ~1.2.3
~1.2
~1
Allows patch-level changes if a minor version is specified on the
comparator. Allows minor-level changes if not.
@@ -182,7 +188,7 @@ Tilde Ranges ~1.2.3
~1.2
1.2.4-beta.2
would not, because it is a prerelease of a
different [major, minor, patch]
tuple.
-Caret Ranges ^1.2.3
^0.2.5
^0.0.4
+Caret Ranges ^1.2.3
^0.2.5
^0.0.4
Allows changes that do not modify the left-most non-zero digit in the
[major, minor, patch]
tuple. In other words, this allows patch and
minor updates for versions 1.0.0
and above, patch updates for
@@ -324,6 +330,21 @@
Ranges
satisfy the range.
If you want to know if a version satisfies or does not satisfy a
range, use the satisfies(version, range)
function.
+Coercion
+
+coerce(version)
: Coerces a string to semver if possible
+
+This aims to provide a very forgiving translation of a non-semver
+string to semver. It looks for the first digit in a string, and
+consumes all remaining characters which satisfy at least a partial semver
+(e.g., 1
, 1.2
, 1.2.3
) up to the max permitted length (256 characters).
+Longer versions are simply truncated (4.6.3.9.2-alpha2
becomes 4.6.3
).
+All surrounding text is simply ignored (v3.4 replaces v3.3.1
becomes 3.4.0
).
+Only text which lacks digits will fail coercion (version one
is not valid).
+The maximum length for any semver component considered for coercion is 16 characters;
+longer components will be ignored (10000000000000000.4.7.4
becomes 4.7.4
).
+The maximum value for any semver component is Integer.MAX_SAFE_INTEGER || (2**53 - 1)
;
+higher value components are invalid (9999999999999999.4.7.4
is likely invalid).
@@ -336,5 +357,5 @@ Ranges
-
+
diff --git a/deps/npm/lib/access.js b/deps/npm/lib/access.js
index ad7a1f54bd34a1..164ea3b7d741a1 100644
--- a/deps/npm/lib/access.js
+++ b/deps/npm/lib/access.js
@@ -1,4 +1,5 @@
'use strict'
+/* eslint-disable standard/no-callback-literal */
var resolve = require('path').resolve
@@ -21,7 +22,7 @@ access.usage =
'npm access edit []'
access.subcommands = ['public', 'restricted', 'grant', 'revoke',
- 'ls-packages', 'ls-collaborators', 'edit']
+ 'ls-packages', 'ls-collaborators', 'edit']
access.completion = function (opts, cb) {
var argv = opts.conf.argv.remain
diff --git a/deps/npm/lib/adduser.js b/deps/npm/lib/adduser.js
index 0aac6b7fbb4330..e1c221032568d6 100644
--- a/deps/npm/lib/adduser.js
+++ b/deps/npm/lib/adduser.js
@@ -17,7 +17,7 @@ adduser.usage = usage(
function adduser (args, cb) {
if (!crypto) {
return cb(new Error(
- 'You must compile node with ssl support to use the adduser feature'
+ 'You must compile node with ssl support to use the adduser feature'
))
}
diff --git a/deps/npm/lib/audit.js b/deps/npm/lib/audit.js
new file mode 100644
index 00000000000000..18add4c646922f
--- /dev/null
+++ b/deps/npm/lib/audit.js
@@ -0,0 +1,264 @@
+'use strict'
+
+const Bluebird = require('bluebird')
+
+const audit = require('./install/audit.js')
+const fs = require('graceful-fs')
+const Installer = require('./install.js').Installer
+const lockVerify = require('lock-verify')
+const log = require('npmlog')
+const npa = require('npm-package-arg')
+const npm = require('./npm.js')
+const output = require('./utils/output.js')
+const parseJson = require('json-parse-better-errors')
+
+const readFile = Bluebird.promisify(fs.readFile)
+
+module.exports = auditCmd
+
+auditCmd.usage =
+ 'npm audit\n' +
+ 'npm audit fix\n'
+
+auditCmd.completion = function (opts, cb) {
+ const argv = opts.conf.argv.remain
+
+ switch (argv[2]) {
+ case 'audit':
+ return cb(null, [])
+ default:
+ return cb(new Error(argv[2] + ' not recognized'))
+ }
+}
+
+class Auditor extends Installer {
+ constructor (where, dryrun, args, opts) {
+ super(where, dryrun, args, opts)
+ this.deepArgs = (opts && opts.deepArgs) || []
+ this.runId = opts.runId || ''
+ this.audit = false
+ }
+
+ loadAllDepsIntoIdealTree (cb) {
+ Bluebird.fromNode(cb => super.loadAllDepsIntoIdealTree(cb)).then(() => {
+ if (this.deepArgs && this.deepArgs.length) {
+ this.deepArgs.forEach(arg => {
+ arg.reduce((acc, child, ii) => {
+ if (!acc) {
+ // We might not always be able to find `target` through the given
+ // path. If we can't we'll just ignore it.
+ return
+ }
+ const spec = npa(child)
+ const target = (
+ acc.requires.find(n => n.package.name === spec.name) ||
+ acc.requires.find(
+ n => audit.scrub(n.package.name, this.runId) === spec.name
+ )
+ )
+ if (target && ii === arg.length - 1) {
+ target.loaded = false
+ // This kills `hasModernMeta()` and forces a re-fetch
+ target.package = {
+ name: spec.name,
+ version: spec.fetchSpec,
+ _requested: target.package._requested
+ }
+ delete target.fakeChild
+ let parent = target.parent
+ while (parent) {
+ parent.loaded = false
+ parent = parent.parent
+ }
+ target.requiredBy.forEach(par => {
+ par.loaded = false
+ delete par.fakeChild
+ })
+ }
+ return target
+ }, this.idealTree)
+ })
+ return Bluebird.fromNode(cb => super.loadAllDepsIntoIdealTree(cb))
+ }
+ }).nodeify(cb)
+ }
+
+ // no top level lifecycles on audit
+ runPreinstallTopLevelLifecycles (cb) { cb() }
+ runPostinstallTopLevelLifecycles (cb) { cb() }
+}
+
+function maybeReadFile (name) {
+ const file = `${npm.prefix}/${name}`
+ return readFile(file)
+ .then((data) => {
+ try {
+ return parseJson(data)
+ } catch (ex) {
+ ex.code = 'EJSONPARSE'
+ throw ex
+ }
+ })
+ .catch({code: 'ENOENT'}, () => null)
+ .catch(ex => {
+ ex.file = file
+ throw ex
+ })
+}
+
+function filterEnv (action) {
+ const includeDev = npm.config.get('dev') ||
+ (!/^prod(uction)?$/.test(npm.config.get('only')) && !npm.config.get('production')) ||
+ /^dev(elopment)?$/.test(npm.config.get('only')) ||
+ /^dev(elopment)?$/.test(npm.config.get('also'))
+ const includeProd = !/^dev(elopment)?$/.test(npm.config.get('only'))
+ const resolves = action.resolves.filter(({dev}) => {
+ return (dev && includeDev) || (!dev && includeProd)
+ })
+ if (resolves.length) {
+ return Object.assign({}, action, {resolves})
+ }
+}
+
+function auditCmd (args, cb) {
+ if (npm.config.get('global')) {
+ const err = new Error('`npm audit` does not support testing globals')
+ err.code = 'EAUDITGLOBAL'
+ throw err
+ }
+ if (args.length && args[0] !== 'fix') {
+ return cb(new Error('Invalid audit subcommand: `' + args[0] + '`\n\nUsage:\n' + auditCmd.usage))
+ }
+ return Bluebird.all([
+ maybeReadFile('npm-shrinkwrap.json'),
+ maybeReadFile('package-lock.json'),
+ maybeReadFile('package.json')
+ ]).spread((shrinkwrap, lockfile, pkgJson) => {
+ const sw = shrinkwrap || lockfile
+ if (!pkgJson) {
+ const err = new Error('No package.json found: Cannot audit a project without a package.json')
+ err.code = 'EAUDITNOPJSON'
+ throw err
+ }
+ if (!sw) {
+ const err = new Error('Neither npm-shrinkwrap.json nor package-lock.json found: Cannot audit a project without a lockfile')
+ err.code = 'EAUDITNOLOCK'
+ throw err
+ } else if (shrinkwrap && lockfile) {
+ log.warn('audit', 'Both npm-shrinkwrap.json and package-lock.json exist, using npm-shrinkwrap.json.')
+ }
+ const requires = Object.assign(
+ {},
+ (pkgJson && pkgJson.dependencies) || {},
+ (pkgJson && pkgJson.devDependencies) || {}
+ )
+ return lockVerify(npm.prefix).then(result => {
+ if (result.status) return audit.generate(sw, requires)
+
+ const lockFile = shrinkwrap ? 'npm-shrinkwrap.json' : 'package-lock.json'
+ const err = new Error(`Errors were found in your ${lockFile}, run npm install to fix them.\n ` +
+ result.errors.join('\n '))
+ err.code = 'ELOCKVERIFY'
+ throw err
+ })
+ }).then((auditReport) => {
+ return audit.submitForFullReport(auditReport)
+ }).catch(err => {
+ if (err.statusCode === 404 || err.statusCode >= 500) {
+ const ne = new Error(`Your configured registry (${npm.config.get('registry')}) does not support audit requests.`)
+ ne.code = 'ENOAUDIT'
+ ne.wrapped = err
+ throw ne
+ }
+ throw err
+ }).then((auditResult) => {
+ if (args[0] === 'fix') {
+ const actions = (auditResult.actions || []).reduce((acc, action) => {
+ action = filterEnv(action)
+ if (!action) { return acc }
+ if (action.isMajor) {
+ acc.major.add(`${action.module}@${action.target}`)
+ action.resolves.forEach(({id, path}) => acc.majorFixes.add(`${id}::${path}`))
+ } else if (action.action === 'install') {
+ acc.install.add(`${action.module}@${action.target}`)
+ action.resolves.forEach(({id, path}) => acc.installFixes.add(`${id}::${path}`))
+ } else if (action.action === 'update') {
+ const name = action.module
+ const version = action.target
+ action.resolves.forEach(vuln => {
+ acc.updateFixes.add(`${vuln.id}::${vuln.path}`)
+ const modPath = vuln.path.split('>')
+ const newPath = modPath.slice(
+ 0, modPath.indexOf(name)
+ ).concat(`${name}@${version}`)
+ if (newPath.length === 1) {
+ acc.install.add(newPath[0])
+ } else {
+ acc.update.add(newPath.join('>'))
+ }
+ })
+ } else if (action.action === 'review') {
+ action.resolves.forEach(({id, path}) => acc.review.add(`${id}::${path}`))
+ }
+ return acc
+ }, {
+ install: new Set(),
+ installFixes: new Set(),
+ update: new Set(),
+ updateFixes: new Set(),
+ major: new Set(),
+ majorFixes: new Set(),
+ review: new Set()
+ })
+ return Bluebird.try(() => {
+ const installMajor = npm.config.get('force')
+ const installCount = actions.install.size + (installMajor ? actions.major.size : 0) + actions.update.size
+ const vulnFixCount = new Set([...actions.installFixes, ...actions.updateFixes, ...(installMajor ? actions.majorFixes : [])]).size
+ const metavuln = auditResult.metadata.vulnerabilities
+ const total = Object.keys(metavuln).reduce((acc, key) => acc + metavuln[key], 0)
+ if (installCount) {
+ log.verbose(
+ 'audit',
+ 'installing',
+ [...actions.install, ...(installMajor ? actions.major : []), ...actions.update]
+ )
+ }
+ return Bluebird.fromNode(cb => {
+ new Auditor(
+ npm.prefix,
+ !!npm.config.get('dry-run'),
+ [...actions.install, ...(installMajor ? actions.major : [])],
+ {
+ runId: auditResult.runId,
+ deepArgs: [...actions.update].map(u => u.split('>'))
+ }
+ ).run(cb)
+ }).then(() => {
+ const numScanned = auditResult.metadata.totalDependencies
+ if (!npm.config.get('json') && !npm.config.get('parseable')) {
+ output(`fixed ${vulnFixCount} of ${total} vulnerabilit${total === 1 ? 'y' : 'ies'} in ${numScanned} scanned package${numScanned === 1 ? '' : 's'}`)
+ if (actions.review.size) {
+ output(` ${actions.review.size} vulnerabilit${actions.review.size === 1 ? 'y' : 'ies'} required manual review and could not be updated`)
+ }
+ if (actions.major.size) {
+ output(` ${actions.major.size} package update${actions.major.size === 1 ? '' : 's'} for ${actions.majorFixes.size} vuln${actions.majorFixes.size === 1 ? '' : 's'} involved breaking changes`)
+ if (installMajor) {
+ output(' (installed due to `--force` option)')
+ } else {
+ output(' (use `npm audit fix --force` to install breaking changes; or do it by hand)')
+ }
+ }
+ }
+ })
+ })
+ } else {
+ const vulns =
+ auditResult.metadata.vulnerabilities.low +
+ auditResult.metadata.vulnerabilities.moderate +
+ auditResult.metadata.vulnerabilities.high +
+ auditResult.metadata.vulnerabilities.critical
+ if (vulns > 0) process.exitCode = 1
+ return audit.printFullReport(auditResult)
+ }
+ }).asCallback(cb)
+}
diff --git a/deps/npm/lib/auth/legacy.js b/deps/npm/lib/auth/legacy.js
index 92bf44c119af39..9aa36966250113 100644
--- a/deps/npm/lib/auth/legacy.js
+++ b/deps/npm/lib/auth/legacy.js
@@ -6,52 +6,74 @@ const npm = require('../npm.js')
const output = require('../utils/output.js')
const pacoteOpts = require('../config/pacote')
const fetchOpts = require('../config/fetch-opts')
+const openUrl = require('../utils/open-url')
-module.exports.login = function login (creds, registry, scope, cb) {
- let username = creds.username || ''
- let password = creds.password || ''
- let email = creds.email || ''
- const auth = {}
- if (npm.config.get('otp')) auth.otp = npm.config.get('otp')
+const openerPromise = (url) => new Promise((resolve, reject) => {
+ openUrl(url, 'to complete your login please visit', (er) => er ? reject(er) : resolve())
+})
- return read.username('Username:', username, {log: log}).then((u) => {
- username = u
- return read.password('Password: ', password)
+const loginPrompter = (creds) => {
+ const opts = { log: log }
+ return read.username('Username:', creds.username, opts).then((u) => {
+ creds.username = u
+ return read.password('Password:', creds.password)
}).then((p) => {
- password = p
- return read.email('Email: (this IS public) ', email, {log: log})
+ creds.password = p
+ return read.email('Email: (this IS public) ', creds.email, opts)
}).then((e) => {
- email = e
- return profile.login(username, password, {registry: registry, auth: auth}).catch((err) => {
+ creds.email = e
+ return creds
+ })
+}
+
+module.exports.login = (creds, registry, scope, cb) => {
+ const conf = {
+ log: log,
+ creds: creds,
+ registry: registry,
+ auth: {
+ otp: npm.config.get('otp')
+ },
+ scope: scope,
+ opts: fetchOpts.fromPacote(pacoteOpts())
+ }
+ login(conf).then((newCreds) => cb(null, newCreds)).catch(cb)
+}
+
+function login (conf) {
+ return profile.login(openerPromise, loginPrompter, conf)
+ .catch((err) => {
if (err.code === 'EOTP') throw err
- return profile.adduser(username, email, password, {
- registry: registry,
- opts: fetchOpts.fromPacote(pacoteOpts())
+ const u = conf.creds.username
+ const p = conf.creds.password
+ const e = conf.creds.email
+ if (!(u && p && e)) throw err
+ return profile.adduserCouch(u, e, p, conf)
+ })
+ .catch((err) => {
+ if (err.code !== 'EOTP') throw err
+ return read.otp('Authenticator provided OTP:').then((otp) => {
+ conf.auth.otp = otp
+ const u = conf.creds.username
+ const p = conf.creds.password
+ return profile.loginCouch(u, p, conf)
})
- }).catch((err) => {
- if (err.code === 'EOTP' && !auth.otp) {
- return read.otp('Authenticator provided OTP:').then((otp) => {
- auth.otp = otp
- return profile.login(username, password, {registry: registry, auth: auth})
- })
+ }).then((result) => {
+ const newCreds = {}
+ if (result && result.token) {
+ newCreds.token = result.token
} else {
- throw err
+ newCreds.username = conf.creds.username
+ newCreds.password = conf.creds.password
+ newCreds.email = conf.creds.email
+ newCreds.alwaysAuth = npm.config.get('always-auth')
}
- })
- }).then((result) => {
- const newCreds = {}
- if (result && result.token) {
- newCreds.token = result.token
- } else {
- newCreds.username = username
- newCreds.password = password
- newCreds.email = email
- newCreds.alwaysAuth = npm.config.get('always-auth')
- }
- log.info('adduser', 'Authorized user %s', username)
- const scopeMessage = scope ? ' to scope ' + scope : ''
- output('Logged in as %s%s on %s.', username, scopeMessage, registry)
- cb(null, newCreds)
- }).catch(cb)
+ const usermsg = conf.creds.username ? ' user ' + conf.creds.username : ''
+ conf.log.info('login', 'Authorized' + usermsg)
+ const scopeMessage = conf.scope ? ' to scope ' + conf.scope : ''
+ const userout = conf.creds.username ? ' as ' + conf.creds.username : ''
+ output('Logged in%s%s on %s.', userout, scopeMessage, conf.registry)
+ return newCreds
+ })
}
diff --git a/deps/npm/lib/auth/sso.js b/deps/npm/lib/auth/sso.js
index faffe2fa595033..519ca8496c74c2 100644
--- a/deps/npm/lib/auth/sso.js
+++ b/deps/npm/lib/auth/sso.js
@@ -1,7 +1,7 @@
var log = require('npmlog')
var npm = require('../npm.js')
var output = require('../utils/output')
-var opener = require('opener')
+var openUrl = require('../utils/open-url')
module.exports.login = function login (creds, registry, scope, cb) {
var ssoType = npm.config.get('sso-type')
@@ -22,10 +22,7 @@ module.exports.login = function login (creds, registry, scope, cb) {
if (!doc || !doc.token) return cb(new Error('no SSO token returned'))
if (!doc.sso) return cb(new Error('no SSO URL returned by services'))
- output('If your browser doesn\'t open, visit ' +
- doc.sso +
- ' to complete authentication')
- opener(doc.sso, { command: npm.config.get('browser') }, function () {
+ openUrl(doc.sso, 'to complete your login please visit', function () {
pollForSession(registry, doc.token, function (err, username) {
if (err) return cb(err)
diff --git a/deps/npm/lib/bugs.js b/deps/npm/lib/bugs.js
index 5f166c33f6f2f6..10300d1e136203 100644
--- a/deps/npm/lib/bugs.js
+++ b/deps/npm/lib/bugs.js
@@ -1,8 +1,7 @@
module.exports = bugs
-var npm = require('./npm.js')
var log = require('npmlog')
-var opener = require('opener')
+var openUrl = require('./utils/open-url')
var fetchPackageMetadata = require('./fetch-package-metadata.js')
var usage = require('./utils/usage')
@@ -27,6 +26,6 @@ function bugs (args, cb) {
url = 'https://www.npmjs.org/package/' + d.name
}
log.silly('bugs', 'url', url)
- opener(url, { command: npm.config.get('browser') }, cb)
+ openUrl(url, 'bug list available at the following URL', cb)
})
}
diff --git a/deps/npm/lib/build.js b/deps/npm/lib/build.js
index 395f9437b4576c..f8b3c4933ed1be 100644
--- a/deps/npm/lib/build.js
+++ b/deps/npm/lib/build.js
@@ -106,7 +106,7 @@ function rebuildBundles (pkg, folder, cb) {
if (!npm.config.get('rebuild-bundle')) return cb()
var deps = Object.keys(pkg.dependencies || {})
- .concat(Object.keys(pkg.devDependencies || {}))
+ .concat(Object.keys(pkg.devDependencies || {}))
var bundles = pkg.bundleDependencies || pkg.bundledDependencies || []
fs.readdir(path.resolve(folder, 'node_modules'), function (er, files) {
@@ -119,7 +119,7 @@ function rebuildBundles (pkg, folder, cb) {
chain(files.filter(function (file) {
// rebuild if:
// not a .folder, like .bin or .hooks
- return !file.match(/^[\._-]/) &&
+ return !file.match(/^[._-]/) &&
// not some old 0.x style bundle
file.indexOf('@') === -1 &&
// either not a dep, or explicitly bundled
diff --git a/deps/npm/lib/cache.js b/deps/npm/lib/cache.js
index 8bd2d5fcb1aea4..d80f196c8912b5 100644
--- a/deps/npm/lib/cache.js
+++ b/deps/npm/lib/cache.js
@@ -1,4 +1,5 @@
'use strict'
+/* eslint-disable standard/no-callback-literal */
const BB = require('bluebird')
diff --git a/deps/npm/lib/ci.js b/deps/npm/lib/ci.js
new file mode 100644
index 00000000000000..e71d89cfddb2f8
--- /dev/null
+++ b/deps/npm/lib/ci.js
@@ -0,0 +1,40 @@
+'use strict'
+
+const Installer = require('libcipm')
+const lifecycleOpts = require('./config/lifecycle.js')
+const npm = require('./npm.js')
+const npmlog = require('npmlog')
+const pacoteOpts = require('./config/pacote.js')
+
+ci.usage = 'npm ci'
+
+ci.completion = (cb) => cb(null, [])
+
+Installer.CipmConfig.impl(npm.config, {
+ get: npm.config.get,
+ set: npm.config.set,
+ toLifecycle (moreOpts) {
+ return lifecycleOpts(moreOpts)
+ },
+ toPacote (moreOpts) {
+ return pacoteOpts(moreOpts)
+ }
+})
+
+module.exports = ci
+function ci (args, cb) {
+ return new Installer({
+ config: npm.config,
+ log: npmlog
+ })
+ .run()
+ .then(
+ (details) => {
+ npmlog.disableProgress()
+ console.error(`added ${details.pkgCount} packages in ${
+ details.runTime / 1000
+ }s`)
+ }
+ )
+ .then(() => cb(), cb)
+}
diff --git a/deps/npm/lib/completion.js b/deps/npm/lib/completion.js
index 3157255bfb625b..a682c134a77377 100644
--- a/deps/npm/lib/completion.js
+++ b/deps/npm/lib/completion.js
@@ -49,7 +49,7 @@ function completion (args, cb) {
if (isWindowsShell) {
var e = new Error('npm completion supported only in MINGW / Git bash on Windows')
e.code = 'ENOTSUP'
- e.errno = require('constants').ENOTSUP
+ e.errno = require('constants').ENOTSUP // eslint-disable-line node/no-deprecated-api
return cb(e)
}
@@ -150,7 +150,7 @@ function dumpScript (cb) {
fs.readFile(p, 'utf8', function (er, d) {
if (er) return cb(er)
- d = d.replace(/^\#\!.*?\n/, '')
+ d = d.replace(/^#!.*?\n/, '')
process.stdout.write(d, function () { cb() })
process.stdout.on('error', function (er) {
diff --git a/deps/npm/lib/config.js b/deps/npm/lib/config.js
index d260c04a54ce65..0d4161d3b53e85 100644
--- a/deps/npm/lib/config.js
+++ b/deps/npm/lib/config.js
@@ -1,3 +1,4 @@
+/* eslint-disable standard/no-callback-literal */
module.exports = config
var log = require('npmlog')
@@ -9,6 +10,8 @@ var types = npmconf.defs.types
var ini = require('ini')
var editor = require('editor')
var os = require('os')
+var path = require('path')
+var mkdirp = require('mkdirp')
var umask = require('./utils/umask')
var usage = require('./utils/usage')
var output = require('./utils/output')
@@ -39,7 +42,7 @@ config.completion = function (opts, cb) {
// todo: complete with valid values, if possible.
if (argv.length > 3) return cb(null, [])
// fallthrough
- /*eslint no-fallthrough:0*/
+ /* eslint no-fallthrough:0 */
case 'get':
case 'delete':
case 'rm':
@@ -89,7 +92,7 @@ function edit (cb) {
data = [
';;;;',
'; npm ' + (npm.config.get('global')
- ? 'globalconfig' : 'userconfig') + ' file',
+ ? 'globalconfig' : 'userconfig') + ' file',
'; this is a simple ini-formatted file',
'; lines that start with semi-colons are comments.',
'; read `npm help config` for help on the various options',
@@ -111,16 +114,19 @@ function edit (cb) {
.replace(/\n/g, '\n; ')
.split('\n'))
}, []))
- .concat([''])
- .join(os.EOL)
- writeFileAtomic(
- f,
- data,
- function (er) {
- if (er) return cb(er)
- editor(f, { editor: e }, noProgressTillDone(cb))
- }
- )
+ .concat([''])
+ .join(os.EOL)
+ mkdirp(path.dirname(f), function (er) {
+ if (er) return cb(er)
+ writeFileAtomic(
+ f,
+ data,
+ function (er) {
+ if (er) return cb(er)
+ editor(f, { editor: e }, noProgressTillDone(cb))
+ }
+ )
+ })
})
})
}
diff --git a/deps/npm/lib/config/cmd-list.js b/deps/npm/lib/config/cmd-list.js
index 49c445a4f0d14f..2069b5ea33ec78 100644
--- a/deps/npm/lib/config/cmd-list.js
+++ b/deps/npm/lib/config/cmd-list.js
@@ -4,8 +4,10 @@ var shorthands = {
'rb': 'rebuild',
'list': 'ls',
'ln': 'link',
+ 'create': 'init',
'i': 'install',
'it': 'install-test',
+ 'cit': 'install-ci-test',
'up': 'update',
'c': 'config',
's': 'search',
@@ -22,6 +24,8 @@ var affordances = {
'la': 'ls',
'll': 'ls',
'verison': 'version',
+ 'ic': 'ci',
+ 'innit': 'init',
'isntall': 'install',
'dist-tags': 'dist-tag',
'apihelp': 'help',
@@ -41,11 +45,14 @@ var affordances = {
'remove': 'uninstall',
'rm': 'uninstall',
'r': 'uninstall',
- 'rum': 'run-script'
+ 'rum': 'run-script',
+ 'sit': 'cit',
+ 'urn': 'run-script'
}
// these are filenames in .
var cmdList = [
+ 'ci',
'install',
'install-test',
'uninstall',
@@ -58,6 +65,7 @@ var cmdList = [
'prune',
'pack',
'dedupe',
+ 'hook',
'rebuild',
'link',
@@ -76,6 +84,7 @@ var cmdList = [
'shrinkwrap',
'token',
'profile',
+ 'audit',
'help',
'help-search',
diff --git a/deps/npm/lib/config/core.js b/deps/npm/lib/config/core.js
index 50cf4772e79f48..b9851f98d0e0c7 100644
--- a/deps/npm/lib/config/core.js
+++ b/deps/npm/lib/config/core.js
@@ -21,18 +21,20 @@ exports.defs = configDefs
Object.defineProperty(exports, 'defaults', { get: function () {
return configDefs.defaults
-}, enumerable: true })
+},
+enumerable: true })
Object.defineProperty(exports, 'types', { get: function () {
return configDefs.types
-}, enumerable: true })
+},
+enumerable: true })
exports.validate = validate
var myUid = process.env.SUDO_UID !== undefined
- ? process.env.SUDO_UID : (process.getuid && process.getuid())
+ ? process.env.SUDO_UID : (process.getuid && process.getuid())
var myGid = process.env.SUDO_GID !== undefined
- ? process.env.SUDO_GID : (process.getgid && process.getgid())
+ ? process.env.SUDO_GID : (process.getgid && process.getgid())
var loading = false
var loadCbs = []
@@ -153,17 +155,10 @@ function load_ (builtin, rc, cli, cb) {
// annoying humans and their expectations!
if (conf.get('prefix')) {
var etc = path.resolve(conf.get('prefix'), 'etc')
- mkdirp(etc, function () {
- defaults.globalconfig = path.resolve(etc, 'npmrc')
- defaults.globalignorefile = path.resolve(etc, 'npmignore')
- afterUserContinuation()
- })
- } else {
- afterUserContinuation()
+ defaults.globalconfig = path.resolve(etc, 'npmrc')
+ defaults.globalignorefile = path.resolve(etc, 'npmignore')
}
- }
- function afterUserContinuation () {
conf.addFile(conf.get('globalconfig'), 'global')
// move the builtin into the conf stack now.
@@ -274,7 +269,7 @@ Conf.prototype.save = function (where, cb) {
if (cb) return cb(er)
else return this.emit('error', er)
}
- this._saving --
+ this._saving--
if (this._saving === 0) {
if (cb) cb()
this.emit('save')
@@ -283,7 +278,7 @@ Conf.prototype.save = function (where, cb) {
then = then.bind(this)
done = done.bind(this)
- this._saving ++
+ this._saving++
var mode = where === 'user' ? '0600' : '0666'
if (!data.trim()) {
@@ -331,7 +326,10 @@ Conf.prototype.parse = function (content, file) {
Conf.prototype.add = function (data, marker) {
try {
Object.keys(data).forEach(function (k) {
- data[k] = parseField(data[k], k)
+ const newKey = envReplace(k)
+ const newField = parseField(data[k], newKey)
+ delete data[k]
+ data[newKey] = newField
})
} catch (e) {
this.emit('error', e)
@@ -351,8 +349,8 @@ Conf.prototype.addEnv = function (env) {
// leave first char untouched, even if
// it is a '_' - convert all other to '-'
var p = k.toLowerCase()
- .replace(/^npm_config_/, '')
- .replace(/(?!^)_/g, '-')
+ .replace(/^npm_config_/, '')
+ .replace(/(?!^)_/g, '-')
conf[p] = env[k]
})
return CC.prototype.addEnv.call(this, '', conf, 'env')
diff --git a/deps/npm/lib/config/defaults.js b/deps/npm/lib/config/defaults.js
index c049f213fa76d1..8e0d7e4fd515dd 100644
--- a/deps/npm/lib/config/defaults.js
+++ b/deps/npm/lib/config/defaults.js
@@ -82,7 +82,7 @@ if (home) process.env.HOME = home
else home = path.resolve(temp, 'npm-' + uidOrPid)
var cacheExtra = process.platform === 'win32' ? 'npm-cache' : '.npm'
-var cacheRoot = process.platform === 'win32' && process.env.APPDATA || home
+var cacheRoot = (process.platform === 'win32' && process.env.APPDATA) || home
var cache = path.resolve(cacheRoot, cacheExtra)
var globalPrefix
@@ -109,6 +109,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
'allow-same-version': false,
'always-auth': false,
also: null,
+ audit: true,
'auth-type': 'legacy',
'bin-links': true,
@@ -130,7 +131,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
cidr: null,
- color: true,
+ color: process.env.NO_COLOR == null,
depth: Infinity,
description: true,
dev: false,
@@ -152,7 +153,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
globalconfig: path.resolve(globalPrefix, 'etc', 'npmrc'),
'global-style': false,
group: process.platform === 'win32' ? 0
- : process.env.SUDO_GID || (process.getgid && process.getgid()),
+ : process.env.SUDO_GID || (process.getgid && process.getgid()),
'ham-it-up': false,
heading: 'npm',
'if-present': false,
@@ -193,6 +194,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
'progress': !process.env.TRAVIS && !process.env.CI,
proxy: null,
'https-proxy': null,
+ 'no-proxy': null,
'user-agent': 'npm/{npm-version} ' +
'node/{node-version} ' +
'{platform} ' +
@@ -251,6 +253,7 @@ exports.types = {
'allow-same-version': Boolean,
'always-auth': Boolean,
also: [null, 'dev', 'development'],
+ audit: Boolean,
'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
'bin-links': Boolean,
browser: [null, String],
@@ -312,12 +315,13 @@ exports.types = {
'metrics-registry': [null, String],
'node-options': [null, String],
'node-version': [null, semver],
+ 'no-proxy': [null, String, Array],
offline: Boolean,
'onload-script': [null, String],
only: [null, 'dev', 'development', 'prod', 'production'],
optional: Boolean,
'package-lock': Boolean,
- otp: Number,
+ otp: [null, String],
'package-lock-only': Boolean,
parseable: Boolean,
'prefer-offline': Boolean,
@@ -382,9 +386,9 @@ function getLocalAddresses () {
return interfaces[nic].filter(function (addr) {
return addr.family === 'IPv4'
})
- .map(function (addr) {
- return addr.address
- })
+ .map(function (addr) {
+ return addr.address
+ })
}).reduce(function (curr, next) {
return curr.concat(next)
}, []).concat(undefined)
diff --git a/deps/npm/lib/config/fetch-opts.js b/deps/npm/lib/config/fetch-opts.js
index 1a030c378ea09c..213c293d6c7c9e 100644
--- a/deps/npm/lib/config/fetch-opts.js
+++ b/deps/npm/lib/config/fetch-opts.js
@@ -26,12 +26,12 @@ function fromPacote (opts) {
function getCacheMode (opts) {
return opts.offline
- ? 'only-if-cached'
- : opts.preferOffline
- ? 'force-cache'
- : opts.preferOnline
- ? 'no-cache'
- : 'default'
+ ? 'only-if-cached'
+ : opts.preferOffline
+ ? 'force-cache'
+ : opts.preferOnline
+ ? 'no-cache'
+ : 'default'
}
function getHeaders (uri, registry, opts) {
diff --git a/deps/npm/lib/config/get-credentials-by-uri.js b/deps/npm/lib/config/get-credentials-by-uri.js
index d04f6137de9ba1..5e672696b2e539 100644
--- a/deps/npm/lib/config/get-credentials-by-uri.js
+++ b/deps/npm/lib/config/get-credentials-by-uri.js
@@ -40,14 +40,14 @@ function getCredentialsByURI (uri) {
var userDef = this.get('username')
var passDef = this.get('_password')
if (authDef && !(userDef && passDef)) {
- authDef = new Buffer(authDef, 'base64').toString()
+ authDef = Buffer.from(authDef, 'base64').toString()
authDef = authDef.split(':')
userDef = authDef.shift()
passDef = authDef.join(':')
}
if (this.get(nerfed + ':_password')) {
- c.password = new Buffer(this.get(nerfed + ':_password'), 'base64').toString('utf8')
+ c.password = Buffer.from(this.get(nerfed + ':_password'), 'base64').toString('utf8')
} else if (nerfed === defnerf && passDef) {
c.password = passDef
}
@@ -65,7 +65,7 @@ function getCredentialsByURI (uri) {
}
if (c.username && c.password) {
- c.auth = new Buffer(c.username + ':' + c.password).toString('base64')
+ c.auth = Buffer.from(c.username + ':' + c.password).toString('base64')
}
return c
diff --git a/deps/npm/lib/config/load-prefix.js b/deps/npm/lib/config/load-prefix.js
index c2af00c7f61da5..090865d2157c02 100644
--- a/deps/npm/lib/config/load-prefix.js
+++ b/deps/npm/lib/config/load-prefix.js
@@ -34,7 +34,7 @@ function loadPrefix (cb) {
Object.defineProperty(this, 'localPrefix',
{ set: function (prefix) { p = prefix },
get: function () { return p },
- enumerable: true })
+ enumerable: true })
// try to guess at a good node_modules location.
// If we are *explicitly* given a prefix on the cli, then
diff --git a/deps/npm/lib/config/pacote.js b/deps/npm/lib/config/pacote.js
index ec43178c7727dd..b9c651d8830214 100644
--- a/deps/npm/lib/config/pacote.js
+++ b/deps/npm/lib/config/pacote.js
@@ -26,6 +26,7 @@ function pacoteOpts (moreOpts) {
defaultTag: npm.config.get('tag'),
dirPacker: pack.packGitDep,
hashAlgorithm: 'sha1',
+ includeDeprecated: false,
key: npm.config.get('key'),
localAddress: npm.config.get('local-address'),
log: log,
@@ -37,6 +38,7 @@ function pacoteOpts (moreOpts) {
preferOnline: npm.config.get('prefer-online') || npm.config.get('cache-max') <= 0,
projectScope: npm.projectScope,
proxy: npm.config.get('https-proxy') || npm.config.get('proxy'),
+ noProxy: npm.config.get('no-proxy'),
refer: npm.registry.refer,
registry: npm.config.get('registry'),
retry: {
diff --git a/deps/npm/lib/config/set-credentials-by-uri.js b/deps/npm/lib/config/set-credentials-by-uri.js
index 74211380d86b6f..4723d561a8af6f 100644
--- a/deps/npm/lib/config/set-credentials-by-uri.js
+++ b/deps/npm/lib/config/set-credentials-by-uri.js
@@ -23,7 +23,7 @@ function setCredentialsByURI (uri, c) {
this.del(nerfed + ':_authToken', 'user')
- var encoded = new Buffer(c.password, 'utf8').toString('base64')
+ var encoded = Buffer.from(c.password, 'utf8').toString('base64')
this.set(nerfed + ':_password', encoded, 'user')
this.set(nerfed + ':username', c.username, 'user')
this.set(nerfed + ':email', c.email, 'user')
diff --git a/deps/npm/lib/dedupe.js b/deps/npm/lib/dedupe.js
index 71e60619c4f1b7..325faeaabcd43f 100644
--- a/deps/npm/lib/dedupe.js
+++ b/deps/npm/lib/dedupe.js
@@ -134,7 +134,7 @@ function hoistChildren_ (tree, diff, seen, next) {
if (seen.has(tree)) return next()
seen.add(tree)
asyncMap(tree.children, function (child, done) {
- if (!tree.parent) return hoistChildren_(child, diff, seen, done)
+ if (!tree.parent || child.fromBundle || child.package._inBundle) return hoistChildren_(child, diff, seen, done)
var better = findRequirement(tree.parent, moduleName(child), getRequested(child) || npa(packageId(child)))
if (better) {
return chain([
@@ -142,7 +142,7 @@ function hoistChildren_ (tree, diff, seen, next) {
[andComputeMetadata(tree)]
], done)
}
- var hoistTo = earliestInstallable(tree, tree.parent, child.package)
+ var hoistTo = earliestInstallable(tree, tree.parent, child.package, log)
if (hoistTo) {
move(child, hoistTo, diff)
chain([
diff --git a/deps/npm/lib/deprecate.js b/deps/npm/lib/deprecate.js
index 15ae58e01457ce..9b71d1de494ad7 100644
--- a/deps/npm/lib/deprecate.js
+++ b/deps/npm/lib/deprecate.js
@@ -1,3 +1,4 @@
+/* eslint-disable standard/no-callback-literal */
var npm = require('./npm.js')
var mapToRegistry = require('./utils/map-to-registry.js')
var npa = require('npm-package-arg')
diff --git a/deps/npm/lib/dist-tag.js b/deps/npm/lib/dist-tag.js
index 7c20ea99015304..bd0c5ae8a27a7d 100644
--- a/deps/npm/lib/dist-tag.js
+++ b/deps/npm/lib/dist-tag.js
@@ -1,3 +1,4 @@
+/* eslint-disable standard/no-callback-literal */
module.exports = distTag
var log = require('npmlog')
diff --git a/deps/npm/lib/docs.js b/deps/npm/lib/docs.js
index 2248702a461954..6d67da4e120907 100644
--- a/deps/npm/lib/docs.js
+++ b/deps/npm/lib/docs.js
@@ -1,7 +1,6 @@
module.exports = docs
-var npm = require('./npm.js')
-var opener = require('opener')
+var openUrl = require('./utils/open-url')
var log = require('npmlog')
var fetchPackageMetadata = require('./fetch-package-metadata.js')
var usage = require('./utils/usage')
@@ -37,6 +36,6 @@ function getDoc (project, cb) {
if (er) return cb(er)
var url = d.homepage
if (!url) url = 'https://www.npmjs.org/package/' + d.name
- return opener(url, {command: npm.config.get('browser')}, cb)
+ return openUrl(url, 'docs available at the following URL', cb)
})
}
diff --git a/deps/npm/lib/edit.js b/deps/npm/lib/edit.js
index 8e9bbd179709e5..48bcd5d346cad6 100644
--- a/deps/npm/lib/edit.js
+++ b/deps/npm/lib/edit.js
@@ -22,8 +22,8 @@ function edit (args, cb) {
))
}
p = p.split('/')
- .join('/node_modules/')
- .replace(/(\/node_modules)+/, '/node_modules')
+ .join('/node_modules/')
+ .replace(/(\/node_modules)+/, '/node_modules')
var f = path.resolve(npm.dir, p)
fs.lstat(f, function (er) {
if (er) return cb(er)
diff --git a/deps/npm/lib/help-search.js b/deps/npm/lib/help-search.js
index ffbe554b7bc064..475f305e49103c 100644
--- a/deps/npm/lib/help-search.js
+++ b/deps/npm/lib/help-search.js
@@ -70,7 +70,7 @@ function searchFiles (args, files, cb) {
if (nextLine) {
for (a = 0, ll = args.length; a < ll && !match; a++) {
match = nextLine.toLowerCase()
- .indexOf(args[a].toLowerCase()) !== -1
+ .indexOf(args[a].toLowerCase()) !== -1
}
if (match) {
// skip over the next line, and the line after it.
@@ -107,7 +107,7 @@ function searchFiles (args, files, cb) {
lines.forEach(function (line) {
args.forEach(function (arg) {
var hit = (line || '').toLowerCase()
- .split(arg.toLowerCase()).length - 1
+ .split(arg.toLowerCase()).length - 1
if (hit > 0) {
found[arg] = (found[arg] || 0) + hit
totalHits += hit
@@ -144,12 +144,12 @@ function searchFiles (args, files, cb) {
// then by number of matching lines
results = results.sort(function (a, b) {
return a.found.length > b.found.length ? -1
- : a.found.length < b.found.length ? 1
- : a.totalHits > b.totalHits ? -1
- : a.totalHits < b.totalHits ? 1
- : a.lines.length > b.lines.length ? -1
- : a.lines.length < b.lines.length ? 1
- : 0
+ : a.found.length < b.found.length ? 1
+ : a.totalHits > b.totalHits ? -1
+ : a.totalHits < b.totalHits ? 1
+ : a.lines.length > b.lines.length ? -1
+ : a.lines.length < b.lines.length ? 1
+ : 0
})
cb(null, results)
@@ -170,7 +170,7 @@ function formatResults (args, results, cb) {
}).join(' ')
out += ((new Array(Math.max(1, cols - out.length - r.length)))
- .join(' ')) + r
+ .join(' ')) + r
if (!npm.config.get('long')) return out
diff --git a/deps/npm/lib/help.js b/deps/npm/lib/help.js
index 64c80f78745647..d996a36e392b5b 100644
--- a/deps/npm/lib/help.js
+++ b/deps/npm/lib/help.js
@@ -10,7 +10,7 @@ var path = require('path')
var spawn = require('./utils/spawn')
var npm = require('./npm.js')
var log = require('npmlog')
-var opener = require('opener')
+var openUrl = require('./utils/open-url')
var glob = require('glob')
var didYouMean = require('./utils/did-you-mean')
var cmdList = require('./config/cmd-list').cmdList
@@ -97,8 +97,8 @@ function pickMan (mans, pref_) {
var an = a.match(nre)[1]
var bn = b.match(nre)[1]
return an === bn ? (a > b ? -1 : 1)
- : pref[an] < pref[bn] ? -1
- : 1
+ : pref[an] < pref[bn] ? -1
+ : 1
})
return mans[0]
}
@@ -127,7 +127,7 @@ function viewMan (man, cb) {
break
case 'browser':
- opener(htmlMan(man), { command: npm.config.get('browser') }, cb)
+ openUrl(htmlMan(man), 'help available at the following URL', cb)
break
default:
@@ -168,7 +168,7 @@ function npmUsage (valid, cb) {
'',
'where is one of:',
npm.config.get('long') ? usages()
- : ' ' + wrap(commands),
+ : ' ' + wrap(commands),
'',
'npm -h quick help on ',
'npm -l display full usage info',
diff --git a/deps/npm/lib/hook.js b/deps/npm/lib/hook.js
new file mode 100644
index 00000000000000..011319c4d11271
--- /dev/null
+++ b/deps/npm/lib/hook.js
@@ -0,0 +1,135 @@
+'use strict'
+
+const BB = require('bluebird')
+
+const crypto = require('crypto')
+const hookApi = require('libnpmhook')
+const log = require('npmlog')
+const npm = require('./npm.js')
+const output = require('./utils/output.js')
+const pudding = require('figgy-pudding')
+const relativeDate = require('tiny-relative-date')
+const Table = require('cli-table2')
+const usage = require('./utils/usage.js')
+const validate = require('aproba')
+
+hook.usage = usage([
+ 'npm hook add [--type=]',
+ 'npm hook ls [pkg]',
+ 'npm hook rm ',
+ 'npm hook update '
+])
+
+hook.completion = (opts, cb) => {
+ validate('OF', [opts, cb])
+ return cb(null, []) // fill in this array with completion values
+}
+
+const npmSession = crypto.randomBytes(8).toString('hex')
+const hookConfig = pudding()
+function config () {
+ return hookConfig({
+ refer: npm.refer,
+ projectScope: npm.projectScope,
+ log,
+ npmSession
+ }, npm.config)
+}
+
+module.exports = (args, cb) => BB.try(() => hook(args)).nodeify(cb)
+function hook (args) {
+ switch (args[0]) {
+ case 'add':
+ return add(args[1], args[2], args[3])
+ case 'ls':
+ return ls(args[1])
+ case 'rm':
+ return rm(args[1])
+ case 'update':
+ case 'up':
+ return update(args[1], args[2], args[3])
+ }
+}
+
+function add (pkg, uri, secret) {
+ return hookApi.add(pkg, uri, secret, config())
+ .then((hook) => {
+ if (npm.config.get('json')) {
+ output(JSON.stringify(hook, null, 2))
+ } else {
+ output(`+ ${hookName(hook)} ${
+ npm.config.get('unicode') ? ' ➜ ' : ' -> '
+ } ${hook.endpoint}`)
+ }
+ })
+}
+
+function ls (pkg) {
+ return hookApi.ls(pkg, config())
+ .then((hooks) => {
+ if (npm.config.get('json')) {
+ output(JSON.stringify(hooks, null, 2))
+ } else if (!hooks.length) {
+ output("You don't have any hooks configured yet.")
+ } else {
+ if (hooks.length === 1) {
+ output('You have one hook configured.')
+ } else {
+ output(`You have ${hooks.length} hooks configured.`)
+ }
+ const table = new Table({head: ['id', 'target', 'endpoint']})
+ hooks.forEach((hook) => {
+ table.push([
+ {rowSpan: 2, content: hook.id},
+ hookName(hook),
+ hook.endpoint
+ ])
+ if (hook.last_delivery) {
+ table.push([
+ {
+ colSpan: 1,
+ content: `triggered ${relativeDate(hook.last_delivery)}`
+ },
+ hook.response_code
+ ])
+ } else {
+ table.push([{colSpan: 2, content: 'never triggered'}])
+ }
+ })
+ output(table.toString())
+ }
+ })
+}
+
+function rm (id) {
+ return hookApi.rm(id, config())
+ .then((hook) => {
+ if (npm.config.get('json')) {
+ output(JSON.stringify(hook, null, 2))
+ } else {
+ output(`- ${hookName(hook)} ${
+ npm.config.get('unicode') ? ' ✘ ' : ' X '
+ } ${hook.endpoint}`)
+ }
+ })
+}
+
+function update (id, uri, secret) {
+ return hookApi.update(id, uri, secret, config())
+ .then((hook) => {
+ if (npm.config.get('json')) {
+ output(JSON.stringify(hook, null, 2))
+ } else {
+ output(`+ ${hookName(hook)} ${
+ npm.config.get('unicode') ? ' ➜ ' : ' -> '
+ } ${hook.endpoint}`)
+ }
+ })
+}
+
+function hookName (hook) {
+ let target = hook.name
+ if (hook.type === 'scope') { target = '@' + target }
+ if (hook.type === 'owner') { target = '~' + target }
+ return target
+}
diff --git a/deps/npm/lib/init.js b/deps/npm/lib/init.js
index 000fa1a5b689e9..9d873689f6b7e1 100644
--- a/deps/npm/lib/init.js
+++ b/deps/npm/lib/init.js
@@ -2,15 +2,59 @@
module.exports = init
+var path = require('path')
var log = require('npmlog')
+var npa = require('npm-package-arg')
var npm = require('./npm.js')
+var npx = require('libnpx')
var initJson = require('init-package-json')
+var isRegistry = require('./utils/is-registry.js')
var output = require('./utils/output.js')
var noProgressTillDone = require('./utils/no-progress-while-running').tillDone
+var usage = require('./utils/usage')
-init.usage = 'npm init [--force|-f|--yes|-y]'
+init.usage = usage(
+ 'init',
+ '\nnpm init [--force|-f|--yes|-y|--scope]' +
+ '\nnpm init <@scope> (same as `npx <@scope>/create`)' +
+ '\nnpm init [<@scope>/] (same as `npx [<@scope>/]create-`)'
+)
function init (args, cb) {
+ if (args.length) {
+ var NPM_PATH = path.resolve(__dirname, '../bin/npm-cli.js')
+ var initerName = args[0]
+ var packageName = initerName
+ if (/^@[^/]+$/.test(initerName)) {
+ packageName = initerName + '/create'
+ } else {
+ var req = npa(initerName)
+ if (req.type === 'git' && req.hosted) {
+ var { user, project } = req.hosted
+ packageName = initerName
+ .replace(user + '/' + project, user + '/create-' + project)
+ } else if (isRegistry(req)) {
+ packageName = req.name.replace(/^(@[^/]+\/)?/, '$1create-')
+ if (req.rawSpec) {
+ packageName += '@' + req.rawSpec
+ }
+ } else {
+ var err = new Error(
+ 'Unrecognized initializer: ' + initerName +
+ '\nFor more package binary executing power check out `npx`:' +
+ '\nhttps://www.npmjs.com/package/npx'
+ )
+ err.code = 'EUNSUPPORTED'
+ throw err
+ }
+ }
+ var npxArgs = [process.argv0, '[fake arg]', '--always-spawn', packageName, ...process.argv.slice(4)]
+ var parsed = npx.parseArgs(npxArgs, NPM_PATH)
+
+ return npx(parsed)
+ .then(() => cb())
+ .catch(cb)
+ }
var dir = process.cwd()
log.pause()
var initFile = npm.config.get('init-module')
diff --git a/deps/npm/lib/install-ci-test.js b/deps/npm/lib/install-ci-test.js
new file mode 100644
index 00000000000000..26120f4a216dfa
--- /dev/null
+++ b/deps/npm/lib/install-ci-test.js
@@ -0,0 +1,26 @@
+'use strict'
+
+// npm install-ci-test
+// Runs `npm ci` and then runs `npm test`
+
+module.exports = installTest
+var ci = require('./ci.js')
+var test = require('./test.js')
+var usage = require('./utils/usage')
+
+installTest.usage = usage(
+ 'install-ci-test',
+ '\nnpm install-ci-test [args]' +
+ '\nSame args as `npm ci`'
+)
+
+installTest.completion = ci.completion
+
+function installTest (args, cb) {
+ ci(args, function (er) {
+ if (er) {
+ return cb(er)
+ }
+ test([], cb)
+ })
+}
diff --git a/deps/npm/lib/install.js b/deps/npm/lib/install.js
index 42906f2394e895..66f85d80a49a20 100644
--- a/deps/npm/lib/install.js
+++ b/deps/npm/lib/install.js
@@ -1,4 +1,6 @@
'use strict'
+/* eslint-disable camelcase */
+/* eslint-disable standard/no-callback-literal */
// npm install
//
// See doc/cli/npm-install.md for more description
@@ -135,6 +137,7 @@ var validateTree = require('./install/validate-tree.js')
var validateArgs = require('./install/validate-args.js')
var saveRequested = require('./install/save.js').saveRequested
var saveShrinkwrap = require('./install/save.js').saveShrinkwrap
+var audit = require('./install/audit.js')
var getSaveType = require('./install/save.js').getSaveType
var doSerialActions = require('./install/actions.js').doSerial
var doReverseSerialActions = require('./install/actions.js').doReverseSerial
@@ -181,8 +184,8 @@ function install (where, args, cb) {
var globalTop = path.resolve(npm.globalDir, '..')
if (!where) {
where = npm.config.get('global')
- ? globalTop
- : npm.prefix
+ ? globalTop
+ : npm.prefix
}
validate('SAF', [where, args, cb])
// the /path/to/node_modules/..
@@ -220,6 +223,8 @@ function Installer (where, dryrun, args, opts) {
this.noPackageJsonOk = !!args.length
this.topLevelLifecycles = !args.length
+ this.autoPrune = npm.config.get('package-lock')
+
const dev = npm.config.get('dev')
const only = npm.config.get('only')
const onlyProd = /^prod(uction)?$/.test(only)
@@ -234,6 +239,7 @@ function Installer (where, dryrun, args, opts) {
this.link = opts.link != null ? opts.link : npm.config.get('link')
this.saveOnlyLock = opts.saveOnlyLock
this.global = opts.global != null ? opts.global : this.where === path.resolve(npm.globalDir, '..')
+ this.audit = npm.config.get('audit') && !this.global
this.started = Date.now()
}
Installer.prototype = {}
@@ -294,7 +300,9 @@ Installer.prototype.run = function (_cb) {
[this, this.finishTracker, 'generateActionsToTake'],
[this, this.debugActions, 'diffTrees', 'differences'],
- [this, this.debugActions, 'decomposeActions', 'todo'])
+ [this, this.debugActions, 'decomposeActions', 'todo'],
+ [this, this.startAudit]
+ )
if (this.packageLockOnly) {
postInstallSteps.push(
@@ -436,8 +444,8 @@ Installer.prototype.pruneIdealTree = function (cb) {
// if our lock file didn't have the requires field and there
// are any fake children then forgo pruning until we have more info.
if (!this.idealTree.hasRequiresFromLock && this.idealTree.children.some((n) => n.fakeChild)) return cb()
- var toPrune = this.idealTree.children
- .filter(isExtraneous)
+ const toPrune = this.idealTree.children
+ .filter((child) => isExtraneous(child) && (this.autoPrune || child.removing))
.map((n) => ({name: moduleName(n)}))
return removeExtraneous(toPrune, this.idealTree, cb)
}
@@ -456,21 +464,13 @@ Installer.prototype.loadAllDepsIntoIdealTree = function (cb) {
steps.push([loadRequestedDeps, this.args, this.idealTree, saveDeps, cg.newGroup('loadRequestedDeps')])
} else {
const depsToPreload = Object.assign({},
- this.dev ? this.idealTree.package.devDependencies : {},
- this.prod ? this.idealTree.package.dependencies : {}
+ this.idealTree.package.devDependencies,
+ this.idealTree.package.dependencies
)
- if (this.prod || this.dev) {
- steps.push(
- [prefetchDeps, this.idealTree, depsToPreload, cg.newGroup('prefetchDeps')])
- }
- if (this.prod) {
- steps.push(
- [loadDeps, this.idealTree, cg.newGroup('loadDeps')])
- }
- if (this.dev) {
- steps.push(
- [loadDevDeps, this.idealTree, cg.newGroup('loadDevDeps')])
- }
+ steps.push(
+ [prefetchDeps, this.idealTree, depsToPreload, cg.newGroup('prefetchDeps')],
+ [loadDeps, this.idealTree, cg.newGroup('loadDeps')],
+ [loadDevDeps, this.idealTree, cg.newGroup('loadDevDeps')])
}
steps.push(
[loadExtraneous.andResolveDeps, this.idealTree, cg.newGroup('loadExtraneous')])
@@ -630,6 +630,16 @@ Installer.prototype.runPostinstallTopLevelLifecycles = function (cb) {
chain(steps, cb)
}
+Installer.prototype.startAudit = function (cb) {
+ if (!this.audit) return cb()
+ this.auditSubmission = Bluebird.try(() => {
+ return audit.generateFromInstall(this.idealTree, this.differences, this.args, this.remove)
+ }).then((auditData) => {
+ return audit.submitForInstallReport(auditData)
+ }).catch(_ => {})
+ cb()
+}
+
Installer.prototype.saveToDependencies = function (cb) {
validate('F', arguments)
if (this.failing) return cb()
@@ -692,27 +702,19 @@ Installer.prototype.readLocalPackageData = function (cb) {
Installer.prototype.cloneCurrentTreeToIdealTree = function (cb) {
validate('F', arguments)
log.silly('install', 'cloneCurrentTreeToIdealTree')
- this.idealTree = copyTree(this.currentTree, (child) => {
- // Filter out any children we didn't install ourselves. They need to be
- // reinstalled in order for things to be correct.
- return child.isTop || isLink(child) || (
- child.package &&
- child.package._resolved &&
- (child.package._integrity || child.package._shasum)
- )
- })
+
+ this.idealTree = copyTree(this.currentTree)
this.idealTree.warnings = []
cb()
}
-function isLink (child) {
- return child.isLink || (child.parent && isLink(child.parent))
-}
-
Installer.prototype.loadShrinkwrap = function (cb) {
validate('F', arguments)
log.silly('install', 'loadShrinkwrap')
- readShrinkwrap.andInflate(this.idealTree, cb)
+ readShrinkwrap.andInflate(this.idealTree, iferr(cb, () => {
+ computeMetadata(this.idealTree)
+ cb()
+ }))
}
Installer.prototype.getInstalledModules = function () {
@@ -760,20 +762,29 @@ Installer.prototype.printInstalled = function (cb) {
diffs.push(['remove', r])
})
}
- if (npm.config.get('json')) {
- return this.printInstalledForJSON(diffs, cb)
- } else if (npm.config.get('parseable')) {
- return this.printInstalledForParseable(diffs, cb)
- } else {
- return this.printInstalledForHuman(diffs, cb)
- }
+ return Bluebird.try(() => {
+ if (!this.auditSubmission) return
+ return Bluebird.resolve(this.auditSubmission).timeout(10000).catch(() => null)
+ }).then((auditResult) => {
+ // maybe write audit report w/ hash of pjson & shrinkwrap for later reading by `npm audit`
+ if (npm.config.get('json')) {
+ return this.printInstalledForJSON(diffs, auditResult)
+ } else if (npm.config.get('parseable')) {
+ return this.printInstalledForParseable(diffs, auditResult)
+ } else {
+ return this.printInstalledForHuman(diffs, auditResult)
+ }
+ }).asCallback(cb)
}
-Installer.prototype.printInstalledForHuman = function (diffs, cb) {
+Installer.prototype.printInstalledForHuman = function (diffs, auditResult) {
var removed = 0
var added = 0
var updated = 0
var moved = 0
+ // Count the number of contributors to packages added, tracking
+ // contributors we've seen, so we can produce a running unique count.
+ var contributors = new Set()
diffs.forEach(function (action) {
var mutation = action[0]
var pkg = action[1]
@@ -784,6 +795,26 @@ Installer.prototype.printInstalledForHuman = function (diffs, cb) {
++moved
} else if (mutation === 'add') {
++added
+ // Count contributors to added packages. Start by combining `author`
+ // and `contributors` data into a single array of contributor-people
+ // for this package.
+ var people = []
+ var meta = pkg.package
+ if (meta.author) people.push(meta.author)
+ if (meta.contributors && Array.isArray(meta.contributors)) {
+ people = people.concat(meta.contributors)
+ }
+ // Make sure a normalized string for every person behind this
+ // package is in `contributors`.
+ people.forEach(function (person) {
+ // Ignore errors from malformed `author` and `contributors`.
+ try {
+ var normalized = normalizePerson(person)
+ } catch (error) {
+ return
+ }
+ if (!contributors.has(normalized)) contributors.add(normalized)
+ })
} else if (mutation === 'update' || mutation === 'update-linked') {
++updated
}
@@ -795,10 +826,17 @@ Installer.prototype.printInstalledForHuman = function (diffs, cb) {
}).join('\n') + '\n'
}
var actions = []
- if (added) actions.push('added ' + packages(added))
+ if (added) {
+ var action = 'added ' + packages(added)
+ if (contributors.size) action += from(contributors.size)
+ actions.push(action)
+ }
if (removed) actions.push('removed ' + packages(removed))
if (updated) actions.push('updated ' + packages(updated))
if (moved) actions.push('moved ' + packages(moved))
+ if (auditResult && auditResult.metadata.totalDependencies) {
+ actions.push('audited ' + packages(auditResult.metadata.totalDependencies))
+ }
if (actions.length === 0) {
report += 'up to date'
} else if (actions.length === 1) {
@@ -810,14 +848,31 @@ Installer.prototype.printInstalledForHuman = function (diffs, cb) {
report += ' in ' + ((Date.now() - this.started) / 1000) + 's'
output(report)
- return cb()
+ return auditResult && audit.printInstallReport(auditResult)
function packages (num) {
return num + ' package' + (num > 1 ? 's' : '')
}
+
+ function from (num) {
+ return ' from ' + num + ' contributor' + (num > 1 ? 's' : '')
+ }
+
+ // Values of `author` and elements of `contributors` in `package.json`
+ // files can be e-mail style strings or Objects with `name`, `email,
+ // and `url` String properties. Convert Objects to Strings so that
+ // we can efficiently keep a set of contributors we have already seen.
+ function normalizePerson (argument) {
+ if (typeof argument === 'string') return argument
+ var returned = ''
+ if (argument.name) returned += argument.name
+ if (argument.email) returned += ' <' + argument.email + '>'
+ if (argument.url) returned += ' (' + argument.email + ')'
+ return returned
+ }
}
-Installer.prototype.printInstalledForJSON = function (diffs, cb) {
+Installer.prototype.printInstalledForJSON = function (diffs, auditResult) {
var result = {
added: [],
removed: [],
@@ -825,6 +880,7 @@ Installer.prototype.printInstalledForJSON = function (diffs, cb) {
moved: [],
failed: [],
warnings: [],
+ audit: auditResult,
elapsed: Date.now() - this.started
}
var self = this
@@ -855,7 +911,6 @@ Installer.prototype.printInstalledForJSON = function (diffs, cb) {
}
})
output(JSON.stringify(result, null, 2))
- cb()
function flattenMessage (msg) {
return msg.map(function (logline) { return logline.slice(1).join(' ') }).join('\n')
@@ -879,7 +934,7 @@ Installer.prototype.printInstalledForJSON = function (diffs, cb) {
}
}
-Installer.prototype.printInstalledForParseable = function (diffs, cb) {
+Installer.prototype.printInstalledForParseable = function (diffs) {
var self = this
diffs.forEach(function (action) {
var mutation = action[0]
@@ -897,7 +952,6 @@ Installer.prototype.printInstalledForParseable = function (diffs, cb) {
(previousVersion || '') + '\t' +
(previousPath || ''))
})
- return cb()
}
Installer.prototype.debugActions = function (name, actionListName, cb) {
diff --git a/deps/npm/lib/install/action/extract-worker.js b/deps/npm/lib/install/action/extract-worker.js
index 24508c780495eb..2b082b4a574c25 100644
--- a/deps/npm/lib/install/action/extract-worker.js
+++ b/deps/npm/lib/install/action/extract-worker.js
@@ -10,9 +10,9 @@ module.exports = (args, cb) => {
const spec = parsed[0]
const extractTo = parsed[1]
const opts = parsed[2]
- if (!opts.log && opts.loglevel) {
+ if (!opts.log) {
opts.log = npmlog
- opts.log.level = opts.loglevel
}
+ opts.log.level = opts.loglevel || opts.log.level
BB.resolve(extract(spec, extractTo, opts)).nodeify(cb)
}
diff --git a/deps/npm/lib/install/action/extract.js b/deps/npm/lib/install/action/extract.js
index 6b827f36ea92fd..e8d7a6c4f6d1f0 100644
--- a/deps/npm/lib/install/action/extract.js
+++ b/deps/npm/lib/install/action/extract.js
@@ -4,9 +4,7 @@ const BB = require('bluebird')
const stat = BB.promisify(require('graceful-fs').stat)
const gentlyRm = BB.promisify(require('../../utils/gently-rm.js'))
-const log = require('npmlog')
const mkdirp = BB.promisify(require('mkdirp'))
-const moduleName = require('../../utils/module-name.js')
const moduleStagingPath = require('../module-staging-path.js')
const move = require('../../utils/move.js')
const npa = require('npm-package-arg')
@@ -59,12 +57,11 @@ function extract (staging, pkg, log) {
pacoteOpts = require('../../config/pacote')
}
const opts = pacoteOpts({
- integrity: pkg.package._integrity
+ integrity: pkg.package._integrity,
+ resolved: pkg.package._resolved
})
const args = [
- pkg.package._resolved
- ? npa.resolve(pkg.package.name, pkg.package._resolved)
- : pkg.package._requested,
+ pkg.package._requested,
extractTo,
opts
]
@@ -112,18 +109,6 @@ function readBundled (pkg, staging, extractTo) {
}, {concurrency: 10})
}
-function getTree (pkg) {
- while (pkg.parent) pkg = pkg.parent
- return pkg
-}
-
-function warn (pkg, code, msg) {
- const tree = getTree(pkg)
- const err = new Error(msg)
- err.code = code
- tree.warnings.push(err)
-}
-
function stageBundledModule (bundler, child, staging, parentPath) {
const stageFrom = path.join(parentPath, 'node_modules', child.package.name)
const stageTo = moduleStagingPath(staging, child)
@@ -146,15 +131,6 @@ function finishModule (bundler, child, stageTo, stageFrom) {
return move(stageFrom, stageTo)
})
} else {
- return stat(stageFrom).then(() => {
- const bundlerId = packageId(bundler)
- if (!getTree(bundler).warnings.some((w) => {
- return w.code === 'EBUNDLEOVERRIDE'
- })) {
- warn(bundler, 'EBUNDLEOVERRIDE', `${bundlerId} had bundled packages that do not match the required version(s). They have been replaced with non-bundled versions.`)
- }
- log.verbose('bundle', `EBUNDLEOVERRIDE: Replacing ${bundlerId}'s bundled version of ${moduleName(child)} with ${packageId(child)}.`)
- return gentlyRm(stageFrom)
- }, () => {})
+ return stat(stageFrom).then(() => gentlyRm(stageFrom), () => {})
}
}
diff --git a/deps/npm/lib/install/action/fetch.js b/deps/npm/lib/install/action/fetch.js
index a4d760fe829a2b..5ad34e29dd27ef 100644
--- a/deps/npm/lib/install/action/fetch.js
+++ b/deps/npm/lib/install/action/fetch.js
@@ -12,5 +12,5 @@ function fetch (staging, pkg, log, next) {
log.silly('fetch', packageId(pkg))
const opts = pacoteOpts({integrity: pkg.package._integrity})
return finished(pacote.tarball.stream(pkg.package._requested, opts))
- .then(() => next(), next)
+ .then(() => next(), next)
}
diff --git a/deps/npm/lib/install/actions.js b/deps/npm/lib/install/actions.js
index 9608a943a5aeec..a34d03ffe21465 100644
--- a/deps/npm/lib/install/actions.js
+++ b/deps/npm/lib/install/actions.js
@@ -118,7 +118,7 @@ function doParallel (type, staging, actionsToRun, log, next) {
}
return acc
}, [])
- log.silly('doParallel', type + ' ' + actionsToRun.length)
+ log.silly('doParallel', type + ' ' + acts.length)
time(log)
if (!acts.length) { return next() }
return withInit(actions[type], () => {
diff --git a/deps/npm/lib/install/audit.js b/deps/npm/lib/install/audit.js
new file mode 100644
index 00000000000000..4be59ca7c5e266
--- /dev/null
+++ b/deps/npm/lib/install/audit.js
@@ -0,0 +1,272 @@
+'use strict'
+exports.generate = generate
+exports.generateFromInstall = generateFromInstall
+exports.submitForInstallReport = submitForInstallReport
+exports.submitForFullReport = submitForFullReport
+exports.printInstallReport = printInstallReport
+exports.printFullReport = printFullReport
+
+const Bluebird = require('bluebird')
+const auditReport = require('npm-audit-report')
+const treeToShrinkwrap = require('../shrinkwrap.js').treeToShrinkwrap
+const packageId = require('../utils/package-id.js')
+const output = require('../utils/output.js')
+const npm = require('../npm.js')
+const qw = require('qw')
+const registryFetch = require('npm-registry-fetch')
+const zlib = require('zlib')
+const gzip = Bluebird.promisify(zlib.gzip)
+const log = require('npmlog')
+const perf = require('../utils/perf.js')
+const url = require('url')
+const npa = require('npm-package-arg')
+const uuid = require('uuid')
+const ssri = require('ssri')
+const cloneDeep = require('lodash.clonedeep')
+const pacoteOpts = require('../config/pacote.js')
+
+// used when scrubbing module names/specifiers
+const runId = uuid.v4()
+
+function submitForInstallReport (auditData) {
+ const cfg = npm.config // avoid the no-dynamic-lookups test
+ const scopedRegistries = cfg.keys.filter(_ => /:registry$/.test(_)).map(_ => cfg.get(_))
+ perf.emit('time', 'audit compress')
+ // TODO: registryFetch will be adding native support for `Content-Encoding: gzip` at which point
+ // we'll pass in something like `gzip: true` and not need to JSON stringify, gzip or headers.
+ return gzip(JSON.stringify(auditData)).then(body => {
+ perf.emit('timeEnd', 'audit compress')
+ log.info('audit', 'Submitting payload of ' + body.length + 'bytes')
+ scopedRegistries.forEach(reg => {
+ // we don't care about the response so destroy the stream if we can, or leave it flowing
+ // so it can eventually finish and clean up after itself
+ fetchAudit(url.resolve(reg, '/-/npm/v1/security/audits/quick'))
+ .then(_ => {
+ _.body.on('error', () => {})
+ if (_.body.destroy) {
+ _.body.destroy()
+ } else {
+ _.body.resume()
+ }
+ }, _ => {})
+ })
+ perf.emit('time', 'audit submit')
+ return fetchAudit('/-/npm/v1/security/audits/quick', body).then(response => {
+ perf.emit('timeEnd', 'audit submit')
+ perf.emit('time', 'audit body')
+ return response.json()
+ }).then(result => {
+ perf.emit('timeEnd', 'audit body')
+ return result
+ })
+ })
+}
+
+function submitForFullReport (auditData) {
+ perf.emit('time', 'audit compress')
+ // TODO: registryFetch will be adding native support for `Content-Encoding: gzip` at which point
+ // we'll pass in something like `gzip: true` and not need to JSON stringify, gzip or headers.
+ return gzip(JSON.stringify(auditData)).then(body => {
+ perf.emit('timeEnd', 'audit compress')
+ log.info('audit', 'Submitting payload of ' + body.length + ' bytes')
+ perf.emit('time', 'audit submit')
+ return fetchAudit('/-/npm/v1/security/audits', body).then(response => {
+ perf.emit('timeEnd', 'audit submit')
+ perf.emit('time', 'audit body')
+ return response.json()
+ }).then(result => {
+ perf.emit('timeEnd', 'audit body')
+ result.runId = runId
+ return result
+ })
+ })
+}
+
+function fetchAudit (href, body) {
+ const opts = pacoteOpts()
+ return registryFetch(href, {
+ method: 'POST',
+ headers: { 'Content-Encoding': 'gzip', 'Content-Type': 'application/json' },
+ config: npm.config,
+ npmSession: opts.npmSession,
+ projectScope: npm.projectScope,
+ log: log,
+ body: body
+ })
+}
+
+function printInstallReport (auditResult) {
+ return auditReport(auditResult, {
+ reporter: 'install',
+ withColor: npm.color,
+ withUnicode: npm.config.get('unicode')
+ }).then(result => output(result.report))
+}
+
+function printFullReport (auditResult) {
+ return auditReport(auditResult, {
+ log: output,
+ reporter: npm.config.get('json') ? 'json' : 'detail',
+ withColor: npm.color,
+ withUnicode: npm.config.get('unicode')
+ }).then(result => output(result.report))
+}
+
+function generate (shrinkwrap, requires, diffs, install, remove) {
+ const sw = cloneDeep(shrinkwrap)
+ delete sw.lockfileVersion
+ sw.requires = scrubRequires(requires)
+ scrubDeps(sw.dependencies)
+
+ // sw.diffs = diffs || {}
+ sw.install = (install || []).map(scrubArg)
+ sw.remove = (remove || []).map(scrubArg)
+ return generateMetadata().then((md) => {
+ sw.metadata = md
+ return sw
+ })
+}
+
+const scrubKeys = qw`version`
+const deleteKeys = qw`from resolved`
+
+function scrubDeps (deps) {
+ if (!deps) return
+ Object.keys(deps).forEach(name => {
+ if (!shouldScrubName(name) && !shouldScrubSpec(name, deps[name].version)) return
+ const value = deps[name]
+ delete deps[name]
+ deps[scrub(name)] = value
+ })
+ Object.keys(deps).forEach(name => {
+ for (let toScrub of scrubKeys) {
+ if (!deps[name][toScrub]) continue
+ deps[name][toScrub] = scrubSpec(name, deps[name][toScrub])
+ }
+ for (let toDelete of deleteKeys) delete deps[name][toDelete]
+
+ scrubRequires(deps[name].requires)
+ scrubDeps(deps[name].dependencies)
+ })
+}
+
+function scrubRequires (reqs) {
+ if (!reqs) return reqs
+ Object.keys(reqs).forEach(name => {
+ const spec = reqs[name]
+ if (shouldScrubName(name) || shouldScrubSpec(name, spec)) {
+ delete reqs[name]
+ reqs[scrub(name)] = scrubSpec(name, spec)
+ } else {
+ reqs[name] = scrubSpec(name, spec)
+ }
+ })
+ return reqs
+}
+
+function getScope (name) {
+ if (name[0] === '@') return name.slice(0, name.indexOf('/'))
+}
+
+function shouldScrubName (name) {
+ const scope = getScope(name)
+ const cfg = npm.config // avoid the no-dynamic-lookups test
+ return Boolean(scope && cfg.get(scope + ':registry'))
+}
+function shouldScrubSpec (name, spec) {
+ const req = npa.resolve(name, spec)
+ return !req.registry
+}
+
+function scrubArg (arg) {
+ const req = npa(arg)
+ let name = req.name
+ if (shouldScrubName(name) || shouldScrubSpec(name, req.rawSpec)) {
+ name = scrubName(name)
+ }
+ const spec = scrubSpec(req.name, req.rawSpec)
+ return name + '@' + spec
+}
+
+function scrubName (name) {
+ return shouldScrubName(name) ? scrub(name) : name
+}
+
+function scrubSpec (name, spec) {
+ const req = npa.resolve(name, spec)
+ if (req.registry) return spec
+ if (req.type === 'git') {
+ return 'git+ssh://' + scrub(spec)
+ } else if (req.type === 'remote') {
+ return 'https://' + scrub(spec)
+ } else if (req.type === 'directory') {
+ return 'file:' + scrub(spec)
+ } else if (req.type === 'file') {
+ return 'file:' + scrub(spec) + '.tar'
+ } else {
+ return scrub(spec)
+ }
+}
+
+module.exports.scrub = scrub
+function scrub (value, rid) {
+ return ssri.fromData((rid || runId) + ' ' + value, {algorithms: ['sha256']}).hexDigest()
+}
+
+function generateMetadata () {
+ const meta = {}
+ meta.npm_version = npm.version
+ meta.node_version = process.version
+ meta.platform = process.platform
+ meta.node_env = process.env.NODE_ENV
+
+ return Promise.resolve(meta)
+}
+/*
+ const head = path.resolve(npm.prefix, '.git/HEAD')
+ return readFile(head, 'utf8').then((head) => {
+ if (!head.match(/^ref: /)) {
+ meta.commit_hash = head.trim()
+ return
+ }
+ const headFile = head.replace(/^ref: /, '').trim()
+ meta.branch = headFile.replace(/^refs[/]heads[/]/, '')
+ return readFile(path.resolve(npm.prefix, '.git', headFile), 'utf8')
+ }).then((commitHash) => {
+ meta.commit_hash = commitHash.trim()
+ const proc = spawn('git', qw`diff --quiet --exit-code package.json package-lock.json`, {cwd: npm.prefix, stdio: 'ignore'})
+ return new Promise((resolve, reject) => {
+ proc.once('error', reject)
+ proc.on('exit', (code, signal) => {
+ if (signal == null) meta.state = code === 0 ? 'clean' : 'dirty'
+ resolve()
+ })
+ })
+ }).then(() => meta, () => meta)
+*/
+
+function generateFromInstall (tree, diffs, install, remove) {
+ const requires = {}
+ tree.requires.forEach((pkg) => {
+ requires[pkg.package.name] = tree.package.dependencies[pkg.package.name] || tree.package.devDependencies[pkg.package.name] || pkg.package.version
+ })
+
+ const auditInstall = (install || []).filter((a) => a.name).map(packageId)
+ const auditRemove = (remove || []).filter((a) => a.name).map(packageId)
+ const auditDiffs = {}
+ diffs.forEach((action) => {
+ const mutation = action[0]
+ const child = action[1]
+ if (mutation !== 'add' && mutation !== 'update' && mutation !== 'remove') return
+ if (!auditDiffs[mutation]) auditDiffs[mutation] = []
+ if (mutation === 'add') {
+ auditDiffs[mutation].push({location: child.location})
+ } else if (mutation === 'update') {
+ auditDiffs[mutation].push({location: child.location, previous: packageId(child.oldPkg)})
+ } else if (mutation === 'remove') {
+ auditDiffs[mutation].push({previous: packageId(child)})
+ }
+ })
+
+ return generate(treeToShrinkwrap(tree), requires, auditDiffs, auditInstall, auditRemove)
+}
diff --git a/deps/npm/lib/install/copy-tree.js b/deps/npm/lib/install/copy-tree.js
index a5b558cf598b73..2bf7064f334896 100644
--- a/deps/npm/lib/install/copy-tree.js
+++ b/deps/npm/lib/install/copy-tree.js
@@ -1,27 +1,26 @@
'use strict'
var createNode = require('./node.js').create
-module.exports = function (tree, filter) {
- return copyTree(tree, {}, filter)
+module.exports = function (tree) {
+ return copyTree(tree, {})
}
-function copyTree (tree, cache, filter) {
- if (filter && !filter(tree)) { return null }
+function copyTree (tree, cache) {
if (cache[tree.path]) { return cache[tree.path] }
var newTree = cache[tree.path] = createNode(Object.assign({}, tree))
- copyModuleList(newTree, 'children', cache, filter)
+ copyModuleList(newTree, 'children', cache)
newTree.children.forEach(function (child) {
child.parent = newTree
})
- copyModuleList(newTree, 'requires', cache, filter)
- copyModuleList(newTree, 'requiredBy', cache, filter)
+ copyModuleList(newTree, 'requires', cache)
+ copyModuleList(newTree, 'requiredBy', cache)
return newTree
}
-function copyModuleList (tree, key, cache, filter) {
+function copyModuleList (tree, key, cache) {
var newList = []
if (tree[key]) {
tree[key].forEach(function (child) {
- const copy = copyTree(child, cache, filter)
+ const copy = copyTree(child, cache)
if (copy) {
newList.push(copy)
}
diff --git a/deps/npm/lib/install/decompose-actions.js b/deps/npm/lib/install/decompose-actions.js
index 57dc7cd6874647..ba08e6e7684e51 100644
--- a/deps/npm/lib/install/decompose-actions.js
+++ b/deps/npm/lib/install/decompose-actions.js
@@ -1,72 +1,79 @@
'use strict'
var validate = require('aproba')
-var asyncMap = require('slide').asyncMap
var npm = require('../npm.js')
module.exports = function (differences, decomposed, next) {
validate('AAF', arguments)
- asyncMap(differences, function (action, done) {
+ differences.forEach((action) => {
var cmd = action[0]
var pkg = action[1]
switch (cmd) {
case 'add':
- addSteps(decomposed, pkg, done)
+ addSteps(decomposed, pkg)
break
case 'update':
- updateSteps(decomposed, pkg, done)
+ updateSteps(decomposed, pkg)
break
case 'move':
- moveSteps(decomposed, pkg, done)
+ moveSteps(decomposed, pkg)
break
case 'remove':
- removeSteps(decomposed, pkg, done)
+ removeSteps(decomposed, pkg)
break
default:
- defaultSteps(decomposed, cmd, pkg, done)
+ defaultSteps(decomposed, cmd, pkg)
}
- }, next)
+ })
+ next()
+}
+
+function addAction (decomposed, action, pkg) {
+ if (decomposed.some((_) => _[0] === action && _[1] === pkg)) return
+ decomposed.push([action, pkg])
}
-function addSteps (decomposed, pkg, done) {
+function addSteps (decomposed, pkg) {
+ if (pkg.fromBundle) {
+ // make sure our source module exists to extract ourselves from
+ // if we're installing our source module anyway, the duplication
+ // of these steps will be elided by `addAction` automatically
+ addAction(decomposed, 'fetch', pkg.fromBundle)
+ addAction(decomposed, 'extract', pkg.fromBundle)
+ }
if (!pkg.fromBundle && !pkg.isLink) {
- decomposed.push(['fetch', pkg])
- decomposed.push(['extract', pkg])
+ addAction(decomposed, 'fetch', pkg)
+ addAction(decomposed, 'extract', pkg)
}
if (!pkg.fromBundle || npm.config.get('rebuild-bundle')) {
- decomposed.push(['preinstall', pkg])
- decomposed.push(['build', pkg])
- decomposed.push(['install', pkg])
- decomposed.push(['postinstall', pkg])
+ addAction(decomposed, 'preinstall', pkg)
+ addAction(decomposed, 'build', pkg)
+ addAction(decomposed, 'install', pkg)
+ addAction(decomposed, 'postinstall', pkg)
}
if (!pkg.fromBundle || !pkg.isLink) {
- decomposed.push(['finalize', pkg])
+ addAction(decomposed, 'finalize', pkg)
}
- decomposed.push(['refresh-package-json', pkg])
- done()
+ addAction(decomposed, 'refresh-package-json', pkg)
}
-function updateSteps (decomposed, pkg, done) {
- removeSteps(decomposed, pkg.oldPkg, () => {
- addSteps(decomposed, pkg, done)
- })
+function updateSteps (decomposed, pkg) {
+ removeSteps(decomposed, pkg.oldPkg)
+ addSteps(decomposed, pkg)
}
-function removeSteps (decomposed, pkg, done) {
- decomposed.push(['unbuild', pkg])
- decomposed.push(['remove', pkg])
- done()
+function removeSteps (decomposed, pkg) {
+ addAction(decomposed, 'unbuild', pkg)
+ addAction(decomposed, 'remove', pkg)
}
-function moveSteps (decomposed, pkg, done) {
- decomposed.push(['move', pkg])
- decomposed.push(['build', pkg])
- decomposed.push(['install', pkg])
- decomposed.push(['postinstall', pkg])
- decomposed.push(['refresh-package-json', pkg])
- done()
+function moveSteps (decomposed, pkg) {
+ addAction(decomposed, 'move', pkg)
+ addAction(decomposed, 'build', pkg)
+ addAction(decomposed, 'install', pkg)
+ addAction(decomposed, 'postinstall', pkg)
+ addAction(decomposed, 'refresh-package-json', pkg)
}
-function defaultSteps (decomposed, cmd, pkg, done) {
- decomposed.push([cmd, pkg])
- done()
+function defaultSteps (decomposed, cmd, pkg) {
+ addAction(decomposed, cmd, pkg)
}
diff --git a/deps/npm/lib/install/deps.js b/deps/npm/lib/install/deps.js
index 93c4adffd7e554..c36265093b090b 100644
--- a/deps/npm/lib/install/deps.js
+++ b/deps/npm/lib/install/deps.js
@@ -33,6 +33,7 @@ var getSaveType = require('./save.js').getSaveType
var unixFormatPath = require('../utils/unix-format-path.js')
var isExtraneous = require('./is-extraneous.js')
var isRegistry = require('../utils/is-registry.js')
+var hasModernMeta = require('./has-modern-meta.js')
// The export functions in this module mutate a dependency tree, adding
// items to them.
@@ -50,6 +51,12 @@ function doesChildVersionMatch (child, requested, requestor) {
return path.relative(child.realpath, requested.fetchSpec) === ''
}
+ if (requested.type === 'git' && child.fromShrinkwrap) {
+ const fromSw = child.package._from ? npa(child.package._from) : child.fromShrinkwrap
+ fromSw.name = requested.name // we're only checking specifiers here
+ if (fromSw.toString() === requested.toString()) return true
+ }
+
if (!registryTypes[requested.type]) {
var childReq = child.package._requested
if (childReq) {
@@ -65,7 +72,7 @@ function doesChildVersionMatch (child, requested, requestor) {
// You'll see this scenario happen with at least tags and git dependencies.
// Some buggy clients will write spaces into the module name part of a _from.
if (child.package._from) {
- var fromReq = npa.resolve(moduleName(child), child.package._from.replace(new RegExp('^\s*' + moduleName(child) + '\s*@'), ''))
+ var fromReq = npa.resolve(moduleName(child), child.package._from.replace(new RegExp('^\\s*' + moduleName(child) + '\\s*@'), ''))
if (fromReq.rawSpec === requested.rawSpec) return true
if (fromReq.type === requested.type && fromReq.saveSpec && fromReq.saveSpec === requested.saveSpec) return true
}
@@ -78,8 +85,8 @@ function doesChildVersionMatch (child, requested, requestor) {
}
}
-function childDependencySpecifier (tree, name, spec) {
- return npa.resolve(name, spec, packageRelativePath(tree))
+function childDependencySpecifier (tree, name, spec, where) {
+ return npa.resolve(name, spec, where || packageRelativePath(tree))
}
exports.computeMetadata = computeMetadata
@@ -104,14 +111,13 @@ function computeMetadata (tree, seen) {
resolveWithExistingModule(child, tree)
return true
}
- return
}
const deps = tree.package.dependencies || {}
const reqs = tree.swRequires || {}
for (let name of Object.keys(deps)) {
if (findChild(name, deps[name])) continue
- if (findChild(name, reqs[name])) continue
+ if (name in reqs && findChild(name, reqs[name])) continue
tree.missingDeps[name] = deps[name]
}
if (tree.isTop) {
@@ -186,15 +192,14 @@ function packageRelativePath (tree) {
var requested = tree.package._requested || {}
var isLocal = requested.type === 'directory' || requested.type === 'file'
return isLocal ? requested.fetchSpec
- : (tree.isLink || tree.isInLink) && !preserveSymlinks() ? tree.realpath
- : tree.path
+ : (tree.isLink || tree.isInLink) && !preserveSymlinks() ? tree.realpath
+ : tree.path
}
function matchingDep (tree, name) {
if (!tree || !tree.package) return
if (tree.package.dependencies && tree.package.dependencies[name]) return tree.package.dependencies[name]
if (tree.package.devDependencies && tree.package.devDependencies[name]) return tree.package.devDependencies[name]
- return
}
exports.getAllMetadata = function (args, tree, where, next) {
@@ -261,6 +266,7 @@ exports.loadRequestedDeps = function (args, tree, saveToDependencies, log, next)
delete tree.package[saveType][childName]
}
}
+ if (child.save === 'optionalDependencies') tree.package.dependencies[childName] = child.saveSpec
}
// For things the user asked to install, that aren't a dependency (or
@@ -282,10 +288,12 @@ function computeVersionSpec (tree, child) {
validate('OO', arguments)
var requested
var childReq = child.package._requested
- if (childReq && (isNotEmpty(childReq.saveSpec) || (isNotEmpty(childReq.rawSpec) && isNotEmpty(childReq.fetchSpec)))) {
+ if (child.isLink) {
+ requested = npa.resolve(child.package.name, 'file:' + child.realpath, getTop(tree).path)
+ } else if (childReq && (isNotEmpty(childReq.saveSpec) || (isNotEmpty(childReq.rawSpec) && isNotEmpty(childReq.fetchSpec)))) {
requested = child.package._requested
} else if (child.package._from) {
- requested = npa(child.package._from)
+ requested = npa(child.package._from, tree.path)
} else {
requested = npa.resolve(child.package.name, child.package.version)
}
@@ -299,7 +307,7 @@ function computeVersionSpec (tree, child) {
}
return rangeDescriptor + version
} else if (requested.type === 'directory' || requested.type === 'file') {
- return 'file:' + unixFormatPath(path.relative(tree.path, requested.fetchSpec))
+ return 'file:' + unixFormatPath(path.relative(getTop(tree).path, requested.fetchSpec))
} else {
return requested.saveSpec || requested.rawSpec
}
@@ -332,9 +340,21 @@ exports.removeDeps = function (args, tree, saveToDependencies, next) {
parent.requires = parent.requires.filter((child) => child !== pkgToRemove)
}
pkgToRemove.requiredBy = pkgToRemove.requiredBy.filter((parent) => parent !== tree)
+ flagAsRemoving(pkgToRemove)
}
next()
}
+
+function flagAsRemoving (toRemove, seen) {
+ if (!seen) seen = new Set()
+ if (seen.has(toRemove)) return
+ seen.add(toRemove)
+ toRemove.removing = true
+ toRemove.requires.forEach((required) => {
+ flagAsRemoving(required, seen)
+ })
+}
+
exports.removeExtraneous = function (args, tree, next) {
for (let pkg of args) {
var pkgName = moduleName(pkg)
@@ -369,8 +389,22 @@ function andForEachChild (load, next) {
function isDepOptional (tree, name, pkg) {
if (pkg.package && pkg.package._optional) return true
- if (!tree.package.optionalDependencies) return false
- if (tree.package.optionalDependencies[name] != null) return true
+ const optDeps = tree.package.optionalDependencies
+ if (optDeps && optDeps[name] != null) return true
+
+ const devDeps = tree.package.devDependencies
+ if (devDeps && devDeps[name] != null) {
+ const includeDev = npm.config.get('dev') ||
+ (!/^prod(uction)?$/.test(npm.config.get('only')) && !npm.config.get('production')) ||
+ /^dev(elopment)?$/.test(npm.config.get('only')) ||
+ /^dev(elopment)?$/.test(npm.config.get('also'))
+ return !includeDev
+ }
+ const prodDeps = tree.package.dependencies
+ if (prodDeps && prodDeps[name] != null) {
+ const includeProd = !/^dev(elopment)?$/.test(npm.config.get('only'))
+ return !includeProd
+ }
return false
}
@@ -461,12 +495,6 @@ function loadDeps (tree, log, next) {
if (!tree.package.dependencies) tree.package.dependencies = {}
asyncMap(Object.keys(tree.package.dependencies), function (dep, done) {
var version = tree.package.dependencies[dep]
- if (tree.package.optionalDependencies &&
- tree.package.optionalDependencies[dep] &&
- !npm.config.get('optional')) {
- return done()
- }
-
addDependency(dep, version, tree, log.newGroup('loadDep:' + dep), andHandleOptionalErrors(log, tree, dep, done))
}, andForEachChild(loadDeps, andFinishTracker(log, next)))
}
@@ -481,7 +509,7 @@ exports.loadDevDeps = function (tree, log, next) {
if (tree.package.dependencies[dep]) return done()
var logGroup = log.newGroup('loadDevDep:' + dep)
- addDependency(dep, tree.package.devDependencies[dep], tree, logGroup, done)
+ addDependency(dep, tree.package.devDependencies[dep], tree, logGroup, andHandleOptionalErrors(log, tree, dep, done))
}, andForEachChild(loadDeps, andFinishTracker(log, next)))
}
@@ -519,14 +547,14 @@ function addDependency (name, versionSpec, tree, log, done) {
try {
var req = childDependencySpecifier(tree, name, versionSpec)
if (tree.swRequires && tree.swRequires[name]) {
- var swReq = childDependencySpecifier(tree, name, tree.swRequires[name])
+ var swReq = childDependencySpecifier(tree, name, tree.swRequires[name], tree.package._where)
}
} catch (err) {
return done(err)
}
var child = findRequirement(tree, name, req)
if (!child && swReq) child = findRequirement(tree, name, swReq)
- if (child) {
+ if (hasModernMeta(child)) {
resolveWithExistingModule(child, tree)
if (child.package._shrinkwrap === undefined) {
readShrinkwrap.andInflate(child, function (er) { next(er, child, log) })
@@ -534,12 +562,42 @@ function addDependency (name, versionSpec, tree, log, done) {
next(null, child, log)
}
} else {
+ if (child) {
+ if (req.registry) {
+ req = childDependencySpecifier(tree, name, child.package.version)
+ }
+ if (child.fromBundle) reportBundleOverride(child, log)
+ removeObsoleteDep(child, log)
+ }
fetchPackageMetadata(req, packageRelativePath(tree), {tracker: log.newItem('fetchMetadata')}, iferr(next, function (pkg) {
resolveWithNewModule(pkg, tree, log, next)
}))
}
}
+function getTop (pkg) {
+ const seen = new Set()
+ while (pkg.parent && !seen.has(pkg.parent)) {
+ pkg = pkg.parent
+ seen.add(pkg)
+ }
+ return pkg
+}
+
+function reportBundleOverride (child, log) {
+ const code = 'EBUNDLEOVERRIDE'
+ const top = getTop(child.fromBundle)
+ const bundlerId = packageId(child.fromBundle)
+ if (!top.warnings.some((w) => {
+ return w.code === code
+ })) {
+ const err = new Error(`${bundlerId} had bundled packages that do not match the required version(s). They have been replaced with non-bundled versions.`)
+ err.code = code
+ top.warnings.push(err)
+ }
+ if (log) log.verbose('bundle', `${code}: Replacing ${bundlerId}'s bundled version of ${moduleName(child)} with ${packageId(child)}.`)
+}
+
function resolveWithExistingModule (child, tree) {
validate('OO', arguments)
addRequiredDep(tree, child)
@@ -592,7 +650,7 @@ function resolveWithNewModule (pkg, tree, log, next) {
return isInstallable(pkg, (err) => {
let installable = !err
addBundled(pkg, (bundleErr) => {
- var parent = earliestInstallable(tree, tree, pkg) || tree
+ var parent = earliestInstallable(tree, tree, pkg, log) || tree
var isLink = pkg._requested.type === 'directory'
var child = createChild({
package: pkg,
@@ -609,7 +667,10 @@ function resolveWithNewModule (pkg, tree, log, next) {
var hasBundled = child.children.length
var replaced = replaceModuleByName(parent, 'children', child)
- if (replaced) removeObsoleteDep(replaced)
+ if (replaced) {
+ if (replaced.fromBundle) reportBundleOverride(replaced, log)
+ removeObsoleteDep(replaced)
+ }
addRequiredDep(tree, child)
child.location = flatNameFromTree(child)
@@ -694,12 +755,25 @@ function preserveSymlinks () {
// Find the highest level in the tree that we can install this module in.
// If the module isn't installed above us yet, that'd be the very top.
// If it is, then it's the level below where its installed.
-var earliestInstallable = exports.earliestInstallable = function (requiredBy, tree, pkg) {
- validate('OOO', arguments)
+var earliestInstallable = exports.earliestInstallable = function (requiredBy, tree, pkg, log) {
+ validate('OOOO', arguments)
+
function undeletedModuleMatches (child) {
return !child.removed && moduleName(child) === pkg.name
}
- if (tree.children.some(undeletedModuleMatches)) return null
+ const undeletedMatches = tree.children.filter(undeletedModuleMatches)
+ if (undeletedMatches.length) {
+ // if there's a conflict with another child AT THE SAME level then we're replacing it, so
+ // mark it as removed and continue with resolution normally.
+ if (tree === requiredBy) {
+ undeletedMatches.forEach((pkg) => {
+ if (pkg.fromBundle) reportBundleOverride(pkg, log)
+ removeObsoleteDep(pkg, log)
+ })
+ } else {
+ return null
+ }
+ }
// If any of the children of this tree have conflicting
// binaries then we need to decline to install this package here.
@@ -738,5 +812,5 @@ var earliestInstallable = exports.earliestInstallable = function (requiredBy, tr
if (!preserveSymlinks() && /^[.][.][\\/]/.test(path.relative(tree.parent.realpath, tree.realpath))) return tree
- return (earliestInstallable(requiredBy, tree.parent, pkg) || tree)
+ return (earliestInstallable(requiredBy, tree.parent, pkg, log) || tree)
}
diff --git a/deps/npm/lib/install/diff-trees.js b/deps/npm/lib/install/diff-trees.js
index 4316f351cc6f6a..346846fdc0ffed 100644
--- a/deps/npm/lib/install/diff-trees.js
+++ b/deps/npm/lib/install/diff-trees.js
@@ -8,6 +8,7 @@ var log = require('npmlog')
var path = require('path')
var ssri = require('ssri')
var moduleName = require('../utils/module-name.js')
+var isOnlyOptional = require('./is-only-optional.js')
// we don't use get-requested because we're operating on files on disk, and
// we don't want to extropolate from what _should_ be there.
@@ -50,7 +51,7 @@ function pkgIntegrity (pkg) {
if (Object.keys(integrity).length === 0) return
return integrity
} catch (ex) {
- return
+
}
}
@@ -70,6 +71,9 @@ function sriMatch (aa, bb) {
function pkgAreEquiv (aa, bb) {
// coming in we know they share a path…
+ // if one is inside a link and the other is not, then they are not equivalent
+ // this happens when we're replacing a linked dep with a non-linked version
+ if (aa.isInLink !== bb.isInLink) return false
// if they share package metadata _identity_, they're the same thing
if (aa.package === bb.package) return true
// if they share integrity information, they're the same thing
@@ -162,6 +166,11 @@ var sortActions = module.exports.sortActions = function (differences) {
sorted.unshift(action)
}
+ // safety net, anything excluded above gets tacked on the end
+ differences.forEach((_) => {
+ if (sorted.indexOf(_) === -1) sorted.push(_)
+ })
+
return sorted
}
@@ -213,9 +222,8 @@ var diffTrees = module.exports._diffTrees = function (oldTree, newTree) {
pkg.fromPath = toMv.pkg.path
setAction(differences, 'move', pkg)
delete toRemove[toMv.flatname]
- // we don't generate add actions for things found in links (which already exist on disk) or
- // for bundled modules (which will be installed when we install their parent)
- } else if (!(pkg.isInLink && pkg.fromBundle)) {
+ // we don't generate add actions for things found in links (which already exist on disk)
+ } else if (!pkg.isInLink || !(pkg.fromBundle && pkg.fromBundle.isLink)) {
setAction(differences, 'add', pkg)
}
}
@@ -227,18 +235,26 @@ var diffTrees = module.exports._diffTrees = function (oldTree, newTree) {
.map((flatname) => toRemove[flatname])
.forEach((pkg) => setAction(differences, 'remove', pkg))
+ return filterActions(differences)
+}
+
+function filterActions (differences) {
+ const includeOpt = npm.config.get('optional')
const includeDev = npm.config.get('dev') ||
(!/^prod(uction)?$/.test(npm.config.get('only')) && !npm.config.get('production')) ||
/^dev(elopment)?$/.test(npm.config.get('only')) ||
/^dev(elopment)?$/.test(npm.config.get('also'))
const includeProd = !/^dev(elopment)?$/.test(npm.config.get('only'))
- if (!includeProd || !includeDev) {
- log.silly('diff-trees', 'filtering actions:', 'includeDev', includeDev, 'includeProd', includeProd)
- differences = differences.filter((diff) => {
- const pkg = diff[1]
- const pkgIsOnlyDev = isOnlyDev(pkg)
- return (!includeProd && pkgIsOnlyDev) || (includeDev && pkgIsOnlyDev) || (includeProd && !pkgIsOnlyDev)
- })
- }
- return differences
+ if (includeProd && includeDev && includeOpt) return differences
+
+ log.silly('diff-trees', 'filtering actions:', 'includeDev', includeDev, 'includeProd', includeProd, 'includeOpt', includeOpt)
+ return differences.filter((diff) => {
+ const pkg = diff[1]
+ const pkgIsOnlyDev = isOnlyDev(pkg)
+ const pkgIsOnlyOpt = isOnlyOptional(pkg)
+ if (!includeProd && pkgIsOnlyDev) return true
+ if (includeDev && pkgIsOnlyDev) return true
+ if (includeProd && !pkgIsOnlyDev && (includeOpt || !pkgIsOnlyOpt)) return true
+ return false
+ })
}
diff --git a/deps/npm/lib/install/get-requested.js b/deps/npm/lib/install/get-requested.js
index f6c44d14634356..ab410ffc9b6e3c 100644
--- a/deps/npm/lib/install/get-requested.js
+++ b/deps/npm/lib/install/get-requested.js
@@ -2,9 +2,9 @@
const npa = require('npm-package-arg')
const moduleName = require('../utils/module-name.js')
-module.exports = function (child) {
+module.exports = function (child, reqBy) {
if (!child.requiredBy.length) return
- const reqBy = child.requiredBy[0]
+ if (!reqBy) reqBy = child.requiredBy[0]
const deps = reqBy.package.dependencies || {}
const devDeps = reqBy.package.devDependencies || {}
const name = moduleName(child)
diff --git a/deps/npm/lib/install/has-modern-meta.js b/deps/npm/lib/install/has-modern-meta.js
new file mode 100644
index 00000000000000..bf801d0d31f5f7
--- /dev/null
+++ b/deps/npm/lib/install/has-modern-meta.js
@@ -0,0 +1,20 @@
+'use strict'
+module.exports = hasModernMeta
+
+const npa = require('npm-package-arg')
+const moduleName = require('../utils/module-name.js')
+
+function isLink (child) {
+ return child.isLink || (child.parent && isLink(child.parent))
+}
+
+function hasModernMeta (child) {
+ if (!child) return false
+ const resolved = child.package._resolved && npa.resolve(moduleName(child), child.package._resolved)
+ const version = npa.resolve(moduleName(child), child.package.version)
+ return child.isTop ||
+ isLink(child) ||
+ child.fromBundle || child.package._inBundle ||
+ child.package._integrity || child.package._shasum ||
+ (resolved && resolved.type === 'git') || (version && version.type === 'git')
+}
diff --git a/deps/npm/lib/install/inflate-shrinkwrap.js b/deps/npm/lib/install/inflate-shrinkwrap.js
index 43ac9136f010f4..bf1ab7065724c8 100644
--- a/deps/npm/lib/install/inflate-shrinkwrap.js
+++ b/deps/npm/lib/install/inflate-shrinkwrap.js
@@ -14,6 +14,9 @@ const realizeShrinkwrapSpecifier = require('./realize-shrinkwrap-specifier.js')
const validate = require('aproba')
const path = require('path')
const isRegistry = require('../utils/is-registry.js')
+const hasModernMeta = require('./has-modern-meta.js')
+const ssri = require('ssri')
+const npa = require('npm-package-arg')
module.exports = function (tree, sw, opts, finishInflating) {
if (!fetchPackageMetadata) {
@@ -66,11 +69,43 @@ function normalizePackageDataNoErrors (pkg) {
}
}
+function quotemeta (str) {
+ return str.replace(/([^A-Za-z_0-9/])/g, '\\$1')
+}
+
+function tarballToVersion (name, tb) {
+ const registry = quotemeta(npm.config.get('registry'))
+ .replace(/https?:/, 'https?:')
+ .replace(/([^/])$/, '$1/')
+ let matchRegTarball
+ if (name) {
+ const nameMatch = quotemeta(name)
+ matchRegTarball = new RegExp(`^${registry}${nameMatch}/-/${nameMatch}-(.*)[.]tgz$`)
+ } else {
+ matchRegTarball = new RegExp(`^${registry}(.*)?/-/\\1-(.*)[.]tgz$`)
+ }
+ const match = tb.match(matchRegTarball)
+ if (!match) return
+ return match[2] || match[1]
+}
+
function inflatableChild (onDiskChild, name, topPath, tree, sw, requested, opts) {
validate('OSSOOOO|ZSSOOOO', arguments)
- if (onDiskChild && childIsEquivalent(sw, requested, onDiskChild)) {
+ const usesIntegrity = (
+ requested.registry ||
+ requested.type === 'remote' ||
+ requested.type === 'file'
+ )
+ const regTarball = tarballToVersion(name, sw.version)
+ if (regTarball) {
+ sw.resolved = sw.version
+ sw.version = regTarball
+ }
+ if (sw.requires) Object.keys(sw.requires).map(_ => { sw.requires[_] = tarballToVersion(_, sw.requires[_]) || sw.requires[_] })
+ const modernLink = requested.type === 'directory' && !sw.from
+ if (hasModernMeta(onDiskChild) && childIsEquivalent(sw, requested, onDiskChild)) {
// The version on disk matches the shrinkwrap entry.
- if (!onDiskChild.fromShrinkwrap) onDiskChild.fromShrinkwrap = true
+ if (!onDiskChild.fromShrinkwrap) onDiskChild.fromShrinkwrap = requested
onDiskChild.package._requested = requested
onDiskChild.package._spec = requested.rawSpec
onDiskChild.package._where = topPath
@@ -88,7 +123,7 @@ function inflatableChild (onDiskChild, name, topPath, tree, sw, requested, opts)
onDiskChild.swRequires = sw.requires
tree.children.push(onDiskChild)
return BB.resolve(onDiskChild)
- } else if ((sw.version && sw.integrity) || sw.bundled) {
+ } else if ((sw.version && (sw.integrity || !usesIntegrity) && (requested.type !== 'directory' || modernLink)) || sw.bundled) {
// The shrinkwrap entry has an integrity field. We can fake a pkg to get
// the installer to do a content-address fetch from the cache, if possible.
return BB.resolve(makeFakeChild(name, topPath, tree, sw, requested))
@@ -100,13 +135,18 @@ function inflatableChild (onDiskChild, name, topPath, tree, sw, requested, opts)
}
}
+function isGit (sw) {
+ const version = npa.resolve(sw.name, sw.version)
+ return (version && version.type === 'git')
+}
+
function makeFakeChild (name, topPath, tree, sw, requested) {
const from = sw.from || requested.raw
const pkg = {
name: name,
version: sw.version,
_id: name + '@' + sw.version,
- _resolved: adaptResolved(requested, sw.resolved),
+ _resolved: sw.resolved || (isGit(sw) && sw.version),
_requested: requested,
_optional: sw.optional,
_development: sw.dev,
@@ -127,15 +167,15 @@ function makeFakeChild (name, topPath, tree, sw, requested) {
}
const child = createChild({
package: pkg,
- loaded: true,
+ loaded: false,
parent: tree,
children: [],
- fromShrinkwrap: true,
+ fromShrinkwrap: requested,
fakeChild: sw,
fromBundle: sw.bundled ? tree.fromBundle || tree : null,
path: childPath(tree.path, pkg),
- realpath: childPath(tree.realpath, pkg),
- location: tree.location + '/' + pkg.name,
+ realpath: requested.type === 'directory' ? requested.fetchSpec : childPath(tree.realpath, pkg),
+ location: (tree.location === '/' ? '' : tree.location + '/') + pkg.name,
isLink: requested.type === 'directory',
isInLink: tree.isLink,
swRequires: sw.requires
@@ -144,23 +184,6 @@ function makeFakeChild (name, topPath, tree, sw, requested) {
return child
}
-function adaptResolved (requested, resolved) {
- const registry = requested.scope
- ? npm.config.get(`${requested.scope}:registry`) || npm.config.get('registry')
- : npm.config.get('registry')
- if (!isRegistry(requested) || (resolved && resolved.indexOf(registry) === 0)) {
- // Nothing to worry about here. Pass it through.
- return resolved
- } else {
- // We could fast-path for registry.npmjs.org here, but if we do, it
- // would end up getting written back to the `resolved` field. By always
- // returning `null` for other registries, `pacote.extract()` will take
- // care of any required metadata fetches internally, without altering
- // the tree we're going to write out to shrinkwrap/lockfile.
- return null
- }
-}
-
function fetchChild (topPath, tree, sw, requested) {
return fetchPackageMetadata(requested, topPath).then((pkg) => {
pkg._from = sw.from || requested.raw
@@ -178,7 +201,7 @@ function fetchChild (topPath, tree, sw, requested) {
path: childPath(tree.path, pkg),
realpath: isLink ? requested.fetchSpec : childPath(tree.realpath, pkg),
children: pkg._bundled || [],
- location: tree.location + '/' + pkg.name,
+ location: (tree.location === '/' ? '' : tree.location + '/') + pkg.name,
fromBundle: null,
isLink: isLink,
isInLink: tree.isLink,
@@ -196,7 +219,11 @@ function fetchChild (topPath, tree, sw, requested) {
function childIsEquivalent (sw, requested, child) {
if (!child) return false
if (child.fromShrinkwrap) return true
- if (sw.integrity && child.package._integrity === sw.integrity) return true
+ if (
+ sw.integrity &&
+ child.package._integrity &&
+ ssri.parse(sw.integrity).match(child.package._integrity)
+ ) return true
if (child.isLink && requested.type === 'directory') return path.relative(child.realpath, requested.fetchSpec) === ''
if (sw.resolved) return child.package._resolved === sw.resolved
diff --git a/deps/npm/lib/install/is-only-optional.js b/deps/npm/lib/install/is-only-optional.js
index 7366e9abe1b326..72d6f065e6745b 100644
--- a/deps/npm/lib/install/is-only-optional.js
+++ b/deps/npm/lib/install/is-only-optional.js
@@ -11,8 +11,9 @@ function isOptional (node, seen) {
return false
}
seen.add(node)
-
+ const swOptional = node.fromShrinkwrap && node.package._optional
return node.requiredBy.every(function (req) {
+ if (req.fakeChild && swOptional) return true
return isOptDep(req, node.package.name) || isOptional(req, seen)
})
}
diff --git a/deps/npm/lib/install/read-shrinkwrap.js b/deps/npm/lib/install/read-shrinkwrap.js
index 45e883caa2f5e2..70746780111275 100644
--- a/deps/npm/lib/install/read-shrinkwrap.js
+++ b/deps/npm/lib/install/read-shrinkwrap.js
@@ -25,14 +25,7 @@ function readShrinkwrap (child, next) {
log.warn('read-shrinkwrap', 'Ignoring package-lock.json because there is already an npm-shrinkwrap.json. Please use only one of the two.')
}
const name = shrinkwrap ? 'npm-shrinkwrap.json' : 'package-lock.json'
- let parsed = null
- if (shrinkwrap || lockfile) {
- try {
- parsed = parseJSON(shrinkwrap || lockfile)
- } catch (ex) {
- throw ex
- }
- }
+ const parsed = parsePkgLock(shrinkwrap || lockfile, name)
if (parsed && parsed.lockfileVersion !== PKGLOCK_VERSION) {
log.warn('read-shrinkwrap', `This version of npm is compatible with lockfileVersion@${PKGLOCK_VERSION}, but ${name} was generated for lockfileVersion@${parsed.lockfileVersion || 0}. I'll try to do my best with it!`)
}
@@ -43,7 +36,8 @@ function readShrinkwrap (child, next) {
function maybeReadFile (name, child) {
return readFileAsync(
- path.join(child.path, name)
+ path.join(child.path, name),
+ 'utf8'
).catch({code: 'ENOENT'}, () => null)
}
@@ -56,3 +50,59 @@ module.exports.andInflate = function (child, next) {
}
}))
}
+
+const PARENT_RE = /\|{7,}/g
+const OURS_RE = /<{7,}/g
+const THEIRS_RE = /={7,}/g
+const END_RE = />{7,}/g
+
+module.exports._isDiff = isDiff
+function isDiff (str) {
+ return str.match(OURS_RE) && str.match(THEIRS_RE) && str.match(END_RE)
+}
+
+module.exports._parsePkgLock = parsePkgLock
+function parsePkgLock (str, filename) {
+ if (!str) { return null }
+ try {
+ return parseJSON(str)
+ } catch (e) {
+ if (isDiff(str)) {
+ log.warn('conflict', `A git conflict was detected in ${filename}. Attempting to auto-resolve.`)
+ log.warn('conflict', 'To make this happen automatically on git rebase/merge, consider using the npm-merge-driver:')
+ log.warn('conflict', '$ npx npm-merge-driver install -g')
+ const pieces = str.split(/[\n\r]+/g).reduce((acc, line) => {
+ if (line.match(PARENT_RE)) acc.state = 'parent'
+ else if (line.match(OURS_RE)) acc.state = 'ours'
+ else if (line.match(THEIRS_RE)) acc.state = 'theirs'
+ else if (line.match(END_RE)) acc.state = 'top'
+ else {
+ if (acc.state === 'top' || acc.state === 'ours') acc.ours += line
+ if (acc.state === 'top' || acc.state === 'theirs') acc.theirs += line
+ if (acc.state === 'top' || acc.state === 'parent') acc.parent += line
+ }
+ return acc
+ }, {
+ state: 'top',
+ ours: '',
+ theirs: '',
+ parent: ''
+ })
+ try {
+ const ours = parseJSON(pieces.ours)
+ const theirs = parseJSON(pieces.theirs)
+ return reconcileLockfiles(ours, theirs)
+ } catch (_e) {
+ log.error('conflict', `Automatic conflict resolution failed. Please manually resolve conflicts in ${filename} and try again.`)
+ log.silly('conflict', `Error during resolution: ${_e}`)
+ throw e
+ }
+ } else {
+ throw e
+ }
+ }
+}
+
+function reconcileLockfiles (parent, ours, theirs) {
+ return Object.assign({}, ours, theirs)
+}
diff --git a/deps/npm/lib/install/save.js b/deps/npm/lib/install/save.js
index f0c61f555d64e4..8bafcbfc6b928c 100644
--- a/deps/npm/lib/install/save.js
+++ b/deps/npm/lib/install/save.js
@@ -1,8 +1,8 @@
'use strict'
-const createShrinkwrap = require('../shrinkwrap.js').createShrinkwrap
const deepSortObject = require('../utils/deep-sort-object.js')
const detectIndent = require('detect-indent')
+const detectNewline = require('detect-newline')
const fs = require('graceful-fs')
const iferr = require('iferr')
const log = require('npmlog')
@@ -10,6 +10,7 @@ const moduleName = require('../utils/module-name.js')
const npm = require('../npm.js')
const parseJSON = require('../utils/parse-json.js')
const path = require('path')
+const stringifyPackage = require('../utils/stringify-package')
const validate = require('aproba')
const without = require('lodash.without')
const writeFileAtomic = require('write-file-atomic')
@@ -44,9 +45,9 @@ exports.saveShrinkwrap = saveShrinkwrap
function saveShrinkwrap (tree, next) {
validate('OF', arguments)
if (!npm.config.get('shrinkwrap') || !npm.config.get('package-lock')) {
- next()
+ return next()
}
- createShrinkwrap(tree, {silent: false}, next)
+ require('../shrinkwrap.js').createShrinkwrap(tree, {silent: false}, next)
}
function savePackageJson (tree, next) {
@@ -60,7 +61,8 @@ function savePackageJson (tree, next) {
// don't use readJson, because we don't want to do all the other
// tricky npm-specific stuff that's in there.
fs.readFile(saveTarget, 'utf8', iferr(next, function (packagejson) {
- const indent = detectIndent(packagejson).indent || ' '
+ const indent = detectIndent(packagejson).indent
+ const newline = detectNewline(packagejson)
try {
tree.package = parseJSON(packagejson)
} catch (ex) {
@@ -122,7 +124,7 @@ function savePackageJson (tree, next) {
tree.package.bundleDependencies = deepSortObject(bundle)
}
- var json = JSON.stringify(tree.package, null, indent) + '\n'
+ var json = stringifyPackage(tree.package, indent, newline)
if (json === packagejson) {
log.verbose('shrinkwrap', 'skipping write for package.json because there were no changes.')
next()
diff --git a/deps/npm/lib/link.js b/deps/npm/lib/link.js
index 158d9b06456ba3..e05526c4080d3b 100644
--- a/deps/npm/lib/link.js
+++ b/deps/npm/lib/link.js
@@ -25,7 +25,7 @@ link.completion = function (opts, cb) {
var dir = npm.globalDir
fs.readdir(dir, function (er, files) {
cb(er, files.filter(function (f) {
- return !f.match(/^[\._-]/)
+ return !f.match(/^[._-]/)
}))
})
}
@@ -37,7 +37,7 @@ function link (args, cb) {
var msg = 'npm link not supported on windows prior to node 0.7.9'
var e = new Error(msg)
e.code = 'ENOTSUP'
- e.errno = require('constants').ENOTSUP
+ e.errno = require('constants').ENOTSUP // eslint-disable-line node/no-deprecated-api
return cb(e)
}
}
@@ -148,8 +148,8 @@ function linkPkg (folder, cb_) {
er = new Error('Package must have a name field to be linked')
return cb(er)
}
- if (npm.config.get('dry-run')) return resultPrinter(path.basename(me), me, target, cb)
var target = path.resolve(npm.globalDir, d.name)
+ if (npm.config.get('dry-run')) return resultPrinter(path.basename(me), me, target, cb)
symlink(me, target, false, true, function (er) {
if (er) return cb(er)
log.verbose('link', 'build target', target)
diff --git a/deps/npm/lib/ls.js b/deps/npm/lib/ls.js
index 7c0ea71e773f98..bb5e433f78fdea 100644
--- a/deps/npm/lib/ls.js
+++ b/deps/npm/lib/ls.js
@@ -139,9 +139,9 @@ function filterByEnv (data) {
return
}
- if ((dev && inList(devKeys, name)) || // only --dev
- (production && inList(prodKeys, name)) || // only --production
- (!dev && !production)) { // no --production|--dev|--only=xxx
+ if ((dev && inList(devKeys, name)) || // only --dev
+ (production && inList(prodKeys, name)) || // only --production
+ (!dev && !production)) { // no --production|--dev|--only=xxx
dependencies[name] = data.dependencies[name]
}
})
@@ -165,7 +165,7 @@ function alphasort (a, b) {
a = a.toLowerCase()
b = b.toLowerCase()
return a > b ? 1
- : a < b ? -1 : 0
+ : a < b ? -1 : 0
}
function isCruft (data) {
@@ -520,16 +520,16 @@ function makeParseable_ (data, long, dir, depth, parent, d) {
if (data.missing) {
if (depth < npm.config.get('depth')) {
data = npm.config.get('long')
- ? path.resolve(parent.path, 'node_modules', d) +
+ ? path.resolve(parent.path, 'node_modules', d) +
':' + d + '@' + JSON.stringify(data.requiredBy) + ':INVALID:MISSING'
- : ''
+ : ''
} else {
data = path.resolve(dir || '', 'node_modules', d || '') +
(npm.config.get('long')
- ? ':' + d + '@' + JSON.stringify(data.requiredBy) +
+ ? ':' + d + '@' + JSON.stringify(data.requiredBy) +
':' + // no realpath resolved
':MAXDEPTH'
- : '')
+ : '')
}
return data
diff --git a/deps/npm/lib/npm.js b/deps/npm/lib/npm.js
index e58712603bf839..da5a3636021223 100644
--- a/deps/npm/lib/npm.js
+++ b/deps/npm/lib/npm.js
@@ -1,6 +1,6 @@
;(function () {
// windows: running 'npm blah' in this folder will invoke WSH, not node.
- /*globals WScript*/
+ /* globals WScript */
if (typeof WScript !== 'undefined') {
WScript.echo(
'npm does not work when run\n' +
@@ -164,11 +164,13 @@
})
return commandCache[a]
- }, enumerable: fullList.indexOf(c) !== -1, configurable: true })
+ },
+ enumerable: fullList.indexOf(c) !== -1,
+ configurable: true })
// make css-case commands callable via camelCase as well
- if (c.match(/\-([a-z])/)) {
- addCommand(c.replace(/\-([a-z])/g, function (a, b) {
+ if (c.match(/-([a-z])/)) {
+ addCommand(c.replace(/-([a-z])/g, function (a, b) {
return b.toUpperCase()
}))
}
@@ -189,7 +191,9 @@
}
if (plumbing.indexOf(c) !== -1) return c
var a = abbrevs[c]
- if (aliases[a]) a = aliases[a]
+ while (aliases[a]) {
+ a = aliases[a]
+ }
return a
}
@@ -288,7 +292,11 @@
var color = config.get('color')
- log.level = config.get('loglevel')
+ if (npm.config.get('timing') && npm.config.get('loglevel') === 'notice') {
+ log.level = 'timing'
+ } else {
+ log.level = config.get('loglevel')
+ }
log.heading = config.get('heading') || 'npm'
log.stream = config.get('logstream')
@@ -411,8 +419,8 @@
{
get: function () {
return (process.platform !== 'win32')
- ? path.resolve(npm.globalPrefix, 'lib', 'node_modules')
- : path.resolve(npm.globalPrefix, 'node_modules')
+ ? path.resolve(npm.globalPrefix, 'lib', 'node_modules')
+ : path.resolve(npm.globalPrefix, 'node_modules')
},
enumerable: true
})
@@ -455,7 +463,9 @@
}
npm.commands[n](args, cb)
}
- }, enumerable: false, configurable: true })
+ },
+ enumerable: false,
+ configurable: true })
})
if (require.main === module) {
diff --git a/deps/npm/lib/outdated.js b/deps/npm/lib/outdated.js
index a38137b66c88c5..8b0a43d6ba336c 100644
--- a/deps/npm/lib/outdated.js
+++ b/deps/npm/lib/outdated.js
@@ -24,13 +24,14 @@ var os = require('os')
var url = require('url')
var path = require('path')
var readPackageTree = require('read-package-tree')
-var readJson = require('read-package-json')
var asyncMap = require('slide').asyncMap
var color = require('ansicolors')
var styles = require('ansistyles')
var table = require('text-table')
var semver = require('semver')
var npa = require('npm-package-arg')
+var pickManifest = require('npm-pick-manifest')
+var fetchPackageMetadata = require('./fetch-package-metadata.js')
var mutateIntoLogicalTree = require('./install/mutate-into-logical-tree.js')
var npm = require('./npm.js')
var long = npm.config.get('long')
@@ -41,7 +42,6 @@ var computeVersionSpec = require('./install/deps.js').computeVersionSpec
var moduleName = require('./utils/module-name.js')
var output = require('./utils/output.js')
var ansiTrim = require('./utils/ansi-trim')
-var fetchPackageMetadata = require('./fetch-package-metadata.js')
function uniq (list) {
// we maintain the array because we need an array, not iterator, return
@@ -89,11 +89,11 @@ function outdated (args, silent, cb) {
} else {
var outList = list.map(makePretty)
var outHead = [ 'Package',
- 'Current',
- 'Wanted',
- 'Latest',
- 'Location'
- ]
+ 'Current',
+ 'Wanted',
+ 'Latest',
+ 'Location'
+ ]
if (long) outHead.push('Package Type')
var outTable = [outHead].concat(outList)
@@ -117,25 +117,19 @@ function outdated (args, silent, cb) {
// [[ dir, dep, has, want, latest, type ]]
function makePretty (p) {
- var dep = p[0]
var depname = p[1]
- var dir = dep.path
var has = p[2]
var want = p[3]
var latest = p[4]
var type = p[6]
var deppath = p[7]
- if (!npm.config.get('global')) {
- dir = path.relative(process.cwd(), dir)
- }
-
var columns = [ depname,
- has || 'MISSING',
- want,
- latest,
- deppath
- ]
+ has || 'MISSING',
+ want,
+ latest,
+ deppath
+ ]
if (long) columns[5] = type
if (npm.color) {
@@ -183,10 +177,10 @@ function makeJSON (list) {
dir = path.relative(process.cwd(), dir)
}
out[depname] = { current: has,
- wanted: want,
- latest: latest,
- location: dir
- }
+ wanted: want,
+ latest: latest,
+ location: dir
+ }
if (long) out[depname].type = type
})
return JSON.stringify(out, null, 2)
@@ -202,13 +196,15 @@ function outdated_ (args, path, tree, parentHas, depth, cb) {
var types = {}
var pkg = tree.package
+ if (!tree.children) tree.children = []
+
var deps = tree.error ? tree.children : tree.children.filter((child) => !isExtraneous(child))
deps.forEach(function (dep) {
types[moduleName(dep)] = 'dependencies'
})
- Object.keys(tree.missingDeps).forEach(function (name) {
+ Object.keys(tree.missingDeps || {}).forEach(function (name) {
deps.push({
package: { name: name },
path: tree.path,
@@ -262,7 +258,7 @@ function outdated_ (args, path, tree, parentHas, depth, cb) {
!npm.config.get('global')
)
if (doUpdate) {
- Object.keys(pkg.devDependencies).forEach(function (k) {
+ Object.keys(pkg.devDependencies || {}).forEach(function (k) {
if (!(k in parentHas)) {
deps[k] = pkg.devDependencies[k]
types[k] = 'devDependencies'
@@ -276,8 +272,8 @@ function outdated_ (args, path, tree, parentHas, depth, cb) {
deps = deps.filter(function (dep) { return dep !== child })
}
has[child.package.name] = {
- version: child.package.version,
- from: child.package._from
+ version: child.isLink ? 'linked' : child.package.version,
+ from: child.isLink ? 'file:' + child.path : child.package._from
}
})
@@ -286,11 +282,17 @@ function outdated_ (args, path, tree, parentHas, depth, cb) {
// otherwise dive into the folder
asyncMap(deps, function (dep, cb) {
var name = moduleName(dep)
- var required = (tree.package.dependencies)[name] ||
- (tree.package.optionalDependencies)[name] ||
- (tree.package.devDependencies)[name] ||
- computeVersionSpec(tree, dep) ||
- '*'
+ var required
+ if (tree.package.dependencies && name in tree.package.dependencies) {
+ required = tree.package.dependencies[name]
+ } else if (tree.package.optionalDependencies && name in tree.package.optionalDependencies) {
+ required = tree.package.optionalDependencies[name]
+ } else if (tree.package.devDependencies && name in tree.package.devDependencies) {
+ required = tree.package.devDependencies[name]
+ } else if (has[name]) {
+ required = computeVersionSpec(tree, dep)
+ }
+
if (!long) return shouldUpdate(args, dep, name, has, required, depth, path, cb)
shouldUpdate(args, dep, name, has, required, depth, path, cb, types[name])
@@ -309,11 +311,11 @@ function shouldUpdate (args, tree, dep, has, req, depth, pkgpath, cb, type) {
// show user that no viable version can be found
if (er) return cb(er)
outdated_(args,
- pkgpath,
- tree,
- has,
- depth + 1,
- cb)
+ pkgpath,
+ tree,
+ has,
+ depth + 1,
+ cb)
}
function doIt (wanted, latest) {
@@ -324,23 +326,32 @@ function shouldUpdate (args, tree, dep, has, req, depth, pkgpath, cb, type) {
}
if (args.length && args.indexOf(dep) === -1) return skip()
+
+ if (tree.isLink && req == null) return skip()
+
+ if (req == null || req === '') req = '*'
+
var parsed = npa.resolve(dep, req)
- if (tree.isLink && tree.parent && tree.parent.isTop) {
- return doIt('linked', 'linked')
- }
- if (parsed.type === 'git' || parsed.type === 'hosted') {
+ if (parsed.type === 'directory') {
+ if (tree.isLink) {
+ return skip()
+ } else {
+ return doIt('linked', 'linked')
+ }
+ } else if (parsed.type === 'git') {
return doIt('git', 'git')
- }
+ } else if (parsed.type === 'file') {
+ return updateLocalDeps()
+ } else {
+ return mapToRegistry(dep, npm.config, function (er, uri, auth) {
+ if (er) return cb(er)
- // search for the latest package
- mapToRegistry(dep, npm.config, function (er, uri, auth) {
- if (er) return cb(er)
-
- npm.registry.get(uri, { auth: auth }, updateDeps)
- })
+ npm.registry.get(uri, { auth: auth }, updateDeps)
+ })
+ }
function updateLocalDeps (latestRegistryVersion) {
- readJson(path.resolve(parsed.fetchSpec, 'package.json'), function (er, localDependency) {
+ fetchPackageMetadata('file:' + parsed.fetchSpec, '.', (er, localDependency) => {
if (er) return cb()
var wanted = localDependency.version
@@ -363,63 +374,31 @@ function shouldUpdate (args, tree, dep, has, req, depth, pkgpath, cb, type) {
}
function updateDeps (er, d) {
- if (er) {
- if (parsed.type !== 'directory' && parsed.type !== 'file') return cb(er)
- return updateLocalDeps()
- }
-
- if (!d || !d['dist-tags'] || !d.versions) return cb()
- var l = d.versions[d['dist-tags'].latest]
- if (!l) return cb()
-
- var r = req
- if (d['dist-tags'][req]) {
- r = d['dist-tags'][req]
- }
-
- if (semver.validRange(r, true)) {
- // some kind of semver range.
- // see if it's in the doc.
- var vers = Object.keys(d.versions)
- var v = semver.maxSatisfying(vers, r, true)
- if (v) {
- return onCacheAdd(null, d.versions[v])
- }
- }
+ if (er) return cb(er)
- // We didn't find the version in the doc. See if we can find it in metadata.
- var spec = dep
- if (req) {
- spec = dep + '@' + req
- }
- fetchPackageMetadata(spec, '', onCacheAdd)
-
- function onCacheAdd (er, d) {
- // if this fails, then it means we can't update this thing.
- // it's probably a thing that isn't published.
- if (er) {
- if (er.code && er.code === 'ETARGET') {
- // no viable version found
- return skip(er)
- }
+ try {
+ var l = pickManifest(d, 'latest')
+ var m = pickManifest(d, req)
+ } catch (er) {
+ if (er.code === 'ETARGET') {
+ return skip(er)
+ } else {
return skip()
}
+ }
- // check that the url origin hasn't changed (#1727) and that
- // there is no newer version available
- var dFromUrl = d._from && url.parse(d._from).protocol
- var cFromUrl = curr && curr.from && url.parse(curr.from).protocol
-
- if (!curr ||
- dFromUrl && cFromUrl && d._from !== curr.from ||
- d.version !== curr.version ||
- d.version !== l.version) {
- if (parsed.type === 'file' || parsed.type === 'directory') return updateLocalDeps(l.version)
-
- doIt(d.version, l.version)
- } else {
- skip()
- }
+ // check that the url origin hasn't changed (#1727) and that
+ // there is no newer version available
+ var dFromUrl = m._from && url.parse(m._from).protocol
+ var cFromUrl = curr && curr.from && url.parse(curr.from).protocol
+
+ if (!curr ||
+ (dFromUrl && cFromUrl && m._from !== curr.from) ||
+ m.version !== curr.version ||
+ m.version !== l.version) {
+ doIt(m.version, l.version)
+ } else {
+ skip()
}
}
}
diff --git a/deps/npm/lib/owner.js b/deps/npm/lib/owner.js
index 64d086af78f9b1..3c2660ace113d5 100644
--- a/deps/npm/lib/owner.js
+++ b/deps/npm/lib/owner.js
@@ -1,3 +1,4 @@
+/* eslint-disable standard/no-callback-literal */
module.exports = owner
var npm = require('./npm.js')
@@ -53,7 +54,7 @@ owner.completion = function (opts, cb) {
})
}
// else fallthrough
- /*eslint no-fallthrough:0*/
+ /* eslint no-fallthrough:0 */
case 'add':
if (argv.length > 3) {
theUser = encodeURIComponent(argv[3])
diff --git a/deps/npm/lib/pack.js b/deps/npm/lib/pack.js
index f6a0eff805f50f..93c21ad55971c8 100644
--- a/deps/npm/lib/pack.js
+++ b/deps/npm/lib/pack.js
@@ -6,7 +6,9 @@
const BB = require('bluebird')
+const byteSize = require('byte-size')
const cacache = require('cacache')
+const columnify = require('columnify')
const cp = require('child_process')
const deprCheck = require('./utils/depr-check')
const fpm = require('./fetch-package-metadata')
@@ -28,6 +30,7 @@ const pinflight = require('promise-inflight')
const readJson = BB.promisify(require('read-package-json'))
const tar = require('tar')
const packlist = require('npm-packlist')
+const ssri = require('ssri')
pack.usage = 'npm pack [[<@scope>/]...]'
@@ -46,35 +49,64 @@ function pack (args, silent, cb) {
BB.all(
args.map((arg) => pack_(arg, cwd))
- ).then((files) => {
- if (!silent) {
- output(files.map((f) => path.relative(cwd, f)).join('\n'))
+ ).then((tarballs) => {
+ if (!silent && npm.config.get('json')) {
+ output(JSON.stringify(tarballs, null, 2))
+ } else if (!silent) {
+ tarballs.forEach(logContents)
+ output(tarballs.map((f) => path.relative(cwd, f.filename)).join('\n'))
}
- cb(null, files)
- }, cb)
+ return tarballs
+ }).nodeify(cb)
}
-// add to cache, then cp to the cwd
function pack_ (pkg, dir) {
return BB.fromNode((cb) => fpm(pkg, dir, cb)).then((mani) => {
let name = mani.name[0] === '@'
// scoped packages get special treatment
- ? mani.name.substr(1).replace(/\//g, '-')
- : mani.name
+ ? mani.name.substr(1).replace(/\//g, '-')
+ : mani.name
const target = `${name}-${mani.version}.tgz`
return pinflight(target, () => {
if (mani._requested.type === 'directory') {
- return prepareDirectory(mani._resolved).then(() => {
- return packDirectory(mani, mani._resolved, target)
+ return cacache.tmp.withTmp(npm.tmp, {tmpPrefix: 'packing'}, (tmp) => {
+ const tmpTarget = path.join(tmp, path.basename(target))
+ return prepareDirectory(mani._resolved)
+ .then(() => {
+ return packDirectory(mani, mani._resolved, tmpTarget, target, true)
+ })
+ .tap(() => {
+ if (npm.config.get('dry-run')) {
+ log.verbose('pack', '--dry-run mode enabled. Skipping write.')
+ } else {
+ return move(tmpTarget, target, {Promise: BB, fs})
+ }
+ })
+ })
+ } else if (npm.config.get('dry-run')) {
+ log.verbose('pack', '--dry-run mode enabled. Skipping write.')
+ return cacache.tmp.withTmp(npm.tmp, {tmpPrefix: 'packing'}, (tmp) => {
+ const tmpTarget = path.join(tmp, path.basename(target))
+ return packFromPackage(pkg, tmpTarget, target)
})
} else {
- return pacote.tarball.toFile(pkg, target, pacoteOpts())
- .then(() => target)
+ return packFromPackage(pkg, target, target)
}
})
})
}
+function packFromPackage (arg, target, filename) {
+ const opts = pacoteOpts()
+ return pacote.tarball.toFile(arg, target, pacoteOpts())
+ .then(() => cacache.tmp.withTmp(npm.tmp, {tmpPrefix: 'unpacking'}, (tmp) => {
+ const tmpTarget = path.join(tmp, filename)
+ return pacote.extract(arg, tmpTarget, opts)
+ .then(() => readJson(path.join(tmpTarget, 'package.json')))
+ }))
+ .then((pkg) => getContents(pkg, target, filename))
+}
+
module.exports.prepareDirectory = prepareDirectory
function prepareDirectory (dir) {
return readJson(path.join(dir, 'package.json')).then((pkg) => {
@@ -105,7 +137,7 @@ function prepareDirectory (dir) {
}
module.exports.packDirectory = packDirectory
-function packDirectory (mani, dir, target) {
+function packDirectory (mani, dir, target, filename, logIt) {
deprCheck(mani)
return readJson(path.join(dir, 'package.json')).then((pkg) => {
return lifecycle(pkg, 'prepack', dir)
@@ -120,22 +152,122 @@ function packDirectory (mani, dir, target) {
cwd: dir,
prefix: 'package/',
portable: true,
- noMtime: true,
+ // Provide a specific date in the 1980s for the benefit of zip,
+ // which is confounded by files dated at the Unix epoch 0.
+ mtime: new Date('1985-10-26T08:15:00.000Z'),
gzip: true
}
- return packlist({ path: dir })
+ return BB.resolve(packlist({ path: dir }))
// NOTE: node-tar does some Magic Stuff depending on prefixes for files
// specifically with @ signs, so we just neutralize that one
// and any such future "features" by prepending `./`
.then((files) => tar.create(tarOpt, files.map((f) => `./${f}`)))
- .then(() => move(tmpTarget, target, {Promise: BB, fs}))
- .then(() => lifecycle(pkg, 'postpack', dir))
- .then(() => target)
+ .then(() => getContents(pkg, tmpTarget, filename, logIt))
+ // thread the content info through
+ .tap(() => move(tmpTarget, target, {Promise: BB, fs}))
+ .tap(() => lifecycle(pkg, 'postpack', dir))
})
})
}
+module.exports.logContents = logContents
+function logContents (tarball) {
+ log.notice('')
+ log.notice('', `${npm.config.get('unicode') ? '📦 ' : 'package:'} ${tarball.name}@${tarball.version}`)
+ log.notice('=== Tarball Contents ===')
+ if (tarball.files.length) {
+ log.notice('', columnify(tarball.files.map((f) => {
+ const bytes = byteSize(f.size)
+ return {path: f.path, size: `${bytes.value}${bytes.unit}`}
+ }), {
+ include: ['size', 'path'],
+ showHeaders: false
+ }))
+ }
+ if (tarball.bundled.length) {
+ log.notice('=== Bundled Dependencies ===')
+ tarball.bundled.forEach((name) => log.notice('', name))
+ }
+ log.notice('=== Tarball Details ===')
+ log.notice('', columnify([
+ {name: 'name:', value: tarball.name},
+ {name: 'version:', value: tarball.version},
+ tarball.filename && {name: 'filename:', value: tarball.filename},
+ {name: 'package size:', value: byteSize(tarball.size)},
+ {name: 'unpacked size:', value: byteSize(tarball.unpackedSize)},
+ {name: 'shasum:', value: tarball.shasum},
+ {
+ name: 'integrity:',
+ value: tarball.integrity.toString().substr(0, 20) + '[...]' + tarball.integrity.toString().substr(80)},
+ tarball.bundled.length && {name: 'bundled deps:', value: tarball.bundled.length},
+ tarball.bundled.length && {name: 'bundled files:', value: tarball.entryCount - tarball.files.length},
+ tarball.bundled.length && {name: 'own files:', value: tarball.files.length},
+ {name: 'total files:', value: tarball.entryCount}
+ ].filter((x) => x), {
+ include: ['name', 'value'],
+ showHeaders: false
+ }))
+ log.notice('', '')
+}
+
+module.exports.getContents = getContents
+function getContents (pkg, target, filename, silent) {
+ const bundledWanted = new Set(
+ pkg.bundleDependencies ||
+ pkg.bundledDependencies ||
+ []
+ )
+ const files = []
+ const bundled = new Set()
+ let totalEntries = 0
+ let totalEntrySize = 0
+ return tar.t({
+ file: target,
+ onentry (entry) {
+ totalEntries++
+ totalEntrySize += entry.size
+ const p = entry.path
+ if (p.startsWith('package/node_modules/')) {
+ const name = p.match(/^package\/node_modules\/((?:@[^/]+\/)?[^/]+)/)[1]
+ if (bundledWanted.has(name)) {
+ bundled.add(name)
+ }
+ } else {
+ files.push({
+ path: entry.path.replace(/^package\//, ''),
+ size: entry.size,
+ mode: entry.mode
+ })
+ }
+ },
+ strip: 1
+ })
+ .then(() => BB.all([
+ BB.fromNode((cb) => fs.stat(target, cb)),
+ ssri.fromStream(fs.createReadStream(target), {
+ algorithms: ['sha1', 'sha512']
+ })
+ ]))
+ .then(([stat, integrity]) => {
+ const shasum = integrity['sha1'][0].hexDigest()
+ return {
+ id: pkg._id,
+ name: pkg.name,
+ version: pkg.version,
+ from: pkg._from,
+ size: stat.size,
+ unpackedSize: totalEntrySize,
+ shasum,
+ integrity: ssri.parse(integrity['sha512'][0]),
+ filename,
+ files,
+ entryCount: totalEntries,
+ bundled: Array.from(bundled)
+ }
+ })
+}
+
const PASSTHROUGH_OPTS = [
'always-auth',
'auth-type',
@@ -170,7 +302,7 @@ function packGitDep (manifest, dir) {
return acc
}, [])
const child = cp.spawn(process.env.NODE || process.execPath, [
- require.main.filename,
+ require.resolve('../bin/npm-cli.js'),
'install',
'--dev',
'--prod',
diff --git a/deps/npm/lib/profile.js b/deps/npm/lib/profile.js
index 587a26ca8b5e68..f57123932702cc 100644
--- a/deps/npm/lib/profile.js
+++ b/deps/npm/lib/profile.js
@@ -82,7 +82,18 @@ function config () {
registry: npm.config.get('registry'),
otp: npm.config.get('otp')
}
- conf.auth = npm.config.getCredentialsByURI(conf.registry)
+ const creds = npm.config.getCredentialsByURI(conf.registry)
+ if (creds.token) {
+ conf.auth = {token: creds.token}
+ } else if (creds.username) {
+ conf.auth = {basic: {username: creds.username, password: creds.password}}
+ } else if (creds.auth) {
+ const auth = Buffer.from(creds.auth, 'base64').toString().split(':', 2)
+ conf.auth = {basic: {username: auth[0], password: auth[1]}}
+ } else {
+ conf.auth = {}
+ }
+
if (conf.otp) conf.auth.otp = conf.otp
return conf
}
@@ -126,7 +137,6 @@ function get (args) {
output(`${key}\t${info[key]}`)
}
})
- return
} else {
const table = new Table()
Object.keys(cleaned).forEach((k) => table.push({[ansistyles.bright(k)]: cleaned[k]}))
@@ -155,12 +165,17 @@ function set (args) {
return Promise.reject(Error(`"${prop}" is not a property we can set. Valid properties are: ` + writableProfileKeys.join(', ')))
}
return Bluebird.try(() => {
- if (prop !== 'password') return
- return readUserInfo.password('Current password: ').then((current) => {
- return readPasswords().then((newpassword) => {
- value = {old: current, new: newpassword}
+ if (prop === 'password') {
+ return readUserInfo.password('Current password: ').then((current) => {
+ return readPasswords().then((newpassword) => {
+ value = {old: current, new: newpassword}
+ })
})
- })
+ } else if (prop === 'email') {
+ return readUserInfo.password('Password: ').then((current) => {
+ return {password: current, email: value}
+ })
+ }
function readPasswords () {
return readUserInfo.password('New password: ').then((password1) => {
return readUserInfo.password(' Again: ').then((password2) => {
diff --git a/deps/npm/lib/prune.js b/deps/npm/lib/prune.js
index 4ac8139576bd04..010e471e4b328e 100644
--- a/deps/npm/lib/prune.js
+++ b/deps/npm/lib/prune.js
@@ -26,6 +26,7 @@ function prune (args, cb) {
function Pruner (where, dryrun, args) {
Installer.call(this, where, dryrun, args)
+ this.autoPrune = true
}
util.inherits(Pruner, Installer)
@@ -64,3 +65,4 @@ Pruner.prototype.loadAllDepsIntoIdealTree = function (cb) {
Pruner.prototype.runPreinstallTopLevelLifecycles = function (cb) { cb() }
Pruner.prototype.runPostinstallTopLevelLifecycles = function (cb) { cb() }
+Pruner.prototype.saveToDependencies = function (cb) { cb() }
diff --git a/deps/npm/lib/publish.js b/deps/npm/lib/publish.js
index 20bd2603e6ff0a..bff8e161b14b15 100644
--- a/deps/npm/lib/publish.js
+++ b/deps/npm/lib/publish.js
@@ -16,9 +16,9 @@ const pacote = require('pacote')
const pacoteOpts = require('./config/pacote')
const path = require('path')
const readJson = BB.promisify(require('read-package-json'))
+const readUserInfo = require('./utils/read-user-info.js')
const semver = require('semver')
const statAsync = BB.promisify(require('graceful-fs').stat)
-const readUserInfo = require('./utils/read-user-info.js')
publish.usage = 'npm publish [|] [--tag ] [--access ]' +
"\n\nPublishes '.' if no argument supplied" +
@@ -47,10 +47,16 @@ function publish (args, isRetry, cb) {
return cb(new Error('Tag name must not be a valid SemVer range: ' + t))
}
- publish_(args[0]).then((pkg) => {
- output(`+ ${pkg._id}`)
- cb()
- }, cb)
+ return publish_(args[0])
+ .then((tarball) => {
+ const silent = log.level === 'silent'
+ if (!silent && npm.config.get('json')) {
+ output(JSON.stringify(tarball, null, 2))
+ } else if (!silent) {
+ output(`+ ${tarball.id}`)
+ }
+ })
+ .nodeify(cb)
}
function publish_ (arg) {
@@ -76,6 +82,7 @@ function publish_ (arg) {
function publishFromDirectory (arg) {
// All this readJson is because any of the given scripts might modify the
// package.json in question, so we need to refresh after every step.
+ let contents
return pack.prepareDirectory(arg).then(() => {
return readJson(path.join(arg, 'package.json'))
}).then((pkg) => {
@@ -85,9 +92,10 @@ function publishFromDirectory (arg) {
}).then((pkg) => {
return cacache.tmp.withTmp(npm.tmp, {tmpPrefix: 'fromDir'}, (tmpDir) => {
const target = path.join(tmpDir, 'package.tgz')
- return pack.packDirectory(pkg, arg, target).then(() => {
- return upload(arg, pkg, false, target)
- })
+ return pack.packDirectory(pkg, arg, target, null, true)
+ .tap((c) => { contents = c })
+ .then((c) => !npm.config.get('json') && pack.logContents(c))
+ .then(() => upload(arg, pkg, false, target))
})
}).then(() => {
return readJson(path.join(arg, 'package.json'))
@@ -96,6 +104,7 @@ function publishFromDirectory (arg) {
}).tap((pkg) => {
return lifecycle(pkg, 'postpublish', arg)
})
+ .then(() => contents)
}
function publishFromPackage (arg) {
@@ -104,9 +113,13 @@ function publishFromPackage (arg) {
const target = path.join(tmp, 'package.json')
const opts = pacoteOpts()
return pacote.tarball.toFile(arg, target, opts)
- .then(() => pacote.extract(arg, extracted, opts))
- .then(() => readJson(path.join(extracted, 'package.json')))
- .tap((pkg) => upload(arg, pkg, false, target))
+ .then(() => pacote.extract(arg, extracted, opts))
+ .then(() => readJson(path.join(extracted, 'package.json')))
+ .then((pkg) => {
+ return BB.resolve(pack.getContents(pkg, target))
+ .tap((c) => !npm.config.get('json') && pack.logContents(c))
+ .tap(() => upload(arg, pkg, false, target))
+ })
})
}
@@ -120,7 +133,6 @@ function upload (arg, pkg, isRetry, cached) {
"Remove the 'private' field from the package.json to publish it."
))
}
-
const mappedConfig = getPublishConfig(
pkg.publishConfig,
npm.config,
@@ -151,7 +163,7 @@ function upload (arg, pkg, isRetry, cached) {
const params = {
metadata: pkg,
- body: createReadStream(cached),
+ body: !npm.config.get('dry-run') && createReadStream(cached),
auth: auth
}
@@ -165,6 +177,11 @@ function upload (arg, pkg, isRetry, cached) {
params.access = config.get('access')
}
+ if (npm.config.get('dry-run')) {
+ log.verbose('publish', '--dry-run mode enabled. Skipping upload.')
+ return BB.resolve()
+ }
+
log.showProgress('publish:' + pkg._id)
return BB.fromNode((cb) => {
registry.publish(registryBase, params, cb)
@@ -192,7 +209,7 @@ function upload (arg, pkg, isRetry, cached) {
if (err.code !== 'EOTP' && !(err.code === 'E401' && /one-time pass/.test(err.message))) throw err
// we prompt on stdout and read answers from stdin, so they need to be ttys.
if (!process.stdin.isTTY || !process.stdout.isTTY) throw err
- return readUserInfo.otp('Enter OTP: ').then((otp) => {
+ return readUserInfo.otp().then((otp) => {
npm.config.set('otp', otp)
return upload(arg, pkg, isRetry, cached)
})
diff --git a/deps/npm/lib/repo.js b/deps/npm/lib/repo.js
index d7e79d76ab6b42..d5aa81a6a00ebd 100644
--- a/deps/npm/lib/repo.js
+++ b/deps/npm/lib/repo.js
@@ -2,8 +2,7 @@ module.exports = repo
repo.usage = 'npm repo []'
-var npm = require('./npm.js')
-var opener = require('opener')
+var openUrl = require('./utils/open-url')
var hostedGitInfo = require('hosted-git-info')
var url_ = require('url')
var fetchPackageMetadata = require('./fetch-package-metadata.js')
@@ -32,7 +31,7 @@ function getUrlAndOpen (d, cb) {
if (!url) return cb(new Error('no repository: could not get url'))
- opener(url, { command: npm.config.get('browser') }, cb)
+ openUrl(url, 'repository available at the following URL', cb)
}
function unknownHostedUrl (url) {
@@ -43,8 +42,8 @@ function unknownHostedUrl (url) {
}
url = url_.parse(url)
var protocol = url.protocol === 'https:'
- ? 'https:'
- : 'http:'
+ ? 'https:'
+ : 'http:'
return protocol + '//' + (url.host || '') +
url.path.replace(/\.git$/, '')
} catch (e) {}
diff --git a/deps/npm/lib/run-script.js b/deps/npm/lib/run-script.js
index fb7781f55179b4..639917441cafbe 100644
--- a/deps/npm/lib/run-script.js
+++ b/deps/npm/lib/run-script.js
@@ -32,7 +32,7 @@ runScript.completion = function (opts, cb) {
if (scripts.indexOf(argv[2]) !== -1) return cb()
// ok, try to find out which package it was, then
var pref = npm.config.get('global') ? npm.config.get('prefix')
- : npm.localPrefix
+ : npm.localPrefix
var pkgDir = path.resolve(pref, 'node_modules', argv[2], 'package.json')
readJson(pkgDir, function (er, d) {
if (er && er.code !== 'ENOENT' && er.code !== 'ENOTDIR') return cb(er)
diff --git a/deps/npm/lib/search/format-package-stream.js b/deps/npm/lib/search/format-package-stream.js
index a312e3f48379f0..bb0f552ba09d19 100644
--- a/deps/npm/lib/search/format-package-stream.js
+++ b/deps/npm/lib/search/format-package-stream.js
@@ -50,8 +50,8 @@ function prettify (data, num, opts) {
var pkg = normalizePackage(data, opts)
var columns = opts.description
- ? ['name', 'description', 'author', 'date', 'version', 'keywords']
- : ['name', 'author', 'date', 'version', 'keywords']
+ ? ['name', 'description', 'author', 'date', 'version', 'keywords']
+ : ['name', 'author', 'date', 'version', 'keywords']
if (opts.parseable) {
return columns.map(function (col) {
@@ -157,16 +157,16 @@ function normalizePackage (data, opts) {
return '=' + m.username
}).join(' '),
keywords: Array.isArray(data.keywords)
- ? data.keywords.join(' ')
- : typeof data.keywords === 'string'
- ? data.keywords.replace(/[,\s]+/, ' ')
- : '',
+ ? data.keywords.join(' ')
+ : typeof data.keywords === 'string'
+ ? data.keywords.replace(/[,\s]+/, ' ')
+ : '',
version: data.version,
- date: data.date &&
+ date: (data.date &&
(data.date.toISOString() // remove time
.split('T').join(' ')
.replace(/:[0-9]{2}\.[0-9]{3}Z$/, ''))
- .slice(0, -5) ||
+ .slice(0, -5)) ||
'prehistoric'
}
}
diff --git a/deps/npm/lib/search/package-filter.js b/deps/npm/lib/search/package-filter.js
index ac2950f46b71aa..892adb08c96a50 100644
--- a/deps/npm/lib/search/package-filter.js
+++ b/deps/npm/lib/search/package-filter.js
@@ -8,16 +8,16 @@ function filter (data, include, exclude, opts) {
function getWords (data, opts) {
return [ data.name ]
- .concat((opts && opts.description) ? data.description : [])
- .concat((data.maintainers || []).map(function (m) {
- return '=' + m.name
- }))
- .concat(data.versions && data.versions.length && data.url && ('<' + data.url + '>'))
- .concat(data.keywords || [])
- .map(function (f) { return f && f.trim && f.trim() })
- .filter(function (f) { return f })
- .join(' ')
- .toLowerCase()
+ .concat((opts && opts.description) ? data.description : [])
+ .concat((data.maintainers || []).map(function (m) {
+ return '=' + m.name
+ }))
+ .concat(data.versions && data.versions.length && data.url && ('<' + data.url + '>'))
+ .concat(data.keywords || [])
+ .map(function (f) { return f && f.trim && f.trim() })
+ .filter(function (f) { return f })
+ .join(' ')
+ .toLowerCase()
}
function filterWords (data, include, exclude, opts) {
diff --git a/deps/npm/lib/shrinkwrap.js b/deps/npm/lib/shrinkwrap.js
index 1db39f00cbc907..36ca853cefb756 100644
--- a/deps/npm/lib/shrinkwrap.js
+++ b/deps/npm/lib/shrinkwrap.js
@@ -4,6 +4,7 @@ const BB = require('bluebird')
const chain = require('slide').chain
const detectIndent = require('detect-indent')
+const detectNewline = require('detect-newline')
const readFile = BB.promisify(require('graceful-fs').readFile)
const getRequested = require('./install/get-requested.js')
const id = require('./install/deps.js')
@@ -18,6 +19,7 @@ const npm = require('./npm.js')
const path = require('path')
const readPackageTree = BB.promisify(require('read-package-tree'))
const ssri = require('ssri')
+const stringifyPackage = require('./utils/stringify-package')
const validate = require('aproba')
const writeFileAtomic = require('write-file-atomic')
const unixFormatPath = require('./utils/unix-format-path.js')
@@ -32,6 +34,8 @@ const PKGLOCK_VERSION = npm.lockfileVersion
shrinkwrap.usage = 'npm shrinkwrap'
module.exports = exports = shrinkwrap
+exports.treeToShrinkwrap = treeToShrinkwrap
+
function shrinkwrap (args, silent, cb) {
if (typeof cb !== 'function') {
cb = silent
@@ -103,14 +107,13 @@ function shrinkwrapDeps (deps, top, tree, seen) {
if (seen.has(tree)) return
seen.add(tree)
sortModules(tree.children).forEach(function (child) {
- if (child.fakeChild) {
- deps[moduleName(child)] = child.fakeChild
- return
- }
var childIsOnlyDev = isOnlyDev(child)
var pkginfo = deps[moduleName(child)] = {}
- var requested = child.package._requested || getRequested(child) || {}
+ var requested = getRequested(child) || child.package._requested || {}
pkginfo.version = childVersion(top, child, requested)
+ if (requested.type === 'git' && child.package._from) {
+ pkginfo.from = child.package._from
+ }
if (child.fromBundle || child.isInLink) {
pkginfo.bundled = true
} else {
@@ -121,7 +124,7 @@ function shrinkwrapDeps (deps, top, tree, seen) {
// tarball and we can't (yet) create consistent tarballs from a stable
// source.
if (requested.type !== 'git') {
- pkginfo.integrity = child.package._integrity
+ pkginfo.integrity = child.package._integrity || undefined
if (!pkginfo.integrity && child.package._shasum) {
pkginfo.integrity = ssri.fromHex(child.package._shasum, 'sha1')
}
@@ -132,8 +135,8 @@ function shrinkwrapDeps (deps, top, tree, seen) {
if (child.requires.length) {
pkginfo.requires = {}
sortModules(child.requires).forEach((required) => {
- var requested = required.package._requested || getRequested(required) || {}
- pkginfo.requires[moduleName(required)] = childVersion(top, required, requested)
+ var requested = getRequested(required, child) || required.package._requested || {}
+ pkginfo.requires[moduleName(required)] = childRequested(top, required, requested)
})
}
if (child.children.length) {
@@ -161,6 +164,24 @@ function childVersion (top, child, req) {
}
}
+function childRequested (top, child, requested) {
+ if (requested.type === 'directory' || requested.type === 'file') {
+ return 'file:' + unixFormatPath(path.relative(top.path, child.package._resolved || requested.fetchSpec))
+ } else if (!isRegistry(requested) && !child.fromBundle) {
+ return child.package._resolved || requested.saveSpec || requested.rawSpec
+ } else if (requested.type === 'tag') {
+ // tags are not ranges we can match against, so we invent a "reasonable"
+ // one based on what we actually installed.
+ return npm.config.get('save-prefix') + child.package.version
+ } else if (requested.saveSpec || requested.rawSpec) {
+ return requested.saveSpec || requested.rawSpec
+ } else if (child.package._from || (child.package._requested && child.package._requested.rawSpec)) {
+ return child.package._from.replace(/^@?[^@]+@/, '') || child.package._requested.rawSpec
+ } else {
+ return child.package.version
+ }
+}
+
function shrinkwrap_ (dir, pkginfo, opts, cb) {
save(dir, pkginfo, opts, cb)
}
@@ -179,11 +200,12 @@ function save (dir, pkginfo, opts, cb) {
{
path: path.resolve(dir, opts.defaultFile || PKGLOCK),
data: '{}',
- indent: (pkg && pkg.indent) || 2
+ indent: pkg && pkg.indent,
+ newline: pkg && pkg.newline
}
)
- const updated = updateLockfileMetadata(pkginfo, pkg && pkg.data)
- const swdata = JSON.stringify(updated, null, info.indent) + '\n'
+ const updated = updateLockfileMetadata(pkginfo, pkg && JSON.parse(pkg.raw))
+ const swdata = stringifyPackage(updated, info.indent, info.newline)
if (swdata === info.raw) {
// skip writing if file is identical
log.verbose('shrinkwrap', `skipping write for ${path.basename(info.path)} because there were no changes.`)
@@ -244,8 +266,8 @@ function checkPackageFile (dir, name) {
return {
path: file,
raw: data,
- data: JSON.parse(data),
- indent: detectIndent(data).indent || 2
+ indent: detectIndent(data).indent,
+ newline: detectNewline(data)
}
}).catch({code: 'ENOENT'}, () => {})
}
diff --git a/deps/npm/lib/team.js b/deps/npm/lib/team.js
index f99063b2787148..2d9e61cd4384b6 100644
--- a/deps/npm/lib/team.js
+++ b/deps/npm/lib/team.js
@@ -1,3 +1,4 @@
+/* eslint-disable standard/no-callback-literal */
var mapToRegistry = require('./utils/map-to-registry.js')
var npm = require('./npm')
var output = require('./utils/output.js')
@@ -41,7 +42,7 @@ function team (args, cb) {
try {
return npm.registry.team(cmd, uri, {
auth: auth,
- scope: entity[0],
+ scope: entity[0].replace(/^@/, ''), // '@' prefix on scope is optional.
team: entity[1],
user: args.shift()
}, function (err, data) {
diff --git a/deps/npm/lib/test.js b/deps/npm/lib/test.js
index 06138ac00a3be7..05bffed86d59c1 100644
--- a/deps/npm/lib/test.js
+++ b/deps/npm/lib/test.js
@@ -1,3 +1,4 @@
+/* eslint-disable standard/no-callback-literal */
module.exports = test
const testCmd = require('./utils/lifecycle-cmd.js')('test')
diff --git a/deps/npm/lib/token.js b/deps/npm/lib/token.js
index 2a3b65e6ad7015..2918f6a8767f19 100644
--- a/deps/npm/lib/token.js
+++ b/deps/npm/lib/token.js
@@ -4,8 +4,8 @@ const npm = require('./npm.js')
const output = require('./utils/output.js')
const Table = require('cli-table2')
const Bluebird = require('bluebird')
-const isCidrV4 = require('is-cidr').isCidrV4
-const isCidrV6 = require('is-cidr').isCidrV6
+const isCidrV4 = require('is-cidr').v4
+const isCidrV6 = require('is-cidr').v6
const readUserInfo = require('./utils/read-user-info.js')
const ansistyles = require('ansistyles')
const log = require('npmlog')
@@ -13,6 +13,8 @@ const pulseTillDone = require('./utils/pulse-till-done.js')
module.exports = token
+token._validateCIDRList = validateCIDRList
+
token.usage =
'npm token list\n' +
'npm token revoke \n' +
@@ -81,7 +83,17 @@ function config () {
registry: npm.config.get('registry'),
otp: npm.config.get('otp')
}
- conf.auth = npm.config.getCredentialsByURI(conf.registry)
+ const creds = npm.config.getCredentialsByURI(conf.registry)
+ if (creds.token) {
+ conf.auth = {token: creds.token}
+ } else if (creds.username) {
+ conf.auth = {basic: {username: creds.username, password: creds.password}}
+ } else if (creds.auth) {
+ const auth = Buffer.from(creds.auth, 'base64').toString().split(':', 2)
+ conf.auth = {basic: {username: auth[0], password: auth[1]}}
+ } else {
+ conf.auth = {}
+ }
if (conf.otp) conf.auth.otp = conf.otp
return conf
}
@@ -149,8 +161,14 @@ function rm (args) {
}
})
return Bluebird.map(toRemove, (key) => {
- progress.info('token', 'removing', key)
- profile.removeToken(key, conf).then(() => profile.completeWork(1))
+ return profile.removeToken(key, conf).catch((ex) => {
+ if (ex.code !== 'EOTP') throw ex
+ log.info('token', 'failed because revoking this token requires OTP')
+ return readUserInfo.otp('Authenticator provided OTP:').then((otp) => {
+ conf.auth.otp = otp
+ return profile.removeToken(key, conf)
+ })
+ })
})
})).then(() => {
if (conf.json) {
@@ -205,7 +223,8 @@ function validateCIDR (cidr) {
}
function validateCIDRList (cidrs) {
- const list = Array.isArray(cidrs) ? cidrs : cidrs ? cidrs.split(/,\s*/) : []
+ const maybeList = cidrs ? (Array.isArray(cidrs) ? cidrs : [cidrs]) : []
+ const list = maybeList.length === 1 ? maybeList[0].split(/,\s*/) : maybeList
list.forEach(validateCIDR)
return list
}
diff --git a/deps/npm/lib/unbuild.js b/deps/npm/lib/unbuild.js
index 78293c9ca269b6..d527778e92b07c 100644
--- a/deps/npm/lib/unbuild.js
+++ b/deps/npm/lib/unbuild.js
@@ -77,7 +77,7 @@ function rmBins (pkg, folder, parent, top, cb) {
asyncMap(Object.keys(pkg.bin), function (b, cb) {
if (process.platform === 'win32') {
chain([ [gentlyRm, path.resolve(binRoot, b) + '.cmd', true, folder],
- [gentlyRm, path.resolve(binRoot, b), true, folder] ], cb)
+ [gentlyRm, path.resolve(binRoot, b), true, folder] ], cb)
} else {
gentlyRm(path.resolve(binRoot, b), true, folder, cb)
}
diff --git a/deps/npm/lib/uninstall.js b/deps/npm/lib/uninstall.js
index 333d3e9d69c3c9..c4bd23ea319959 100644
--- a/deps/npm/lib/uninstall.js
+++ b/deps/npm/lib/uninstall.js
@@ -29,8 +29,8 @@ function uninstall (args, cb) {
if (args.length === 1 && args[0] === '.') args = []
const where = npm.config.get('global') || !args.length
- ? path.resolve(npm.globalDir, '..')
- : npm.prefix
+ ? path.resolve(npm.globalDir, '..')
+ : npm.prefix
args = args.filter(function (a) {
return path.resolve(a) !== where
diff --git a/deps/npm/lib/unpublish.js b/deps/npm/lib/unpublish.js
index 4ea8187025f808..c2e9edd8006f51 100644
--- a/deps/npm/lib/unpublish.js
+++ b/deps/npm/lib/unpublish.js
@@ -1,3 +1,4 @@
+/* eslint-disable standard/no-callback-literal */
module.exports = unpublish
@@ -100,10 +101,10 @@ function gotProject (project, version, publishConfig, cb_) {
// remove from the cache first
// npm.commands.cache(['clean', project, version], function (er) {
- // if (er) {
- // log.error('unpublish', 'Failed to clean cache')
- // return cb(er)
- // }
+ // if (er) {
+ // log.error('unpublish', 'Failed to clean cache')
+ // return cb(er)
+ // }
mapToRegistry(project, config, function (er, uri, auth) {
if (er) return cb(er)
diff --git a/deps/npm/lib/update.js b/deps/npm/lib/update.js
index efb56f5e415ba7..9b1345f9dfbfb4 100644
--- a/deps/npm/lib/update.js
+++ b/deps/npm/lib/update.js
@@ -57,7 +57,7 @@ function update_ (args) {
// use the initial installation method (repo, tar, git) for updating
if (url.parse(ww.req).protocol) ww.what = ww.req
- const where = ww.dep.parent && ww.dep.parent.path || ww.dep.path
+ const where = (ww.dep.parent && ww.dep.parent.path) || ww.dep.path
const isTransitive = !(ww.dep.requiredBy || []).some((p) => p.isTop)
const key = where + ':' + String(isTransitive)
if (!toInstall[key]) toInstall[key] = {where: where, opts: {saveOnlyLock: isTransitive}, what: []}
diff --git a/deps/npm/lib/utils/error-handler.js b/deps/npm/lib/utils/error-handler.js
index b2fd45a5f3e5fb..6631c10743d1be 100644
--- a/deps/npm/lib/utils/error-handler.js
+++ b/deps/npm/lib/utils/error-handler.js
@@ -247,6 +247,6 @@ function writeLogFile () {
log.record.length = 0
wroteLogFile = true
} catch (ex) {
- return
+
}
}
diff --git a/deps/npm/lib/utils/error-message.js b/deps/npm/lib/utils/error-message.js
index 85504f5edc5bb5..60f52bfc93992e 100644
--- a/deps/npm/lib/utils/error-message.js
+++ b/deps/npm/lib/utils/error-message.js
@@ -9,6 +9,17 @@ function errorMessage (er) {
var short = []
var detail = []
switch (er.code) {
+ case 'ENOAUDIT':
+ short.push(['audit', er.message])
+ break
+ case 'EAUDITNOPJSON':
+ short.push(['audit', er.message])
+ break
+ case 'EAUDITNOLOCK':
+ short.push(['audit', er.message])
+ detail.push(['audit', 'Try creating one first with: npm i --package-lock-only'])
+ break
+
case 'ECONNREFUSED':
short.push(['', er])
detail.push([
@@ -23,8 +34,17 @@ function errorMessage (er) {
case 'EACCES':
case 'EPERM':
short.push(['', er])
- detail.push(['', ['\nPlease try running this command again as root/Administrator.'
- ].join('\n')])
+ detail.push([
+ '',
+ [
+ '\nThe operation was rejected by your operating system.',
+ (process.platform === 'win32'
+ ? 'It\'s possible that the file was already in use (by a text editor or antivirus),\nor that you lack permissions to access it.'
+ : 'It is likely you do not have the permissions to access this file as the current user'),
+ '\nIf you believe this might be a permissions issue, please double-check the',
+ 'permissions of the file and its containing directories, or try running',
+ 'the command again as root/Administrator (though this is not recommended).'
+ ].join('\n')])
break
case 'ELIFECYCLE':
@@ -52,17 +72,32 @@ function errorMessage (er) {
break
case 'EJSONPARSE':
- short.push(['', er.message])
- short.push(['', 'File: ' + er.file])
+ const path = require('path')
+ // Check whether we ran into a conflict in our own package.json
+ if (er.file === path.join(npm.prefix, 'package.json')) {
+ const isDiff = require('../install/read-shrinkwrap.js')._isDiff
+ const txt = require('fs').readFileSync(er.file, 'utf8')
+ if (isDiff(txt)) {
+ detail.push([
+ '',
+ [
+ 'Merge conflict detected in your package.json.',
+ '',
+ 'Please resolve the package.json conflict and retry the command:',
+ '',
+ `$ ${process.argv.join(' ')}`
+ ].join('\n')
+ ])
+ break
+ }
+ }
+ short.push(['JSON.parse', er.message])
detail.push([
- '',
+ 'JSON.parse',
[
'Failed to parse package.json data.',
- 'package.json must be actual JSON, not just JavaScript.',
- '',
- 'Tell the package author to fix their package.json file.'
- ].join('\n'),
- 'JSON.parse'
+ 'package.json must be actual JSON, not just JavaScript.'
+ ].join('\n')
])
break
@@ -70,7 +105,7 @@ function errorMessage (er) {
case 'E401':
// the E401 message checking is a hack till we replace npm-registry-client with something
// OTP aware.
- if (er.code === 'EOTP' || (er.code === 'E401' && /one-time pass/.test(er.message))) {
+ if (er.code === 'EOTP' || /one-time pass/.test(er.message)) {
short.push(['', 'This operation requires a one-time password from your authenticator.'])
detail.push([
'',
@@ -80,42 +115,40 @@ function errorMessage (er) {
'it, or it timed out. Please try again.'
].join('\n')
])
- break
} else {
// npm ERR! code E401
// npm ERR! Unable to authenticate, need: Basic
- if (er.headers && er.headers['www-authenticate']) {
- const auth = er.headers['www-authenticate'].map((au) => au.split(/,\s*/))[0] || []
- if (auth.indexOf('Bearer') !== -1) {
- short.push(['', 'Unable to authenticate, your authentication token seems to be invalid.'])
- detail.push([
- '',
- [
- 'To correct this please trying logging in again with:',
- ' npm login'
- ].join('\n')
- ])
- break
- } else if (auth.indexOf('Basic') !== -1) {
- short.push(['', 'Incorrect or missing password.'])
- detail.push([
+ const auth = (er.headers && er.headers['www-authenticate'] && er.headers['www-authenticate'].map((au) => au.split(/,\s*/))[0]) || []
+ if (auth.indexOf('Bearer') !== -1) {
+ short.push(['', 'Unable to authenticate, your authentication token seems to be invalid.'])
+ detail.push([
+ '',
+ [
+ 'To correct this please trying logging in again with:',
+ ' npm login'
+ ].join('\n')
+ ])
+ } else if (auth.indexOf('Basic') !== -1) {
+ short.push(['', 'Incorrect or missing password.'])
+ detail.push([
+ '',
+ [
+ 'If you were trying to login, change your password, create an',
+ 'authentication token or enable two-factor authentication then',
+ 'that means you likely typed your password in incorrectly.',
+ 'Please try again, or recover your password at:',
+ ' https://www.npmjs.com/forgot',
'',
- [
- 'If you were trying to login, change your password, create an',
- 'authentication token or enable two-factor authentication then',
- 'that means you likely typed your password in incorrectly.',
- 'Please try again, or recover your password at:',
- ' https://www.npmjs.com/forgot',
- '',
- 'If you were doing some other operation then your saved credentials are',
- 'probably out of date. To correct this please try logging in again with:',
- ' npm login'
- ].join('\n')
- ])
- break
- }
+ 'If you were doing some other operation then your saved credentials are',
+ 'probably out of date. To correct this please try logging in again with:',
+ ' npm login'
+ ].join('\n')
+ ])
+ } else {
+ short.push(['', er.message || er])
}
}
+ break
case 'E404':
// There's no need to have 404 in the message as well.
@@ -271,7 +304,7 @@ function errorMessage (er) {
])
break
} // else passthrough
- /*eslint no-fallthrough:0*/
+ /* eslint no-fallthrough:0 */
case 'ENOSPC':
short.push(['nospc', er.message])
diff --git a/deps/npm/lib/utils/gunzip-maybe.js b/deps/npm/lib/utils/gunzip-maybe.js
index db75f0601713f5..adf7e4402aa2d9 100644
--- a/deps/npm/lib/utils/gunzip-maybe.js
+++ b/deps/npm/lib/utils/gunzip-maybe.js
@@ -11,8 +11,8 @@ function gunzip () {
var stream = duplex()
var peeker = through(function (chunk, enc, cb) {
var newStream = hasGzipHeader(chunk)
- ? zlib.createGunzip()
- : through()
+ ? zlib.createGunzip()
+ : through()
stream.setReadable(newStream)
stream.setWritable(newStream)
stream.write(chunk)
diff --git a/deps/npm/lib/utils/metrics-launch.js b/deps/npm/lib/utils/metrics-launch.js
index 821f8bc7e4fde3..7e2a8d1cc98d61 100644
--- a/deps/npm/lib/utils/metrics-launch.js
+++ b/deps/npm/lib/utils/metrics-launch.js
@@ -1,4 +1,5 @@
'use strict'
+/* eslint-disable camelcase */
module.exports = launchSendMetrics
var fs = require('graceful-fs')
var child_process = require('child_process')
diff --git a/deps/npm/lib/utils/open-url.js b/deps/npm/lib/utils/open-url.js
new file mode 100644
index 00000000000000..7a48d2e868959b
--- /dev/null
+++ b/deps/npm/lib/utils/open-url.js
@@ -0,0 +1,16 @@
+'use strict'
+const npm = require('../npm.js')
+const output = require('./output.js')
+const opener = require('opener')
+
+// attempt to open URL in web-browser, print address otherwise:
+module.exports = function open (url, errMsg, cb, browser = npm.config.get('browser')) {
+ opener(url, { command: npm.config.get('browser') }, (er) => {
+ if (er && er.code === 'ENOENT') {
+ output(`${errMsg}:\n\n${url}`)
+ return cb()
+ } else {
+ return cb(er)
+ }
+ })
+}
diff --git a/deps/npm/lib/utils/parse-json.js b/deps/npm/lib/utils/parse-json.js
index 5c0b959a0d39ee..c2ebac35819adc 100644
--- a/deps/npm/lib/utils/parse-json.js
+++ b/deps/npm/lib/utils/parse-json.js
@@ -1,13 +1,14 @@
'use strict'
+var parseJsonWithErrors = require('json-parse-better-errors')
var parseJSON = module.exports = function (content) {
- return JSON.parse(stripBOM(content))
+ return parseJsonWithErrors(stripBOM(content))
}
parseJSON.noExceptions = function (content) {
try {
return parseJSON(content)
} catch (ex) {
- return
+
}
}
diff --git a/deps/npm/lib/utils/perf.js b/deps/npm/lib/utils/perf.js
index 04232632254531..d314860792d2a3 100644
--- a/deps/npm/lib/utils/perf.js
+++ b/deps/npm/lib/utils/perf.js
@@ -18,10 +18,9 @@ function time (name) {
function timeEnd (name) {
if (name in timings) {
- process.emit('timing', name, Date.now() - timings[name])
+ perf.emit('timing', name, Date.now() - timings[name])
delete timings[name]
} else {
log.silly('timing', "Tried to end timer that doesn't exist:", name)
- return
}
}
diff --git a/deps/npm/lib/utils/pick-manifest-from-registry-metadata.js b/deps/npm/lib/utils/pick-manifest-from-registry-metadata.js
index e2c0d2e5aa45e0..589cef207dcd9d 100644
--- a/deps/npm/lib/utils/pick-manifest-from-registry-metadata.js
+++ b/deps/npm/lib/utils/pick-manifest-from-registry-metadata.js
@@ -21,6 +21,6 @@ function pickManifestFromRegistryMetadata (spec, tag, versions, metadata) {
} else if (spec === '*' && versions.length && tagged && metadata.versions[tagged]) {
return {resolvedTo: tag, manifest: metadata.versions[tagged]}
} else {
- return
+
}
}
diff --git a/deps/npm/lib/utils/read-user-info.js b/deps/npm/lib/utils/read-user-info.js
index 81bb44c98f0f60..445bdfeea3e846 100644
--- a/deps/npm/lib/utils/read-user-info.js
+++ b/deps/npm/lib/utils/read-user-info.js
@@ -19,7 +19,15 @@ function read (opts) {
}
function readOTP (msg, otp, isRetry) {
- if (!msg) msg = 'Enter OTP: '
+ if (!msg) {
+ msg = [
+ 'There was an error while trying authentication due to OTP (One-Time-Password).',
+ 'The One-Time-Password is generated via applications like Authy or',
+ 'Google Authenticator, for more information see:',
+ 'https://docs.npmjs.com/getting-started/using-two-factor-authentication',
+ 'Enter OTP: '
+ ].join('\n')
+ }
if (isRetry && otp && /^[\d ]+$|^[A-Fa-f0-9]{64,64}$/.test(otp)) return otp.replace(/\s+/g, '')
return read({prompt: msg, default: otp || ''})
diff --git a/deps/npm/lib/utils/stringify-package.js b/deps/npm/lib/utils/stringify-package.js
new file mode 100644
index 00000000000000..0cc9de0a363658
--- /dev/null
+++ b/deps/npm/lib/utils/stringify-package.js
@@ -0,0 +1,17 @@
+'use strict'
+
+module.exports = stringifyPackage
+
+const DEFAULT_INDENT = 2
+const CRLF = '\r\n'
+const LF = '\n'
+
+function stringifyPackage (data, indent, newline) {
+ const json = JSON.stringify(data, null, indent || DEFAULT_INDENT)
+
+ if (newline === CRLF) {
+ return json.replace(/\n/g, CRLF) + CRLF
+ }
+
+ return json + LF
+}
diff --git a/deps/npm/lib/utils/unsupported.js b/deps/npm/lib/utils/unsupported.js
index b586d035ced9d1..09d7784dd5125d 100644
--- a/deps/npm/lib/utils/unsupported.js
+++ b/deps/npm/lib/utils/unsupported.js
@@ -1,12 +1,11 @@
'use strict'
var semver = require('semver')
var supportedNode = [
- {ver: '4', min: '4.7.0'},
{ver: '6', min: '6.0.0'},
- {ver: '7', min: '7.0.0'},
{ver: '8', min: '8.0.0'},
{ver: '9', min: '9.0.0'},
- {ver: '10', min: '10.0.0'}
+ {ver: '10', min: '10.0.0'},
+ {ver: '11', min: '11.0.0'}
]
var knownBroken = '<4.7.0'
@@ -26,7 +25,7 @@ exports.checkForBrokenNode = function () {
supportedNode.forEach(function (rel) {
if (semver.satisfies(nodejs.version, rel.ver)) {
console.error('Node.js ' + rel.ver + " is supported but the specific version you're running has")
- console.error(`a bug known to break npm. Please update to at least ${rel.min} to use this`)
+ console.error('a bug known to break npm. Please update to at least ' + rel.min + ' to use this')
console.error('version of npm. You can find the latest release of Node.js at https://nodejs.org/')
process.exit(1)
}
diff --git a/deps/npm/lib/version.js b/deps/npm/lib/version.js
index edcd664f2a7c4e..a8bc3123a9c80d 100644
--- a/deps/npm/lib/version.js
+++ b/deps/npm/lib/version.js
@@ -4,6 +4,7 @@ const BB = require('bluebird')
const assert = require('assert')
const chain = require('slide').chain
const detectIndent = require('detect-indent')
+const detectNewline = require('detect-newline')
const fs = require('graceful-fs')
const readFile = BB.promisify(require('graceful-fs').readFile)
const git = require('./utils/git.js')
@@ -14,6 +15,7 @@ const output = require('./utils/output.js')
const parseJSON = require('./utils/parse-json.js')
const path = require('path')
const semver = require('semver')
+const stringifyPackage = require('./utils/stringify-package')
const writeFileAtomic = require('write-file-atomic')
version.usage = 'npm version [ | major | minor | patch | premajor | preminor | prepatch | prerelease | from-git]' +
@@ -33,7 +35,7 @@ function version (args, silent, cb_) {
}
if (args.length > 1) return cb_(version.usage)
- readPackage(function (er, data, indent) {
+ readPackage(function (er, data, indent, newline) {
if (!args.length) return dump(data, cb_)
if (er) {
@@ -115,14 +117,16 @@ function readPackage (cb) {
fs.readFile(packagePath, 'utf8', function (er, data) {
if (er) return cb(new Error(er))
var indent
+ var newline
try {
- indent = detectIndent(data).indent || ' '
+ indent = detectIndent(data).indent
+ newline = detectNewline(data)
data = JSON.parse(data)
} catch (e) {
er = e
data = null
}
- cb(er, data, indent)
+ cb(er, data, indent, newline)
})
}
@@ -132,10 +136,10 @@ function updatePackage (newVersion, silent, cb_) {
cb_(er)
}
- readPackage(function (er, data, indent) {
+ readPackage(function (er, data, indent, newline) {
if (er) return cb(new Error(er))
data.version = newVersion
- write(data, 'package.json', indent, cb)
+ write(data, 'package.json', indent, newline, cb)
})
}
@@ -168,15 +172,17 @@ function updateShrinkwrap (newVersion, cb) {
const file = shrinkwrap ? SHRINKWRAP : PKGLOCK
let data
let indent
+ let newline
try {
data = parseJSON(shrinkwrap || lockfile)
- indent = detectIndent(shrinkwrap || lockfile).indent || ' '
+ indent = detectIndent(shrinkwrap || lockfile).indent
+ newline = detectNewline(shrinkwrap || lockfile)
} catch (err) {
log.error('version', `Bad ${file} data.`)
return cb(err)
}
data.version = newVersion
- write(data, file, indent, (err) => {
+ write(data, file, indent, newline, (err) => {
if (err) {
log.error('version', `Failed to update version in ${file}`)
return cb(err)
@@ -307,9 +313,9 @@ function _commit (version, localData, cb) {
function stagePackageFiles (localData, options) {
return addLocalFile('package.json', options, false).then(() => {
if (localData.hasShrinkwrap) {
- return addLocalFile('npm-shrinkwrap.json', options, false)
+ return addLocalFile('npm-shrinkwrap.json', options, true)
} else if (localData.hasPackageLock) {
- return addLocalFile('package-lock.json', options, false)
+ return addLocalFile('package-lock.json', options, true)
}
})
}
@@ -317,18 +323,18 @@ function stagePackageFiles (localData, options) {
function addLocalFile (file, options, ignoreFailure) {
const p = git.exec(['add', path.join(npm.localPrefix, file)], options)
return ignoreFailure
- ? p.catch(() => {})
- : p
+ ? p.catch(() => {})
+ : p
}
-function write (data, file, indent, cb) {
+function write (data, file, indent, newline, cb) {
assert(data && typeof data === 'object', 'must pass data to version write')
assert(typeof file === 'string', 'must pass filename to write to version write')
log.verbose('version.write', 'data', data, 'to', file)
writeFileAtomic(
path.join(npm.localPrefix, file),
- new Buffer(JSON.stringify(data, null, indent || 2) + '\n'),
+ stringifyPackage(data, indent, newline),
cb
)
}
diff --git a/deps/npm/lib/view.js b/deps/npm/lib/view.js
index e0904048df8ab4..88bd97c916c44f 100644
--- a/deps/npm/lib/view.js
+++ b/deps/npm/lib/view.js
@@ -1,6 +1,15 @@
+'use strict'
+
// npm view [pkg [pkg ...]]
module.exports = view
+const BB = require('bluebird')
+
+const byteSize = require('byte-size')
+const color = require('ansicolors')
+const columns = require('cli-columns')
+const relativeDate = require('tiny-relative-date')
+const style = require('ansistyles')
var npm = require('./npm.js')
var readJson = require('read-package-json')
var log = require('npmlog')
@@ -111,7 +120,7 @@ function fetchAndRead (nv, args, silent, cb) {
npm.registry.get(uri, { auth: auth }, function (er, data) {
if (er) return cb(er)
- if (data['dist-tags'] && data['dist-tags'].hasOwnProperty(version)) {
+ if (data['dist-tags'] && data['dist-tags'][version]) {
version = data['dist-tags'][version]
}
@@ -146,20 +155,162 @@ function fetchAndRead (nv, args, silent, cb) {
})
}
})
- results = results.reduce(reducer, {})
- var retval = results
+ var retval = results.reduce(reducer, {})
if (args.length === 1 && args[0] === '') {
retval = cleanBlanks(retval)
log.silly('cleanup', retval)
}
- if (error || silent) cb(error, retval)
- else printData(results, data._id, cb.bind(null, error, retval))
+ if (error || silent) {
+ cb(error, retval)
+ } else if (
+ !npm.config.get('json') &&
+ args.length === 1 &&
+ args[0] === ''
+ ) {
+ data.version = version
+ BB.all(results.map((v) => prettyView(data, v[Object.keys(v)[0]][''])))
+ .nodeify(cb)
+ .then(() => retval)
+ } else {
+ printData(retval, data._id, cb.bind(null, error, retval))
+ }
})
})
}
+function prettyView (packument, manifest) {
+ // More modern, pretty printing of default view
+ const unicode = npm.config.get('unicode')
+ return BB.try(() => {
+ if (!manifest) {
+ log.error(
+ 'view',
+ 'No matching versions.\n' +
+ 'To see a list of versions, run:\n' +
+ `> npm view ${packument.name} versions`
+ )
+ return
+ }
+ const tags = []
+ Object.keys(packument['dist-tags']).forEach((t) => {
+ const version = packument['dist-tags'][t]
+ tags.push(`${style.bright(color.green(t))}: ${version}`)
+ })
+ const unpackedSize = manifest.dist.unpackedSize &&
+ byteSize(manifest.dist.unpackedSize)
+ const licenseField = manifest.license || manifest.licence || 'Proprietary'
+ const info = {
+ name: color.green(manifest.name),
+ version: color.green(manifest.version),
+ bins: Object.keys(manifest.bin || {}).map(color.yellow),
+ versions: color.yellow(packument.versions.length + ''),
+ description: manifest.description,
+ deprecated: manifest.deprecated,
+ keywords: (packument.keywords || []).map(color.yellow),
+ license: typeof licenseField === 'string'
+ ? licenseField
+ : (licenseField.type || 'Proprietary'),
+ deps: Object.keys(manifest.dependencies || {}).map((dep) => {
+ return `${color.yellow(dep)}: ${manifest.dependencies[dep]}`
+ }),
+ publisher: manifest._npmUser && unparsePerson({
+ name: color.yellow(manifest._npmUser.name),
+ email: color.cyan(manifest._npmUser.email)
+ }),
+ modified: color.yellow(relativeDate(packument.time[packument.version])),
+ maintainers: (packument.maintainers || []).map((u) => unparsePerson({
+ name: color.yellow(u.name),
+ email: color.cyan(u.email)
+ })),
+ repo: (
+ manifest.bugs && (manifest.bugs.url || manifest.bugs)
+ ) || (
+ manifest.repository && (manifest.repository.url || manifest.repository)
+ ),
+ site: (
+ manifest.homepage && (manifest.homepage.url || manifest.homepage)
+ ),
+ stars: color.yellow('' + packument.users ? Object.keys(packument.users || {}).length : 0),
+ tags,
+ tarball: color.cyan(manifest.dist.tarball),
+ shasum: color.yellow(manifest.dist.shasum),
+ integrity: manifest.dist.integrity && color.yellow(manifest.dist.integrity),
+ fileCount: manifest.dist.fileCount && color.yellow(manifest.dist.fileCount),
+ unpackedSize: unpackedSize && color.yellow(unpackedSize.value) + ' ' + unpackedSize.unit
+ }
+ if (info.license.toLowerCase().trim() === 'proprietary') {
+ info.license = style.bright(color.red(info.license))
+ } else {
+ info.license = color.green(info.license)
+ }
+ console.log('')
+ console.log(
+ style.underline(style.bright(`${info.name}@${info.version}`)) +
+ ' | ' + info.license +
+ ' | deps: ' + (info.deps.length ? color.cyan(info.deps.length) : color.green('none')) +
+ ' | versions: ' + info.versions
+ )
+ info.description && console.log(info.description)
+ if (info.repo || info.site) {
+ info.site && console.log(color.cyan(info.site))
+ }
+
+ const warningSign = unicode ? ' ⚠️ ' : '!!'
+ info.deprecated && console.log(
+ `\n${style.bright(color.red('DEPRECATED'))}${
+ warningSign
+ } - ${info.deprecated}`
+ )
+
+ if (info.keywords.length) {
+ console.log('')
+ console.log('keywords:', info.keywords.join(', '))
+ }
+
+ if (info.bins.length) {
+ console.log('')
+ console.log('bin:', info.bins.join(', '))
+ }
+
+ console.log('')
+ console.log('dist')
+ console.log('.tarball', info.tarball)
+ console.log('.shasum:', info.shasum)
+ info.integrity && console.log('.integrity:', info.integrity)
+ info.unpackedSize && console.log('.unpackedSize:', info.unpackedSize)
+
+ const maxDeps = 24
+ if (info.deps.length) {
+ console.log('')
+ console.log('dependencies:')
+ console.log(columns(info.deps.slice(0, maxDeps), {padding: 1}))
+ if (info.deps.length > maxDeps) {
+ console.log(`(...and ${info.deps.length - maxDeps} more.)`)
+ }
+ }
+
+ if (info.maintainers && info.maintainers.length) {
+ console.log('')
+ console.log('maintainers:')
+ info.maintainers.forEach((u) => console.log('-', u))
+ }
+
+ console.log('')
+ console.log('dist-tags:')
+ console.log(columns(info.tags))
+
+ if (info.publisher || info.modified) {
+ let publishInfo = 'published'
+ if (info.modified) { publishInfo += ` ${info.modified}` }
+ if (info.publisher) { publishInfo += ` by ${info.publisher}` }
+ console.log('')
+ console.log(publishInfo)
+ }
+ })
+}
+
function cleanBlanks (obj) {
var clean = {}
Object.keys(obj).forEach(function (version) {
@@ -323,8 +474,8 @@ function cleanup (data) {
if (keys.length <= 3 &&
data.name &&
(keys.length === 1 ||
- keys.length === 3 && data.email && data.url ||
- keys.length === 2 && (data.email || data.url))) {
+ (keys.length === 3 && data.email && data.url) ||
+ (keys.length === 2 && (data.email || data.url)))) {
data = unparsePerson(data)
}
return data
diff --git a/deps/npm/lib/xmas.js b/deps/npm/lib/xmas.js
index 25535533e10fbd..65c0c131abd484 100644
--- a/deps/npm/lib/xmas.js
+++ b/deps/npm/lib/xmas.js
@@ -48,7 +48,7 @@ module.exports = function (args, cb) {
w('\n\n')
log.heading = ''
log.addLevel('npm', 100000, log.headingStyle)
- log.npm('loves you', 'Happy Xmas, Noders!')
+ log.npm('loves you', 'Happy Xmas, JavaScripters!')
cb()
}
var dg = false
diff --git a/deps/npm/man/man1/npm-README.1 b/deps/npm/man/man1/npm-README.1
index a878813f91af92..fd188b0c39a8ad 100644
--- a/deps/npm/man/man1/npm-README.1
+++ b/deps/npm/man/man1/npm-README.1
@@ -1,4 +1,4 @@
-.TH "NPM" "1" "December 2017" "" ""
+.TH "NPM" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm\fR \- a JavaScript package manager
.P
@@ -10,9 +10,9 @@ This is just enough info to get you up and running\.
Much more info available via \fBnpm help\fP once it's installed\.
.SH IMPORTANT
.P
-\fBYou need node v4 or higher to run this program\.\fR
+\fBYou need node v6 or higher to run this program\.\fR
.P
-To install an old \fBand unsupported\fR version of npm that works on node v0\.12
+To install an old \fBand unsupported\fR version of npm that works on node v5
and prior, clone the git repo and dig through the old tags and branches\.
.P
\fBnpm is configured to use npm, Inc\.'s public package registry at
@@ -162,7 +162,7 @@ https://github\.com/npm/npm/issues
Be sure to include \fIall\fR of the output from the npm command that didn't work
as expected\. The \fBnpm\-debug\.log\fP file is also helpful to provide\.
.P
-You can also find npm people in \fB#npm\fP on https://package\.community/ or
+You can also find npm people in \fB#npm\fP on https:// or
on Twitter \fIhttps://twitter\.com/npm_support\fR\|\. Whoever responds will no
doubt tell you to put the output in a gist or email\.
.SH SEE ALSO
diff --git a/deps/npm/man/man1/npm-access.1 b/deps/npm/man/man1/npm-access.1
index 124fb542efd81f..58fdf36de1eae7 100644
--- a/deps/npm/man/man1/npm-access.1
+++ b/deps/npm/man/man1/npm-access.1
@@ -1,4 +1,4 @@
-.TH "NPM\-ACCESS" "1" "December 2017" "" ""
+.TH "NPM\-ACCESS" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-access\fR \- Set access level on published packages
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-adduser.1 b/deps/npm/man/man1/npm-adduser.1
index 1d0dc7d63f2822..a8d27d07365ed7 100644
--- a/deps/npm/man/man1/npm-adduser.1
+++ b/deps/npm/man/man1/npm-adduser.1
@@ -1,4 +1,4 @@
-.TH "NPM\-ADDUSER" "1" "December 2017" "" ""
+.TH "NPM\-ADDUSER" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-adduser\fR \- Add a registry user account
.SH SYNOPSIS
@@ -31,7 +31,7 @@ your existing record\.
.SH CONFIGURATION
.SS registry
.P
-Default: https://registry\.npmjs\.org/
+Default: https://
.P
The base URL of the npm package registry\. If \fBscope\fP is also specified,
this registry will only be used for packages with that scope\. \fBscope\fP defaults
diff --git a/deps/npm/man/man1/npm-audit.1 b/deps/npm/man/man1/npm-audit.1
new file mode 100644
index 00000000000000..8a4283d4cf26c5
--- /dev/null
+++ b/deps/npm/man/man1/npm-audit.1
@@ -0,0 +1,132 @@
+.TH "NPM\-AUDIT" "1" "May 2018" "" ""
+.SH "NAME"
+\fBnpm-audit\fR \- Run a security audit
+.SH SYNOPSIS
+.P
+.RS 2
+.nf
+npm audit [\-\-json]
+npm audit fix [\-\-force|\-\-package\-lock\-only|\-\-dry\-run|\-\-production|\-\-only=dev]
+.fi
+.RE
+.SH EXAMPLES
+.P
+Scan your project for vulnerabilities and automatically install any compatible
+updates to vulnerable dependencies:
+.P
+.RS 2
+.nf
+$ npm audit fix
+.fi
+.RE
+.P
+Run \fBaudit fix\fP without modifying \fBnode_modules\fP, but still updating the
+pkglock:
+.P
+.RS 2
+.nf
+$ npm audit fix \-\-package\-lock\-only
+.fi
+.RE
+.P
+Skip updating \fBdevDependencies\fP:
+.P
+.RS 2
+.nf
+$ npm audit fix \-\-only=prod
+.fi
+.RE
+.P
+Have \fBaudit fix\fP install semver\-major updates to toplevel dependencies, not just
+semver\-compatible ones:
+.P
+.RS 2
+.nf
+$ npm audit fix \-\-force
+.fi
+.RE
+.P
+Do a dry run to get an idea of what \fBaudit fix\fP will do, and \fIalso\fR output
+install information in JSON format:
+.P
+.RS 2
+.nf
+$ npm audit fix \-\-dry\-run \-\-json
+.fi
+.RE
+.P
+Scan your project for vulnerabilities and just show the details, without fixing
+anything:
+.P
+.RS 2
+.nf
+$ npm audit
+.fi
+.RE
+.P
+Get the detailed audit report in JSON format:
+.P
+.RS 2
+.nf
+$ npm audit \-\-json
+.fi
+.RE
+.SH DESCRIPTION
+.P
+The audit command submits a description of the dependencies configured in
+your project to your default registry and asks for a report of known
+vulnerabilities\. The report returned includes instructions on how to act on
+this information\.
+.P
+You can also have npm automatically fix the vulnerabilities by running \fBnpm
+audit fix\fP\|\. Note that some vulnerabilities cannot be fixed automatically and
+will require manual intervention or review\. Also note that since \fBnpm audit fix\fP
+runs a full\-fledged \fBnpm install\fP under the hood, all configs that apply to the
+installer will also apply to \fBnpm install\fP \-\- so things like \fBnpm audit fix
+\-\-package\-lock\-only\fP will work as expected\.
+.SH CONTENT SUBMITTED
+.RS 0
+.IP \(bu 2
+npm_version
+.IP \(bu 2
+node_version
+.IP \(bu 2
+platform
+.IP \(bu 2
+node_env
+.IP \(bu 2
+A scrubbed version of your package\-lock\.json or npm\-shrinkwrap\.json
+
+.RE
+.SS SCRUBBING
+.P
+In order to ensure that potentially sensitive information is not included in
+the audit data bundle, some dependencies may have their names (and sometimes
+versions) replaced with opaque non\-reversible identifiers\. It is done for
+the following dependency types:
+.RS 0
+.IP \(bu 2
+Any module referencing a scope that is configured for a non\-default
+registry has its name scrubbed\. (That is, a scope you did a \fBnpm login \-\-scope=@ourscope\fP for\.)
+.IP \(bu 2
+All git dependencies have their names and specifiers scrubbed\.
+.IP \(bu 2
+All remote tarball dependencies have their names and specifiers scrubbed\.
+.IP \(bu 2
+All local directory and tarball dependencies have their names and specifiers scrubbed\.
+
+.RE
+.P
+The non\-reversible identifiers are a sha256 of a session\-specific UUID and the
+value being replaced, ensuring a consistent value within the payload that is
+different between runs\.
+.SH SEE ALSO
+.RS 0
+.IP \(bu 2
+npm help install
+.IP \(bu 2
+npm help 5 package\-locks
+.IP \(bu 2
+npm help 7 config
+
+.RE
diff --git a/deps/npm/man/man1/npm-bin.1 b/deps/npm/man/man1/npm-bin.1
index a146ed8ce2eec1..402d1de0969d85 100644
--- a/deps/npm/man/man1/npm-bin.1
+++ b/deps/npm/man/man1/npm-bin.1
@@ -1,4 +1,4 @@
-.TH "NPM\-BIN" "1" "December 2017" "" ""
+.TH "NPM\-BIN" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-bin\fR \- Display npm bin folder
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-bugs.1 b/deps/npm/man/man1/npm-bugs.1
index e4a74891780807..c7ee3cb52b72f5 100644
--- a/deps/npm/man/man1/npm-bugs.1
+++ b/deps/npm/man/man1/npm-bugs.1
@@ -1,4 +1,4 @@
-.TH "NPM\-BUGS" "1" "December 2017" "" ""
+.TH "NPM\-BUGS" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-bugs\fR \- Bugs for a package in a web browser maybe
.SH SYNOPSIS
@@ -30,7 +30,7 @@ The browser that is called by the \fBnpm bugs\fP command to open websites\.
.SS registry
.RS 0
.IP \(bu 2
-Default: https://registry\.npmjs\.org/
+Default: https://
.IP \(bu 2
Type: url
diff --git a/deps/npm/man/man1/npm-build.1 b/deps/npm/man/man1/npm-build.1
index 6ea78934f15927..fe947c9707a54b 100644
--- a/deps/npm/man/man1/npm-build.1
+++ b/deps/npm/man/man1/npm-build.1
@@ -1,4 +1,4 @@
-.TH "NPM\-BUILD" "1" "December 2017" "" ""
+.TH "NPM\-BUILD" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-build\fR \- Build a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-bundle.1 b/deps/npm/man/man1/npm-bundle.1
index 6eb57d7c1022a9..2730fbf80b3d3c 100644
--- a/deps/npm/man/man1/npm-bundle.1
+++ b/deps/npm/man/man1/npm-bundle.1
@@ -1,4 +1,4 @@
-.TH "NPM\-BUNDLE" "1" "December 2017" "" ""
+.TH "NPM\-BUNDLE" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-bundle\fR \- REMOVED
.SH DESCRIPTION
diff --git a/deps/npm/man/man1/npm-cache.1 b/deps/npm/man/man1/npm-cache.1
index 133b61730f7268..9cf603114c155e 100644
--- a/deps/npm/man/man1/npm-cache.1
+++ b/deps/npm/man/man1/npm-cache.1
@@ -1,4 +1,4 @@
-.TH "NPM\-CACHE" "1" "December 2017" "" ""
+.TH "NPM\-CACHE" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-cache\fR \- Manipulates packages cache
.SH SYNOPSIS
@@ -88,9 +88,9 @@ npm help publish
.IP \(bu 2
npm help pack
.IP \(bu 2
-https://npm\.im/cacache
+https://
.IP \(bu 2
-https://npm\.im/pacote
+https://
.RE
diff --git a/deps/npm/man/man1/npm-ci.1 b/deps/npm/man/man1/npm-ci.1
new file mode 100644
index 00000000000000..02d4c0753816e1
--- /dev/null
+++ b/deps/npm/man/man1/npm-ci.1
@@ -0,0 +1,76 @@
+.TH "NPM\-CI" "1" "May 2018" "" ""
+.SH "NAME"
+\fBnpm-ci\fR \- Install a project with a clean slate
+.SH SYNOPSIS
+.P
+.RS 2
+.nf
+npm ci
+.fi
+.RE
+.SH EXAMPLE
+.P
+Make sure you have a package\-lock and an up\-to\-date install:
+.P
+.RS 2
+.nf
+$ cd \./my/npm/project
+$ npm install
+added 154 packages in 10s
+$ ls | grep package\-lock
+.fi
+.RE
+.P
+Run \fBnpm ci\fP in that project
+.P
+.RS 2
+.nf
+$ npm ci
+added 154 packages in 5s
+.fi
+.RE
+.P
+Configure Travis to build using \fBnpm ci\fP instead of \fBnpm install\fP:
+.P
+.RS 2
+.nf
+# \.travis\.yml
+install:
+\- npm ci
+# keep the npm cache around to speed up installs
+cache:
+ directories:
+ \- "$HOME/\.npm"
+.fi
+.RE
+.SH DESCRIPTION
+.P
+This command is similar to npm help \fBnpm\-install\fP, except it's meant to be used in
+automated environments such as test platforms, continuous integration, and
+deployment\. It can be significantly faster than a regular npm install by
+skipping certain user\-oriented features\. It is also more strict than a regular
+install, which can help catch errors or inconsistencies caused by the
+incrementally\-installed local environments of most npm users\.
+.P
+In short, the main differences between using \fBnpm install\fP and \fBnpm ci\fP are:
+.RS 0
+.IP \(bu 2
+The project \fBmust\fR have an existing \fBpackage\-lock\.json\fP or \fBnpm\-shrinkwrap\.json\fP\|\.
+.IP \(bu 2
+If dependencies in the package lock do not match those in \fBpackage\.json\fP, \fBnpm ci\fP will exit with an error, instead of updating the package lock\.
+.IP \(bu 2
+\fBnpm ci\fP can only install entire projects at a time: individual dependencies cannot be added with this command\.
+.IP \(bu 2
+If a \fBnode_modules\fP is already present, it will be automatically removed before \fBnpm ci\fP begins its install\.
+.IP \(bu 2
+It will never write to \fBpackage\.json\fP or any of the package\-locks: installs are essentially frozen\.
+
+.RE
+.SH SEE ALSO
+.RS 0
+.IP \(bu 2
+npm help install
+.IP \(bu 2
+npm help 5 package\-locks
+
+.RE
diff --git a/deps/npm/man/man1/npm-completion.1 b/deps/npm/man/man1/npm-completion.1
index 131cd3f0d6062e..a26740f617bd25 100644
--- a/deps/npm/man/man1/npm-completion.1
+++ b/deps/npm/man/man1/npm-completion.1
@@ -1,4 +1,4 @@
-.TH "NPM\-COMPLETION" "1" "December 2017" "" ""
+.TH "NPM\-COMPLETION" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-completion\fR \- Tab Completion for npm
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-config.1 b/deps/npm/man/man1/npm-config.1
index c284370d3f0ac7..228ff1d3973b31 100644
--- a/deps/npm/man/man1/npm-config.1
+++ b/deps/npm/man/man1/npm-config.1
@@ -1,4 +1,4 @@
-.TH "NPM\-CONFIG" "1" "December 2017" "" ""
+.TH "NPM\-CONFIG" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-config\fR \- Manage the npm configuration files
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-dedupe.1 b/deps/npm/man/man1/npm-dedupe.1
index c1ccfc6bf2d5d4..c4b47d6477d4d9 100644
--- a/deps/npm/man/man1/npm-dedupe.1
+++ b/deps/npm/man/man1/npm-dedupe.1
@@ -1,4 +1,4 @@
-.TH "NPM\-DEDUPE" "1" "December 2017" "" ""
+.TH "NPM\-DEDUPE" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-dedupe\fR \- Reduce duplication
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-deprecate.1 b/deps/npm/man/man1/npm-deprecate.1
index d50b3eb39a8060..9bf53cdae46c6e 100644
--- a/deps/npm/man/man1/npm-deprecate.1
+++ b/deps/npm/man/man1/npm-deprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM\-DEPRECATE" "1" "December 2017" "" ""
+.TH "NPM\-DEPRECATE" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-deprecate\fR \- Deprecate a version of a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-dist-tag.1 b/deps/npm/man/man1/npm-dist-tag.1
index ba49d77fa835f9..adf8cb1b809e66 100644
--- a/deps/npm/man/man1/npm-dist-tag.1
+++ b/deps/npm/man/man1/npm-dist-tag.1
@@ -1,4 +1,4 @@
-.TH "NPM\-DIST\-TAG" "1" "December 2017" "" ""
+.TH "NPM\-DIST\-TAG" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-dist-tag\fR \- Modify package distribution tags
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-docs.1 b/deps/npm/man/man1/npm-docs.1
index f913d4ee51e74c..66ef57a79ea3fb 100644
--- a/deps/npm/man/man1/npm-docs.1
+++ b/deps/npm/man/man1/npm-docs.1
@@ -1,4 +1,4 @@
-.TH "NPM\-DOCS" "1" "December 2017" "" ""
+.TH "NPM\-DOCS" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-docs\fR \- Docs for a package in a web browser maybe
.SH SYNOPSIS
@@ -32,7 +32,7 @@ The browser that is called by the \fBnpm docs\fP command to open websites\.
.SS registry
.RS 0
.IP \(bu 2
-Default: https://registry\.npmjs\.org/
+Default: https://
.IP \(bu 2
Type: url
diff --git a/deps/npm/man/man1/npm-doctor.1 b/deps/npm/man/man1/npm-doctor.1
index 649b81f2e7f727..fe8a185f42be80 100644
--- a/deps/npm/man/man1/npm-doctor.1
+++ b/deps/npm/man/man1/npm-doctor.1
@@ -1,4 +1,4 @@
-.TH "NPM\-DOCTOR" "1" "December 2017" "" ""
+.TH "NPM\-DOCTOR" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-doctor\fR \- Check your environments
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-edit.1 b/deps/npm/man/man1/npm-edit.1
index 96275a8d9a104f..c3c0d8ad62693c 100644
--- a/deps/npm/man/man1/npm-edit.1
+++ b/deps/npm/man/man1/npm-edit.1
@@ -1,4 +1,4 @@
-.TH "NPM\-EDIT" "1" "December 2017" "" ""
+.TH "NPM\-EDIT" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-edit\fR \- Edit an installed package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-explore.1 b/deps/npm/man/man1/npm-explore.1
index 9ed823aeef37cf..bda151d67a2abc 100644
--- a/deps/npm/man/man1/npm-explore.1
+++ b/deps/npm/man/man1/npm-explore.1
@@ -1,4 +1,4 @@
-.TH "NPM\-EXPLORE" "1" "December 2017" "" ""
+.TH "NPM\-EXPLORE" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-explore\fR \- Browse an installed package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-help-search.1 b/deps/npm/man/man1/npm-help-search.1
index 4252dff6987cfd..e31049e657bc89 100644
--- a/deps/npm/man/man1/npm-help-search.1
+++ b/deps/npm/man/man1/npm-help-search.1
@@ -1,4 +1,4 @@
-.TH "NPM\-HELP\-SEARCH" "1" "December 2017" "" ""
+.TH "NPM\-HELP\-SEARCH" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-help-search\fR \- Search npm help documentation
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-help.1 b/deps/npm/man/man1/npm-help.1
index dea51fb5dc857a..bfdf384a5bb2f6 100644
--- a/deps/npm/man/man1/npm-help.1
+++ b/deps/npm/man/man1/npm-help.1
@@ -1,4 +1,4 @@
-.TH "NPM\-HELP" "1" "December 2017" "" ""
+.TH "NPM\-HELP" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-help\fR \- Get help on npm
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-hook.1 b/deps/npm/man/man1/npm-hook.1
new file mode 100644
index 00000000000000..c4844c5a534688
--- /dev/null
+++ b/deps/npm/man/man1/npm-hook.1
@@ -0,0 +1,97 @@
+.TH "NPM\-HOOK" "1" "May 2018" "" ""
+.SH "NAME"
+\fBnpm-hook\fR \- Manage registry hooks
+.SH SYNOPSIS
+.P
+.RS 2
+.nf
+npm hook ls [pkg]
+npm hook add
+npm hook update [secret]
+npm hook rm
+.fi
+.RE
+.SH EXAMPLE
+.P
+Add a hook to watch a package for changes:
+.P
+.RS 2
+.nf
+$ npm hook add lodash https://example\.com/ my\-shared\-secret
+.fi
+.RE
+.P
+Add a hook to watch packages belonging to the user \fBsubstack\fP:
+.P
+.RS 2
+.nf
+$ npm hook add ~substack https://example\.com/ my\-shared\-secret
+.fi
+.RE
+.P
+Add a hook to watch packages in the scope \fB@npm\fP
+.P
+.RS 2
+.nf
+$ npm hook add @npm https://example\.com/ my\-shared\-secret
+.fi
+.RE
+.P
+List all your active hooks:
+.P
+.RS 2
+.nf
+$ npm hook ls
+.fi
+.RE
+.P
+List your active hooks for the \fBlodash\fP package:
+.P
+.RS 2
+.nf
+$ npm hook ls lodash
+.fi
+.RE
+.P
+Update an existing hook's url:
+.P
+.RS 2
+.nf
+$ npm hook update id\-deadbeef https://my\-new\-website\.here/
+.fi
+.RE
+.P
+Remove a hook:
+.P
+.RS 2
+.nf
+$ npm hook rm id\-deadbeef
+.fi
+.RE
+.SH DESCRIPTION
+.P
+Allows you to manage npm
+hooks \fIhttp://blog\.npmjs\.org/post/145260155635/introducing\-hooks\-get\-notifications\-of\-npm\fR,
+including adding, removing, listing, and updating\.
+.P
+Hooks allow you to configure URL endpoints that will be notified whenever a
+change happens to any of the supported entity types\. Three different types of
+entities can be watched by hooks: packages, owners, and scopes\.
+.P
+To create a package hook, simply reference the package name\.
+.P
+To create an owner hook, prefix the owner name with \fB~\fP (as in, \fB~youruser\fP)\.
+.P
+To create a scope hook, prefix the scope name with \fB@\fP (as in, \fB@yourscope\fP)\.
+.P
+The hook \fBid\fP used by \fBupdate\fP and \fBrm\fP are the IDs listed in \fBnpm hook ls\fP for
+that particular hook\.
+.P
+The shared secret will be sent along to the URL endpoint so you can verify the
+request came from your own configured hook\.
+.SH SEE ALSO
+.RS 0
+.IP \(bu 2
+"Introducing Hooks" blog post \fIhttp://blog\.npmjs\.org/post/145260155635/introducing\-hooks\-get\-notifications\-of\-npm\fR
+
+.RE
diff --git a/deps/npm/man/man1/npm-init.1 b/deps/npm/man/man1/npm-init.1
index 3395281ac75769..91562d64212225 100644
--- a/deps/npm/man/man1/npm-init.1
+++ b/deps/npm/man/man1/npm-init.1
@@ -1,39 +1,81 @@
-.TH "NPM\-INIT" "1" "December 2017" "" ""
+.TH "NPM\-INIT" "1" "May 2018" "" ""
.SH "NAME"
-\fBnpm-init\fR \- Interactively create a package\.json file
+\fBnpm-init\fR \- create a package\.json file
.SH SYNOPSIS
.P
.RS 2
.nf
-npm init [\-f|\-\-force|\-y|\-\-yes]
+npm init [\-\-force|\-f|\-\-yes|\-y|\-\-scope]
+npm init <@scope> (same as `npx <@scope>/create`)
+npm init [<@scope>/] (same as `npx [<@scope>/]create\-`)
+.fi
+.RE
+.SH EXAMPLES
+.P
+Create a new React\-based project using \fBcreate\-react\-app\fP \fIhttps://npm\.im/create\-react\-app\fR:
+.P
+.RS 2
+.nf
+$ npm init react\-app \./my\-react\-app
+.fi
+.RE
+.P
+Create a new \fBesm\fP\-compatible package using \fBcreate\-esm\fP \fIhttps://npm\.im/create\-esm\fR:
+.P
+.RS 2
+.nf
+$ mkdir my\-esm\-lib && cd my\-esm\-lib
+$ npm init esm \-\-yes
.fi
.RE
-.SH DESCRIPTION
.P
-This will ask you a bunch of questions, and then write a package\.json for you\.
+Generate a plain old package\.json using legacy init:
.P
-It attempts to make reasonable guesses about what you want things to be set to,
-and then writes a package\.json file with the options you've selected\.
+.RS 2
+.nf
+$ mkdir my\-npm\-pkg && cd my\-npm\-pkg
+$ git init
+$ npm init
+.fi
+.RE
.P
-If you already have a package\.json file, it'll read that first, and default to
-the options in there\.
+Generate it without having it ask any questions:
.P
-It is strictly additive, so it does not delete options from your package\.json
-without a really good reason to do so\.
+.RS 2
+.nf
+$ npm init \-y
+.fi
+.RE
+.SH DESCRIPTION
+.P
+\fBnpm init \fP can be used to set up a new or existing npm package\.
.P
-If you invoke it with \fB\-f\fP, \fB\-\-force\fP, \fB\-y\fP, or \fB\-\-yes\fP, it will use only
-defaults and not prompt you for any options\.
-.SH CONFIGURATION
-.SS scope
+\fBinitializer\fP in this case is an npm package named \fBcreate\-\fP, which
+will be installed by npm help \fBnpx\fP \fIhttps://npm\.im/npx\fR, and then have its main bin
+executed \-\- presumably creating or updating \fBpackage\.json\fP and running any other
+initialization\-related operations\.
+.P
+The init command is transformed to a corresponding \fBnpx\fP operation as follows:
.RS 0
.IP \(bu 2
-Default: none
+\fBnpm init foo\fP \-> \fBnpx create\-foo\fP
+.IP \(bu 2
+\fBnpm init @usr/foo\fP \-> \fBnpx @usr/create\-foo\fP
.IP \(bu 2
-Type: String
+\fBnpm init @usr\fP \-> \fBnpx @usr/create\fP
.RE
.P
-The scope under which the new module should be created\.
+Any additional options will be passed directly to the command, so \fBnpm init foo
+\-\-hello\fP will map to \fBnpx create\-foo \-\-hello\fP\|\.
+.P
+If the initializer is omitted (by just calling \fBnpm init\fP), init will fall back
+to legacy init behavior\. It will ask you a bunch of questions, and then write a
+package\.json for you\. It will attempt to make reasonable guesses based on
+existing fields, dependencies, and options selected\. It is strictly additive, so
+it will keep any fields and values that were already set\. You can also use
+\fB\-y\fP/\fB\-\-yes\fP to skip the questionnaire altogether\. If you pass \fB\-\-scope\fP, it
+will create a scoped package\.
.SH SEE ALSO
.RS 0
.IP \(bu 2
diff --git a/deps/npm/man/man1/npm-install-ci-test.1 b/deps/npm/man/man1/npm-install-ci-test.1
new file mode 100644
index 00000000000000..29171fe5c602a9
--- /dev/null
+++ b/deps/npm/man/man1/npm-install-ci-test.1
@@ -0,0 +1,23 @@
+.TH "NPM" "" "May 2018" "" ""
+.SH "NAME"
+\fBnpm\fR
+.SH SYNOPSIS
+.P
+.RS 2
+.nf
+npm install\-ci\-test
+
+alias: npm cit
+.fi
+.RE
+.SH DESCRIPTION
+.P
+This command runs an \fBnpm ci\fP followed immediately by an \fBnpm test\fP\|\.
+.SH SEE ALSO
+.RS 0
+.IP \(bu 2
+npm help ci
+.IP \(bu 2
+npm help test
+
+.RE
diff --git a/deps/npm/man/man1/npm-install-test.1 b/deps/npm/man/man1/npm-install-test.1
index 34a306b520b807..2aef6db229f2ef 100644
--- a/deps/npm/man/man1/npm-install-test.1
+++ b/deps/npm/man/man1/npm-install-test.1
@@ -1,4 +1,4 @@
-.TH "NPM" "" "December 2017" "" ""
+.TH "NPM" "" "May 2018" "" ""
.SH "NAME"
\fBnpm\fR
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-install.1 b/deps/npm/man/man1/npm-install.1
index bdbc6794c9bf2f..cd5dc4094126a4 100644
--- a/deps/npm/man/man1/npm-install.1
+++ b/deps/npm/man/man1/npm-install.1
@@ -1,4 +1,4 @@
-.TH "NPM\-INSTALL" "1" "December 2017" "" ""
+.TH "NPM\-INSTALL" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-install\fR \- Install a package
.SH SYNOPSIS
@@ -62,6 +62,11 @@ after packing it up into a tarball (b)\.
With the \fB\-\-production\fP flag (or when the \fBNODE_ENV\fP environment variable
is set to \fBproduction\fP), npm will not install modules listed in
\fBdevDependencies\fP\|\.
+.QP
+NOTE: The \fB\-\-production\fP flag has no particular meaning when adding a
+ dependency to a project\.
+
+.
.IP \(bu 2
\fBnpm install \fP:
Install the package in the directory as a symlink in the current project\.
@@ -397,7 +402,8 @@ The \fB\-\-no\-shrinkwrap\fP argument, which will ignore an available
package lock or shrinkwrap file and use the package\.json instead\.
.P
The \fB\-\-no\-package\-lock\fP argument will prevent npm from creating a
-\fBpackage\-lock\.json\fP file\.
+\fBpackage\-lock\.json\fP file\. When running with package\-lock's disabled npm
+will not automatically prune your node modules when installing\.
.P
The \fB\-\-nodedir=/path/to/node/source\fP argument will allow npm to find the
node source code so that npm can compile native modules\.
@@ -405,6 +411,9 @@ node source code so that npm can compile native modules\.
The \fB\-\-only={prod[uction]|dev[elopment]}\fP argument will cause either only
\fBdevDependencies\fP or only non\-\fBdevDependencies\fP to be installed regardless of the \fBNODE_ENV\fP\|\.
.P
+The \fB\-\-no\-audit\fP argument can be used to disable sending of audit reports to
+the configured registries\. See npm help \fBnpm\-audit\fP for details on what is sent\.
+.P
See npm help 7 \fBnpm\-config\fP\|\. Many of the configuration params have some
effect on installation, since that's most of what npm does\.
.SH ALGORITHM
@@ -496,6 +505,8 @@ npm help 5 folders
.IP \(bu 2
npm help update
.IP \(bu 2
+npm help audit
+.IP \(bu 2
npm help link
.IP \(bu 2
npm help rebuild
diff --git a/deps/npm/man/man1/npm-link.1 b/deps/npm/man/man1/npm-link.1
index 471db86d33ef75..218ccadeb3f68d 100644
--- a/deps/npm/man/man1/npm-link.1
+++ b/deps/npm/man/man1/npm-link.1
@@ -1,4 +1,4 @@
-.TH "NPM\-LINK" "1" "December 2017" "" ""
+.TH "NPM\-LINK" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-link\fR \- Symlink a package folder
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-logout.1 b/deps/npm/man/man1/npm-logout.1
index fab4c6c13577d0..c0e282b053e25f 100644
--- a/deps/npm/man/man1/npm-logout.1
+++ b/deps/npm/man/man1/npm-logout.1
@@ -1,4 +1,4 @@
-.TH "NPM\-LOGOUT" "1" "December 2017" "" ""
+.TH "NPM\-LOGOUT" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-logout\fR \- Log out of the registry
.SH SYNOPSIS
@@ -23,7 +23,7 @@ connected to that scope, if set\.
.SH CONFIGURATION
.SS registry
.P
-Default: https://registry\.npmjs\.org/
+Default: https://
.P
The base URL of the npm package registry\. If \fBscope\fP is also specified,
it takes precedence\.
diff --git a/deps/npm/man/man1/npm-ls.1 b/deps/npm/man/man1/npm-ls.1
index c28056f2d076cb..5c9a3578d0cb4b 100644
--- a/deps/npm/man/man1/npm-ls.1
+++ b/deps/npm/man/man1/npm-ls.1
@@ -1,4 +1,4 @@
-.TH "NPM\-LS" "1" "December 2017" "" ""
+.TH "NPM\-LS" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-ls\fR \- List installed packages
.SH SYNOPSIS
@@ -22,7 +22,7 @@ For example, running \fBnpm ls promzard\fP in npm's source tree will show:
.P
.RS 2
.nf
-npm@5.6.0 /path/to/npm
+npm@6.1.0 /path/to/npm
└─┬ init\-package\-json@0\.0\.4
└── promzard@0\.1\.5
.fi
@@ -98,7 +98,7 @@ Default: false
.RE
.P
Display only the dependency tree for packages in \fBdependencies\fP\|\.
-.SS dev
+.SS dev / development
.RS 0
.IP \(bu 2
Type: Boolean
diff --git a/deps/npm/man/man1/npm-outdated.1 b/deps/npm/man/man1/npm-outdated.1
index e301f08e44b25e..8938e45db6932d 100644
--- a/deps/npm/man/man1/npm-outdated.1
+++ b/deps/npm/man/man1/npm-outdated.1
@@ -1,4 +1,4 @@
-.TH "NPM\-OUTDATED" "1" "December 2017" "" ""
+.TH "NPM\-OUTDATED" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-outdated\fR \- Check for outdated packages
.SH SYNOPSIS
@@ -34,6 +34,10 @@ always be seeing only top\-level dependencies that are outdated\.
\fBpackage type\fP (when using \fB\-\-long\fP / \fB\-l\fP) tells you whether this package is
a \fBdependency\fP or a \fBdevDependency\fP\|\. Packages not included in \fBpackage\.json\fP
are always marked \fBdependencies\fP\|\.
+.IP \(bu 2
+Red means there's a newer version matching your semver requirements, so you should update now\.
+.IP \(bu 2
+Yellow indicates that there's a newer version above your semver requirements (usually new major, or new 0\.x minor) so proceed with caution\.
.RE
.SS An example
@@ -75,10 +79,9 @@ something immutable, like a commit SHA), or it might not, so \fBnpm outdated\fP
\fBnpm update\fP have to fetch Git repos to check\. This is why currently doing a
reinstall of a Git dependency always forces a new clone and install\.
.IP \(bu 2
-\fBnpm@3\.5\.2\fP is marked as "wanted", but "latest" is \fBnpm@3\.5\.1\fP because npm
-uses dist\-tags to manage its \fBlatest\fP and \fBnext\fP release channels\. \fBnpm update\fP
-will install the \fInewest\fR version, but \fBnpm install npm\fP (with no semver range)
-will install whatever's tagged as \fBlatest\fP\|\.
+\fBis marked as "wanted", but "latest" is\fP\fBbecause npm
+uses dist\-tags to manage its\fPlatest\fBand\fPnext\fBrelease channels\.\fPnpm update\fBwill install the _newest_ version, but\fPnpm install npm\fB(with no semver range)
+will install whatever's tagged as\fPlatest`\.
.IP \(bu 2
\fBonce\fP is just plain out of date\. Reinstalling \fBnode_modules\fP from scratch or
running \fBnpm update\fP will bring it up to spec\.
diff --git a/deps/npm/man/man1/npm-owner.1 b/deps/npm/man/man1/npm-owner.1
index 8e0617d6e79585..6c910db02b27b7 100644
--- a/deps/npm/man/man1/npm-owner.1
+++ b/deps/npm/man/man1/npm-owner.1
@@ -1,4 +1,4 @@
-.TH "NPM\-OWNER" "1" "December 2017" "" ""
+.TH "NPM\-OWNER" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-owner\fR \- Manage package owners
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-pack.1 b/deps/npm/man/man1/npm-pack.1
index 633ceac020d8d0..b2a23ec1f94f6c 100644
--- a/deps/npm/man/man1/npm-pack.1
+++ b/deps/npm/man/man1/npm-pack.1
@@ -1,4 +1,4 @@
-.TH "NPM\-PACK" "1" "December 2017" "" ""
+.TH "NPM\-PACK" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-pack\fR \- Create a tarball from a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-ping.1 b/deps/npm/man/man1/npm-ping.1
index 3c5a3ed9997a7a..3d861b66fd9297 100644
--- a/deps/npm/man/man1/npm-ping.1
+++ b/deps/npm/man/man1/npm-ping.1
@@ -1,4 +1,4 @@
-.TH "NPM\-PING" "1" "December 2017" "" ""
+.TH "NPM\-PING" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-ping\fR \- Ping npm registry
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-prefix.1 b/deps/npm/man/man1/npm-prefix.1
index f69b65b9cacf6b..9243d892c2b7e4 100644
--- a/deps/npm/man/man1/npm-prefix.1
+++ b/deps/npm/man/man1/npm-prefix.1
@@ -1,4 +1,4 @@
-.TH "NPM\-PREFIX" "1" "December 2017" "" ""
+.TH "NPM\-PREFIX" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-prefix\fR \- Display prefix
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-profile.1 b/deps/npm/man/man1/npm-profile.1
index 37252a530e1417..0bf0ba446416d2 100644
--- a/deps/npm/man/man1/npm-profile.1
+++ b/deps/npm/man/man1/npm-profile.1
@@ -1,4 +1,4 @@
-.TH "NPM\-PROFILE" "1" "December 2017" "" ""
+.TH "NPM\-PROFILE" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-profile\fR \- Change settings on your registry profile
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-prune.1 b/deps/npm/man/man1/npm-prune.1
index f84d2e41ec7e51..7b0a438ed775ef 100644
--- a/deps/npm/man/man1/npm-prune.1
+++ b/deps/npm/man/man1/npm-prune.1
@@ -1,11 +1,11 @@
-.TH "NPM\-PRUNE" "1" "December 2017" "" ""
+.TH "NPM\-PRUNE" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-prune\fR \- Remove extraneous packages
.SH SYNOPSIS
.P
.RS 2
.nf
-npm prune [[<@scope>/]\.\.\.] [\-\-production]
+npm prune [[<@scope>/]\.\.\.] [\-\-production] [\-\-dry\-run] [\-\-json]
.fi
.RE
.SH DESCRIPTION
@@ -19,8 +19,20 @@ package's dependencies list\.
.P
If the \fB\-\-production\fP flag is specified or the \fBNODE_ENV\fP environment
variable is set to \fBproduction\fP, this command will remove the packages
-specified in your \fBdevDependencies\fP\|\. Setting \fB\-\-production=false\fP will
+specified in your \fBdevDependencies\fP\|\. Setting \fB\-\-no\-production\fP will
negate \fBNODE_ENV\fP being set to \fBproduction\fP\|\.
+.P
+If the \fB\-\-dry\-run\fP flag is used then no changes will actually be made\.
+.P
+If the \fB\-\-json\fP flag is used then the changes \fBnpm prune\fP made (or would
+have made with \fB\-\-dry\-run\fP) are printed as a JSON object\.
+.P
+In normal operation with package\-locks enabled, extraneous modules are
+pruned automatically when modules are installed and you'll only need
+this command with the \fB\-\-production\fP flag\.
+.P
+If you've disabled package\-locks then extraneous modules will not be removed
+and it's up to you to run \fBnpm prune\fP from time\-to\-time to remove them\.
.SH SEE ALSO
.RS 0
.IP \(bu 2
diff --git a/deps/npm/man/man1/npm-publish.1 b/deps/npm/man/man1/npm-publish.1
index 2764e9e4c49d89..536ca1fe070b5c 100644
--- a/deps/npm/man/man1/npm-publish.1
+++ b/deps/npm/man/man1/npm-publish.1
@@ -1,4 +1,4 @@
-.TH "NPM\-PUBLISH" "1" "December 2017" "" ""
+.TH "NPM\-PUBLISH" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-publish\fR \- Publish a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-rebuild.1 b/deps/npm/man/man1/npm-rebuild.1
index ab2b80391a8749..29b14b4ce1cf5b 100644
--- a/deps/npm/man/man1/npm-rebuild.1
+++ b/deps/npm/man/man1/npm-rebuild.1
@@ -1,4 +1,4 @@
-.TH "NPM\-REBUILD" "1" "December 2017" "" ""
+.TH "NPM\-REBUILD" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-rebuild\fR \- Rebuild a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-repo.1 b/deps/npm/man/man1/npm-repo.1
index 85b22ead2d04bf..bd09d42531ecd4 100644
--- a/deps/npm/man/man1/npm-repo.1
+++ b/deps/npm/man/man1/npm-repo.1
@@ -1,4 +1,4 @@
-.TH "NPM\-REPO" "1" "December 2017" "" ""
+.TH "NPM\-REPO" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-repo\fR \- Open package repository page in the browser
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-restart.1 b/deps/npm/man/man1/npm-restart.1
index b269a5fb75bbbd..cd564b0b112a6d 100644
--- a/deps/npm/man/man1/npm-restart.1
+++ b/deps/npm/man/man1/npm-restart.1
@@ -1,4 +1,4 @@
-.TH "NPM\-RESTART" "1" "December 2017" "" ""
+.TH "NPM\-RESTART" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-restart\fR \- Restart a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-root.1 b/deps/npm/man/man1/npm-root.1
index 63901eef3c51a5..623e947741fac8 100644
--- a/deps/npm/man/man1/npm-root.1
+++ b/deps/npm/man/man1/npm-root.1
@@ -1,4 +1,4 @@
-.TH "NPM\-ROOT" "1" "December 2017" "" ""
+.TH "NPM\-ROOT" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-root\fR \- Display npm root
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-run-script.1 b/deps/npm/man/man1/npm-run-script.1
index 2cdde2a46cd374..8b124e91e5da36 100644
--- a/deps/npm/man/man1/npm-run-script.1
+++ b/deps/npm/man/man1/npm-run-script.1
@@ -1,4 +1,4 @@
-.TH "NPM\-RUN\-SCRIPT" "1" "December 2017" "" ""
+.TH "NPM\-RUN\-SCRIPT" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-run-script\fR \- Run arbitrary package scripts
.SH SYNOPSIS
@@ -18,7 +18,7 @@ used by the test, start, restart, and stop commands, but can be called
directly, as well\. When the scripts in the package are printed out, they're
separated into lifecycle (test, start, restart) and directly\-run scripts\.
.P
-As of \fBnpm@2\.0\.0\fP \fIhttp://blog\.npmjs\.org/post/98131109725/npm\-2\-0\-0\fR, you can
+As of ` \fIhttp://blog\.npmjs\.org/post/98131109725/npm\-2\-0\-0\fR, you can
use custom arguments when executing scripts\. The special option \fB\-\-\fP is used by
getopt \fIhttp://goo\.gl/KxMmtG\fR to delimit the end of the options\. npm will pass
all the arguments after the \fB\-\-\fP directly to your script:
@@ -62,7 +62,7 @@ to run your tests\.
The actual shell your script is run within is platform dependent\. By default,
on Unix\-like systems it is the \fB/bin/sh\fP command, on Windows it is the \fBcmd\.exe\fP\|\.
The actual shell referred to by \fB/bin/sh\fP also depends on the system\.
-As of \fBnpm@5\.1\.0\fP \fIhttps://github\.com/npm/npm/releases/tag/v5\.1\.0\fR you can
+As of ` \fIhttps://github\.com/npm/npm/releases/tag/v5\.1\.0\fR you can
customize the shell with the \fBscript\-shell\fP configuration\.
.P
Scripts are run from the root of the module, regardless of what your current
@@ -82,6 +82,10 @@ If you try to run a script without having a \fBnode_modules\fP directory and it
you will be given a warning to run \fBnpm install\fP, just in case you've forgotten\.
.P
You can use the \fB\-\-silent\fP flag to prevent showing \fBnpm ERR!\fP output on error\.
+.P
+You can use the \fB\-\-if\-present\fP flag to avoid exiting with a non\-zero exit code
+when the script is undefined\. This lets you run potentially undefined scripts
+without breaking the execution chain\.
.SH SEE ALSO
.RS 0
.IP \(bu 2
diff --git a/deps/npm/man/man1/npm-search.1 b/deps/npm/man/man1/npm-search.1
index f175c8628cbe60..af6924f0d3a915 100644
--- a/deps/npm/man/man1/npm-search.1
+++ b/deps/npm/man/man1/npm-search.1
@@ -1,4 +1,4 @@
-.TH "NPM\-SEARCH" "1" "December 2017" "" ""
+.TH "NPM\-SEARCH" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-search\fR \- Search for packages
.SH SYNOPSIS
@@ -110,7 +110,7 @@ The age of the cache, in seconds, before another registry request is made\.
.SS registry
.RS 0
.IP \(bu 2
-Default: https://registry\.npmjs\.org/
+Default: https://
.IP \(bu 2
Type: url
diff --git a/deps/npm/man/man1/npm-shrinkwrap.1 b/deps/npm/man/man1/npm-shrinkwrap.1
index 00347defa6d2d2..455485180388bc 100644
--- a/deps/npm/man/man1/npm-shrinkwrap.1
+++ b/deps/npm/man/man1/npm-shrinkwrap.1
@@ -1,4 +1,4 @@
-.TH "NPM\-SHRINKWRAP" "1" "December 2017" "" ""
+.TH "NPM\-SHRINKWRAP" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-shrinkwrap\fR \- Lock down dependency versions for publication
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-star.1 b/deps/npm/man/man1/npm-star.1
index 44e51472051377..7186e4b5960470 100644
--- a/deps/npm/man/man1/npm-star.1
+++ b/deps/npm/man/man1/npm-star.1
@@ -1,4 +1,4 @@
-.TH "NPM\-STAR" "1" "December 2017" "" ""
+.TH "NPM\-STAR" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-star\fR \- Mark your favorite packages
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-stars.1 b/deps/npm/man/man1/npm-stars.1
index c5a7de3cc3e0e0..a28881489cf8e8 100644
--- a/deps/npm/man/man1/npm-stars.1
+++ b/deps/npm/man/man1/npm-stars.1
@@ -1,4 +1,4 @@
-.TH "NPM\-STARS" "1" "December 2017" "" ""
+.TH "NPM\-STARS" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-stars\fR \- View packages marked as favorites
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-start.1 b/deps/npm/man/man1/npm-start.1
index 57b75de5b8e5b4..37039b5f668e46 100644
--- a/deps/npm/man/man1/npm-start.1
+++ b/deps/npm/man/man1/npm-start.1
@@ -1,4 +1,4 @@
-.TH "NPM\-START" "1" "December 2017" "" ""
+.TH "NPM\-START" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-start\fR \- Start a package
.SH SYNOPSIS
@@ -14,7 +14,7 @@ This runs an arbitrary command specified in the package's \fB"start"\fP property
its \fB"scripts"\fP object\. If no \fB"start"\fP property is specified on the
\fB"scripts"\fP object, it will run \fBnode server\.js\fP\|\.
.P
-As of \fBnpm@2\.0\.0\fP \fIhttp://blog\.npmjs\.org/post/98131109725/npm\-2\-0\-0\fR, you can
+As of ` \fIhttp://blog\.npmjs\.org/post/98131109725/npm\-2\-0\-0\fR, you can
use custom arguments when executing scripts\. Refer to npm help run\-script for
more details\.
.SH SEE ALSO
diff --git a/deps/npm/man/man1/npm-stop.1 b/deps/npm/man/man1/npm-stop.1
index 674ed9a530d149..94f2e168003049 100644
--- a/deps/npm/man/man1/npm-stop.1
+++ b/deps/npm/man/man1/npm-stop.1
@@ -1,4 +1,4 @@
-.TH "NPM\-STOP" "1" "December 2017" "" ""
+.TH "NPM\-STOP" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-stop\fR \- Stop a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-team.1 b/deps/npm/man/man1/npm-team.1
index cb75eeeec92fa1..405595ebf73296 100644
--- a/deps/npm/man/man1/npm-team.1
+++ b/deps/npm/man/man1/npm-team.1
@@ -1,4 +1,4 @@
-.TH "NPM\-TEAM" "1" "December 2017" "" ""
+.TH "NPM\-TEAM" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-team\fR \- Manage organization teams and team memberships
.SH SYNOPSIS
@@ -37,6 +37,9 @@ ls:
If performed on an organization name, will return a list of existing teams
under that organization\. If performed on a team, it will instead return a list
of all users belonging to that particular team\.
+.IP \(bu 2
+edit:
+Edit a current team\.
.RE
.SH DETAILS
diff --git a/deps/npm/man/man1/npm-test.1 b/deps/npm/man/man1/npm-test.1
index 2b03620434dfc5..f345ab2c9a86bc 100644
--- a/deps/npm/man/man1/npm-test.1
+++ b/deps/npm/man/man1/npm-test.1
@@ -1,4 +1,4 @@
-.TH "NPM\-TEST" "1" "December 2017" "" ""
+.TH "NPM\-TEST" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-test\fR \- Test a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-token.1 b/deps/npm/man/man1/npm-token.1
index 8eb645e9fa4c67..b47fe1da353d68 100644
--- a/deps/npm/man/man1/npm-token.1
+++ b/deps/npm/man/man1/npm-token.1
@@ -1,4 +1,4 @@
-.TH "NPM\-TOKEN" "1" "December 2017" "" ""
+.TH "NPM\-TOKEN" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-token\fR \- Manage your authentication tokens
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-uninstall.1 b/deps/npm/man/man1/npm-uninstall.1
index be83b3f7a8deb9..ade2aa770a4e77 100644
--- a/deps/npm/man/man1/npm-uninstall.1
+++ b/deps/npm/man/man1/npm-uninstall.1
@@ -1,4 +1,4 @@
-.TH "NPM\-UNINSTALL" "1" "December 2017" "" ""
+.TH "NPM\-UNINSTALL" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-uninstall\fR \- Remove a package
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-unpublish.1 b/deps/npm/man/man1/npm-unpublish.1
index 224e04f1bb2882..cd4dd2bcfa5f16 100644
--- a/deps/npm/man/man1/npm-unpublish.1
+++ b/deps/npm/man/man1/npm-unpublish.1
@@ -1,4 +1,4 @@
-.TH "NPM\-UNPUBLISH" "1" "December 2017" "" ""
+.TH "NPM\-UNPUBLISH" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-unpublish\fR \- Remove a package from the registry
.SH SYNOPSIS
@@ -32,7 +32,7 @@ package again, a new version number must be used\.
With the default registry (\fBregistry\.npmjs\.org\fP), unpublish is
only allowed with versions published in the last 24 hours\. If you
are trying to unpublish a version published longer ago than that,
-contact support@npmjs\.com\.
+contact \|\.
.P
The scope is optional and follows the usual rules for npm help 7 \fBnpm\-scope\fP\|\.
.SH SEE ALSO
diff --git a/deps/npm/man/man1/npm-update.1 b/deps/npm/man/man1/npm-update.1
index d8ae500df08140..70e7d7676c807e 100644
--- a/deps/npm/man/man1/npm-update.1
+++ b/deps/npm/man/man1/npm-update.1
@@ -1,4 +1,4 @@
-.TH "NPM\-UPDATE" "1" "December 2017" "" ""
+.TH "NPM\-UPDATE" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-update\fR \- Update a package
.SH SYNOPSIS
@@ -25,13 +25,17 @@ packages\.
If no package name is specified, all packages in the specified location (global
or local) will be updated\.
.P
-As of \fBnpm@2\.6\.1\fP, the \fBnpm update\fP will only inspect top\-level packages\.
-Prior versions of \fBnpm\fP would also recursively inspect all dependencies\.
-To get the old behavior, use \fBnpm \-\-depth 9999 update\fP\|\.
+As of \fB, the\fPnpm update\fBwill only inspect top\-level packages\.
+Prior versions of\fPnpm\fBwould also recursively inspect all dependencies\.
+To get the old behavior, use\fPnpm \-\-depth 9999 update`\.
+.P
+As of \fB, the\fPnpm update\fBwill change\fPpackage\.json\fBto save the
+new version as the minimum required dependency\. To get the old behavior,
+use\fPnpm update \-\-no\-save`\.
.SH EXAMPLES
.P
-IMPORTANT VERSION NOTE: these examples assume \fBnpm@2\.6\.1\fP or later\. For
-older versions of \fBnpm\fP, you must specify \fB\-\-depth 0\fP to get the behavior
+IMPORTANT VERSION NOTE: these examples assume \fBor later\. For
+older versions of\fPnpm\fB, you must specify\fP\-\-depth 0` to get the behavior
described below\.
.P
For the examples below, assume that the current package is \fBapp\fP and it depends
@@ -67,8 +71,7 @@ If \fBapp\fP\|'s \fBpackage\.json\fP contains:
.fi
.RE
.P
-Then \fBnpm update\fP will install \fBdep1@1\.2\.2\fP, because \fB1\.2\.2\fP is \fBlatest\fP and
-\fB1\.2\.2\fP satisfies \fB^1\.1\.1\fP\|\.
+Then \fBnpm update\fP will install \fB, because\fP1\.2\.2\fBis\fPlatest\fBand\fP1\.2\.2\fBsatisfies\fP^1\.1\.1`\.
.SS Tilde Dependencies
.P
However, if \fBapp\fP\|'s \fBpackage\.json\fP contains:
@@ -81,10 +84,9 @@ However, if \fBapp\fP\|'s \fBpackage\.json\fP contains:
.fi
.RE
.P
-In this case, running \fBnpm update\fP will install \fBdep1@1\.1\.2\fP\|\. Even though the \fBlatest\fP
-tag points to \fB1\.2\.2\fP, this version does not satisfy \fB~1\.1\.1\fP, which is equivalent
-to \fB>=1\.1\.1 <1\.2\.0\fP\|\. So the highest\-sorting version that satisfies \fB~1\.1\.1\fP is used,
-which is \fB1\.1\.2\fP\|\.
+In this case, running \fBnpm update\fP will install \fB\|\. Even though the\fPlatest\fBtag points to\fP1\.2\.2\fB, this version does not satisfy\fP~1\.1\.1\fB, which is equivalent
+to\fP>=1\.1\.1 <1\.2\.0\fB\|\. So the highest\-sorting version that satisfies\fP~1\.1\.1\fBis used,
+which is\fP1\.1\.2`\.
.SS Caret Dependencies below 1\.0\.0
.P
Suppose \fBapp\fP has a caret dependency on a version below \fB1\.0\.0\fP, for example:
@@ -97,8 +99,8 @@ Suppose \fBapp\fP has a caret dependency on a version below \fB1\.0\.0\fP, for e
.fi
.RE
.P
-\fBnpm update\fP will install \fBdep1@0\.2\.0\fP, because there are no other
-versions which satisfy \fB^0\.2\.0\fP\|\.
+\fBnpm update\fP will install \fB, because there are no other
+versions which satisfy\fP^0\.2\.0`\.
.P
If the dependence were on \fB^0\.4\.0\fP:
.P
@@ -110,36 +112,8 @@ If the dependence were on \fB^0\.4\.0\fP:
.fi
.RE
.P
-Then \fBnpm update\fP will install \fBdep1@0\.4\.1\fP, because that is the highest\-sorting
-version that satisfies \fB^0\.4\.0\fP (\fB>= 0\.4\.0 <0\.5\.0\fP)
-.SS Recording Updates with \fB\-\-save\fP
-.P
-When you want to update a package and save the new version as
-the minimum required dependency in \fBpackage\.json\fP, you can use
-\fBnpm update \-S\fP or \fBnpm update \-\-save\fP\|\. For example if
-\fBpackage\.json\fP contains:
-.P
-.RS 2
-.nf
-"dependencies": {
- "dep1": "^1\.1\.1"
-}
-.fi
-.RE
-.P
-Then \fBnpm update \-\-save\fP will install \fBdep1@1\.2\.2\fP (i\.e\., \fBlatest\fP),
-and \fBpackage\.json\fP will be modified:
-.P
-.RS 2
-.nf
-"dependencies": {
- "dep1": "^1\.2\.2"
-}
-.fi
-.RE
-.P
-Note that \fBnpm\fP will only write an updated version to \fBpackage\.json\fP
-if it installs a new package\.
+Then \fBnpm update\fP will install \fB, because that is the highest\-sorting
+version that satisfies\fP^0\.4\.0\fB(\fP>= 0\.4\.0 <0\.5\.0`)
.SS Updating Globally\-Installed Packages
.P
\fBnpm update \-g\fP will apply the \fBupdate\fP action to each globally installed
diff --git a/deps/npm/man/man1/npm-version.1 b/deps/npm/man/man1/npm-version.1
index 9601e4f1883d5c..c86e8e5d0bc050 100644
--- a/deps/npm/man/man1/npm-version.1
+++ b/deps/npm/man/man1/npm-version.1
@@ -1,4 +1,4 @@
-.TH "NPM\-VERSION" "1" "December 2017" "" ""
+.TH "NPM\-VERSION" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-version\fR \- Bump a package version
.SH SYNOPSIS
@@ -15,7 +15,7 @@ npm version [ | major | minor | patch | premajor | preminor | prepat
.SH DESCRIPTION
.P
Run this in a package directory to bump the version and write the new
-data back to \fBpackage\.json\fP and, if present, \fBnpm\-shrinkwrap\.json\fP\|\.
+data back to \fBpackage\.json\fP, \fBpackage\-lock\.json\fP, and, if present, \fBnpm\-shrinkwrap\.json\fP\|\.
.P
The \fBnewversion\fP argument should be a valid semver string, a
valid second argument to semver\.inc \fIhttps://github\.com/npm/node\-semver#functions\fR (one of \fBpatch\fP, \fBminor\fP, \fBmajor\fP,
diff --git a/deps/npm/man/man1/npm-view.1 b/deps/npm/man/man1/npm-view.1
index 2c18268271a435..b17739904f4a9c 100644
--- a/deps/npm/man/man1/npm-view.1
+++ b/deps/npm/man/man1/npm-view.1
@@ -1,4 +1,4 @@
-.TH "NPM\-VIEW" "1" "December 2017" "" ""
+.TH "NPM\-VIEW" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-view\fR \- View registry info
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm-whoami.1 b/deps/npm/man/man1/npm-whoami.1
index 2f096ac2a0c0cd..4e375a9ab7ab3b 100644
--- a/deps/npm/man/man1/npm-whoami.1
+++ b/deps/npm/man/man1/npm-whoami.1
@@ -1,4 +1,4 @@
-.TH "NPM\-WHOAMI" "1" "December 2017" "" ""
+.TH "NPM\-WHOAMI" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-whoami\fR \- Display npm username
.SH SYNOPSIS
diff --git a/deps/npm/man/man1/npm.1 b/deps/npm/man/man1/npm.1
index 42eb2962500dbe..c77fae3a3ca2e0 100644
--- a/deps/npm/man/man1/npm.1
+++ b/deps/npm/man/man1/npm.1
@@ -1,4 +1,4 @@
-.TH "NPM" "1" "December 2017" "" ""
+.TH "NPM" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm\fR \- javascript package manager
.SH SYNOPSIS
@@ -10,7 +10,7 @@ npm [args]
.RE
.SH VERSION
.P
-5.6.0
+6.1.0
.SH DESCRIPTION
.P
npm is the package manager for the Node JavaScript platform\. It puts
@@ -105,7 +105,7 @@ Command line switches:
.br
Set a config with \fB\-\-key val\fP\|\. All keys take a value, even if they
are booleans (the config parser doesn't know what the options are at
-the time of parsing\.) If no value is provided, then the option is set
+the time of parsing)\. If no value is provided, then the option is set
to boolean \fBtrue\fP\|\.
.IP \(bu 2
Environment Variables:
@@ -156,7 +156,7 @@ If you would like to contribute, but don't know what to work on, read
the contributing guidelines and check the issues list\.
.RS 0
.IP \(bu 2
-https://github\.com/npm/npm/wiki/Contributing\-Guidelines
+https://
.IP \(bu 2
https://github\.com/npm/npm/issues
diff --git a/deps/npm/man/man1/npx.1 b/deps/npm/man/man1/npx.1
index 912effdc3bdc7c..d00c489c39b213 100644
--- a/deps/npm/man/man1/npx.1
+++ b/deps/npm/man/man1/npx.1
@@ -1,4 +1,4 @@
-.TH "NPX" "1" "October 2017" "npx@9.7.0" "User Commands"
+.TH "NPX" "1" "April 2018" "npx@10.1.1" "User Commands"
.SH "NAME"
\fBnpx\fR \- execute npm package binaries
.SH SYNOPSIS
@@ -101,6 +101,13 @@ $ npx \-\-node\-arg=\-\-inspect cowsay
Debugger listening on ws://127\.0\.0\.1:9229/\.\.\.\.
.fi
.RE
+.SS Specify a node version to run npm scripts (or anything else!)
+.P
+.RS 2
+.nf
+npx \-p node@8 npm run build
+.fi
+.RE
.SH SHELL AUTO FALLBACK
.P
You can configure \fBnpx\fP to run as your default fallback command when you type something in the command line with an \fB@\fP but the command is not found\. This includes installing packages that were not found in the local prefix either\.
diff --git a/deps/npm/man/man5/npm-folders.5 b/deps/npm/man/man5/npm-folders.5
index a252685bd0e43a..32abfe6956f120 100644
--- a/deps/npm/man/man5/npm-folders.5
+++ b/deps/npm/man/man5/npm-folders.5
@@ -1,4 +1,4 @@
-.TH "NPM\-FOLDERS" "5" "December 2017" "" ""
+.TH "NPM\-FOLDERS" "5" "May 2018" "" ""
.SH "NAME"
\fBnpm-folders\fR \- Folder Structures Used by npm
.SH DESCRIPTION
@@ -69,7 +69,7 @@ Man pages are not installed on Windows systems\.
.SS Cache
.P
See npm help \fBnpm\-cache\fP\|\. Cache files are stored in \fB~/\.npm\fP on Posix, or
-\fB~/npm\-cache\fP on Windows\.
+\fB%AppData%/npm\-cache\fP on Windows\.
.P
This is controlled by the \fBcache\fP configuration param\.
.SS Temp Files
@@ -173,17 +173,17 @@ foo
.fi
.RE
.P
-Since foo depends directly on \fBbar@1\.2\.3\fP and \fBbaz@1\.2\.3\fP, those are
-installed in foo's \fBnode_modules\fP folder\.
+Since foo depends directly on \fBand\fP\fB, those are
+installed in foo's\fPnode_modules` folder\.
.P
Even though the latest copy of blerg is 1\.3\.7, foo has a specific
dependency on version 1\.2\.5\. So, that gets installed at [A]\. Since the
-parent installation of blerg satisfies bar's dependency on \fBblerg@1\.x\fP,
+parent installation of blerg satisfies bar's dependency on `,
it does not install another copy under [B]\.
.P
Bar [B] also has dependencies on baz and asdf, so those are installed in
-bar's \fBnode_modules\fP folder\. Because it depends on \fBbaz@2\.x\fP, it cannot
-re\-use the \fBbaz@1\.2\.3\fP installed in the parent \fBnode_modules\fP folder [D],
+bar's \fBnode_modules\fP folder\. Because it depends on \fB, it cannot
+re\-use the\fP\fBinstalled in the parent\fPnode_modules` folder [D],
and must install its own copy [C]\.
.P
Underneath bar, the \fBbaz \-> quux \-> bar\fP dependency creates a cycle\.
diff --git a/deps/npm/man/man5/npm-global.5 b/deps/npm/man/man5/npm-global.5
index a252685bd0e43a..32abfe6956f120 100644
--- a/deps/npm/man/man5/npm-global.5
+++ b/deps/npm/man/man5/npm-global.5
@@ -1,4 +1,4 @@
-.TH "NPM\-FOLDERS" "5" "December 2017" "" ""
+.TH "NPM\-FOLDERS" "5" "May 2018" "" ""
.SH "NAME"
\fBnpm-folders\fR \- Folder Structures Used by npm
.SH DESCRIPTION
@@ -69,7 +69,7 @@ Man pages are not installed on Windows systems\.
.SS Cache
.P
See npm help \fBnpm\-cache\fP\|\. Cache files are stored in \fB~/\.npm\fP on Posix, or
-\fB~/npm\-cache\fP on Windows\.
+\fB%AppData%/npm\-cache\fP on Windows\.
.P
This is controlled by the \fBcache\fP configuration param\.
.SS Temp Files
@@ -173,17 +173,17 @@ foo
.fi
.RE
.P
-Since foo depends directly on \fBbar@1\.2\.3\fP and \fBbaz@1\.2\.3\fP, those are
-installed in foo's \fBnode_modules\fP folder\.
+Since foo depends directly on \fBand\fP\fB, those are
+installed in foo's\fPnode_modules` folder\.
.P
Even though the latest copy of blerg is 1\.3\.7, foo has a specific
dependency on version 1\.2\.5\. So, that gets installed at [A]\. Since the
-parent installation of blerg satisfies bar's dependency on \fBblerg@1\.x\fP,
+parent installation of blerg satisfies bar's dependency on `,
it does not install another copy under [B]\.
.P
Bar [B] also has dependencies on baz and asdf, so those are installed in
-bar's \fBnode_modules\fP folder\. Because it depends on \fBbaz@2\.x\fP, it cannot
-re\-use the \fBbaz@1\.2\.3\fP installed in the parent \fBnode_modules\fP folder [D],
+bar's \fBnode_modules\fP folder\. Because it depends on \fB, it cannot
+re\-use the\fP\fBinstalled in the parent\fPnode_modules` folder [D],
and must install its own copy [C]\.
.P
Underneath bar, the \fBbaz \-> quux \-> bar\fP dependency creates a cycle\.
diff --git a/deps/npm/man/man5/npm-json.5 b/deps/npm/man/man5/npm-json.5
index 0a4328f73fda3b..2c24a01ab7fb89 100644
--- a/deps/npm/man/man5/npm-json.5
+++ b/deps/npm/man/man5/npm-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE\.JSON" "5" "December 2017" "" ""
+.TH "PACKAGE\.JSON" "5" "May 2018" "" ""
.SH "NAME"
\fBpackage.json\fR \- Specifics of npm's package\.json handling
.SH DESCRIPTION
@@ -10,11 +10,11 @@ A lot of the behavior described in this document is affected by the config
settings described in npm help 7 \fBnpm\-config\fP\|\.
.SH name
.P
-The \fImost\fR important things in your package\.json are the name and version fields\.
-Those are actually required, and your package won't install without
-them\. The name and version together form an identifier that is assumed
-to be completely unique\. Changes to the package should come along with
-changes to the version\.
+If you plan to publish your package, the \fImost\fR important things in your
+package\.json are the name and version fields as they will be required\. The name
+and version together form an identifier that is assumed to be completely unique\.
+Changes to the package should come along with changes to the version\. If you don't
+plan to publish your package, the name and version fields are optional\.
.P
The name is what your thing is called\.
.P
@@ -54,11 +54,11 @@ A name can be optionally prefixed by a scope, e\.g\. \fB@myorg/mypackage\fP\|\.
npm help 7 \fBnpm\-scope\fP for more detail\.
.SH version
.P
-The \fImost\fR important things in your package\.json are the name and version fields\.
-Those are actually required, and your package won't install without
-them\. The name and version together form an identifier that is assumed
-to be completely unique\. Changes to the package should come along with
-changes to the version\.
+If you plan to publish your package, the \fImost\fR important things in your
+package\.json are the name and version fields as they will be required\. The name
+and version together form an identifier that is assumed to be completely unique\.
+Changes to the package should come along with changes to the version\. If you don't
+plan to publish your package, the name and version fields are optional\.
.P
Version must be parseable by
node\-semver \fIhttps://github\.com/isaacs/node\-semver\fR, which is bundled
@@ -76,6 +76,14 @@ discover your package as it's listed in \fBnpm search\fP\|\.
.SH homepage
.P
The url to the project homepage\.
+.P
+Example:
+.P
+.RS 2
+.nf
+"homepage": "https://github\.com/owner/project#readme"
+.fi
+.RE
.SH bugs
.P
The url to your project's issue tracker and / or the email address to which
@@ -207,13 +215,15 @@ Both email and url are optional either way\.
npm also sets a top\-level "maintainers" field with your npm user info\.
.SH files
.P
-The optional "files" field is an array of file patterns that describes
+The optional \fBfiles\fP field is an array of file patterns that describes
the entries to be included when your package is installed as a
-dependency\. If the files array is omitted, everything except
-automatically\-excluded files will be included in your publish\. If you
-name a folder in the array, then it will also include the files inside
-that folder (unless they would be ignored by another rule in this
-section\.)\.
+dependency\. File patterns follow a similar syntax to \fB\|\.gitignore\fP, but
+reversed: including a file, directory, or glob pattern (\fB*\fP, \fB**/*\fP, and such)
+will make it so that file is included in the tarball when it's packed\. Omitting
+the field will make it default to \fB["*"]\fP, which means it will include all files\.
+.P
+Some special files and directories are also included or excluded regardless of
+whether they exist in the \fBfiles\fP array (see below)\.
.P
You can also provide a \fB\|\.npmignore\fP file in the root of your package or
in subdirectories, which will keep files from being included\. At the
@@ -288,6 +298,11 @@ This should be a module ID relative to the root of your package folder\.
.P
For most modules, it makes the most sense to have a main script and often not
much else\.
+.SH browser
+.P
+If your module is meant to be used client\-side the browser field should be
+used instead of the main field\. This is helpful to hint users that it might
+rely on primitives that aren't available in Node\.js modules\. (e\.g\. \fBwindow\fP)
.SH bin
.P
A lot of packages have one or more executable files that they'd like to
@@ -901,8 +916,8 @@ especially handy if you want to set the tag, registry or access, so that
you can ensure that a given package is not tagged with "latest", published
to the global public registry or that a scoped module is private by default\.
.P
-Any config values can be overridden, but of course only "tag", "registry" and
-"access" probably matter for the purposes of publishing\.
+Any config values can be overridden, but only "tag", "registry" and "access"
+probably matter for the purposes of publishing\.
.P
See npm help 7 \fBnpm\-config\fP to see the list of config options that can be
overridden\.
diff --git a/deps/npm/man/man5/npm-package-locks.5 b/deps/npm/man/man5/npm-package-locks.5
index 241a45d9bb9a81..91f43b921ce2d3 100644
--- a/deps/npm/man/man5/npm-package-locks.5
+++ b/deps/npm/man/man5/npm-package-locks.5
@@ -1,4 +1,4 @@
-.TH "NPM\-PACKAGE\-LOCKS" "5" "December 2017" "" ""
+.TH "NPM\-PACKAGE\-LOCKS" "5" "May 2018" "" ""
.SH "NAME"
\fBnpm-package-locks\fR \- An explanation of npm lockfiles
.SH DESCRIPTION
@@ -71,7 +71,7 @@ A@0\.1\.0
.fi
.RE
.P
-However, if B@0\.0\.2 is published, then a fresh \fBnpm install A\fP will
+However, if is published, then a fresh \fBnpm install A\fP will
install:
.P
.RS 2
@@ -85,7 +85,7 @@ A@0\.1\.0
assuming the new version did not modify B's dependencies\. Of course,
the new version of B could include a new version of C and any number
of new dependencies\. If such changes are undesirable, the author of A
-could specify a dependency on B@0\.0\.1\. However, if A's author and B's
+could specify a dependency on \|\. However, if A's author and B's
author are not the same person, there's no way for A's author to say
that he or she does not want to pull in newly published versions of C
when B hasn't changed at all\.
@@ -167,10 +167,25 @@ package source to get the exact same dependency tree that you were developing
on\. Additionally, the diffs from these changes are human\-readable and will
inform you of any changes npm has made to your \fBnode_modules\fP, so you can notice
if any transitive dependencies were updated, hoisted, etc\.
+.SS Resolving lockfile conflicts
+.P
+Occasionally, two separate npm install will create package locks that cause
+merge conflicts in source control systems\. As of \fB, these conflicts
+can be resolved by manually fixing any\fPpackage\.json\fBconflicts, and then
+running\fPnpm install [\-\-package\-lock\-only]\fBagain\. npm will automatically
+resolve any conflicts for you and write a merged package lock that includes all
+the dependencies from both branches in a reasonable tree\. If\fP\-\-package\-lock\-only\fBis provided, it will do this without also modifying your
+local\fPnode_modules/`\.
+.P
+To make this process seamless on git, consider installing
+\fBnpm\-merge\-driver\fP \fIhttps://npm\.im/npm\-merge\-driver\fR, which will teach git how
+to do this itself without any user interaction\. In short: \fB$ npx
+npm\-merge\-driver install \-g\fP will let you do this, and even works with
+\fBversions of npm 5, albeit a bit more noisily\. Note that if\fPpackage\.json\fBitself conflicts, you will have to resolve that by hand and run\fPnpm install` manually, even with the merge driver\.
.SH SEE ALSO
.RS 0
.IP \(bu 2
-https://medium\.com/@sdboyer/so\-you\-want\-to\-write\-a\-package\-manager\-4ae9c17d9527
+https://
.IP \(bu 2
npm help 5 package\.json
.IP \(bu 2
diff --git a/deps/npm/man/man5/npm-shrinkwrap.json.5 b/deps/npm/man/man5/npm-shrinkwrap.json.5
index a832963dc633a3..6efde4a7d9c8c0 100644
--- a/deps/npm/man/man5/npm-shrinkwrap.json.5
+++ b/deps/npm/man/man5/npm-shrinkwrap.json.5
@@ -1,4 +1,4 @@
-.TH "NPM\-SHRINKWRAP\.JSON" "5" "December 2017" "" ""
+.TH "NPM\-SHRINKWRAP\.JSON" "5" "May 2018" "" ""
.SH "NAME"
\fBnpm-shrinkwrap.json\fR \- A publishable lockfile
.SH DESCRIPTION
diff --git a/deps/npm/man/man5/npmrc.5 b/deps/npm/man/man5/npmrc.5
index 26d65c2598d1ee..d9d90e1465055c 100644
--- a/deps/npm/man/man5/npmrc.5
+++ b/deps/npm/man/man5/npmrc.5
@@ -1,4 +1,4 @@
-.TH "NPMRC" "5" "December 2017" "" ""
+.TH "NPMRC" "5" "May 2018" "" ""
.SH "NAME"
\fBnpmrc\fR \- The npm config files
.SH DESCRIPTION
diff --git a/deps/npm/man/man5/package-lock.json.5 b/deps/npm/man/man5/package-lock.json.5
index 0196cc87e6f07a..c67cd1f0cca8f0 100644
--- a/deps/npm/man/man5/package-lock.json.5
+++ b/deps/npm/man/man5/package-lock.json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE\-LOCK\.JSON" "5" "December 2017" "" ""
+.TH "PACKAGE\-LOCK\.JSON" "5" "May 2018" "" ""
.SH "NAME"
\fBpackage-lock.json\fR \- A manifestation of the manifest
.SH DESCRIPTION
@@ -127,6 +127,12 @@ transitive dependency of a non\-optional dependency of the top level\.
.P
All optional dependencies should be included even if they're uninstallable
on the current platform\.
+.SS requires
+.P
+This is a mapping of module name to version\. This is a list of everything
+this module requires, regardless of where it will be installed\. The version
+should match via normal matching rules a dependency either in our
+\fBdependencies\fP or in a level higher than us\.
.SS dependencies
.P
The dependencies of this dependency, exactly as at the top level\.
@@ -137,6 +143,8 @@ npm help shrinkwrap
.IP \(bu 2
npm help 5 shrinkwrap\.json
.IP \(bu 2
+npm help 5 package\-locks
+.IP \(bu 2
npm help 5 package\.json
.IP \(bu 2
npm help install
diff --git a/deps/npm/man/man5/package.json.5 b/deps/npm/man/man5/package.json.5
index 0a4328f73fda3b..2c24a01ab7fb89 100644
--- a/deps/npm/man/man5/package.json.5
+++ b/deps/npm/man/man5/package.json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE\.JSON" "5" "December 2017" "" ""
+.TH "PACKAGE\.JSON" "5" "May 2018" "" ""
.SH "NAME"
\fBpackage.json\fR \- Specifics of npm's package\.json handling
.SH DESCRIPTION
@@ -10,11 +10,11 @@ A lot of the behavior described in this document is affected by the config
settings described in npm help 7 \fBnpm\-config\fP\|\.
.SH name
.P
-The \fImost\fR important things in your package\.json are the name and version fields\.
-Those are actually required, and your package won't install without
-them\. The name and version together form an identifier that is assumed
-to be completely unique\. Changes to the package should come along with
-changes to the version\.
+If you plan to publish your package, the \fImost\fR important things in your
+package\.json are the name and version fields as they will be required\. The name
+and version together form an identifier that is assumed to be completely unique\.
+Changes to the package should come along with changes to the version\. If you don't
+plan to publish your package, the name and version fields are optional\.
.P
The name is what your thing is called\.
.P
@@ -54,11 +54,11 @@ A name can be optionally prefixed by a scope, e\.g\. \fB@myorg/mypackage\fP\|\.
npm help 7 \fBnpm\-scope\fP for more detail\.
.SH version
.P
-The \fImost\fR important things in your package\.json are the name and version fields\.
-Those are actually required, and your package won't install without
-them\. The name and version together form an identifier that is assumed
-to be completely unique\. Changes to the package should come along with
-changes to the version\.
+If you plan to publish your package, the \fImost\fR important things in your
+package\.json are the name and version fields as they will be required\. The name
+and version together form an identifier that is assumed to be completely unique\.
+Changes to the package should come along with changes to the version\. If you don't
+plan to publish your package, the name and version fields are optional\.
.P
Version must be parseable by
node\-semver \fIhttps://github\.com/isaacs/node\-semver\fR, which is bundled
@@ -76,6 +76,14 @@ discover your package as it's listed in \fBnpm search\fP\|\.
.SH homepage
.P
The url to the project homepage\.
+.P
+Example:
+.P
+.RS 2
+.nf
+"homepage": "https://github\.com/owner/project#readme"
+.fi
+.RE
.SH bugs
.P
The url to your project's issue tracker and / or the email address to which
@@ -207,13 +215,15 @@ Both email and url are optional either way\.
npm also sets a top\-level "maintainers" field with your npm user info\.
.SH files
.P
-The optional "files" field is an array of file patterns that describes
+The optional \fBfiles\fP field is an array of file patterns that describes
the entries to be included when your package is installed as a
-dependency\. If the files array is omitted, everything except
-automatically\-excluded files will be included in your publish\. If you
-name a folder in the array, then it will also include the files inside
-that folder (unless they would be ignored by another rule in this
-section\.)\.
+dependency\. File patterns follow a similar syntax to \fB\|\.gitignore\fP, but
+reversed: including a file, directory, or glob pattern (\fB*\fP, \fB**/*\fP, and such)
+will make it so that file is included in the tarball when it's packed\. Omitting
+the field will make it default to \fB["*"]\fP, which means it will include all files\.
+.P
+Some special files and directories are also included or excluded regardless of
+whether they exist in the \fBfiles\fP array (see below)\.
.P
You can also provide a \fB\|\.npmignore\fP file in the root of your package or
in subdirectories, which will keep files from being included\. At the
@@ -288,6 +298,11 @@ This should be a module ID relative to the root of your package folder\.
.P
For most modules, it makes the most sense to have a main script and often not
much else\.
+.SH browser
+.P
+If your module is meant to be used client\-side the browser field should be
+used instead of the main field\. This is helpful to hint users that it might
+rely on primitives that aren't available in Node\.js modules\. (e\.g\. \fBwindow\fP)
.SH bin
.P
A lot of packages have one or more executable files that they'd like to
@@ -901,8 +916,8 @@ especially handy if you want to set the tag, registry or access, so that
you can ensure that a given package is not tagged with "latest", published
to the global public registry or that a scoped module is private by default\.
.P
-Any config values can be overridden, but of course only "tag", "registry" and
-"access" probably matter for the purposes of publishing\.
+Any config values can be overridden, but only "tag", "registry" and "access"
+probably matter for the purposes of publishing\.
.P
See npm help 7 \fBnpm\-config\fP to see the list of config options that can be
overridden\.
diff --git a/deps/npm/man/man7/npm-coding-style.7 b/deps/npm/man/man7/npm-coding-style.7
index 508198722dfdea..5af2d71a04d6d2 100644
--- a/deps/npm/man/man7/npm-coding-style.7
+++ b/deps/npm/man/man7/npm-coding-style.7
@@ -1,4 +1,4 @@
-.TH "NPM\-CODING\-STYLE" "7" "December 2017" "" ""
+.TH "NPM\-CODING\-STYLE" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-coding-style\fR \- npm's "funny" coding style
.SH DESCRIPTION
@@ -147,7 +147,7 @@ var alsoOk = "String contains 'single' quotes or apostrophe"
.RE
.SH Whitespace
.P
-Put a single space in front of ( for anything other than a function call\.
+Put a single space in front of \fB(\fP for anything other than a function call\.
Also use a single space wherever it makes things more readable\.
.P
Don't leave trailing whitespace at the end of lines\. Don't indent empty
diff --git a/deps/npm/man/man7/npm-config.7 b/deps/npm/man/man7/npm-config.7
index aec6d8014caf84..c2e77487989dd4 100644
--- a/deps/npm/man/man7/npm-config.7
+++ b/deps/npm/man/man7/npm-config.7
@@ -1,4 +1,4 @@
-.TH "NPM\-CONFIG" "7" "December 2017" "" ""
+.TH "NPM\-CONFIG" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-config\fR \- More than you probably want to know about npm configuration
.SH DESCRIPTION
@@ -211,6 +211,18 @@ Type: String
.P
When "dev" or "development" and running local \fBnpm shrinkwrap\fP,
\fBnpm outdated\fP, or \fBnpm update\fP, is an alias for \fB\-\-dev\fP\|\.
+.SS audit
+.RS 0
+.IP \(bu 2
+Default: true
+.IP \(bu 2
+Type: Boolean
+
+.RE
+.P
+When "true" submit audit reports alongside \fBnpm install\fP runs to the default
+registry and all registries configured for scopes\. See the documentation
+for npm help audit for details on what is submitted\.
.SS auth\-type
.RS 0
.IP \(bu 2
@@ -394,6 +406,9 @@ Type: Boolean or \fB"always"\fP
.P
If false, never shows colors\. If \fB"always"\fP then always shows colors\.
If true, then only prints color codes for tty file descriptors\.
+.P
+This option can also be changed using the environment: colors are
+disabled when the environment variable \fBNO_COLOR\fP is set to any value\.
.SS depth
.RS 0
.IP \(bu 2
@@ -902,7 +917,7 @@ Any "%s" in the message will be replaced with the version number\.
.SS metrics\-registry
.RS 0
.IP \(bu 2
-Default: The value of \fBregistry\fP (which defaults to "https://registry\.npmjs\.org/")
+Default: The value of \fBregistry\fP (which defaults to "https://
.IP \(bu 2
Type: String
@@ -931,6 +946,16 @@ Type: semver or false
.RE
.P
The node version to use when checking a package's \fBengines\fP map\.
+.SS no\-proxy
+.RS 0
+.IP \(bu 2
+Default: null
+.IP \(bu 2
+Type: String or Array
+
+.RE
+.P
+A comma\-separated string or an array of domain extensions that a proxy should not be used for\.
.SS offline
.RS 0
.IP \(bu 2
@@ -1009,6 +1034,10 @@ Type: Boolean
If set to false, then ignore \fBpackage\-lock\.json\fP files when installing\. This
will also prevent \fIwriting\fR \fBpackage\-lock\.json\fP if \fBsave\fP is true\.
.P
+When package package\-locks are disabled, automatic pruning of extraneous
+modules will also be disabled\. To remove extraneous modules with
+package\-locks disabled use \fBnpm prune\fP\|\.
+.P
This option is an alias for \fB\-\-shrinkwrap\fP\|\.
.SS package\-lock\-only
.RS 0
@@ -1019,7 +1048,7 @@ Type: Boolean
.RE
.P
-If set to true, it will update only the \fBpackage\-json\fP,
+If set to true, it will update only the \fBpackage\-lock\.json\fP,
instead of checking \fBnode_modules\fP and downloading dependencies\.
.SS parseable
.RS 0
@@ -1133,7 +1162,7 @@ Rebuild bundled dependencies after installation\.
.SS registry
.RS 0
.IP \(bu 2
-Default: https://registry\.npmjs\.org/
+Default: https://
.IP \(bu 2
Type: url
@@ -1153,7 +1182,7 @@ Remove failed installs\.
.SS save
.RS 0
.IP \(bu 2
-Default: false
+Default: true
.IP \(bu 2
Type: Boolean
diff --git a/deps/npm/man/man7/npm-developers.7 b/deps/npm/man/man7/npm-developers.7
index d9e483206a4fdb..9d10c9cc4d7cfd 100644
--- a/deps/npm/man/man7/npm-developers.7
+++ b/deps/npm/man/man7/npm-developers.7
@@ -1,4 +1,4 @@
-.TH "NPM\-DEVELOPERS" "7" "December 2017" "" ""
+.TH "NPM\-DEVELOPERS" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-developers\fR \- Developer Guide
.SH DESCRIPTION
@@ -68,7 +68,7 @@ This should be a string that identifies your project\. Please do not
use the name to specify that it runs on node, or is in JavaScript\.
You can use the "engines" field to explicitly state the versions of
node (or whatever else) that your program requires, and it's pretty
-well assumed that it's javascript\.
+well assumed that it's JavaScript\.
It does not necessarily need to match your github repository name\.
So, \fBnode\-foo\fP and \fBbar\-js\fP are bad names\. \fBfoo\fP or \fBbar\fP are better\.
.IP \(bu 2
diff --git a/deps/npm/man/man7/npm-disputes.7 b/deps/npm/man/man7/npm-disputes.7
index 642abcf178351b..ccdaed597578b3 100644
--- a/deps/npm/man/man7/npm-disputes.7
+++ b/deps/npm/man/man7/npm-disputes.7
@@ -1,4 +1,4 @@
-.TH "NPM\-DISPUTES" "7" "December 2017" "" ""
+.TH "NPM\-DISPUTES" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-disputes\fR \- Handling Module Name Disputes
.P
@@ -46,7 +46,7 @@ publishes it to the npm registry\. Being a simple little thing, it never
really has to be updated\. Alice works for Foo Inc, the makers of the
critically acclaimed and widely\-marketed \fBfoo\fP JavaScript toolkit framework\.
They publish it to npm as \fBfoojs\fP, but people are routinely confused when
-\fBnpm install\fPfoo`` is some different thing\.
+\fBnpm install\fPfoo\fB\fP is some different thing\.
.IP 4. 3
Yusuf writes a parser for the widely\-known \fBfoo\fP file format, because he
needs it for work\. Then, he gets a new job, and never updates the prototype\.
@@ -120,7 +120,7 @@ here to help\.\fR
.P
If you think another npm publisher is infringing your trademark, such as by
using a confusingly similar package name, email abuse@npmjs\.com with a link to
-the package or user account on \fIhttps://npmjs\.com\fR\|\. Attach a
+the package or user account on https:// \fIhttps://npmjs\.com\fR\|\. Attach a
copy of your trademark registration certificate\.
.P
If we see that the package's publisher is intentionally misleading others by
diff --git a/deps/npm/man/man7/npm-index.7 b/deps/npm/man/man7/npm-index.7
index 77a70e6cc62ef0..23327c713ca466 100644
--- a/deps/npm/man/man7/npm-index.7
+++ b/deps/npm/man/man7/npm-index.7
@@ -1,4 +1,4 @@
-.TH "NPM\-INDEX" "7" "December 2017" "" ""
+.TH "NPM\-INDEX" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-index\fR \- Index of all npm documentation
.SS npm help README
@@ -16,6 +16,9 @@ Set access level on published packages
.SS npm help adduser
.P
Add a registry user account
+.SS npm help audit
+.P
+Run a security audit
.SS npm help bin
.P
Display npm bin folder
@@ -31,6 +34,9 @@ REMOVED
.SS npm help cache
.P
Manipulates packages cache
+.SS npm help ci
+.P
+Install a project with a clean slate
.SS npm help completion
.P
Tab Completion for npm
@@ -64,9 +70,15 @@ Search npm help documentation
.SS npm help help
.P
Get help on npm
+.SS npm help hook
+.P
+Manage registry hooks
.SS npm help init
.P
-Interactively create a package\.json file
+create a package\.json file
+.SS npm help install\-ci\-test
+.P
+Install a project with a clean slate and run tests
.SS npm help install\-test
.P
Install package(s) and run tests
diff --git a/deps/npm/man/man7/npm-orgs.7 b/deps/npm/man/man7/npm-orgs.7
index d1c3588ad8e683..fa4d2aa0d6ab9f 100644
--- a/deps/npm/man/man7/npm-orgs.7
+++ b/deps/npm/man/man7/npm-orgs.7
@@ -1,4 +1,4 @@
-.TH "NPM\-ORGS" "7" "December 2017" "" ""
+.TH "NPM\-ORGS" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-orgs\fR \- Working with Teams & Orgs
.SH DESCRIPTION
diff --git a/deps/npm/man/man7/npm-registry.7 b/deps/npm/man/man7/npm-registry.7
index a51170a387bda1..e04928610f7302 100644
--- a/deps/npm/man/man7/npm-registry.7
+++ b/deps/npm/man/man7/npm-registry.7
@@ -1,4 +1,4 @@
-.TH "NPM\-REGISTRY" "7" "December 2017" "" ""
+.TH "NPM\-REGISTRY" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-registry\fR \- The JavaScript Package Registry
.SH DESCRIPTION
diff --git a/deps/npm/man/man7/npm-scope.7 b/deps/npm/man/man7/npm-scope.7
index 16e42f4bf0d71d..9a7a1809bd335e 100644
--- a/deps/npm/man/man7/npm-scope.7
+++ b/deps/npm/man/man7/npm-scope.7
@@ -1,4 +1,4 @@
-.TH "NPM\-SCOPE" "7" "December 2017" "" ""
+.TH "NPM\-SCOPE" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-scope\fR \- Scoped packages
.SH DESCRIPTION
@@ -86,7 +86,7 @@ to \fBpublic\fP as if you had run \fBnpm access public\fP after publishing\.
.SS Publishing private scoped packages to the npm registry
.P
To publish a private scoped package to the npm registry, you must have
-an npm Private Modules \fIhttps://www\.npmjs\.com/private\-modules\fR
+an npm Private Modules \fIhttps://docs\.npmjs\.com/private\-modules/intro\fR
account\.
.P
You can then publish the module with \fBnpm publish\fP or \fBnpm publish
diff --git a/deps/npm/man/man7/npm-scripts.7 b/deps/npm/man/man7/npm-scripts.7
index bd0383116b79c1..4b9e666bae51dc 100644
--- a/deps/npm/man/man7/npm-scripts.7
+++ b/deps/npm/man/man7/npm-scripts.7
@@ -1,4 +1,4 @@
-.TH "NPM\-SCRIPTS" "7" "December 2017" "" ""
+.TH "NPM\-SCRIPTS" "7" "May 2018" "" ""
.SH "NAME"
\fBnpm-scripts\fR \- How npm handles the "scripts" field
.SH DESCRIPTION
@@ -78,15 +78,15 @@ names will be run for those as well (e\.g\. \fBpremyscript\fP, \fBmyscript\fP,
.SH PREPUBLISH AND PREPARE
.SS DEPRECATION NOTE
.P
-Since \fBnpm@1\.1\.71\fP, the npm CLI has run the \fBprepublish\fP script for both \fBnpm
-publish\fP and \fBnpm install\fP, because it's a convenient way to prepare a package
+Since \fB, the npm CLI has run the\fPprepublish\fBscript for both\fPnpm
+publish\fBand\fPnpm install\fB, because it's a convenient way to prepare a package
for use (some common use cases are described in the section below)\. It has
-also turned out to be, in practice, very
-confusing \fIhttps://github\.com/npm/npm/issues/10074\fR\|\. As of \fBnpm@4\.0\.0\fP, a new
-event has been introduced, \fBprepare\fP, that preserves this existing behavior\. A
-\fInew\fR event, \fBprepublishOnly\fP has been added as a transitional strategy to
+also turned out to be, in practice, [very
+confusing](https://github\.com/npm/npm/issues/10074)\. As of\fP\fB, a new
+event has been introduced,\fPprepare\fB, that preserves this existing behavior\. A
+_new_ event,\fPprepublishOnly\fBhas been added as a transitional strategy to
allow users to avoid the confusing behavior of existing npm versions and only
-run on \fBnpm publish\fP (for instance, running the tests one last time to ensure
+run on\fPnpm publish` (for instance, running the tests one last time to ensure
they're in good shape)\.
.P
See https://github\.com/npm/npm/issues/10074 for a much lengthier
diff --git a/deps/npm/man/man7/removing-npm.7 b/deps/npm/man/man7/removing-npm.7
index 62c5ae42615e6b..46bf9bbf9a397a 100644
--- a/deps/npm/man/man7/removing-npm.7
+++ b/deps/npm/man/man7/removing-npm.7
@@ -1,4 +1,4 @@
-.TH "NPM\-REMOVAL" "1" "December 2017" "" ""
+.TH "NPM\-REMOVAL" "1" "May 2018" "" ""
.SH "NAME"
\fBnpm-removal\fR \- Cleaning the Slate
.SH SYNOPSIS
diff --git a/deps/npm/man/man7/semver.7 b/deps/npm/man/man7/semver.7
index 23c1e018d53f03..dcb3b0f3309df4 100644
--- a/deps/npm/man/man7/semver.7
+++ b/deps/npm/man/man7/semver.7
@@ -1,4 +1,4 @@
-.TH "SEMVER" "7" "December 2017" "" ""
+.TH "SEMVER" "7" "May 2018" "" ""
.SH "NAME"
\fBsemver\fR \- The semantic versioner for npm
.SH Install
@@ -23,6 +23,8 @@ semver\.clean(' =v1\.2\.3 ') // '1\.2\.3'
semver\.satisfies('1\.2\.3', '1\.x || >=2\.5\.0 || 5\.0\.0 \- 7\.2\.3') // true
semver\.gt('1\.2\.3', '9\.8\.7') // false
semver\.lt('1\.2\.3', '9\.8\.7') // true
+semver\.valid(semver\.coerce('v2')) // '2\.0\.0'
+semver\.valid(semver\.coerce('42\.6\.7\.9\.3\-alpha')) // '42\.6\.7'
.fi
.RE
.P
@@ -57,6 +59,10 @@ Options:
\-l \-\-loose
Interpret versions and ranges loosely
+\-c \-\-coerce
+ Coerce a string into SemVer if possible
+ (does not imply \-\-loose)
+
Program exits successfully if any valid version satisfies
all supplied ranges, and prints all satisfying versions\.
@@ -455,4 +461,22 @@ satisfy the range\.
.P
If you want to know if a version satisfies or does not satisfy a
range, use the \fBsatisfies(version, range)\fP function\.
+.SS Coercion
+.RS 0
+.IP \(bu 2
+\fBcoerce(version)\fP: Coerces a string to semver if possible
+
+.RE
+.P
+This aims to provide a very forgiving translation of a non\-semver
+string to semver\. It looks for the first digit in a string, and
+consumes all remaining characters which satisfy at least a partial semver
+(e\.g\., \fB1\fP, \fB1\.2\fP, \fB1\.2\.3\fP) up to the max permitted length (256 characters)\.
+Longer versions are simply truncated (\fB4\.6\.3\.9\.2\-alpha2\fP becomes \fB4\.6\.3\fP)\.
+All surrounding text is simply ignored (\fBv3\.4 replaces v3\.3\.1\fP becomes \fB3\.4\.0\fP)\.
+Only text which lacks digits will fail coercion (\fBversion one\fP is not valid)\.
+The maximum length for any semver component considered for coercion is 16 characters;
+longer components will be ignored (\fB10000000000000000\.4\.7\.4\fP becomes \fB4\.7\.4\fP)\.
+The maximum value for any semver component is \fBInteger\.MAX_SAFE_INTEGER || (2**53 \- 1)\fP;
+higher value components are invalid (\fB9999999999999999\.4\.7\.4\fP is likely invalid)\.
diff --git a/deps/npm/node_modules/JSONStream/bin.js b/deps/npm/node_modules/JSONStream/bin.js
new file mode 100755
index 00000000000000..32209630f2f026
--- /dev/null
+++ b/deps/npm/node_modules/JSONStream/bin.js
@@ -0,0 +1,10 @@
+#! /usr/bin/env node
+
+var JSONStream = require('./')
+
+if(!module.parent && process.title !== 'browser') {
+ process.stdin
+ .pipe(JSONStream.parse(process.argv[2]))
+ .pipe(JSONStream.stringify('[', ',\n', ']\n', 2))
+ .pipe(process.stdout)
+}
diff --git a/deps/npm/node_modules/JSONStream/index.js b/deps/npm/node_modules/JSONStream/index.js
index 2cc9fff0713e31..4e3b0ef6787ccc 100755
--- a/deps/npm/node_modules/JSONStream/index.js
+++ b/deps/npm/node_modules/JSONStream/index.js
@@ -1,5 +1,3 @@
-#! /usr/bin/env node
-
'use strict'
var Parser = require('jsonparse')
@@ -244,9 +242,3 @@ exports.stringifyObject = function (op, sep, cl, indent) {
return stream
}
-if(!module.parent && process.title !== 'browser') {
- process.stdin
- .pipe(exports.parse(process.argv[2]))
- .pipe(exports.stringify('[', ',\n', ']\n', 2))
- .pipe(process.stdout)
-}
diff --git a/deps/npm/node_modules/JSONStream/node_modules/jsonparse/package.json b/deps/npm/node_modules/JSONStream/node_modules/jsonparse/package.json
deleted file mode 100644
index fe0cfcd1f4a151..00000000000000
--- a/deps/npm/node_modules/JSONStream/node_modules/jsonparse/package.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
- "_from": "jsonparse@^1.2.0",
- "_id": "jsonparse@1.3.1",
- "_inBundle": false,
- "_integrity": "sha1-P02uSpH6wxX3EGL4UhzCOfE2YoA=",
- "_location": "/JSONStream/jsonparse",
- "_phantomChildren": {},
- "_requested": {
- "type": "range",
- "registry": true,
- "raw": "jsonparse@^1.2.0",
- "name": "jsonparse",
- "escapedName": "jsonparse",
- "rawSpec": "^1.2.0",
- "saveSpec": null,
- "fetchSpec": "^1.2.0"
- },
- "_requiredBy": [
- "/JSONStream"
- ],
- "_resolved": "https://registry.npmjs.org/jsonparse/-/jsonparse-1.3.1.tgz",
- "_shasum": "3f4dae4a91fac315f71062f8521cc239f1366280",
- "_spec": "jsonparse@^1.2.0",
- "_where": "/Users/rebecca/code/npm/node_modules/JSONStream",
- "author": {
- "name": "Tim Caswell",
- "email": "tim@creationix.com"
- },
- "bugs": {
- "url": "http://github.com/creationix/jsonparse/issues"
- },
- "bundleDependencies": false,
- "deprecated": false,
- "description": "This is a pure-js JSON streaming parser for node.js",
- "devDependencies": {
- "tap": "~0.3.3",
- "tape": "~0.1.1"
- },
- "engines": [
- "node >= 0.2.0"
- ],
- "homepage": "https://github.com/creationix/jsonparse#readme",
- "license": "MIT",
- "main": "jsonparse.js",
- "name": "jsonparse",
- "repository": {
- "type": "git",
- "url": "git+ssh://git@github.com/creationix/jsonparse.git"
- },
- "scripts": {
- "test": "tap test/*.js"
- },
- "tags": [
- "json",
- "stream"
- ],
- "version": "1.3.1"
-}
diff --git a/deps/npm/node_modules/JSONStream/node_modules/through/package.json b/deps/npm/node_modules/JSONStream/node_modules/through/package.json
deleted file mode 100644
index 645e8a4f6a3487..00000000000000
--- a/deps/npm/node_modules/JSONStream/node_modules/through/package.json
+++ /dev/null
@@ -1,72 +0,0 @@
-{
- "_from": "through@>=2.2.7 <3",
- "_id": "through@2.3.8",
- "_integrity": "sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU=",
- "_location": "/JSONStream/through",
- "_phantomChildren": {},
- "_requested": {
- "type": "range",
- "registry": true,
- "raw": "through@>=2.2.7 <3",
- "name": "through",
- "escapedName": "through",
- "rawSpec": ">=2.2.7 <3",
- "saveSpec": null,
- "fetchSpec": ">=2.2.7 <3"
- },
- "_requiredBy": [
- "/JSONStream"
- ],
- "_resolved": "https://registry.npmjs.org/through/-/through-2.3.8.tgz",
- "_shasum": "0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5",
- "_shrinkwrap": null,
- "_spec": "through@>=2.2.7 <3",
- "_where": "/Users/zkat/Documents/code/npm/node_modules/JSONStream",
- "author": {
- "name": "Dominic Tarr",
- "email": "dominic.tarr@gmail.com",
- "url": "dominictarr.com"
- },
- "bin": null,
- "bugs": {
- "url": "https://github.com/dominictarr/through/issues"
- },
- "bundleDependencies": false,
- "dependencies": {},
- "deprecated": false,
- "description": "simplified stream construction",
- "devDependencies": {
- "from": "~0.1.3",
- "stream-spec": "~0.3.5",
- "tape": "~2.3.2"
- },
- "homepage": "https://github.com/dominictarr/through",
- "keywords": [
- "stream",
- "streams",
- "user-streams",
- "pipe"
- ],
- "license": "MIT",
- "main": "index.js",
- "name": "through",
- "optionalDependencies": {},
- "peerDependencies": {},
- "repository": {
- "type": "git",
- "url": "git+https://github.com/dominictarr/through.git"
- },
- "scripts": {
- "test": "set -e; for t in test/*.js; do node $t; done"
- },
- "testling": {
- "browsers": [
- "ie/8..latest",
- "ff/15..latest",
- "chrome/20..latest",
- "safari/5.1..latest"
- ],
- "files": "test/*.js"
- },
- "version": "2.3.8"
-}
diff --git a/deps/npm/node_modules/JSONStream/package.json b/deps/npm/node_modules/JSONStream/package.json
index 2086da717bcf41..5f6be1368e5664 100644
--- a/deps/npm/node_modules/JSONStream/package.json
+++ b/deps/npm/node_modules/JSONStream/package.json
@@ -1,27 +1,31 @@
{
- "_from": "JSONStream@~1.3.1",
- "_id": "JSONStream@1.3.1",
+ "_args": [
+ [
+ "JSONStream@1.3.2",
+ "/Users/rebecca/code/npm"
+ ]
+ ],
+ "_from": "JSONStream@1.3.2",
+ "_id": "JSONStream@1.3.2",
"_inBundle": false,
- "_integrity": "sha1-cH92HgHa6eFvG8+TcDt4xwlmV5o=",
+ "_integrity": "sha1-wQI3G27Dp887hHygDCC7D85Mbeo=",
"_location": "/JSONStream",
"_phantomChildren": {},
"_requested": {
- "type": "range",
+ "type": "version",
"registry": true,
- "raw": "JSONStream@~1.3.1",
+ "raw": "JSONStream@1.3.2",
"name": "JSONStream",
"escapedName": "JSONStream",
- "rawSpec": "~1.3.1",
+ "rawSpec": "1.3.2",
"saveSpec": null,
- "fetchSpec": "~1.3.1"
+ "fetchSpec": "1.3.2"
},
"_requiredBy": [
- "#USER",
"/"
],
- "_resolved": "https://registry.npmjs.org/JSONStream/-/JSONStream-1.3.1.tgz",
- "_shasum": "707f761e01dae9e16f1bcf93703b78c70966579a",
- "_spec": "JSONStream@~1.3.1",
+ "_resolved": "https://registry.npmjs.org/JSONStream/-/JSONStream-1.3.2.tgz",
+ "_spec": "1.3.2",
"_where": "/Users/rebecca/code/npm",
"author": {
"name": "Dominic Tarr",
@@ -29,17 +33,15 @@
"url": "http://bit.ly/dominictarr"
},
"bin": {
- "JSONStream": "./index.js"
+ "JSONStream": "./bin.js"
},
"bugs": {
"url": "https://github.com/dominictarr/JSONStream/issues"
},
- "bundleDependencies": false,
"dependencies": {
"jsonparse": "^1.2.0",
"through": ">=2.2.7 <3"
},
- "deprecated": false,
"description": "rawStream.pipe(JSONStream.parse()).pipe(streamOfObjects)",
"devDependencies": {
"assertions": "~2.2.2",
@@ -71,5 +73,5 @@
"scripts": {
"test": "set -e; for t in test/*.js; do echo '***' $t '***'; node $t; done"
},
- "version": "1.3.1"
+ "version": "1.3.2"
}
diff --git a/deps/npm/node_modules/abbrev/package.json b/deps/npm/node_modules/abbrev/package.json
index 0c44f79d60baf2..4c05db1efe758f 100644
--- a/deps/npm/node_modules/abbrev/package.json
+++ b/deps/npm/node_modules/abbrev/package.json
@@ -1,4 +1,10 @@
{
+ "_args": [
+ [
+ "abbrev@1.1.1",
+ "/Users/rebecca/code/npm"
+ ]
+ ],
"_from": "abbrev@1.1.1",
"_id": "abbrev@1.1.1",
"_inBundle": false,
@@ -16,14 +22,12 @@
"fetchSpec": "1.1.1"
},
"_requiredBy": [
- "#USER",
"/",
"/node-gyp/nopt",
"/nopt"
],
"_resolved": "https://registry.npmjs.org/abbrev/-/abbrev-1.1.1.tgz",
- "_shasum": "f8f2c887ad10bf67f634f005b6987fed3179aac8",
- "_spec": "abbrev@1.1.1",
+ "_spec": "1.1.1",
"_where": "/Users/rebecca/code/npm",
"author": {
"name": "Isaac Z. Schlueter",
@@ -32,8 +36,6 @@
"bugs": {
"url": "https://github.com/isaacs/abbrev-js/issues"
},
- "bundleDependencies": false,
- "deprecated": false,
"description": "Like ruby's abbrev module, but in js",
"devDependencies": {
"tap": "^10.1"
diff --git a/deps/npm/node_modules/pacote/node_modules/make-fetch-happen/node_modules/http-proxy-agent/node_modules/agent-base/.travis.yml b/deps/npm/node_modules/agent-base/.travis.yml
similarity index 100%
rename from deps/npm/node_modules/pacote/node_modules/make-fetch-happen/node_modules/http-proxy-agent/node_modules/agent-base/.travis.yml
rename to deps/npm/node_modules/agent-base/.travis.yml
diff --git a/deps/npm/node_modules/agent-base/History.md b/deps/npm/node_modules/agent-base/History.md
new file mode 100644
index 00000000000000..80c88dc401f960
--- /dev/null
+++ b/deps/npm/node_modules/agent-base/History.md
@@ -0,0 +1,113 @@
+
+4.2.0 / 2018-01-15
+==================
+
+ * Add support for returning an `http.Agent` instance
+ * Optimize promisifying logic
+ * Set `timeout` to null for proper cleanup
+ * Remove Node.js <= 0.11.3 special-casing from test case
+
+4.1.2 / 2017-11-20
+==================
+
+ * test Node 9 on Travis
+ * ensure that `https.get()` uses the patched `https.request()`
+
+4.1.1 / 2017-07-20
+==================
+
+ * Correct `https.request()` with a String (#9)
+
+4.1.0 / 2017-06-26
+==================
+
+ * mix in Agent options into Request options
+ * throw when nothing is returned from agent-base callback
+ * do not modify the options object for https requests
+
+4.0.1 / 2017-06-13
+==================
+
+ * add `this` context tests and fixes
+
+4.0.0 / 2017-06-06
+==================
+
+ * drop support for Node.js < 4
+ * drop old versions of Node.js from Travis-CI
+ * specify Node.js >= 4.0.0 in `engines.node`
+ * remove more old code
+ * remove "extend" dependency
+ * remove "semver" dependency
+ * make the Promise logic a bit cleaner
+ * add async function pseudo-example to README
+ * use direct return in README example
+
+3.0.0 / 2017-06-02
+==================
+
+ * drop support for Node.js v0.8 and v0.10
+ * add support for async, Promises, and direct return
+ * add a couple `options` test cases
+ * implement a `"timeout"` option
+ * rename main file to `index.js`
+ * test Node 8 on Travis
+
+2.1.1 / 2017-05-30
+==================
+
+ * Revert [`fe2162e`](https://github.com/TooTallNate/node-agent-base/commit/fe2162e0ba18123f5b301cba4de1e9dd74e437cd) and [`270bdc9`](https://github.com/TooTallNate/node-agent-base/commit/270bdc92eb8e3bd0444d1e5266e8e9390aeb3095) (fixes #7)
+
+2.1.0 / 2017-05-26
+==================
+
+ * unref is not supported for node < 0.9.1 (@pi0)
+ * add tests to dangling socket (@pi0)
+ * check unref() is supported (@pi0)
+ * fix dangling sockets problem (@pi0)
+ * add basic "ws" module tests
+ * make `Agent` be subclassable
+ * turn `addRequest()` into a named function
+ * test: Node.js v4 likes to call `cork` on the stream (#3, @tomhughes)
+ * travis: test node v4, v5, v6 and v7
+
+2.0.1 / 2015-09-10
+==================
+
+ * package: update "semver" to v5.0.1 for WebPack (#1, @vhpoet)
+
+2.0.0 / 2015-07-10
+==================
+
+ * refactor to patch Node.js core for more consistent `opts` values
+ * ensure that HTTP(s) default port numbers are always given
+ * test: use ssl-cert-snakeoil SSL certs
+ * test: add tests for arbitrary options
+ * README: add API section
+ * README: make the Agent HTTP/HTTPS generic in the example
+ * README: use SVG for Travis-CI badge
+
+1.0.2 / 2015-06-27
+==================
+
+ * agent: set `req._hadError` to true after emitting "error"
+ * package: update "mocha" to v2
+ * test: add artificial HTTP GET request test
+ * test: add artificial data events test
+ * test: fix artifical GET response test on node > v0.11.3
+ * test: use a real timeout for the async error test
+
+1.0.1 / 2013-09-09
+==================
+
+ * Fix passing an "error" object to the callback function on the first tick
+
+1.0.0 / 2013-09-09
+==================
+
+ * New API: now you pass a callback function directly
+
+0.0.1 / 2013-07-09
+==================
+
+ * Initial release
diff --git a/deps/npm/node_modules/agent-base/README.md b/deps/npm/node_modules/agent-base/README.md
new file mode 100644
index 00000000000000..dbeceab8a125f6
--- /dev/null
+++ b/deps/npm/node_modules/agent-base/README.md
@@ -0,0 +1,145 @@
+agent-base
+==========
+### Turn a function into an [`http.Agent`][http.Agent] instance
+[![Build Status](https://travis-ci.org/TooTallNate/node-agent-base.svg?branch=master)](https://travis-ci.org/TooTallNate/node-agent-base)
+
+This module provides an `http.Agent` generator. That is, you pass it an async
+callback function, and it returns a new `http.Agent` instance that will invoke the
+given callback function when sending outbound HTTP requests.
+
+#### Some subclasses:
+
+Here's some more interesting uses of `agent-base`.
+Send a pull request to list yours!
+
+ * [`http-proxy-agent`][http-proxy-agent]: An HTTP(s) proxy `http.Agent` implementation for HTTP endpoints
+ * [`https-proxy-agent`][https-proxy-agent]: An HTTP(s) proxy `http.Agent` implementation for HTTPS endpoints
+ * [`pac-proxy-agent`][pac-proxy-agent]: A PAC file proxy `http.Agent` implementation for HTTP and HTTPS
+ * [`socks-proxy-agent`][socks-proxy-agent]: A SOCKS (v4a) proxy `http.Agent` implementation for HTTP and HTTPS
+
+
+Installation
+------------
+
+Install with `npm`:
+
+``` bash
+$ npm install agent-base
+```
+
+
+Example
+-------
+
+Here's a minimal example that creates a new `net.Socket` connection to the server
+for every HTTP request (i.e. the equivalent of `agent: false` option):
+
+```js
+var net = require('net');
+var tls = require('tls');
+var url = require('url');
+var http = require('http');
+var agent = require('agent-base');
+
+var endpoint = 'http://nodejs.org/api/';
+var parsed = url.parse(endpoint);
+
+// This is the important part!
+parsed.agent = agent(function (req, opts) {
+ var socket;
+ // `secureEndpoint` is true when using the https module
+ if (opts.secureEndpoint) {
+ socket = tls.connect(opts);
+ } else {
+ socket = net.connect(opts);
+ }
+ return socket;
+});
+
+// Everything else works just like normal...
+http.get(parsed, function (res) {
+ console.log('"response" event!', res.headers);
+ res.pipe(process.stdout);
+});
+```
+
+Returning a Promise or using an `async` function is also supported:
+
+```js
+agent(async function (req, opts) {
+ await sleep(1000);
+ // etc…
+});
+```
+
+Return another `http.Agent` instance to "pass through" the responsibility
+for that HTTP request to that agent:
+
+```js
+agent(function (req, opts) {
+ return opts.secureEndpoint ? https.globalAgent : http.globalAgent;
+});
+```
+
+
+API
+---
+
+## Agent(Function callback[, Object options]) → [http.Agent][]
+
+Creates a base `http.Agent` that will execute the callback function `callback`
+for every HTTP request that it is used as the `agent` for. The callback function
+is responsible for creating a `stream.Duplex` instance of some kind that will be
+used as the underlying socket in the HTTP request.
+
+The `options` object accepts the following properties:
+
+ * `timeout` - Number - Timeout for the `callback()` function in milliseconds. Defaults to Infinity (optional).
+
+The callback function should have the following signature:
+
+### callback(http.ClientRequest req, Object options, Function cb) → undefined
+
+The ClientRequest `req` can be accessed to read request headers and
+and the path, etc. The `options` object contains the options passed
+to the `http.request()`/`https.request()` function call, and is formatted
+to be directly passed to `net.connect()`/`tls.connect()`, or however
+else you want a Socket to be created. Pass the created socket to
+the callback function `cb` once created, and the HTTP request will
+continue to proceed.
+
+If the `https` module is used to invoke the HTTP request, then the
+`secureEndpoint` property on `options` _will be set to `true`_.
+
+
+License
+-------
+
+(The MIT License)
+
+Copyright (c) 2013 Nathan Rajlich <nathan@tootallnate.net>
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+[http-proxy-agent]: https://github.com/TooTallNate/node-http-proxy-agent
+[https-proxy-agent]: https://github.com/TooTallNate/node-https-proxy-agent
+[pac-proxy-agent]: https://github.com/TooTallNate/node-pac-proxy-agent
+[socks-proxy-agent]: https://github.com/TooTallNate/node-socks-proxy-agent
+[http.Agent]: https://nodejs.org/api/http.html#http_class_http_agent
diff --git a/deps/npm/node_modules/agent-base/index.js b/deps/npm/node_modules/agent-base/index.js
new file mode 100644
index 00000000000000..b1f42e6317431d
--- /dev/null
+++ b/deps/npm/node_modules/agent-base/index.js
@@ -0,0 +1,160 @@
+'use strict';
+require('./patch-core');
+const inherits = require('util').inherits;
+const promisify = require('es6-promisify');
+const EventEmitter = require('events').EventEmitter;
+
+module.exports = Agent;
+
+function isAgent(v) {
+ return v && typeof v.addRequest === 'function';
+}
+
+/**
+ * Base `http.Agent` implementation.
+ * No pooling/keep-alive is implemented by default.
+ *
+ * @param {Function} callback
+ * @api public
+ */
+function Agent(callback, _opts) {
+ if (!(this instanceof Agent)) {
+ return new Agent(callback, _opts);
+ }
+
+ EventEmitter.call(this);
+
+ // The callback gets promisified if it has 3 parameters
+ // (i.e. it has a callback function) lazily
+ this._promisifiedCallback = false;
+
+ let opts = _opts;
+ if ('function' === typeof callback) {
+ this.callback = callback;
+ } else if (callback) {
+ opts = callback;
+ }
+
+ // timeout for the socket to be returned from the callback
+ this.timeout = (opts && opts.timeout) || null;
+
+ this.options = opts;
+}
+inherits(Agent, EventEmitter);
+
+/**
+ * Override this function in your subclass!
+ */
+Agent.prototype.callback = function callback(req, opts) {
+ throw new Error(
+ '"agent-base" has no default implementation, you must subclass and override `callback()`'
+ );
+};
+
+/**
+ * Called by node-core's "_http_client.js" module when creating
+ * a new HTTP request with this Agent instance.
+ *
+ * @api public
+ */
+Agent.prototype.addRequest = function addRequest(req, _opts) {
+ const ownOpts = Object.assign({}, _opts);
+
+ // Set default `host` for HTTP to localhost
+ if (null == ownOpts.host) {
+ ownOpts.host = 'localhost';
+ }
+
+ // Set default `port` for HTTP if none was explicitly specified
+ if (null == ownOpts.port) {
+ ownOpts.port = ownOpts.secureEndpoint ? 443 : 80;
+ }
+
+ const opts = Object.assign({}, this.options, ownOpts);
+
+ if (opts.host && opts.path) {
+ // If both a `host` and `path` are specified then it's most likely the
+ // result of a `url.parse()` call... we need to remove the `path` portion so
+ // that `net.connect()` doesn't attempt to open that as a unix socket file.
+ delete opts.path;
+ }
+
+ delete opts.agent;
+ delete opts.hostname;
+ delete opts._defaultAgent;
+ delete opts.defaultPort;
+ delete opts.createConnection;
+
+ // Hint to use "Connection: close"
+ // XXX: non-documented `http` module API :(
+ req._last = true;
+ req.shouldKeepAlive = false;
+
+ // Create the `stream.Duplex` instance
+ let timeout;
+ let timedOut = false;
+ const timeoutMs = this.timeout;
+
+ function onerror(err) {
+ if (req._hadError) return;
+ req.emit('error', err);
+ // For Safety. Some additional errors might fire later on
+ // and we need to make sure we don't double-fire the error event.
+ req._hadError = true;
+ }
+
+ function ontimeout() {
+ timeout = null;
+ timedOut = true;
+ const err = new Error(
+ 'A "socket" was not created for HTTP request before ' + timeoutMs + 'ms'
+ );
+ err.code = 'ETIMEOUT';
+ onerror(err);
+ }
+
+ function callbackError(err) {
+ if (timedOut) return;
+ if (timeout != null) {
+ clearTimeout(timeout);
+ timeout = null;
+ }
+ onerror(err);
+ }
+
+ function onsocket(socket) {
+ if (timedOut) return;
+ if (timeout != null) {
+ clearTimeout(timeout);
+ timeout = null;
+ }
+ if (isAgent(socket)) {
+ // `socket` is actually an http.Agent instance, so relinquish
+ // responsibility for this `req` to the Agent from here on
+ socket.addRequest(req, opts);
+ } else if (socket) {
+ req.onSocket(socket);
+ } else {
+ const err = new Error(
+ `no Duplex stream was returned to agent-base for \`${req.method} ${req.path}\``
+ );
+ onerror(err);
+ }
+ }
+
+ if (!this._promisifiedCallback && this.callback.length >= 3) {
+ // Legacy callback function - convert to a Promise
+ this.callback = promisify(this.callback, this);
+ this._promisifiedCallback = true;
+ }
+
+ if (timeoutMs > 0) {
+ timeout = setTimeout(ontimeout, timeoutMs);
+ }
+
+ try {
+ Promise.resolve(this.callback(req, opts)).then(onsocket, callbackError);
+ } catch (err) {
+ Promise.reject(err).catch(callbackError);
+ }
+};
diff --git a/deps/npm/node_modules/agent-base/package.json b/deps/npm/node_modules/agent-base/package.json
new file mode 100644
index 00000000000000..59c5e0be25956a
--- /dev/null
+++ b/deps/npm/node_modules/agent-base/package.json
@@ -0,0 +1,69 @@
+{
+ "_from": "agent-base@4",
+ "_id": "agent-base@4.2.0",
+ "_inBundle": false,
+ "_integrity": "sha512-c+R/U5X+2zz2+UCrCFv6odQzJdoqI+YecuhnAJLa1zYaMc13zPfwMwZrr91Pd1DYNo/yPRbiM4WVf9whgwFsIg==",
+ "_location": "/agent-base",
+ "_phantomChildren": {},
+ "_requested": {
+ "type": "range",
+ "registry": true,
+ "raw": "agent-base@4",
+ "name": "agent-base",
+ "escapedName": "agent-base",
+ "rawSpec": "4",
+ "saveSpec": null,
+ "fetchSpec": "4"
+ },
+ "_requiredBy": [
+ "/http-proxy-agent",
+ "/https-proxy-agent",
+ "/npm-profile/socks-proxy-agent",
+ "/npm-registry-fetch/socks-proxy-agent",
+ "/socks-proxy-agent"
+ ],
+ "_resolved": "https://registry.npmjs.org/agent-base/-/agent-base-4.2.0.tgz",
+ "_shasum": "9838b5c3392b962bad031e6a4c5e1024abec45ce",
+ "_spec": "agent-base@4",
+ "_where": "/Users/rebecca/code/npm/node_modules/http-proxy-agent",
+ "author": {
+ "name": "Nathan Rajlich",
+ "email": "nathan@tootallnate.net",
+ "url": "http://n8.io/"
+ },
+ "bugs": {
+ "url": "https://github.com/TooTallNate/node-agent-base/issues"
+ },
+ "bundleDependencies": false,
+ "dependencies": {
+ "es6-promisify": "^5.0.0"
+ },
+ "deprecated": false,
+ "description": "Turn a function into an `http.Agent` instance",
+ "devDependencies": {
+ "mocha": "^3.4.2",
+ "ws": "^3.0.0"
+ },
+ "engines": {
+ "node": ">= 4.0.0"
+ },
+ "homepage": "https://github.com/TooTallNate/node-agent-base#readme",
+ "keywords": [
+ "http",
+ "agent",
+ "base",
+ "barebones",
+ "https"
+ ],
+ "license": "MIT",
+ "main": "./index.js",
+ "name": "agent-base",
+ "repository": {
+ "type": "git",
+ "url": "git://github.com/TooTallNate/node-agent-base.git"
+ },
+ "scripts": {
+ "test": "mocha --reporter spec"
+ },
+ "version": "4.2.0"
+}
diff --git a/deps/npm/node_modules/agent-base/patch-core.js b/deps/npm/node_modules/agent-base/patch-core.js
new file mode 100644
index 00000000000000..47d26a72b0a65e
--- /dev/null
+++ b/deps/npm/node_modules/agent-base/patch-core.js
@@ -0,0 +1,37 @@
+'use strict';
+const url = require('url');
+const https = require('https');
+
+/**
+ * This currently needs to be applied to all Node.js versions
+ * in order to determine if the `req` is an HTTP or HTTPS request.
+ *
+ * There is currently no PR attempting to move this property upstream.
+ */
+https.request = (function(request) {
+ return function(_options, cb) {
+ let options;
+ if (typeof _options === 'string') {
+ options = url.parse(_options);
+ } else {
+ options = Object.assign({}, _options);
+ }
+ if (null == options.port) {
+ options.port = 443;
+ }
+ options.secureEndpoint = true;
+ return request.call(https, options, cb);
+ };
+})(https.request);
+
+/**
+ * This is needed for Node.js >= 9.0.0 to make sure `https.get()` uses the
+ * patched `https.request()`.
+ *
+ * Ref: https://github.com/nodejs/node/commit/5118f31
+ */
+https.get = function(options, cb) {
+ const req = https.request(options, cb);
+ req.end();
+ return req;
+};
diff --git a/deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/http-proxy-agent/node_modules/agent-base/test/ssl-cert-snakeoil.key b/deps/npm/node_modules/agent-base/test/ssl-cert-snakeoil.key
similarity index 100%
rename from deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/http-proxy-agent/node_modules/agent-base/test/ssl-cert-snakeoil.key
rename to deps/npm/node_modules/agent-base/test/ssl-cert-snakeoil.key
diff --git a/deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/http-proxy-agent/node_modules/agent-base/test/ssl-cert-snakeoil.pem b/deps/npm/node_modules/agent-base/test/ssl-cert-snakeoil.pem
similarity index 100%
rename from deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/http-proxy-agent/node_modules/agent-base/test/ssl-cert-snakeoil.pem
rename to deps/npm/node_modules/agent-base/test/ssl-cert-snakeoil.pem
diff --git a/deps/npm/node_modules/agent-base/test/test.js b/deps/npm/node_modules/agent-base/test/test.js
new file mode 100644
index 00000000000000..da2e91983548b4
--- /dev/null
+++ b/deps/npm/node_modules/agent-base/test/test.js
@@ -0,0 +1,673 @@
+/**
+ * Module dependencies.
+ */
+
+var fs = require('fs');
+var url = require('url');
+var net = require('net');
+var tls = require('tls');
+var http = require('http');
+var https = require('https');
+var WebSocket = require('ws');
+var assert = require('assert');
+var events = require('events');
+var inherits = require('util').inherits;
+var Agent = require('../');
+
+var PassthroughAgent = Agent(function(req, opts) {
+ return opts.secureEndpoint ? https.globalAgent : http.globalAgent;
+});
+
+describe('Agent', function() {
+ describe('subclass', function() {
+ it('should be subclassable', function(done) {
+ function MyAgent() {
+ Agent.call(this);
+ }
+ inherits(MyAgent, Agent);
+
+ MyAgent.prototype.callback = function(req, opts, fn) {
+ assert.equal(req.path, '/foo');
+ assert.equal(req.getHeader('host'), '127.0.0.1:1234');
+ assert.equal(opts.secureEndpoint, true);
+ done();
+ };
+
+ var info = url.parse('https://127.0.0.1:1234/foo');
+ info.agent = new MyAgent();
+ https.get(info);
+ });
+ });
+ describe('options', function() {
+ it('should support an options Object as first argument', function() {
+ var agent = new Agent({ timeout: 1000 });
+ assert.equal(1000, agent.timeout);
+ });
+ it('should support an options Object as second argument', function() {
+ var agent = new Agent(function() {}, { timeout: 1000 });
+ assert.equal(1000, agent.timeout);
+ });
+ it('should be mixed in with HTTP request options', function(done) {
+ var agent = new Agent({
+ host: 'my-proxy.com',
+ port: 3128,
+ foo: 'bar'
+ });
+ agent.callback = function(req, opts, fn) {
+ assert.equal('bar', opts.foo);
+ assert.equal('a', opts.b);
+
+ // `host` and `port` are special-cases, and should always be
+ // overwritten in the request `opts` inside the agent-base callback
+ assert.equal('localhost', opts.host);
+ assert.equal(80, opts.port);
+ done();
+ };
+ var opts = {
+ b: 'a',
+ agent: agent
+ };
+ http.get(opts);
+ });
+ });
+ describe('`this` context', function() {
+ it('should be the Agent instance', function(done) {
+ var called = false;
+ var agent = new Agent();
+ agent.callback = function() {
+ called = true;
+ assert.equal(this, agent);
+ };
+ var info = url.parse('http://127.0.0.1/foo');
+ info.agent = agent;
+ var req = http.get(info);
+ req.on('error', function(err) {
+ assert(/no Duplex stream was returned/.test(err.message));
+ done();
+ });
+ });
+ it('should be the Agent instance with callback signature', function(done) {
+ var called = false;
+ var agent = new Agent();
+ agent.callback = function(req, opts, fn) {
+ called = true;
+ assert.equal(this, agent);
+ fn();
+ };
+ var info = url.parse('http://127.0.0.1/foo');
+ info.agent = agent;
+ var req = http.get(info);
+ req.on('error', function(err) {
+ assert(/no Duplex stream was returned/.test(err.message));
+ done();
+ });
+ });
+ });
+ describe('"error" event', function() {
+ it('should be invoked on `http.ClientRequest` instance if `callback()` has not been defined', function(
+ done
+ ) {
+ var agent = new Agent();
+ var info = url.parse('http://127.0.0.1/foo');
+ info.agent = agent;
+ var req = http.get(info);
+ req.on('error', function(err) {
+ assert.equal(
+ '"agent-base" has no default implementation, you must subclass and override `callback()`',
+ err.message
+ );
+ done();
+ });
+ });
+ it('should be invoked on `http.ClientRequest` instance if Error passed to callback function on the first tick', function(
+ done
+ ) {
+ var agent = new Agent(function(req, opts, fn) {
+ fn(new Error('is this caught?'));
+ });
+ var info = url.parse('http://127.0.0.1/foo');
+ info.agent = agent;
+ var req = http.get(info);
+ req.on('error', function(err) {
+ assert.equal('is this caught?', err.message);
+ done();
+ });
+ });
+ it('should be invoked on `http.ClientRequest` instance if Error passed to callback function after the first tick', function(
+ done
+ ) {
+ var agent = new Agent(function(req, opts, fn) {
+ setTimeout(function() {
+ fn(new Error('is this caught?'));
+ }, 10);
+ });
+ var info = url.parse('http://127.0.0.1/foo');
+ info.agent = agent;
+ var req = http.get(info);
+ req.on('error', function(err) {
+ assert.equal('is this caught?', err.message);
+ done();
+ });
+ });
+ });
+ describe('artificial "streams"', function() {
+ it('should send a GET request', function(done) {
+ var stream = new events.EventEmitter();
+
+ // needed for the `http` module to call .write() on the stream
+ stream.writable = true;
+
+ stream.write = function(str) {
+ assert(0 == str.indexOf('GET / HTTP/1.1'));
+ done();
+ };
+
+ // needed for `http` module in Node.js 4
+ stream.cork = function() {};
+
+ var opts = {
+ method: 'GET',
+ host: '127.0.0.1',
+ path: '/',
+ port: 80,
+ agent: new Agent(function(req, opts, fn) {
+ fn(null, stream);
+ })
+ };
+ var req = http.request(opts);
+ req.end();
+ });
+ it('should receive a GET response', function(done) {
+ var stream = new events.EventEmitter();
+ var opts = {
+ method: 'GET',
+ host: '127.0.0.1',
+ path: '/',
+ port: 80,
+ agent: new Agent(function(req, opts, fn) {
+ fn(null, stream);
+ })
+ };
+ var req = http.request(opts, function(res) {
+ assert.equal('0.9', res.httpVersion);
+ assert.equal(111, res.statusCode);
+ assert.equal('bar', res.headers.foo);
+ done();
+ });
+
+ // have to wait for the "socket" event since `http.ClientRequest`
+ // doesn't *actually* attach the listeners to the "stream" until
+ // this happens
+ req.once('socket', function() {
+ var buf = new Buffer(
+ 'HTTP/0.9 111\r\n' +
+ 'Foo: bar\r\n' +
+ 'Set-Cookie: 1\r\n' +
+ 'Set-Cookie: 2\r\n\r\n'
+ );
+ stream.emit('data', buf);
+ });
+
+ req.end();
+ });
+ });
+});
+
+describe('"http" module', function() {
+ var server;
+ var port;
+
+ // setup test HTTP server
+ before(function(done) {
+ server = http.createServer();
+ server.listen(0, function() {
+ port = server.address().port;
+ done();
+ });
+ });
+
+ // shut down test HTTP server
+ after(function(done) {
+ server.once('close', function() {
+ done();
+ });
+ server.close();
+ });
+
+ it('should work for basic HTTP requests', function(done) {
+ var called = false;
+ var agent = new Agent(function(req, opts, fn) {
+ called = true;
+ var socket = net.connect(opts);
+ fn(null, socket);
+ });
+
+ // add HTTP server "request" listener
+ var gotReq = false;
+ server.once('request', function(req, res) {
+ gotReq = true;
+ res.setHeader('X-Foo', 'bar');
+ res.setHeader('X-Url', req.url);
+ res.end();
+ });
+
+ var info = url.parse('http://127.0.0.1:' + port + '/foo');
+ info.agent = agent;
+ http.get(info, function(res) {
+ assert.equal('bar', res.headers['x-foo']);
+ assert.equal('/foo', res.headers['x-url']);
+ assert(gotReq);
+ assert(called);
+ done();
+ });
+ });
+
+ it('should support direct return in `connect()`', function(done) {
+ var called = false;
+ var agent = new Agent(function(req, opts) {
+ called = true;
+ return net.connect(opts);
+ });
+
+ // add HTTP server "request" listener
+ var gotReq = false;
+ server.once('request', function(req, res) {
+ gotReq = true;
+ res.setHeader('X-Foo', 'bar');
+ res.setHeader('X-Url', req.url);
+ res.end();
+ });
+
+ var info = url.parse('http://127.0.0.1:' + port + '/foo');
+ info.agent = agent;
+ http.get(info, function(res) {
+ assert.equal('bar', res.headers['x-foo']);
+ assert.equal('/foo', res.headers['x-url']);
+ assert(gotReq);
+ assert(called);
+ done();
+ });
+ });
+
+ it('should support returning a Promise in `connect()`', function(done) {
+ var called = false;
+ var agent = new Agent(function(req, opts) {
+ return new Promise(function(resolve, reject) {
+ called = true;
+ resolve(net.connect(opts));
+ });
+ });
+
+ // add HTTP server "request" listener
+ var gotReq = false;
+ server.once('request', function(req, res) {
+ gotReq = true;
+ res.setHeader('X-Foo', 'bar');
+ res.setHeader('X-Url', req.url);
+ res.end();
+ });
+
+ var info = url.parse('http://127.0.0.1:' + port + '/foo');
+ info.agent = agent;
+ http.get(info, function(res) {
+ assert.equal('bar', res.headers['x-foo']);
+ assert.equal('/foo', res.headers['x-url']);
+ assert(gotReq);
+ assert(called);
+ done();
+ });
+ });
+
+ it('should set the `Connection: close` response header', function(done) {
+ var called = false;
+ var agent = new Agent(function(req, opts, fn) {
+ called = true;
+ var socket = net.connect(opts);
+ fn(null, socket);
+ });
+
+ // add HTTP server "request" listener
+ var gotReq = false;
+ server.once('request', function(req, res) {
+ gotReq = true;
+ res.setHeader('X-Url', req.url);
+ assert.equal('close', req.headers.connection);
+ res.end();
+ });
+
+ var info = url.parse('http://127.0.0.1:' + port + '/bar');
+ info.agent = agent;
+ http.get(info, function(res) {
+ assert.equal('/bar', res.headers['x-url']);
+ assert.equal('close', res.headers.connection);
+ assert(gotReq);
+ assert(called);
+ done();
+ });
+ });
+
+ it('should pass through options from `http.request()`', function(done) {
+ var agent = new Agent(function(req, opts, fn) {
+ assert.equal('google.com', opts.host);
+ assert.equal('bar', opts.foo);
+ done();
+ });
+
+ http.get({
+ host: 'google.com',
+ foo: 'bar',
+ agent: agent
+ });
+ });
+
+ it('should default to port 80', function(done) {
+ var agent = new Agent(function(req, opts, fn) {
+ assert.equal(80, opts.port);
+ done();
+ });
+
+ // (probably) not hitting a real HTTP server here,
+ // so no need to add a httpServer request listener
+ http.get({
+ host: '127.0.0.1',
+ path: '/foo',
+ agent: agent
+ });
+ });
+
+ it('should support the "timeout" option', function(done) {
+ // ensure we timeout after the "error" event had a chance to trigger
+ this.timeout(1000);
+ this.slow(800);
+
+ var agent = new Agent(
+ function(req, opts, fn) {
+ // this function will time out
+ },
+ { timeout: 100 }
+ );
+
+ var opts = url.parse('http://nodejs.org');
+ opts.agent = agent;
+
+ var req = http.get(opts);
+ req.once('error', function(err) {
+ assert.equal('ETIMEOUT', err.code);
+ req.abort();
+ done();
+ });
+ });
+
+ describe('PassthroughAgent', function() {
+ it('should pass through to `http.globalAgent`', function(done) {
+ // add HTTP server "request" listener
+ var gotReq = false;
+ server.once('request', function(req, res) {
+ gotReq = true;
+ res.setHeader('X-Foo', 'bar');
+ res.setHeader('X-Url', req.url);
+ res.end();
+ });
+
+ var info = url.parse('http://127.0.0.1:' + port + '/foo');
+ info.agent = PassthroughAgent;
+ http.get(info, function(res) {
+ assert.equal('bar', res.headers['x-foo']);
+ assert.equal('/foo', res.headers['x-url']);
+ assert(gotReq);
+ done();
+ });
+ });
+ });
+});
+
+describe('"https" module', function() {
+ var server;
+ var port;
+
+ // setup test HTTPS server
+ before(function(done) {
+ var options = {
+ key: fs.readFileSync(__dirname + '/ssl-cert-snakeoil.key'),
+ cert: fs.readFileSync(__dirname + '/ssl-cert-snakeoil.pem')
+ };
+ server = https.createServer(options);
+ server.listen(0, function() {
+ port = server.address().port;
+ done();
+ });
+ });
+
+ // shut down test HTTP server
+ after(function(done) {
+ server.once('close', function() {
+ done();
+ });
+ server.close();
+ });
+
+ it('should not modify the passed in Options object', function(done) {
+ var called = false;
+ var agent = new Agent(function(req, opts, fn) {
+ called = true;
+ assert.equal(true, opts.secureEndpoint);
+ assert.equal(443, opts.port);
+ assert.equal('localhost', opts.host);
+ });
+ var opts = { agent: agent };
+ var req = https.request(opts);
+ assert.equal(true, called);
+ assert.equal(false, 'secureEndpoint' in opts);
+ assert.equal(false, 'port' in opts);
+ done();
+ });
+
+ it('should work with a String URL', function(done) {
+ var endpoint = 'https://127.0.0.1:' + port;
+ var req = https.get(endpoint);
+
+ // it's gonna error out since `rejectUnauthorized` is not being passed in
+ req.on('error', function(err) {
+ assert.equal(err.code, 'DEPTH_ZERO_SELF_SIGNED_CERT');
+ done();
+ });
+ });
+
+ it('should work for basic HTTPS requests', function(done) {
+ var called = false;
+ var agent = new Agent(function(req, opts, fn) {
+ called = true;
+ assert(opts.secureEndpoint);
+ var socket = tls.connect(opts);
+ fn(null, socket);
+ });
+
+ // add HTTPS server "request" listener
+ var gotReq = false;
+ server.once('request', function(req, res) {
+ gotReq = true;
+ res.setHeader('X-Foo', 'bar');
+ res.setHeader('X-Url', req.url);
+ res.end();
+ });
+
+ var info = url.parse('https://127.0.0.1:' + port + '/foo');
+ info.agent = agent;
+ info.rejectUnauthorized = false;
+ https.get(info, function(res) {
+ assert.equal('bar', res.headers['x-foo']);
+ assert.equal('/foo', res.headers['x-url']);
+ assert(gotReq);
+ assert(called);
+ done();
+ });
+ });
+
+ it('should pass through options from `https.request()`', function(done) {
+ var agent = new Agent(function(req, opts, fn) {
+ assert.equal('google.com', opts.host);
+ assert.equal('bar', opts.foo);
+ done();
+ });
+
+ https.get({
+ host: 'google.com',
+ foo: 'bar',
+ agent: agent
+ });
+ });
+
+ it('should default to port 443', function(done) {
+ var agent = new Agent(function(req, opts, fn) {
+ assert.equal(true, opts.secureEndpoint);
+ assert.equal(false, opts.rejectUnauthorized);
+ assert.equal(443, opts.port);
+ done();
+ });
+
+ // (probably) not hitting a real HTTPS server here,
+ // so no need to add a httpsServer request listener
+ https.get({
+ host: '127.0.0.1',
+ path: '/foo',
+ agent: agent,
+ rejectUnauthorized: false
+ });
+ });
+
+ describe('PassthroughAgent', function() {
+ it('should pass through to `https.globalAgent`', function(done) {
+ // add HTTP server "request" listener
+ var gotReq = false;
+ server.once('request', function(req, res) {
+ gotReq = true;
+ res.setHeader('X-Foo', 'bar');
+ res.setHeader('X-Url', req.url);
+ res.end();
+ });
+
+ var info = url.parse('https://127.0.0.1:' + port + '/foo');
+ info.agent = PassthroughAgent;
+ info.rejectUnauthorized = false;
+ https.get(info, function(res) {
+ assert.equal('bar', res.headers['x-foo']);
+ assert.equal('/foo', res.headers['x-url']);
+ assert(gotReq);
+ done();
+ });
+ });
+ });
+});
+
+describe('"ws" server', function() {
+ var wss;
+ var server;
+ var port;
+
+ // setup test HTTP server
+ before(function(done) {
+ server = http.createServer();
+ wss = new WebSocket.Server({ server: server });
+ server.listen(0, function() {
+ port = server.address().port;
+ done();
+ });
+ });
+
+ // shut down test HTTP server
+ after(function(done) {
+ server.once('close', function() {
+ done();
+ });
+ server.close();
+ });
+
+ it('should work for basic WebSocket connections', function(done) {
+ function onconnection(ws) {
+ ws.on('message', function(data) {
+ assert.equal('ping', data);
+ ws.send('pong');
+ });
+ }
+ wss.on('connection', onconnection);
+
+ var agent = new Agent(function(req, opts, fn) {
+ var socket = net.connect(opts);
+ fn(null, socket);
+ });
+
+ var client = new WebSocket('ws://127.0.0.1:' + port + '/', {
+ agent: agent
+ });
+
+ client.on('open', function() {
+ client.send('ping');
+ });
+
+ client.on('message', function(data) {
+ assert.equal('pong', data);
+ client.close();
+ wss.removeListener('connection', onconnection);
+ done();
+ });
+ });
+});
+
+describe('"wss" server', function() {
+ var wss;
+ var server;
+ var port;
+
+ // setup test HTTP server
+ before(function(done) {
+ var options = {
+ key: fs.readFileSync(__dirname + '/ssl-cert-snakeoil.key'),
+ cert: fs.readFileSync(__dirname + '/ssl-cert-snakeoil.pem')
+ };
+ server = https.createServer(options);
+ wss = new WebSocket.Server({ server: server });
+ server.listen(0, function() {
+ port = server.address().port;
+ done();
+ });
+ });
+
+ // shut down test HTTP server
+ after(function(done) {
+ server.once('close', function() {
+ done();
+ });
+ server.close();
+ });
+
+ it('should work for secure WebSocket connections', function(done) {
+ function onconnection(ws) {
+ ws.on('message', function(data) {
+ assert.equal('ping', data);
+ ws.send('pong');
+ });
+ }
+ wss.on('connection', onconnection);
+
+ var agent = new Agent(function(req, opts, fn) {
+ var socket = tls.connect(opts);
+ fn(null, socket);
+ });
+
+ var client = new WebSocket('wss://127.0.0.1:' + port + '/', {
+ agent: agent,
+ rejectUnauthorized: false
+ });
+
+ client.on('open', function() {
+ client.send('ping');
+ });
+
+ client.on('message', function(data) {
+ assert.equal('pong', data);
+ client.close();
+ wss.removeListener('connection', onconnection);
+ done();
+ });
+ });
+});
diff --git a/deps/npm/node_modules/agentkeepalive/History.md b/deps/npm/node_modules/agentkeepalive/History.md
new file mode 100644
index 00000000000000..da67a1c4f6f94e
--- /dev/null
+++ b/deps/npm/node_modules/agentkeepalive/History.md
@@ -0,0 +1,148 @@
+
+3.4.1 / 2018-03-08
+==================
+
+**fixes**
+ * [[`4d3a3b1`](http://github.com/node-modules/agentkeepalive/commit/4d3a3b1f7b16595febbbd39eeed72b2663549014)] - fix: Handle ipv6 addresses in host-header correctly with TLS (#53) (Mattias Holmlund <>)
+
+**others**
+ * [[`55a7a5c`](http://github.com/node-modules/agentkeepalive/commit/55a7a5cd33e97f9a8370083dcb041c5552f10ac9)] - test: stop timer after test end (fengmk2 <>)
+
+3.4.0 / 2018-02-27
+==================
+
+**features**
+ * [[`bc7cadb`](http://github.com/node-modules/agentkeepalive/commit/bc7cadb30ecd2071e2b341ac53ae1a2b8155c43d)] - feat: use socket custom freeSocketKeepAliveTimeout first (#59) (fengmk2 <>)
+
+**others**
+ * [[`138eda8`](http://github.com/node-modules/agentkeepalive/commit/138eda81e10b632aaa87bea0cb66d8667124c4e8)] - doc: fix `keepAliveMsecs` params description (#55) (Hongcai Deng <>)
+
+3.3.0 / 2017-06-20
+==================
+
+ * feat: add statusChanged getter (#51)
+ * chore: format License
+
+3.2.0 / 2017-06-10
+==================
+
+ * feat: add expiring active sockets
+ * test: add node 8 (#49)
+
+3.1.0 / 2017-02-20
+==================
+
+ * feat: timeout support humanize ms (#48)
+
+3.0.0 / 2016-12-20
+==================
+
+ * fix: emit agent socket close event
+ * test: add remove excess calls to removeSocket
+ * test: use egg-ci
+ * test: refactor test with eslint rules
+ * feat: merge _http_agent.js from 7.2.1
+
+2.2.0 / 2016-06-26
+==================
+
+ * feat: Add browser shim (noop) for isomorphic use. (#39)
+ * chore: add security check badge
+
+2.1.1 / 2016-04-06
+==================
+
+ * https: fix ssl socket leak when keepalive is used
+ * chore: remove circle ci image
+
+2.1.0 / 2016-04-02
+==================
+
+ * fix: opened sockets number overflow maxSockets
+
+2.0.5 / 2016-03-16
+==================
+
+ * fix: pick _evictSession to httpsAgent
+
+2.0.4 / 2016-03-13
+==================
+
+ * test: add Circle ci
+ * test: add appveyor ci build
+ * refactor: make sure only one error listener
+ * chore: use codecov
+ * fix: handle idle socket error
+ * test: run on more node versions
+
+2.0.3 / 2015-08-03
+==================
+
+ * fix: add default error handler to avoid Unhandled error event throw
+
+2.0.2 / 2015-04-25
+==================
+
+ * fix: remove socket from freeSockets on 'timeout' (@pmalouin)
+
+2.0.1 / 2015-04-19
+==================
+
+ * fix: add timeoutSocketCount to getCurrentStatus()
+ * feat(getCurrentStatus): add getCurrentStatus
+
+2.0.0 / 2015-04-01
+==================
+
+ * fix: socket.destroyed always be undefined on 0.10.x
+ * Make it compatible with node v0.10.x (@lattmann)
+
+1.2.1 / 2015-03-23
+==================
+
+ * patch from iojs: don't overwrite servername option
+ * patch commits from joyent/node
+ * add max sockets test case
+ * add nagle algorithm delayed link
+
+1.2.0 / 2014-09-02
+==================
+
+ * allow set keepAliveTimeout = 0
+ * support timeout on working socket. fixed #6
+
+1.1.0 / 2014-08-28
+==================
+
+ * add some socket counter for deep monitor
+
+1.0.0 / 2014-08-13
+==================
+
+ * update _http_agent, only support 0.11+, only support node 0.11.0+
+
+0.2.2 / 2013-11-19
+==================
+
+ * support node 0.8 and node 0.10
+
+0.2.1 / 2013-11-08
+==================
+
+ * fix socket does not timeout bug, it will hang on life, must use 0.2.x on node 0.11
+
+0.2.0 / 2013-11-06
+==================
+
+ * use keepalive agent on node 0.11+ impl
+
+0.1.5 / 2013-06-24
+==================
+
+ * support coveralls
+ * add node 0.10 test
+ * add 0.8.22 original https.js
+ * add original http.js module to diff
+ * update jscover
+ * mv pem to fixtures
+ * add https agent usage
diff --git a/deps/npm/node_modules/agentkeepalive/README.md b/deps/npm/node_modules/agentkeepalive/README.md
new file mode 100644
index 00000000000000..ce067f10c7fb7a
--- /dev/null
+++ b/deps/npm/node_modules/agentkeepalive/README.md
@@ -0,0 +1,248 @@
+# agentkeepalive
+
+[![NPM version][npm-image]][npm-url]
+[![build status][travis-image]][travis-url]
+[![Appveyor status][appveyor-image]][appveyor-url]
+[![Test coverage][codecov-image]][codecov-url]
+[![David deps][david-image]][david-url]
+[![Known Vulnerabilities][snyk-image]][snyk-url]
+[![npm download][download-image]][download-url]
+
+[npm-image]: https://img.shields.io/npm/v/agentkeepalive.svg?style=flat
+[npm-url]: https://npmjs.org/package/agentkeepalive
+[travis-image]: https://img.shields.io/travis/node-modules/agentkeepalive.svg?style=flat
+[travis-url]: https://travis-ci.org/node-modules/agentkeepalive
+[appveyor-image]: https://ci.appveyor.com/api/projects/status/k7ct4s47di6m5uy2?svg=true
+[appveyor-url]: https://ci.appveyor.com/project/fengmk2/agentkeepalive
+[codecov-image]: https://codecov.io/gh/node-modules/agentkeepalive/branch/master/graph/badge.svg
+[codecov-url]: https://codecov.io/gh/node-modules/agentkeepalive
+[david-image]: https://img.shields.io/david/node-modules/agentkeepalive.svg?style=flat
+[david-url]: https://david-dm.org/node-modules/agentkeepalive
+[snyk-image]: https://snyk.io/test/npm/agentkeepalive/badge.svg?style=flat-square
+[snyk-url]: https://snyk.io/test/npm/agentkeepalive
+[download-image]: https://img.shields.io/npm/dm/agentkeepalive.svg?style=flat-square
+[download-url]: https://npmjs.org/package/agentkeepalive
+
+The Node.js's missing `keep alive` `http.Agent`. Support `http` and `https`.
+
+## What's different from original `http.Agent`?
+
+- `keepAlive=true` by default
+- Disable Nagle's algorithm: `socket.setNoDelay(true)`
+- Add free socket timeout: avoid long time inactivity socket leak in the free-sockets queue.
+- Add active socket timeout: avoid long time inactivity socket leak in the active-sockets queue.
+
+## Install
+
+```bash
+$ npm install agentkeepalive --save
+```
+
+## new Agent([options])
+
+* `options` {Object} Set of configurable options to set on the agent.
+ Can have the following fields:
+ * `keepAlive` {Boolean} Keep sockets around in a pool to be used by
+ other requests in the future. Default = `true`.
+ * `keepAliveMsecs` {Number} When using the keepAlive option, specifies the initial delay
+ for TCP Keep-Alive packets. Ignored when the keepAlive option is false or undefined. Defaults to 1000.
+ Default = `1000`. Only relevant if `keepAlive` is set to `true`.
+ * `freeSocketKeepAliveTimeout`: {Number} Sets the free socket to timeout
+ after `freeSocketKeepAliveTimeout` milliseconds of inactivity on the free socket.
+ Default is `15000`.
+ Only relevant if `keepAlive` is set to `true`.
+ * `timeout`: {Number} Sets the working socket to timeout
+ after `timeout` milliseconds of inactivity on the working socket.
+ Default is `freeSocketKeepAliveTimeout * 2`.
+ * `maxSockets` {Number} Maximum number of sockets to allow per
+ host. Default = `Infinity`.
+ * `maxFreeSockets` {Number} Maximum number of sockets to leave open
+ in a free state. Only relevant if `keepAlive` is set to `true`.
+ Default = `256`.
+ * `socketActiveTTL` {Number} Sets the socket active time to live, even if it's in use.
+ If not setted the behaviour continues the same (the socket will be released only when free)
+ Default = `null`.
+
+## Usage
+
+```js
+const http = require('http');
+const Agent = require('agentkeepalive');
+
+const keepaliveAgent = new Agent({
+ maxSockets: 100,
+ maxFreeSockets: 10,
+ timeout: 60000,
+ freeSocketKeepAliveTimeout: 30000, // free socket keepalive for 30 seconds
+});
+
+const options = {
+ host: 'cnodejs.org',
+ port: 80,
+ path: '/',
+ method: 'GET',
+ agent: keepaliveAgent,
+};
+
+const req = http.request(options, res => {
+ console.log('STATUS: ' + res.statusCode);
+ console.log('HEADERS: ' + JSON.stringify(res.headers));
+ res.setEncoding('utf8');
+ res.on('data', function (chunk) {
+ console.log('BODY: ' + chunk);
+ });
+});
+req.on('error', e => {
+ console.log('problem with request: ' + e.message);
+});
+req.end();
+
+setTimeout(() => {
+ if (keepaliveAgent.statusChanged) {
+ console.log('[%s] agent status changed: %j', Date(), keepaliveAgent.getCurrentStatus());
+ }
+}, 2000);
+
+```
+
+### `getter agent.statusChanged`
+
+counters have change or not after last checkpoint.
+
+### `agent.getCurrentStatus()`
+
+`agent.getCurrentStatus()` will return a object to show the status of this agent:
+
+```js
+{
+ createSocketCount: 10,
+ closeSocketCount: 5,
+ timeoutSocketCount: 0,
+ requestCount: 5,
+ freeSockets: { 'localhost:57479:': 3 },
+ sockets: { 'localhost:57479:': 5 },
+ requests: {}
+}
+```
+
+### Support `https`
+
+```js
+const https = require('https');
+const HttpsAgent = require('agentkeepalive').HttpsAgent;
+
+const keepaliveAgent = new HttpsAgent();
+// https://www.google.com/search?q=nodejs&sugexp=chrome,mod=12&sourceid=chrome&ie=UTF-8
+const options = {
+ host: 'www.google.com',
+ port: 443,
+ path: '/search?q=nodejs&sugexp=chrome,mod=12&sourceid=chrome&ie=UTF-8',
+ method: 'GET',
+ agent: keepaliveAgent,
+};
+
+const req = https.request(options, res => {
+ console.log('STATUS: ' + res.statusCode);
+ console.log('HEADERS: ' + JSON.stringify(res.headers));
+ res.setEncoding('utf8');
+ res.on('data', chunk => {
+ console.log('BODY: ' + chunk);
+ });
+});
+
+req.on('error', e => {
+ console.log('problem with request: ' + e.message);
+});
+req.end();
+
+setTimeout(() => {
+ console.log('agent status: %j', keepaliveAgent.getCurrentStatus());
+}, 2000);
+```
+
+## [Benchmark](https://github.com/node-modules/agentkeepalive/tree/master/benchmark)
+
+run the benchmark:
+
+```bash
+cd benchmark
+sh start.sh
+```
+
+Intel(R) Core(TM)2 Duo CPU P8600 @ 2.40GHz
+
+node@v0.8.9
+
+50 maxSockets, 60 concurrent, 1000 requests per concurrent, 5ms delay
+
+Keep alive agent (30 seconds):
+
+```js
+Transactions: 60000 hits
+Availability: 100.00 %
+Elapsed time: 29.70 secs
+Data transferred: 14.88 MB
+Response time: 0.03 secs
+Transaction rate: 2020.20 trans/sec
+Throughput: 0.50 MB/sec
+Concurrency: 59.84
+Successful transactions: 60000
+Failed transactions: 0
+Longest transaction: 0.15
+Shortest transaction: 0.01
+```
+
+Normal agent:
+
+```js
+Transactions: 60000 hits
+Availability: 100.00 %
+Elapsed time: 46.53 secs
+Data transferred: 14.88 MB
+Response time: 0.05 secs
+Transaction rate: 1289.49 trans/sec
+Throughput: 0.32 MB/sec
+Concurrency: 59.81
+Successful transactions: 60000
+Failed transactions: 0
+Longest transaction: 0.45
+Shortest transaction: 0.00
+```
+
+Socket created:
+
+```
+[proxy.js:120000] keepalive, 50 created, 60000 requestFinished, 1200 req/socket, 0 requests, 0 sockets, 0 unusedSockets, 50 timeout
+{" <10ms":662," <15ms":17825," <20ms":20552," <30ms":17646," <40ms":2315," <50ms":567," <100ms":377," <150ms":56," <200ms":0," >=200ms+":0}
+----------------------------------------------------------------
+[proxy.js:120000] normal , 53866 created, 84260 requestFinished, 1.56 req/socket, 0 requests, 0 sockets
+{" <10ms":75," <15ms":1112," <20ms":10947," <30ms":32130," <40ms":8228," <50ms":3002," <100ms":4274," <150ms":181," <200ms":18," >=200ms+":33}
+```
+
+## License
+
+```
+(The MIT License)
+
+Copyright(c) node-modules and other contributors.
+Copyright(c) 2012 - 2015 fengmk2
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+'Software'), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+```
diff --git a/deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/agentkeepalive/browser.js b/deps/npm/node_modules/agentkeepalive/browser.js
similarity index 100%
rename from deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/agentkeepalive/browser.js
rename to deps/npm/node_modules/agentkeepalive/browser.js
diff --git a/deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/agentkeepalive/index.js b/deps/npm/node_modules/agentkeepalive/index.js
similarity index 100%
rename from deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/agentkeepalive/index.js
rename to deps/npm/node_modules/agentkeepalive/index.js
diff --git a/deps/npm/node_modules/agentkeepalive/lib/_http_agent.js b/deps/npm/node_modules/agentkeepalive/lib/_http_agent.js
new file mode 100644
index 00000000000000..83f1d115eac84a
--- /dev/null
+++ b/deps/npm/node_modules/agentkeepalive/lib/_http_agent.js
@@ -0,0 +1,416 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+// patch from https://github.com/nodejs/node/blob/v7.2.1/lib/_http_agent.js
+
+'use strict';
+
+const net = require('net');
+const util = require('util');
+const EventEmitter = require('events');
+const debug = util.debuglog('http');
+
+// New Agent code.
+
+// The largest departure from the previous implementation is that
+// an Agent instance holds connections for a variable number of host:ports.
+// Surprisingly, this is still API compatible as far as third parties are
+// concerned. The only code that really notices the difference is the
+// request object.
+
+// Another departure is that all code related to HTTP parsing is in
+// ClientRequest.onSocket(). The Agent is now *strictly*
+// concerned with managing a connection pool.
+
+function Agent(options) {
+ if (!(this instanceof Agent))
+ return new Agent(options);
+
+ EventEmitter.call(this);
+
+ var self = this;
+
+ self.defaultPort = 80;
+ self.protocol = 'http:';
+
+ self.options = util._extend({}, options);
+
+ // don't confuse net and make it think that we're connecting to a pipe
+ self.options.path = null;
+ self.requests = {};
+ self.sockets = {};
+ self.freeSockets = {};
+ self.keepAliveMsecs = self.options.keepAliveMsecs || 1000;
+ self.keepAlive = self.options.keepAlive || false;
+ self.maxSockets = self.options.maxSockets || Agent.defaultMaxSockets;
+ self.maxFreeSockets = self.options.maxFreeSockets || 256;
+
+ // [patch start]
+ // free keep-alive socket timeout. By default free socket do not have a timeout.
+ self.freeSocketKeepAliveTimeout = self.options.freeSocketKeepAliveTimeout || 0;
+ // working socket timeout. By default working socket do not have a timeout.
+ self.timeout = self.options.timeout || 0;
+ // the socket active time to live, even if it's in use
+ this.socketActiveTTL = this.options.socketActiveTTL || null;
+ // [patch end]
+
+ self.on('free', function(socket, options) {
+ var name = self.getName(options);
+ debug('agent.on(free)', name);
+
+ if (socket.writable &&
+ self.requests[name] && self.requests[name].length) {
+ // [patch start]
+ debug('continue handle next request');
+ // [patch end]
+ self.requests[name].shift().onSocket(socket);
+ if (self.requests[name].length === 0) {
+ // don't leak
+ delete self.requests[name];
+ }
+ } else {
+ // If there are no pending requests, then put it in
+ // the freeSockets pool, but only if we're allowed to do so.
+ var req = socket._httpMessage;
+ if (req &&
+ req.shouldKeepAlive &&
+ socket.writable &&
+ self.keepAlive) {
+ var freeSockets = self.freeSockets[name];
+ var freeLen = freeSockets ? freeSockets.length : 0;
+ var count = freeLen;
+ if (self.sockets[name])
+ count += self.sockets[name].length;
+
+ if (count > self.maxSockets || freeLen >= self.maxFreeSockets) {
+ socket.destroy();
+ } else {
+ freeSockets = freeSockets || [];
+ self.freeSockets[name] = freeSockets;
+ socket.setKeepAlive(true, self.keepAliveMsecs);
+ socket.unref();
+ socket._httpMessage = null;
+ self.removeSocket(socket, options);
+ freeSockets.push(socket);
+
+ // [patch start]
+ // Add a default error handler to avoid Unhandled 'error' event throw on idle socket
+ // https://github.com/node-modules/agentkeepalive/issues/25
+ // https://github.com/nodejs/node/pull/4482 (fixed in >= 4.4.0 and >= 5.4.0)
+ if (socket.listeners('error').length === 0) {
+ socket.once('error', freeSocketErrorListener);
+ }
+ // set free keepalive timer
+ // try to use socket custom freeSocketKeepAliveTimeout first
+ const freeSocketKeepAliveTimeout = socket.freeSocketKeepAliveTimeout || self.freeSocketKeepAliveTimeout;
+ socket.setTimeout(freeSocketKeepAliveTimeout);
+ debug(`push to free socket queue and wait for ${freeSocketKeepAliveTimeout}ms`);
+ // [patch end]
+ }
+ } else {
+ socket.destroy();
+ }
+ }
+ });
+}
+
+util.inherits(Agent, EventEmitter);
+exports.Agent = Agent;
+
+// [patch start]
+function freeSocketErrorListener(err) {
+ var socket = this;
+ debug('SOCKET ERROR on FREE socket:', err.message, err.stack);
+ socket.destroy();
+ socket.emit('agentRemove');
+}
+// [patch end]
+
+Agent.defaultMaxSockets = Infinity;
+
+Agent.prototype.createConnection = net.createConnection;
+
+// Get the key for a given set of request options
+Agent.prototype.getName = function getName(options) {
+ var name = options.host || 'localhost';
+
+ name += ':';
+ if (options.port)
+ name += options.port;
+
+ name += ':';
+ if (options.localAddress)
+ name += options.localAddress;
+
+ // Pacify parallel/test-http-agent-getname by only appending
+ // the ':' when options.family is set.
+ if (options.family === 4 || options.family === 6)
+ name += ':' + options.family;
+
+ return name;
+};
+
+// [patch start]
+function handleSocketCreation(req) {
+ return function(err, newSocket) {
+ if (err) {
+ process.nextTick(function() {
+ req.emit('error', err);
+ });
+ return;
+ }
+ req.onSocket(newSocket);
+ }
+}
+// [patch end]
+
+Agent.prototype.addRequest = function addRequest(req, options, port/*legacy*/,
+ localAddress/*legacy*/) {
+ // Legacy API: addRequest(req, host, port, localAddress)
+ if (typeof options === 'string') {
+ options = {
+ host: options,
+ port,
+ localAddress
+ };
+ }
+
+ options = util._extend({}, options);
+ options = util._extend(options, this.options);
+
+ if (!options.servername)
+ options.servername = calculateServerName(options, req);
+
+ var name = this.getName(options);
+ if (!this.sockets[name]) {
+ this.sockets[name] = [];
+ }
+
+ var freeLen = this.freeSockets[name] ? this.freeSockets[name].length : 0;
+ var sockLen = freeLen + this.sockets[name].length;
+
+ if (freeLen) {
+ // we have a free socket, so use that.
+ var socket = this.freeSockets[name].shift();
+ debug('have free socket');
+
+ // [patch start]
+ // remove free socket error event handler
+ socket.removeListener('error', freeSocketErrorListener);
+ // restart the default timer
+ socket.setTimeout(this.timeout);
+
+ if (this.socketActiveTTL && Date.now() - socket.createdTime > this.socketActiveTTL) {
+ debug(`socket ${socket.createdTime} expired`);
+ socket.destroy();
+ return this.createSocket(req, options, handleSocketCreation(req));
+ }
+ // [patch end]
+
+ // don't leak
+ if (!this.freeSockets[name].length)
+ delete this.freeSockets[name];
+
+ socket.ref();
+ req.onSocket(socket);
+ this.sockets[name].push(socket);
+ } else if (sockLen < this.maxSockets) {
+ debug('call onSocket', sockLen, freeLen);
+ // If we are under maxSockets create a new one.
+ // [patch start]
+ this.createSocket(req, options, handleSocketCreation(req));
+ // [patch end]
+ } else {
+ debug('wait for socket');
+ // We are over limit so we'll add it to the queue.
+ if (!this.requests[name]) {
+ this.requests[name] = [];
+ }
+ this.requests[name].push(req);
+ }
+};
+
+Agent.prototype.createSocket = function createSocket(req, options, cb) {
+ var self = this;
+ options = util._extend({}, options);
+ options = util._extend(options, self.options);
+
+ if (!options.servername)
+ options.servername = calculateServerName(options, req);
+
+ var name = self.getName(options);
+ options._agentKey = name;
+
+ debug('createConnection', name, options);
+ options.encoding = null;
+ var called = false;
+ const newSocket = self.createConnection(options, oncreate);
+ // [patch start]
+ if (newSocket) {
+ oncreate(null, Object.assign(newSocket, { createdTime: Date.now() }));
+ }
+ // [patch end]
+ function oncreate(err, s) {
+ if (called)
+ return;
+ called = true;
+ if (err)
+ return cb(err);
+ if (!self.sockets[name]) {
+ self.sockets[name] = [];
+ }
+ self.sockets[name].push(s);
+ debug('sockets', name, self.sockets[name].length);
+
+ function onFree() {
+ self.emit('free', s, options);
+ }
+ s.on('free', onFree);
+
+ function onClose(err) {
+ debug('CLIENT socket onClose');
+ // This is the only place where sockets get removed from the Agent.
+ // If you want to remove a socket from the pool, just close it.
+ // All socket errors end in a close event anyway.
+ self.removeSocket(s, options);
+
+ // [patch start]
+ self.emit('close');
+ // [patch end]
+ }
+ s.on('close', onClose);
+
+ // [patch start]
+ // start socket timeout handler
+ function onTimeout() {
+ debug('CLIENT socket onTimeout');
+ s.destroy();
+ // Remove it from freeSockets immediately to prevent new requests from being sent through this socket.
+ self.removeSocket(s, options);
+ self.emit('timeout');
+ }
+ s.on('timeout', onTimeout);
+ // set the default timer
+ s.setTimeout(self.timeout);
+ // [patch end]
+
+ function onRemove() {
+ // We need this function for cases like HTTP 'upgrade'
+ // (defined by WebSockets) where we need to remove a socket from the
+ // pool because it'll be locked up indefinitely
+ debug('CLIENT socket onRemove');
+ self.removeSocket(s, options);
+ s.removeListener('close', onClose);
+ s.removeListener('free', onFree);
+ s.removeListener('agentRemove', onRemove);
+
+ // [patch start]
+ // remove socket timeout handler
+ s.setTimeout(0, onTimeout);
+ // [patch end]
+ }
+ s.on('agentRemove', onRemove);
+ cb(null, s);
+ }
+};
+
+function calculateServerName(options, req) {
+ let servername = options.host;
+ const hostHeader = req.getHeader('host');
+ if (hostHeader) {
+ // abc => abc
+ // abc:123 => abc
+ // [::1] => ::1
+ // [::1]:123 => ::1
+ if (hostHeader.startsWith('[')) {
+ const index = hostHeader.indexOf(']');
+ if (index === -1) {
+ // Leading '[', but no ']'. Need to do something...
+ servername = hostHeader;
+ } else {
+ servername = hostHeader.substr(1, index - 1);
+ }
+ } else {
+ servername = hostHeader.split(':', 1)[0];
+ }
+ }
+ return servername;
+}
+
+Agent.prototype.removeSocket = function removeSocket(s, options) {
+ var name = this.getName(options);
+ debug('removeSocket', name, 'writable:', s.writable);
+ var sets = [this.sockets];
+
+ // If the socket was destroyed, remove it from the free buffers too.
+ if (!s.writable)
+ sets.push(this.freeSockets);
+
+ for (var sk = 0; sk < sets.length; sk++) {
+ var sockets = sets[sk];
+
+ if (sockets[name]) {
+ var index = sockets[name].indexOf(s);
+ if (index !== -1) {
+ sockets[name].splice(index, 1);
+ // Don't leak
+ if (sockets[name].length === 0)
+ delete sockets[name];
+ }
+ }
+ }
+
+ // [patch start]
+ var freeLen = this.freeSockets[name] ? this.freeSockets[name].length : 0;
+ var sockLen = freeLen + this.sockets[name] ? this.sockets[name].length : 0;
+ // [patch end]
+
+ if (this.requests[name] && this.requests[name].length && sockLen < this.maxSockets) {
+ debug('removeSocket, have a request, make a socket');
+ var req = this.requests[name][0];
+ // If we have pending requests and a socket gets closed make a new one
+ this.createSocket(req, options, function(err, newSocket) {
+ if (err) {
+ process.nextTick(function() {
+ req.emit('error', err);
+ });
+ return;
+ }
+ newSocket.emit('free');
+ });
+ }
+};
+
+Agent.prototype.destroy = function destroy() {
+ var sets = [this.freeSockets, this.sockets];
+ for (var s = 0; s < sets.length; s++) {
+ var set = sets[s];
+ var keys = Object.keys(set);
+ for (var v = 0; v < keys.length; v++) {
+ var setName = set[keys[v]];
+ for (var n = 0; n < setName.length; n++) {
+ setName[n].destroy();
+ }
+ }
+ }
+};
+
+exports.globalAgent = new Agent();
diff --git a/deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/agentkeepalive/lib/agent.js b/deps/npm/node_modules/agentkeepalive/lib/agent.js
similarity index 100%
rename from deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/agentkeepalive/lib/agent.js
rename to deps/npm/node_modules/agentkeepalive/lib/agent.js
diff --git a/deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/agentkeepalive/lib/https_agent.js b/deps/npm/node_modules/agentkeepalive/lib/https_agent.js
similarity index 100%
rename from deps/npm/node_modules/npm-profile/node_modules/make-fetch-happen/node_modules/agentkeepalive/lib/https_agent.js
rename to deps/npm/node_modules/agentkeepalive/lib/https_agent.js
diff --git a/deps/npm/node_modules/agentkeepalive/package.json b/deps/npm/node_modules/agentkeepalive/package.json
new file mode 100644
index 00000000000000..c0ce0576bc1070
--- /dev/null
+++ b/deps/npm/node_modules/agentkeepalive/package.json
@@ -0,0 +1,84 @@
+{
+ "_from": "agentkeepalive@^3.4.1",
+ "_id": "agentkeepalive@3.4.1",
+ "_inBundle": false,
+ "_integrity": "sha512-MPIwsZU9PP9kOrZpyu2042kYA8Fdt/AedQYkYXucHgF9QoD9dXVp0ypuGnHXSR0hTstBxdt85Xkh4JolYfK5wg==",
+ "_location": "/agentkeepalive",
+ "_phantomChildren": {},
+ "_requested": {
+ "type": "range",
+ "registry": true,
+ "raw": "agentkeepalive@^3.4.1",
+ "name": "agentkeepalive",
+ "escapedName": "agentkeepalive",
+ "rawSpec": "^3.4.1",
+ "saveSpec": null,
+ "fetchSpec": "^3.4.1"
+ },
+ "_requiredBy": [
+ "/make-fetch-happen",
+ "/npm-profile/make-fetch-happen",
+ "/npm-registry-fetch/make-fetch-happen"
+ ],
+ "_resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-3.4.1.tgz",
+ "_shasum": "aa95aebc3a749bca5ed53e3880a09f5235b48f0c",
+ "_spec": "agentkeepalive@^3.4.1",
+ "_where": "/Users/rebecca/code/npm/node_modules/make-fetch-happen",
+ "author": {
+ "name": "fengmk2",
+ "email": "fengmk2@gmail.com",
+ "url": "https://fengmk2.com"
+ },
+ "browser": "browser.js",
+ "bugs": {
+ "url": "https://github.com/node-modules/agentkeepalive/issues"
+ },
+ "bundleDependencies": false,
+ "ci": {
+ "version": "4.3.2, 4, 6, 8, 9"
+ },
+ "dependencies": {
+ "humanize-ms": "^1.2.1"
+ },
+ "deprecated": false,
+ "description": "Missing keepalive http.Agent",
+ "devDependencies": {
+ "autod": "^2.8.0",
+ "egg-bin": "^1.10.3",
+ "egg-ci": "^1.7.0",
+ "eslint": "^3.19.0",
+ "eslint-config-egg": "^4.2.0",
+ "pedding": "^1.1.0"
+ },
+ "engines": {
+ "node": ">= 4.0.0"
+ },
+ "files": [
+ "index.js",
+ "browser.js",
+ "lib"
+ ],
+ "homepage": "https://github.com/node-modules/agentkeepalive#readme",
+ "keywords": [
+ "http",
+ "https",
+ "agent",
+ "keepalive",
+ "agentkeepalive"
+ ],
+ "license": "MIT",
+ "main": "index.js",
+ "name": "agentkeepalive",
+ "repository": {
+ "type": "git",
+ "url": "git://github.com/node-modules/agentkeepalive.git"
+ },
+ "scripts": {
+ "autod": "autod",
+ "ci": "npm run lint && npm run cov",
+ "cov": "egg-bin cov",
+ "lint": "eslint lib test index.js",
+ "test": "egg-bin test"
+ },
+ "version": "3.4.1"
+}
diff --git a/deps/npm/node_modules/request/node_modules/har-validator/node_modules/ajv/.tonic_example.js b/deps/npm/node_modules/ajv/.tonic_example.js
similarity index 100%
rename from deps/npm/node_modules/request/node_modules/har-validator/node_modules/ajv/.tonic_example.js
rename to deps/npm/node_modules/ajv/.tonic_example.js
diff --git a/deps/npm/node_modules/request/node_modules/har-validator/node_modules/ajv/LICENSE b/deps/npm/node_modules/ajv/LICENSE
similarity index 100%
rename from deps/npm/node_modules/request/node_modules/har-validator/node_modules/ajv/LICENSE
rename to deps/npm/node_modules/ajv/LICENSE
diff --git a/deps/npm/node_modules/ajv/README.md b/deps/npm/node_modules/ajv/README.md
new file mode 100644
index 00000000000000..63a265f04d9e84
--- /dev/null
+++ b/deps/npm/node_modules/ajv/README.md
@@ -0,0 +1,1327 @@
+
+
+# Ajv: Another JSON Schema Validator
+
+The fastest JSON Schema validator for Node.js and browser with draft 6 support.
+
+
+[![Build Status](https://travis-ci.org/epoberezkin/ajv.svg?branch=master)](https://travis-ci.org/epoberezkin/ajv)
+[![npm version](https://badge.fury.io/js/ajv.svg)](https://www.npmjs.com/package/ajv)
+[![npm@beta](https://img.shields.io/npm/v/ajv/beta.svg)](https://github.com/epoberezkin/ajv/tree/beta)
+[![npm downloads](https://img.shields.io/npm/dm/ajv.svg)](https://www.npmjs.com/package/ajv)
+[![Coverage Status](https://coveralls.io/repos/epoberezkin/ajv/badge.svg?branch=master&service=github)](https://coveralls.io/github/epoberezkin/ajv?branch=master)
+[![Greenkeeper badge](https://badges.greenkeeper.io/epoberezkin/ajv.svg)](https://greenkeeper.io/)
+[![Gitter](https://img.shields.io/gitter/room/ajv-validator/ajv.svg)](https://gitter.im/ajv-validator/ajv)
+
+
+__Please note__: Ajv [version 6](https://github.com/epoberezkin/ajv/tree/beta) with [JSON Schema draft-07](http://json-schema.org/work-in-progress) support is released. Use `npm install ajv@beta` to install.
+
+
+## Using version 5
+
+[JSON Schema draft-06](https://trac.tools.ietf.org/html/draft-wright-json-schema-validation-01) is published.
+
+[Ajv version 5.0.0](https://github.com/epoberezkin/ajv/releases/tag/5.0.0) that supports draft-06 is released. It may require either migrating your schemas or updating your code (to continue using draft-04 and v5 schemas).
+
+__Please note__: To use Ajv with draft-04 schemas you need to explicitly add meta-schema to the validator instance:
+
+```javascript
+ajv.addMetaSchema(require('ajv/lib/refs/json-schema-draft-04.json'));
+```
+
+
+## Contents
+
+- [Performance](#performance)
+- [Features](#features)
+- [Getting started](#getting-started)
+- [Frequently Asked Questions](https://github.com/epoberezkin/ajv/blob/master/FAQ.md)
+- [Using in browser](#using-in-browser)
+- [Command line interface](#command-line-interface)
+- Validation
+ - [Keywords](#validation-keywords)
+ - [Formats](#formats)
+ - [Combining schemas with $ref](#ref)
+ - [$data reference](#data-reference)
+ - NEW: [$merge and $patch keywords](#merge-and-patch-keywords)
+ - [Defining custom keywords](#defining-custom-keywords)
+ - [Asynchronous schema compilation](#asynchronous-schema-compilation)
+ - [Asynchronous validation](#asynchronous-validation)
+- Modifying data during validation
+ - [Filtering data](#filtering-data)
+ - [Assigning defaults](#assigning-defaults)
+ - [Coercing data types](#coercing-data-types)
+- API
+ - [Methods](#api)
+ - [Options](#options)
+ - [Validation errors](#validation-errors)
+- [Related packages](#related-packages)
+- [Packages using Ajv](#some-packages-using-ajv)
+- [Tests, Contributing, History, License](#tests)
+
+
+## Performance
+
+Ajv generates code using [doT templates](https://github.com/olado/doT) to turn JSON schemas into super-fast validation functions that are efficient for v8 optimization.
+
+Currently Ajv is the fastest and the most standard compliant validator according to these benchmarks:
+
+- [json-schema-benchmark](https://github.com/ebdrup/json-schema-benchmark) - 50% faster than the second place
+- [jsck benchmark](https://github.com/pandastrike/jsck#benchmarks) - 20-190% faster
+- [z-schema benchmark](https://rawgit.com/zaggino/z-schema/master/benchmark/results.html)
+- [themis benchmark](https://cdn.rawgit.com/playlyfe/themis/master/benchmark/results.html)
+
+
+Performance of different validators by [json-schema-benchmark](https://github.com/ebdrup/json-schema-benchmark):
+
+[![performance](https://chart.googleapis.com/chart?chxt=x,y&cht=bhs&chco=76A4FB&chls=2.0&chbh=32,4,1&chs=600x416&chxl=-1:|djv|ajv|json-schema-validator-generator|jsen|is-my-json-valid|themis|z-schema|jsck|skeemas|json-schema-library|tv4&chd=t:100,98,72.1,66.8,50.1,15.1,6.1,3.8,1.2,0.7,0.2)](https://github.com/ebdrup/json-schema-benchmark/blob/master/README.md#performance)
+
+
+## Features
+
+- Ajv implements full JSON Schema [draft 6](http://json-schema.org/) and draft 4 standards:
+ - all validation keywords (see [JSON Schema validation keywords](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md))
+ - full support of remote refs (remote schemas have to be added with `addSchema` or compiled to be available)
+ - support of circular references between schemas
+ - correct string lengths for strings with unicode pairs (can be turned off)
+ - [formats](#formats) defined by JSON Schema draft 4 standard and custom formats (can be turned off)
+ - [validates schemas against meta-schema](#api-validateschema)
+- supports [browsers](#using-in-browser) and Node.js 0.10-8.x
+- [asynchronous loading](#asynchronous-schema-compilation) of referenced schemas during compilation
+- "All errors" validation mode with [option allErrors](#options)
+- [error messages with parameters](#validation-errors) describing error reasons to allow creating custom error messages
+- i18n error messages support with [ajv-i18n](https://github.com/epoberezkin/ajv-i18n) package
+- [filtering data](#filtering-data) from additional properties
+- [assigning defaults](#assigning-defaults) to missing properties and items
+- [coercing data](#coercing-data-types) to the types specified in `type` keywords
+- [custom keywords](#defining-custom-keywords)
+- draft-6 keywords `const`, `contains` and `propertyNames`
+- draft-6 boolean schemas (`true`/`false` as a schema to always pass/fail).
+- keywords `switch`, `patternRequired`, `formatMaximum` / `formatMinimum` and `formatExclusiveMaximum` / `formatExclusiveMinimum` from [JSON-schema extension proposals](https://github.com/json-schema/json-schema/wiki/v5-Proposals) with [ajv-keywords](https://github.com/epoberezkin/ajv-keywords) package
+- [$data reference](#data-reference) to use values from the validated data as values for the schema keywords
+- [asynchronous validation](#asynchronous-validation) of custom formats and keywords
+
+Currently Ajv is the only validator that passes all the tests from [JSON Schema Test Suite](https://github.com/json-schema/JSON-Schema-Test-Suite) (according to [json-schema-benchmark](https://github.com/ebdrup/json-schema-benchmark), apart from the test that requires that `1.0` is not an integer that is impossible to satisfy in JavaScript).
+
+
+## Install
+
+```
+npm install ajv
+```
+
+or to install [version 6](https://github.com/epoberezkin/ajv/tree/beta):
+
+```
+npm install ajv@beta
+```
+
+
+## Getting started
+
+Try it in the Node.js REPL: https://tonicdev.com/npm/ajv
+
+
+The fastest validation call:
+
+```javascript
+var Ajv = require('ajv');
+var ajv = new Ajv(); // options can be passed, e.g. {allErrors: true}
+var validate = ajv.compile(schema);
+var valid = validate(data);
+if (!valid) console.log(validate.errors);
+```
+
+or with less code
+
+```javascript
+// ...
+var valid = ajv.validate(schema, data);
+if (!valid) console.log(ajv.errors);
+// ...
+```
+
+or
+
+```javascript
+// ...
+var valid = ajv.addSchema(schema, 'mySchema')
+ .validate('mySchema', data);
+if (!valid) console.log(ajv.errorsText());
+// ...
+```
+
+See [API](#api) and [Options](#options) for more details.
+
+Ajv compiles schemas to functions and caches them in all cases (using schema serialized with [fast-json-stable-stringify](https://github.com/epoberezkin/fast-json-stable-stringify) or a custom function as a key), so that the next time the same schema is used (not necessarily the same object instance) it won't be compiled again.
+
+The best performance is achieved when using compiled functions returned by `compile` or `getSchema` methods (there is no additional function call).
+
+__Please note__: every time a validation function or `ajv.validate` are called `errors` property is overwritten. You need to copy `errors` array reference to another variable if you want to use it later (e.g., in the callback). See [Validation errors](#validation-errors)
+
+
+## Using in browser
+
+You can require Ajv directly from the code you browserify - in this case Ajv will be a part of your bundle.
+
+If you need to use Ajv in several bundles you can create a separate UMD bundle using `npm run bundle` script (thanks to [siddo420](https://github.com/siddo420)).
+
+Then you need to load Ajv in the browser:
+```html
+
+```
+
+This bundle can be used with different module systems; it creates global `Ajv` if no module system is found.
+
+The browser bundle is available on [cdnjs](https://cdnjs.com/libraries/ajv).
+
+Ajv is tested with these browsers:
+
+[![Sauce Test Status](https://saucelabs.com/browser-matrix/epoberezkin.svg)](https://saucelabs.com/u/epoberezkin)
+
+__Please note__: some frameworks, e.g. Dojo, may redefine global require in such way that is not compatible with CommonJS module format. In such case Ajv bundle has to be loaded before the framework and then you can use global Ajv (see issue [#234](https://github.com/epoberezkin/ajv/issues/234)).
+
+
+## Command line interface
+
+CLI is available as a separate npm package [ajv-cli](https://github.com/jessedc/ajv-cli). It supports:
+
+- compiling JSON-schemas to test their validity
+- BETA: generating standalone module exporting a validation function to be used without Ajv (using [ajv-pack](https://github.com/epoberezkin/ajv-pack))
+- migrate schemas to draft-06 (using [json-schema-migrate](https://github.com/epoberezkin/json-schema-migrate))
+- validating data file(s) against JSON-schema
+- testing expected validity of data against JSON-schema
+- referenced schemas
+- custom meta-schemas
+- files in JSON and JavaScript format
+- all Ajv options
+- reporting changes in data after validation in [JSON-patch](https://tools.ietf.org/html/rfc6902) format
+
+
+## Validation keywords
+
+Ajv supports all validation keywords from draft 4 of JSON-schema standard:
+
+- [type](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#type)
+- [for numbers](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#keywords-for-numbers) - maximum, minimum, exclusiveMaximum, exclusiveMinimum, multipleOf
+- [for strings](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#keywords-for-strings) - maxLength, minLength, pattern, format
+- [for arrays](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#keywords-for-arrays) - maxItems, minItems, uniqueItems, items, additionalItems, [contains](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#contains)
+- [for objects](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#keywords-for-objects) - maxProperties, minProperties, required, properties, patternProperties, additionalProperties, dependencies, [propertyNames](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#propertynames)
+- [for all types](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#keywords-for-all-types) - enum, [const](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#const)
+- [compound keywords](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#compound-keywords) - not, oneOf, anyOf, allOf
+
+With [ajv-keywords](https://github.com/epoberezkin/ajv-keywords) package Ajv also supports validation keywords from [JSON Schema extension proposals](https://github.com/json-schema/json-schema/wiki/v5-Proposals) for JSON-schema standard:
+
+- [switch](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#switch-proposed) - conditional validation with a sequence of if/then clauses
+- [patternRequired](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#patternrequired-proposed) - like `required` but with patterns that some property should match.
+- [formatMaximum, formatMinimum, formatExclusiveMaximum, formatExclusiveMinimum](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md#formatmaximum--formatminimum-and-exclusiveformatmaximum--exclusiveformatminimum-proposed) - setting limits for date, time, etc.
+
+See [JSON Schema validation keywords](https://github.com/epoberezkin/ajv/blob/master/KEYWORDS.md) for more details.
+
+
+## Formats
+
+The following formats are supported for string validation with "format" keyword:
+
+- _date_: full-date according to [RFC3339](http://tools.ietf.org/html/rfc3339#section-5.6).
+- _time_: time with optional time-zone.
+- _date-time_: date-time from the same source (time-zone is mandatory). `date`, `time` and `date-time` validate ranges in `full` mode and only regexp in `fast` mode (see [options](#options)).
+- _uri_: full uri with optional protocol.
+- _url_: [URL record](https://url.spec.whatwg.org/#concept-url).
+- _uri-template_: URI template according to [RFC6570](https://tools.ietf.org/html/rfc6570)
+- _email_: email address.
+- _hostname_: host name according to [RFC1034](http://tools.ietf.org/html/rfc1034#section-3.5).
+- _ipv4_: IP address v4.
+- _ipv6_: IP address v6.
+- _regex_: tests whether a string is a valid regular expression by passing it to RegExp constructor.
+- _uuid_: Universally Unique IDentifier according to [RFC4122](http://tools.ietf.org/html/rfc4122).
+- _json-pointer_: JSON-pointer according to [RFC6901](https://tools.ietf.org/html/rfc6901).
+- _relative-json-pointer_: relative JSON-pointer according to [this draft](http://tools.ietf.org/html/draft-luff-relative-json-pointer-00).
+
+There are two modes of format validation: `fast` and `full`. This mode affects formats `date`, `time`, `date-time`, `uri`, `email`, and `hostname`. See [Options](#options) for details.
+
+You can add additional formats and replace any of the formats above using [addFormat](#api-addformat) method.
+
+The option `unknownFormats` allows changing the default behaviour when an unknown format is encountered. In this case Ajv can either fail schema compilation (default) or ignore it (default in versions before 5.0.0). You also can whitelist specific format(s) to be ignored. See [Options](#options) for details.
+
+You can find patterns used for format validation and the sources that were used in [formats.js](https://github.com/epoberezkin/ajv/blob/master/lib/compile/formats.js).
+
+
+## Combining schemas with $ref
+
+You can structure your validation logic across multiple schema files and have schemas reference each other using `$ref` keyword.
+
+Example:
+
+```javascript
+var schema = {
+ "$id": "http://example.com/schemas/schema.json",
+ "type": "object",
+ "properties": {
+ "foo": { "$ref": "defs.json#/definitions/int" },
+ "bar": { "$ref": "defs.json#/definitions/str" }
+ }
+};
+
+var defsSchema = {
+ "$id": "http://example.com/schemas/defs.json",
+ "definitions": {
+ "int": { "type": "integer" },
+ "str": { "type": "string" }
+ }
+};
+```
+
+Now to compile your schema you can either pass all schemas to Ajv instance:
+
+```javascript
+var ajv = new Ajv({schemas: [schema, defsSchema]});
+var validate = ajv.getSchema('http://example.com/schemas/schema.json');
+```
+
+or use `addSchema` method:
+
+```javascript
+var ajv = new Ajv;
+var validate = ajv.addSchema(defsSchema)
+ .compile(schema);
+```
+
+See [Options](#options) and [addSchema](#api) method.
+
+__Please note__:
+- `$ref` is resolved as the uri-reference using schema $id as the base URI (see the example).
+- References can be recursive (and mutually recursive) to implement the schemas for different data structures (such as linked lists, trees, graphs, etc.).
+- You don't have to host your schema files at the URIs that you use as schema $id. These URIs are only used to identify the schemas, and according to JSON Schema specification validators should not expect to be able to download the schemas from these URIs.
+- The actual location of the schema file in the file system is not used.
+- You can pass the identifier of the schema as the second parameter of `addSchema` method or as a property name in `schemas` option. This identifier can be used instead of (or in addition to) schema $id.
+- You cannot have the same $id (or the schema identifier) used for more than one schema - the exception will be thrown.
+- You can implement dynamic resolution of the referenced schemas using `compileAsync` method. In this way you can store schemas in any system (files, web, database, etc.) and reference them without explicitly adding to Ajv instance. See [Asynchronous schema compilation](#asynchronous-schema-compilation).
+
+
+## $data reference
+
+With `$data` option you can use values from the validated data as the values for the schema keywords. See [proposal](https://github.com/json-schema/json-schema/wiki/$data-(v5-proposal)) for more information about how it works.
+
+`$data` reference is supported in the keywords: const, enum, format, maximum/minimum, exclusiveMaximum / exclusiveMinimum, maxLength / minLength, maxItems / minItems, maxProperties / minProperties, formatMaximum / formatMinimum, formatExclusiveMaximum / formatExclusiveMinimum, multipleOf, pattern, required, uniqueItems.
+
+The value of "$data" should be a [JSON-pointer](https://tools.ietf.org/html/rfc6901) to the data (the root is always the top level data object, even if the $data reference is inside a referenced subschema) or a [relative JSON-pointer](http://tools.ietf.org/html/draft-luff-relative-json-pointer-00) (it is relative to the current point in data; if the $data reference is inside a referenced subschema it cannot point to the data outside of the root level for this subschema).
+
+Examples.
+
+This schema requires that the value in property `smaller` is less or equal than the value in the property larger:
+
+```javascript
+var ajv = new Ajv({$data: true});
+
+var schema = {
+ "properties": {
+ "smaller": {
+ "type": "number",
+ "maximum": { "$data": "1/larger" }
+ },
+ "larger": { "type": "number" }
+ }
+};
+
+var validData = {
+ smaller: 5,
+ larger: 7
+};
+
+ajv.validate(schema, validData); // true
+```
+
+This schema requires that the properties have the same format as their field names:
+
+```javascript
+var schema = {
+ "additionalProperties": {
+ "type": "string",
+ "format": { "$data": "0#" }
+ }
+};
+
+var validData = {
+ 'date-time': '1963-06-19T08:30:06.283185Z',
+ email: 'joe.bloggs@example.com'
+}
+```
+
+`$data` reference is resolved safely - it won't throw even if some property is undefined. If `$data` resolves to `undefined` the validation succeeds (with the exclusion of `const` keyword). If `$data` resolves to incorrect type (e.g. not "number" for maximum keyword) the validation fails.
+
+
+## $merge and $patch keywords
+
+With the package [ajv-merge-patch](https://github.com/epoberezkin/ajv-merge-patch) you can use the keywords `$merge` and `$patch` that allow extending JSON-schemas with patches using formats [JSON Merge Patch (RFC 7396)](https://tools.ietf.org/html/rfc7396) and [JSON Patch (RFC 6902)](https://tools.ietf.org/html/rfc6902).
+
+To add keywords `$merge` and `$patch` to Ajv instance use this code:
+
+```javascript
+require('ajv-merge-patch')(ajv);
+```
+
+Examples.
+
+Using `$merge`:
+
+```json
+{
+ "$merge": {
+ "source": {
+ "type": "object",
+ "properties": { "p": { "type": "string" } },
+ "additionalProperties": false
+ },
+ "with": {
+ "properties": { "q": { "type": "number" } }
+ }
+ }
+}
+```
+
+Using `$patch`:
+
+```json
+{
+ "$patch": {
+ "source": {
+ "type": "object",
+ "properties": { "p": { "type": "string" } },
+ "additionalProperties": false
+ },
+ "with": [
+ { "op": "add", "path": "/properties/q", "value": { "type": "number" } }
+ ]
+ }
+}
+```
+
+The schemas above are equivalent to this schema:
+
+```json
+{
+ "type": "object",
+ "properties": {
+ "p": { "type": "string" },
+ "q": { "type": "number" }
+ },
+ "additionalProperties": false
+}
+```
+
+The properties `source` and `with` in the keywords `$merge` and `$patch` can use absolute or relative `$ref` to point to other schemas previously added to the Ajv instance or to the fragments of the current schema.
+
+See the package [ajv-merge-patch](https://github.com/epoberezkin/ajv-merge-patch) for more information.
+
+
+## Defining custom keywords
+
+The advantages of using custom keywords are:
+
+- allow creating validation scenarios that cannot be expressed using JSON Schema
+- simplify your schemas
+- help bringing a bigger part of the validation logic to your schemas
+- make your schemas more expressive, less verbose and closer to your application domain
+- implement custom data processors that modify your data (`modifying` option MUST be used in keyword definition) and/or create side effects while the data is being validated
+
+If a keyword is used only for side-effects and its validation result is pre-defined, use option `valid: true/false` in keyword definition to simplify both generated code (no error handling in case of `valid: true`) and your keyword functions (no need to return any validation result).
+
+The concerns you have to be aware of when extending JSON-schema standard with custom keywords are the portability and understanding of your schemas. You will have to support these custom keywords on other platforms and to properly document these keywords so that everybody can understand them in your schemas.
+
+You can define custom keywords with [addKeyword](#api-addkeyword) method. Keywords are defined on the `ajv` instance level - new instances will not have previously defined keywords.
+
+Ajv allows defining keywords with:
+- validation function
+- compilation function
+- macro function
+- inline compilation function that should return code (as string) that will be inlined in the currently compiled schema.
+
+Example. `range` and `exclusiveRange` keywords using compiled schema:
+
+```javascript
+ajv.addKeyword('range', {
+ type: 'number',
+ compile: function (sch, parentSchema) {
+ var min = sch[0];
+ var max = sch[1];
+
+ return parentSchema.exclusiveRange === true
+ ? function (data) { return data > min && data < max; }
+ : function (data) { return data >= min && data <= max; }
+ }
+});
+
+var schema = { "range": [2, 4], "exclusiveRange": true };
+var validate = ajv.compile(schema);
+console.log(validate(2.01)); // true
+console.log(validate(3.99)); // true
+console.log(validate(2)); // false
+console.log(validate(4)); // false
+```
+
+Several custom keywords (typeof, instanceof, range and propertyNames) are defined in [ajv-keywords](https://github.com/epoberezkin/ajv-keywords) package - they can be used for your schemas and as a starting point for your own custom keywords.
+
+See [Defining custom keywords](https://github.com/epoberezkin/ajv/blob/master/CUSTOM.md) for more details.
+
+
+## Asynchronous schema compilation
+
+During asynchronous compilation remote references are loaded using supplied function. See `compileAsync` [method](#api-compileAsync) and `loadSchema` [option](#options).
+
+Example:
+
+```javascript
+var ajv = new Ajv({ loadSchema: loadSchema });
+
+ajv.compileAsync(schema).then(function (validate) {
+ var valid = validate(data);
+ // ...
+});
+
+function loadSchema(uri) {
+ return request.json(uri).then(function (res) {
+ if (res.statusCode >= 400)
+ throw new Error('Loading error: ' + res.statusCode);
+ return res.body;
+ });
+}
+```
+
+__Please note__: [Option](#options) `missingRefs` should NOT be set to `"ignore"` or `"fail"` for asynchronous compilation to work.
+
+
+## Asynchronous validation
+
+Example in Node.js REPL: https://tonicdev.com/esp/ajv-asynchronous-validation
+
+You can define custom formats and keywords that perform validation asynchronously by accessing database or some other service. You should add `async: true` in the keyword or format definition (see [addFormat](#api-addformat), [addKeyword](#api-addkeyword) and [Defining custom keywords](#defining-custom-keywords)).
+
+If your schema uses asynchronous formats/keywords or refers to some schema that contains them it should have `"$async": true` keyword so that Ajv can compile it correctly. If asynchronous format/keyword or reference to asynchronous schema is used in the schema without `$async` keyword Ajv will throw an exception during schema compilation.
+
+__Please note__: all asynchronous subschemas that are referenced from the current or other schemas should have `"$async": true` keyword as well, otherwise the schema compilation will fail.
+
+Validation function for an asynchronous custom format/keyword should return a promise that resolves with `true` or `false` (or rejects with `new Ajv.ValidationError(errors)` if you want to return custom errors from the keyword function). Ajv compiles asynchronous schemas to either [es7 async functions](http://tc39.github.io/ecmascript-asyncawait/) that can optionally be transpiled with [nodent](https://github.com/MatAtBread/nodent) or with [regenerator](https://github.com/facebook/regenerator) or to [generator functions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/function*) that can be optionally transpiled with regenerator as well. You can also supply any other transpiler as a function. See [Options](#options).
+
+The compiled validation function has `$async: true` property (if the schema is asynchronous), so you can differentiate these functions if you are using both synchronous and asynchronous schemas.
+
+If you are using generators, the compiled validation function can be either wrapped with [co](https://github.com/tj/co) (default) or returned as generator function, that can be used directly, e.g. in [koa](http://koajs.com/) 1.0. `co` is a small library, it is included in Ajv (both as npm dependency and in the browser bundle).
+
+Async functions are currently supported in Chrome 55, Firefox 52, Node.js 7 (with --harmony-async-await) and MS Edge 13 (with flag).
+
+Generator functions are currently supported in Chrome, Firefox and Node.js.
+
+If you are using Ajv in other browsers or in older versions of Node.js you should use one of available transpiling options. All provided async modes use global Promise class. If your platform does not have Promise you should use a polyfill that defines it.
+
+Validation result will be a promise that resolves with validated data or rejects with an exception `Ajv.ValidationError` that contains the array of validation errors in `errors` property.
+
+
+Example:
+
+```javascript
+/**
+ * Default mode is non-transpiled generator function wrapped with `co`.
+ * Using package ajv-async (https://github.com/epoberezkin/ajv-async)
+ * you can auto-detect the best async mode.
+ * In this case, without "async" and "transpile" options
+ * (or with option {async: true})
+ * Ajv will choose the first supported/installed option in this order:
+ * 1. native async function
+ * 2. native generator function wrapped with co
+ * 3. es7 async functions transpiled with nodent
+ * 4. es7 async functions transpiled with regenerator
+ */
+
+var setupAsync = require('ajv-async');
+var ajv = setupAsync(new Ajv);
+
+ajv.addKeyword('idExists', {
+ async: true,
+ type: 'number',
+ validate: checkIdExists
+});
+
+
+function checkIdExists(schema, data) {
+ return knex(schema.table)
+ .select('id')
+ .where('id', data)
+ .then(function (rows) {
+ return !!rows.length; // true if record is found
+ });
+}
+
+var schema = {
+ "$async": true,
+ "properties": {
+ "userId": {
+ "type": "integer",
+ "idExists": { "table": "users" }
+ },
+ "postId": {
+ "type": "integer",
+ "idExists": { "table": "posts" }
+ }
+ }
+};
+
+var validate = ajv.compile(schema);
+
+validate({ userId: 1, postId: 19 })
+.then(function (data) {
+ console.log('Data is valid', data); // { userId: 1, postId: 19 }
+})
+.catch(function (err) {
+ if (!(err instanceof Ajv.ValidationError)) throw err;
+ // data is invalid
+ console.log('Validation errors:', err.errors);
+});
+```
+
+### Using transpilers with asynchronous validation functions.
+
+To use a transpiler you should separately install it (or load its bundle in the browser).
+
+Ajv npm package includes minified browser bundles of regenerator and nodent in dist folder.
+
+
+#### Using nodent
+
+```javascript
+var setupAsync = require('ajv-async');
+var ajv = new Ajv({ /* async: 'es7', */ transpile: 'nodent' });
+setupAsync(ajv);
+var validate = ajv.compile(schema); // transpiled es7 async function
+validate(data).then(successFunc).catch(errorFunc);
+```
+
+`npm install nodent` or use `nodent.min.js` from dist folder of npm package.
+
+
+#### Using regenerator
+
+```javascript
+var setupAsync = require('ajv-async');
+var ajv = new Ajv({ /* async: 'es7', */ transpile: 'regenerator' });
+setupAsync(ajv);
+var validate = ajv.compile(schema); // transpiled es7 async function
+validate(data).then(successFunc).catch(errorFunc);
+```
+
+`npm install regenerator` or use `regenerator.min.js` from dist folder of npm package.
+
+
+#### Using other transpilers
+
+```javascript
+var ajv = new Ajv({ async: 'es7', processCode: transpileFunc });
+var validate = ajv.compile(schema); // transpiled es7 async function
+validate(data).then(successFunc).catch(errorFunc);
+```
+
+See [Options](#options).
+
+
+#### Comparison of async modes
+
+|mode|transpile
speed*|run-time
speed*|bundle
size|
+|---|:-:|:-:|:-:|
+|es7 async
(native)|-|0.75|-|
+|generators
(native)|-|1.0|-|
+|es7.nodent|1.35|1.1|215Kb|
+|es7.regenerator|1.0|2.7|1109Kb|
+|regenerator|1.0|3.2|1109Kb|
+
+\* Relative performance in Node.js 7.x — smaller is better.
+
+[nodent](https://github.com/MatAtBread/nodent) has several advantages:
+
+- much smaller browser bundle than regenerator
+- almost the same performance of generated code as native generators in Node.js and the latest Chrome
+- much better performance than native generators in other browsers
+- works in IE 9 (regenerator does not)
+
+
+## Filtering data
+
+With [option `removeAdditional`](#options) (added by [andyscott](https://github.com/andyscott)) you can filter data during the validation.
+
+This option modifies original data.
+
+Example:
+
+```javascript
+var ajv = new Ajv({ removeAdditional: true });
+var schema = {
+ "additionalProperties": false,
+ "properties": {
+ "foo": { "type": "number" },
+ "bar": {
+ "additionalProperties": { "type": "number" },
+ "properties": {
+ "baz": { "type": "string" }
+ }
+ }
+ }
+}
+
+var data = {
+ "foo": 0,
+ "additional1": 1, // will be removed; `additionalProperties` == false
+ "bar": {
+ "baz": "abc",
+ "additional2": 2 // will NOT be removed; `additionalProperties` != false
+ },
+}
+
+var validate = ajv.compile(schema);
+
+console.log(validate(data)); // true
+console.log(data); // { "foo": 0, "bar": { "baz": "abc", "additional2": 2 }
+```
+
+If `removeAdditional` option in the example above were `"all"` then both `additional1` and `additional2` properties would have been removed.
+
+If the option were `"failing"` then property `additional1` would have been removed regardless of its value and property `additional2` would have been removed only if its value were failing the schema in the inner `additionalProperties` (so in the example above it would have stayed because it passes the schema, but any non-number would have been removed).
+
+__Please note__: If you use `removeAdditional` option with `additionalProperties` keyword inside `anyOf`/`oneOf` keywords your validation can fail with this schema, for example:
+
+```json
+{
+ "type": "object",
+ "oneOf": [
+ {
+ "properties": {
+ "foo": { "type": "string" }
+ },
+ "required": [ "foo" ],
+ "additionalProperties": false
+ },
+ {
+ "properties": {
+ "bar": { "type": "integer" }
+ },
+ "required": [ "bar" ],
+ "additionalProperties": false
+ }
+ ]
+}
+```
+
+The intention of the schema above is to allow objects with either the string property "foo" or the integer property "bar", but not with both and not with any other properties.
+
+With the option `removeAdditional: true` the validation will pass for the object `{ "foo": "abc"}` but will fail for the object `{"bar": 1}`. It happens because while the first subschema in `oneOf` is validated, the property `bar` is removed because it is an additional property according to the standard (because it is not included in `properties` keyword in the same schema).
+
+While this behaviour is unexpected (issues [#129](https://github.com/epoberezkin/ajv/issues/129), [#134](https://github.com/epoberezkin/ajv/issues/134)), it is correct. To have the expected behaviour (both objects are allowed and additional properties are removed) the schema has to be refactored in this way:
+
+```json
+{
+ "type": "object",
+ "properties": {
+ "foo": { "type": "string" },
+ "bar": { "type": "integer" }
+ },
+ "additionalProperties": false,
+ "oneOf": [
+ { "required": [ "foo" ] },
+ { "required": [ "bar" ] }
+ ]
+}
+```
+
+The schema above is also more efficient - it will compile into a faster function.
+
+
+## Assigning defaults
+
+With [option `useDefaults`](#options) Ajv will assign values from `default` keyword in the schemas of `properties` and `items` (when it is the array of schemas) to the missing properties and items.
+
+This option modifies original data.
+
+__Please note__: by default the default value is inserted in the generated validation code as a literal (starting from v4.0), so the value inserted in the data will be the deep clone of the default in the schema.
+
+If you need to insert the default value in the data by reference pass the option `useDefaults: "shared"`.
+
+Inserting defaults by reference can be faster (in case you have an object in `default`) and it allows to have dynamic values in defaults, e.g. timestamp, without recompiling the schema. The side effect is that modifying the default value in any validated data instance will change the default in the schema and in other validated data instances. See example 3 below.
+
+
+Example 1 (`default` in `properties`):
+
+```javascript
+var ajv = new Ajv({ useDefaults: true });
+var schema = {
+ "type": "object",
+ "properties": {
+ "foo": { "type": "number" },
+ "bar": { "type": "string", "default": "baz" }
+ },
+ "required": [ "foo", "bar" ]
+};
+
+var data = { "foo": 1 };
+
+var validate = ajv.compile(schema);
+
+console.log(validate(data)); // true
+console.log(data); // { "foo": 1, "bar": "baz" }
+```
+
+Example 2 (`default` in `items`):
+
+```javascript
+var schema = {
+ "type": "array",
+ "items": [
+ { "type": "number" },
+ { "type": "string", "default": "foo" }
+ ]
+}
+
+var data = [ 1 ];
+
+var validate = ajv.compile(schema);
+
+console.log(validate(data)); // true
+console.log(data); // [ 1, "foo" ]
+```
+
+Example 3 (inserting "defaults" by reference):
+
+```javascript
+var ajv = new Ajv({ useDefaults: 'shared' });
+
+var schema = {
+ properties: {
+ foo: {
+ default: { bar: 1 }
+ }
+ }
+}
+
+var validate = ajv.compile(schema);
+
+var data = {};
+console.log(validate(data)); // true
+console.log(data); // { foo: { bar: 1 } }
+
+data.foo.bar = 2;
+
+var data2 = {};
+console.log(validate(data2)); // true
+console.log(data2); // { foo: { bar: 2 } }
+```
+
+`default` keywords in other cases are ignored:
+
+- not in `properties` or `items` subschemas
+- in schemas inside `anyOf`, `oneOf` and `not` (see [#42](https://github.com/epoberezkin/ajv/issues/42))
+- in `if` subschema of `switch` keyword
+- in schemas generated by custom macro keywords
+
+
+## Coercing data types
+
+When you are validating user inputs all your data properties are usually strings. The option `coerceTypes` allows you to have your data types coerced to the types specified in your schema `type` keywords, both to pass the validation and to use the correctly typed data afterwards.
+
+This option modifies original data.
+
+__Please note__: if you pass a scalar value to the validating function its type will be coerced and it will pass the validation, but the value of the variable you pass won't be updated because scalars are passed by value.
+
+
+Example 1:
+
+```javascript
+var ajv = new Ajv({ coerceTypes: true });
+var schema = {
+ "type": "object",
+ "properties": {
+ "foo": { "type": "number" },
+ "bar": { "type": "boolean" }
+ },
+ "required": [ "foo", "bar" ]
+};
+
+var data = { "foo": "1", "bar": "false" };
+
+var validate = ajv.compile(schema);
+
+console.log(validate(data)); // true
+console.log(data); // { "foo": 1, "bar": false }
+```
+
+Example 2 (array coercions):
+
+```javascript
+var ajv = new Ajv({ coerceTypes: 'array' });
+var schema = {
+ "properties": {
+ "foo": { "type": "array", "items": { "type": "number" } },
+ "bar": { "type": "boolean" }
+ }
+};
+
+var data = { "foo": "1", "bar": ["false"] };
+
+var validate = ajv.compile(schema);
+
+console.log(validate(data)); // true
+console.log(data); // { "foo": [1], "bar": false }
+```
+
+The coercion rules, as you can see from the example, are different from JavaScript both to validate user input as expected and to have the coercion reversible (to correctly validate cases where different types are defined in subschemas of "anyOf" and other compound keywords).
+
+See [Coercion rules](https://github.com/epoberezkin/ajv/blob/master/COERCION.md) for details.
+
+
+## API
+
+##### new Ajv(Object options) -> Object
+
+Create Ajv instance.
+
+
+##### .compile(Object schema) -> Function<Object data>
+
+Generate validating function and cache the compiled schema for future use.
+
+Validating function returns boolean and has properties `errors` with the errors from the last validation (`null` if there were no errors) and `schema` with the reference to the original schema.
+
+Unless the option `validateSchema` is false, the schema will be validated against meta-schema and if schema is invalid the error will be thrown. See [options](#options).
+
+
+##### .compileAsync(Object schema [, Boolean meta] [, Function callback]) -> Promise
+
+Asynchronous version of `compile` method that loads missing remote schemas using asynchronous function in `options.loadSchema`. This function returns a Promise that resolves to a validation function. An optional callback passed to `compileAsync` will be called with 2 parameters: error (or null) and validating function. The returned promise will reject (and the callback will be called with an error) when:
+
+- missing schema can't be loaded (`loadSchema` returns a Promise that rejects).
+- a schema containing a missing reference is loaded, but the reference cannot be resolved.
+- schema (or some loaded/referenced schema) is invalid.
+
+The function compiles schema and loads the first missing schema (or meta-schema) until all missing schemas are loaded.
+
+You can asynchronously compile meta-schema by passing `true` as the second parameter.
+
+See example in [Asynchronous compilation](#asynchronous-schema-compilation).
+
+
+##### .validate(Object schema|String key|String ref, data) -> Boolean
+
+Validate data using passed schema (it will be compiled and cached).
+
+Instead of the schema you can use the key that was previously passed to `addSchema`, the schema id if it was present in the schema or any previously resolved reference.
+
+Validation errors will be available in the `errors` property of Ajv instance (`null` if there were no errors).
+
+__Please note__: every time this method is called the errors are overwritten so you need to copy them to another variable if you want to use them later.
+
+If the schema is asynchronous (has `$async` keyword on the top level) this method returns a Promise. See [Asynchronous validation](#asynchronous-validation).
+
+
+##### .addSchema(Array<Object>|Object schema [, String key]) -> Ajv
+
+Add schema(s) to validator instance. This method does not compile schemas (but it still validates them). Because of that dependencies can be added in any order and circular dependencies are supported. It also prevents unnecessary compilation of schemas that are containers for other schemas but not used as a whole.
+
+Array of schemas can be passed (schemas should have ids), the second parameter will be ignored.
+
+Key can be passed that can be used to reference the schema and will be used as the schema id if there is no id inside the schema. If the key is not passed, the schema id will be used as the key.
+
+
+Once the schema is added, it (and all the references inside it) can be referenced in other schemas and used to validate data.
+
+Although `addSchema` does not compile schemas, explicit compilation is not required - the schema will be compiled when it is used first time.
+
+By default the schema is validated against meta-schema before it is added, and if the schema does not pass validation the exception is thrown. This behaviour is controlled by `validateSchema` option.
+
+__Please note__: Ajv uses the [method chaining syntax](https://en.wikipedia.org/wiki/Method_chaining) for all methods with the prefix `add*` and `remove*`.
+This allows you to do nice things like the following.
+
+```javascript
+var validate = new Ajv().addSchema(schema).addFormat(name, regex).getSchema(uri);
+```
+
+##### .addMetaSchema(Array<Object>|Object schema [, String key]) -> Ajv
+
+Adds meta schema(s) that can be used to validate other schemas. That function should be used instead of `addSchema` because there may be instance options that would compile a meta schema incorrectly (at the moment it is `removeAdditional` option).
+
+There is no need to explicitly add draft 6 meta schema (http://json-schema.org/draft-06/schema and http://json-schema.org/schema) - it is added by default, unless option `meta` is set to `false`. You only need to use it if you have a changed meta-schema that you want to use to validate your schemas. See `validateSchema`.
+
+
+##### .validateSchema(Object schema) -> Boolean
+
+Validates schema. This method should be used to validate schemas rather than `validate` due to the inconsistency of `uri` format in JSON Schema standard.
+
+By default this method is called automatically when the schema is added, so you rarely need to use it directly.
+
+If schema doesn't have `$schema` property, it is validated against draft 6 meta-schema (option `meta` should not be false).
+
+If schema has `$schema` property, then the schema with this id (that should be previously added) is used to validate passed schema.
+
+Errors will be available at `ajv.errors`.
+
+
+##### .getSchema(String key) -> Function<Object data>
+
+Retrieve compiled schema previously added with `addSchema` by the key passed to `addSchema` or by its full reference (id). The returned validating function has `schema` property with the reference to the original schema.
+
+
+##### .removeSchema([Object schema|String key|String ref|RegExp pattern]) -> Ajv
+
+Remove added/cached schema. Even if schema is referenced by other schemas it can be safely removed as dependent schemas have local references.
+
+Schema can be removed using:
+- key passed to `addSchema`
+- it's full reference (id)
+- RegExp that should match schema id or key (meta-schemas won't be removed)
+- actual schema object that will be stable-stringified to remove schema from cache
+
+If no parameter is passed all schemas but meta-schemas will be removed and the cache will be cleared.
+
+
+##### .addFormat(String name, String|RegExp|Function|Object format) -> Ajv
+
+Add custom format to validate strings or numbers. It can also be used to replace pre-defined formats for Ajv instance.
+
+Strings are converted to RegExp.
+
+Function should return validation result as `true` or `false`.
+
+If object is passed it should have properties `validate`, `compare` and `async`:
+
+- _validate_: a string, RegExp or a function as described above.
+- _compare_: an optional comparison function that accepts two strings and compares them according to the format meaning. This function is used with keywords `formatMaximum`/`formatMinimum` (defined in [ajv-keywords](https://github.com/epoberezkin/ajv-keywords) package). It should return `1` if the first value is bigger than the second value, `-1` if it is smaller and `0` if it is equal.
+- _async_: an optional `true` value if `validate` is an asynchronous function; in this case it should return a promise that resolves with a value `true` or `false`.
+- _type_: an optional type of data that the format applies to. It can be `"string"` (default) or `"number"` (see https://github.com/epoberezkin/ajv/issues/291#issuecomment-259923858). If the type of data is different, the validation will pass.
+
+Custom formats can be also added via `formats` option.
+
+
+##### .addKeyword(String keyword, Object definition) -> Ajv
+
+Add custom validation keyword to Ajv instance.
+
+Keyword should be different from all standard JSON schema keywords and different from previously defined keywords. There is no way to redefine keywords or to remove keyword definition from the instance.
+
+Keyword must start with a letter, `_` or `$`, and may continue with letters, numbers, `_`, `$`, or `-`.
+It is recommended to use an application-specific prefix for keywords to avoid current and future name collisions.
+
+Example Keywords:
+- `"xyz-example"`: valid, and uses prefix for the xyz project to avoid name collisions.
+- `"example"`: valid, but not recommended as it could collide with future versions of JSON schema etc.
+- `"3-example"`: invalid as numbers are not allowed to be the first character in a keyword
+
+Keyword definition is an object with the following properties:
+
+- _type_: optional string or array of strings with data type(s) that the keyword applies to. If not present, the keyword will apply to all types.
+- _validate_: validating function
+- _compile_: compiling function
+- _macro_: macro function
+- _inline_: compiling function that returns code (as string)
+- _schema_: an optional `false` value used with "validate" keyword to not pass schema
+- _metaSchema_: an optional meta-schema for keyword schema
+- _modifying_: `true` MUST be passed if keyword modifies data
+- _valid_: pass `true`/`false` to pre-define validation result, the result returned from validation function will be ignored. This option cannot be used with macro keywords.
+- _$data_: an optional `true` value to support [$data reference](#data-reference) as the value of custom keyword. The reference will be resolved at validation time. If the keyword has meta-schema it would be extended to allow $data and it will be used to validate the resolved value. Supporting $data reference requires that keyword has validating function (as the only option or in addition to compile, macro or inline function).
+- _async_: an optional `true` value if the validation function is asynchronous (whether it is compiled or passed in _validate_ property); in this case it should return a promise that resolves with a value `true` or `false`. This option is ignored in case of "macro" and "inline" keywords.
+- _errors_: an optional boolean indicating whether keyword returns errors. If this property is not set Ajv will determine if the errors were set in case of failed validation.
+
+_compile_, _macro_ and _inline_ are mutually exclusive, only one should be used at a time. _validate_ can be used separately or in addition to them to support $data reference.
+
+__Please note__: If the keyword is validating data type that is different from the type(s) in its definition, the validation function will not be called (and expanded macro will not be used), so there is no need to check for data type inside validation function or inside schema returned by macro function (unless you want to enforce a specific type and for some reason do not want to use a separate `type` keyword for that). In the same way as standard keywords work, if the keyword does not apply to the data type being validated, the validation of this keyword will succeed.
+
+See [Defining custom keywords](#defining-custom-keywords) for more details.
+
+
+##### .getKeyword(String keyword) -> Object|Boolean
+
+Returns custom keyword definition, `true` for pre-defined keywords and `false` if the keyword is unknown.
+
+
+##### .removeKeyword(String keyword) -> Ajv
+
+Removes custom or pre-defined keyword so you can redefine them.
+
+While this method can be used to extend pre-defined keywords, it can also be used to completely change their meaning - it may lead to unexpected results.
+
+__Please note__: schemas compiled before the keyword is removed will continue to work without changes. To recompile schemas use `removeSchema` method and compile them again.
+
+
+##### .errorsText([Array<Object> errors [, Object options]]) -> String
+
+Returns the text with all errors in a String.
+
+Options can have properties `separator` (string used to separate errors, ", " by default) and `dataVar` (the variable name that dataPaths are prefixed with, "data" by default).
+
+
+## Options
+
+Defaults:
+
+```javascript
+{
+ // validation and reporting options:
+ $data: false,
+ allErrors: false,
+ verbose: false,
+ jsonPointers: false,
+ uniqueItems: true,
+ unicode: true,
+ format: 'fast',
+ formats: {},
+ unknownFormats: true,
+ schemas: {},
+ logger: undefined,
+ // referenced schema options:
+ schemaId: undefined // recommended '$id'
+ missingRefs: true,
+ extendRefs: 'ignore', // recommended 'fail'
+ loadSchema: undefined, // function(uri: string): Promise {}
+ // options to modify validated data:
+ removeAdditional: false,
+ useDefaults: false,
+ coerceTypes: false,
+ // asynchronous validation options:
+ async: 'co*',
+ transpile: undefined, // requires ajv-async package
+ // advanced options:
+ meta: true,
+ validateSchema: true,
+ addUsedSchema: true,
+ inlineRefs: true,
+ passContext: false,
+ loopRequired: Infinity,
+ ownProperties: false,
+ multipleOfPrecision: false,
+ errorDataPath: 'object',
+ messages: true,
+ sourceCode: false,
+ processCode: undefined, // function (str: string): string {}
+ cache: new Cache,
+ serialize: undefined
+}
+```
+
+##### Validation and reporting options
+
+- _$data_: support [$data references](#data-reference). Draft 6 meta-schema that is added by default will be extended to allow them. If you want to use another meta-schema you need to use $dataMetaSchema method to add support for $data reference. See [API](#api).
+- _allErrors_: check all rules collecting all errors. Default is to return after the first error.
+- _verbose_: include the reference to the part of the schema (`schema` and `parentSchema`) and validated data in errors (false by default).
+- _jsonPointers_: set `dataPath` property of errors using [JSON Pointers](https://tools.ietf.org/html/rfc6901) instead of JavaScript property access notation.
+- _uniqueItems_: validate `uniqueItems` keyword (true by default).
+- _unicode_: calculate correct length of strings with unicode pairs (true by default). Pass `false` to use `.length` of strings that is faster, but gives "incorrect" lengths of strings with unicode pairs - each unicode pair is counted as two characters.
+- _format_: formats validation mode ('fast' by default). Pass 'full' for more correct and slow validation or `false` not to validate formats at all. E.g., 25:00:00 and 2015/14/33 will be invalid time and date in 'full' mode but it will be valid in 'fast' mode.
+- _formats_: an object with custom formats. Keys and values will be passed to `addFormat` method.
+- _unknownFormats_: handling of unknown formats. Option values:
+ - `true` (default) - if an unknown format is encountered the exception is thrown during schema compilation. If `format` keyword value is [$data reference](#data-reference) and it is unknown the validation will fail.
+ - `[String]` - an array of unknown format names that will be ignored. This option can be used to allow usage of third party schemas with format(s) for which you don't have definitions, but still fail if another unknown format is used. If `format` keyword value is [$data reference](#data-reference) and it is not in this array the validation will fail.
+ - `"ignore"` - to log warning during schema compilation and always pass validation (the default behaviour in versions before 5.0.0). This option is not recommended, as it allows to mistype format name and it won't be validated without any error message. This behaviour is required by JSON-schema specification.
+- _schemas_: an array or object of schemas that will be added to the instance. In case you pass the array the schemas must have IDs in them. When the object is passed the method `addSchema(value, key)` will be called for each schema in this object.
+- _logger_: sets the logging method. Default is the global `console` object that should have methods `log`, `warn` and `error`. Option values:
+ - custom logger - it should have methods `log`, `warn` and `error`. If any of these methods is missing an exception will be thrown.
+ - `false` - logging is disabled.
+
+
+##### Referenced schema options
+
+- _schemaId_: this option defines which keywords are used as schema URI. Option value:
+ - `"$id"` (recommended) - only use `$id` keyword as schema URI (as specified in JSON Schema draft-06), ignore `id` keyword (if it is present a warning will be logged).
+ - `"id"` - only use `id` keyword as schema URI (as specified in JSON Schema draft-04), ignore `$id` keyword (if it is present a warning will be logged).
+ - `undefined` (default) - use both `$id` and `id` keywords as schema URI. If both are present (in the same schema object) and different the exception will be thrown during schema compilation.
+- _missingRefs_: handling of missing referenced schemas. Option values:
+ - `true` (default) - if the reference cannot be resolved during compilation the exception is thrown. The thrown error has properties `missingRef` (with hash fragment) and `missingSchema` (without it). Both properties are resolved relative to the current base id (usually schema id, unless it was substituted).
+ - `"ignore"` - to log error during compilation and always pass validation.
+ - `"fail"` - to log error and successfully compile schema but fail validation if this rule is checked.
+- _extendRefs_: validation of other keywords when `$ref` is present in the schema. Option values:
+ - `"ignore"` (default) - when `$ref` is used other keywords are ignored (as per [JSON Reference](https://tools.ietf.org/html/draft-pbryan-zyp-json-ref-03#section-3) standard). A warning will be logged during the schema compilation.
+ - `"fail"` (recommended) - if other validation keywords are used together with `$ref` the exception will be thrown when the schema is compiled. This option is recommended to make sure schema has no keywords that are ignored, which can be confusing.
+ - `true` - validate all keywords in the schemas with `$ref` (the default behaviour in versions before 5.0.0).
+- _loadSchema_: asynchronous function that will be used to load remote schemas when `compileAsync` [method](#api-compileAsync) is used and some reference is missing (option `missingRefs` should NOT be 'fail' or 'ignore'). This function should accept remote schema uri as a parameter and return a Promise that resolves to a schema. See example in [Asynchronous compilation](#asynchronous-schema-compilation).
+
+
+##### Options to modify validated data
+
+- _removeAdditional_: remove additional properties - see example in [Filtering data](#filtering-data). This option is not used if schema is added with `addMetaSchema` method. Option values:
+ - `false` (default) - not to remove additional properties
+ - `"all"` - all additional properties are removed, regardless of `additionalProperties` keyword in schema (and no validation is made for them).
+ - `true` - only additional properties with `additionalProperties` keyword equal to `false` are removed.
+ - `"failing"` - additional properties that fail schema validation will be removed (where `additionalProperties` keyword is `false` or schema).
+- _useDefaults_: replace missing properties and items with the values from corresponding `default` keywords. Default behaviour is to ignore `default` keywords. This option is not used if schema is added with `addMetaSchema` method. See examples in [Assigning defaults](#assigning-defaults). Option values:
+ - `false` (default) - do not use defaults
+ - `true` - insert defaults by value (safer and slower, object literal is used).
+ - `"shared"` - insert defaults by reference (faster). If the default is an object, it will be shared by all instances of validated data. If you modify the inserted default in the validated data, it will be modified in the schema as well.
+- _coerceTypes_: change data type of data to match `type` keyword. See the example in [Coercing data types](#coercing-data-types) and [coercion rules](https://github.com/epoberezkin/ajv/blob/master/COERCION.md). Option values:
+ - `false` (default) - no type coercion.
+ - `true` - coerce scalar data types.
+ - `"array"` - in addition to coercions between scalar types, coerce scalar data to an array with one element and vice versa (as required by the schema).
+
+
+##### Asynchronous validation options
+
+- _async_: determines how Ajv compiles asynchronous schemas (see [Asynchronous validation](#asynchronous-validation)) to functions. Option values:
+ - `"*"` / `"co*"` (default) - compile to generator function ("co*" - wrapped with `co.wrap`). If generators are not supported and you don't provide `processCode` option (or `transpile` option if you use [ajv-async](https://github.com/epoberezkin/ajv-async) package), the exception will be thrown when async schema is compiled.
+ - `"es7"` - compile to es7 async function. Unless your platform supports them you need to provide `processCode` or `transpile` option. According to [compatibility table](http://kangax.github.io/compat-table/es7/)) async functions are supported by:
+ - Firefox 52,
+ - Chrome 55,
+ - Node.js 7 (with `--harmony-async-await`),
+ - MS Edge 13 (with flag).
+ - `undefined`/`true` - auto-detect async mode. It requires [ajv-async](https://github.com/epoberezkin/ajv-async) package. If `transpile` option is not passed, ajv-async will choose the first of supported/installed async/transpile modes in this order:
+ - "es7" (native async functions),
+ - "co*" (native generators with co.wrap),
+ - "es7"/"nodent",
+ - "co*"/"regenerator" during the creation of the Ajv instance.
+
+ If none of the options is available the exception will be thrown.
+- _transpile_: Requires [ajv-async](https://github.com/epoberezkin/ajv-async) package. It determines whether Ajv transpiles compiled asynchronous validation function. Option values:
+ - `"nodent"` - transpile with [nodent](https://github.com/MatAtBread/nodent). If nodent is not installed, the exception will be thrown. nodent can only transpile es7 async functions; it will enforce this mode.
+ - `"regenerator"` - transpile with [regenerator](https://github.com/facebook/regenerator). If regenerator is not installed, the exception will be thrown.
+ - a function - this function should accept the code of validation function as a string and return transpiled code. This option allows you to use any other transpiler you prefer. If you are passing a function, you can simply pass it to `processCode` option without using ajv-async.
+
+
+##### Advanced options
+
+- _meta_: add [meta-schema](http://json-schema.org/documentation.html) so it can be used by other schemas (true by default). If an object is passed, it will be used as the default meta-schema for schemas that have no `$schema` keyword. This default meta-schema MUST have `$schema` keyword.
+- _validateSchema_: validate added/compiled schemas against meta-schema (true by default). `$schema` property in the schema can either be http://json-schema.org/schema or http://json-schema.org/draft-04/schema or absent (draft-4 meta-schema will be used) or can be a reference to the schema previously added with `addMetaSchema` method. Option values:
+ - `true` (default) - if the validation fails, throw the exception.
+ - `"log"` - if the validation fails, log error.
+ - `false` - skip schema validation.
+- _addUsedSchema_: by default methods `compile` and `validate` add schemas to the instance if they have `$id` (or `id`) property that doesn't start with "#". If `$id` is present and it is not unique the exception will be thrown. Set this option to `false` to skip adding schemas to the instance and the `$id` uniqueness check when these methods are used. This option does not affect `addSchema` method.
+- _inlineRefs_: Affects compilation of referenced schemas. Option values:
+ - `true` (default) - the referenced schemas that don't have refs in them are inlined, regardless of their size - that substantially improves performance at the cost of the bigger size of compiled schema functions.
+ - `false` - to not inline referenced schemas (they will be compiled as separate functions).
+ - integer number - to limit the maximum number of keywords of the schema that will be inlined.
+- _passContext_: pass validation context to custom keyword functions. If this option is `true` and you pass some context to the compiled validation function with `validate.call(context, data)`, the `context` will be available as `this` in your custom keywords. By default `this` is Ajv instance.
+- _loopRequired_: by default `required` keyword is compiled into a single expression (or a sequence of statements in `allErrors` mode). In case of a very large number of properties in this keyword it may result in a very big validation function. Pass integer to set the number of properties above which `required` keyword will be validated in a loop - smaller validation function size but also worse performance.
+- _ownProperties_: by default Ajv iterates over all enumerable object properties; when this option is `true` only own enumerable object properties (i.e. found directly on the object rather than on its prototype) are iterated. Contributed by @mbroadst.
+- _multipleOfPrecision_: by default `multipleOf` keyword is validated by comparing the result of division with parseInt() of that result. It works for dividers that are bigger than 1. For small dividers such as 0.01 the result of the division is usually not integer (even when it should be integer, see issue [#84](https://github.com/epoberezkin/ajv/issues/84)). If you need to use fractional dividers set this option to some positive integer N to have `multipleOf` validated using this formula: `Math.abs(Math.round(division) - division) < 1e-N` (it is slower but allows for float arithmetics deviations).
+- _errorDataPath_: set `dataPath` to point to 'object' (default) or to 'property' when validating keywords `required`, `additionalProperties` and `dependencies`.
+- _messages_: Include human-readable messages in errors. `true` by default. `false` can be passed when custom messages are used (e.g. with [ajv-i18n](https://github.com/epoberezkin/ajv-i18n)).
+- _sourceCode_: add `sourceCode` property to validating function (for debugging; this code can be different from the result of toString call).
+- _processCode_: an optional function to process generated code before it is passed to Function constructor. It can be used to either beautify (the validating function is generated without line-breaks) or to transpile code. Starting from version 5.0.0 this option replaced options:
+ - `beautify` that formatted the generated function using [js-beautify](https://github.com/beautify-web/js-beautify). If you want to beautify the generated code pass `require('js-beautify').js_beautify`.
+ - `transpile` that transpiled asynchronous validation function. You can still use `transpile` option with [ajv-async](https://github.com/epoberezkin/ajv-async) package. See [Asynchronous validation](#asynchronous-validation) for more information.
+- _cache_: an optional instance of cache to store compiled schemas using stable-stringified schema as a key. For example, set-associative cache [sacjs](https://github.com/epoberezkin/sacjs) can be used. If not passed then a simple hash is used which is good enough for the common use case (a limited number of statically defined schemas). Cache should have methods `put(key, value)`, `get(key)`, `del(key)` and `clear()`.
+- _serialize_: an optional function to serialize schema to cache key. Pass `false` to use schema itself as a key (e.g., if WeakMap used as a cache). By default [fast-json-stable-stringify](https://github.com/epoberezkin/fast-json-stable-stringify) is used.
+
+
+## Validation errors
+
+In case of validation failure, Ajv assigns the array of errors to `errors` property of validation function (or to `errors` property of Ajv instance when `validate` or `validateSchema` methods were called). In case of [asynchronous validation](#asynchronous-validation), the returned promise is rejected with exception `Ajv.ValidationError` that has `errors` property.
+
+
+### Error objects
+
+Each error is an object with the following properties:
+
+- _keyword_: validation keyword.
+- _dataPath_: the path to the part of the data that was validated. By default `dataPath` uses JavaScript property access notation (e.g., `".prop[1].subProp"`). When the option `jsonPointers` is true (see [Options](#options)) `dataPath` will be set using JSON pointer standard (e.g., `"/prop/1/subProp"`).
+- _schemaPath_: the path (JSON-pointer as a URI fragment) to the schema of the keyword that failed validation.
+- _params_: the object with the additional information about error that can be used to create custom error messages (e.g., using [ajv-i18n](https://github.com/epoberezkin/ajv-i18n) package). See below for parameters set by all keywords.
+- _message_: the standard error message (can be excluded with option `messages` set to false).
+- _schema_: the schema of the keyword (added with `verbose` option).
+- _parentSchema_: the schema containing the keyword (added with `verbose` option)
+- _data_: the data validated by the keyword (added with `verbose` option).
+
+__Please note__: `propertyNames` keyword schema validation errors have an additional property `propertyName`, `dataPath` points to the object. After schema validation for each property name, if it is invalid an additional error is added with the property `keyword` equal to `"propertyNames"`.
+
+
+### Error parameters
+
+Properties of `params` object in errors depend on the keyword that failed validation.
+
+- `maxItems`, `minItems`, `maxLength`, `minLength`, `maxProperties`, `minProperties` - property `limit` (number, the schema of the keyword).
+- `additionalItems` - property `limit` (the maximum number of allowed items in case when `items` keyword is an array of schemas and `additionalItems` is false).
+- `additionalProperties` - property `additionalProperty` (the property not used in `properties` and `patternProperties` keywords).
+- `dependencies` - properties:
+ - `property` (dependent property),
+ - `missingProperty` (required missing dependency - only the first one is reported currently)
+ - `deps` (required dependencies, comma separated list as a string),
+ - `depsCount` (the number of required dependencies).
+- `format` - property `format` (the schema of the keyword).
+- `maximum`, `minimum` - properties:
+ - `limit` (number, the schema of the keyword),
+ - `exclusive` (boolean, the schema of `exclusiveMaximum` or `exclusiveMinimum`),
+ - `comparison` (string, comparison operation to compare the data to the limit, with the data on the left and the limit on the right; can be "<", "<=", ">", ">=")
+- `multipleOf` - property `multipleOf` (the schema of the keyword)
+- `pattern` - property `pattern` (the schema of the keyword)
+- `required` - property `missingProperty` (required property that is missing).
+- `propertyNames` - property `propertyName` (an invalid property name).
+- `patternRequired` (in ajv-keywords) - property `missingPattern` (required pattern that did not match any property).
+- `type` - property `type` (required type(s), a string, can be a comma-separated list)
+- `uniqueItems` - properties `i` and `j` (indices of duplicate items).
+- `enum` - property `allowedValues` pointing to the array of values (the schema of the keyword).
+- `$ref` - property `ref` with the referenced schema URI.
+- custom keywords (in case keyword definition doesn't create errors) - property `keyword` (the keyword name).
+
+
+## Related packages
+
+- [ajv-async](https://github.com/epoberezkin/ajv-async) - configure async validation mode
+- [ajv-cli](https://github.com/jessedc/ajv-cli) - command line interface
+- [ajv-errors](https://github.com/epoberezkin/ajv-errors) - custom error messages
+- [ajv-i18n](https://github.com/epoberezkin/ajv-i18n) - internationalised error messages
+- [ajv-istanbul](https://github.com/epoberezkin/ajv-istanbul) - instrument generated validation code to measure test coverage of your schemas
+- [ajv-keywords](https://github.com/epoberezkin/ajv-keywords) - custom validation keywords (if/then/else, select, typeof, etc.)
+- [ajv-merge-patch](https://github.com/epoberezkin/ajv-merge-patch) - keywords $merge and $patch
+- [ajv-pack](https://github.com/epoberezkin/ajv-pack) - produces a compact module exporting validation functions
+
+
+## Some packages using Ajv
+
+- [webpack](https://github.com/webpack/webpack) - a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser
+- [jsonscript-js](https://github.com/JSONScript/jsonscript-js) - the interpreter for [JSONScript](http://www.jsonscript.org) - scripted processing of existing endpoints and services
+- [osprey-method-handler](https://github.com/mulesoft-labs/osprey-method-handler) - Express middleware for validating requests and responses based on a RAML method object, used in [osprey](https://github.com/mulesoft/osprey) - validating API proxy generated from a RAML definition
+- [har-validator](https://github.com/ahmadnassri/har-validator) - HTTP Archive (HAR) validator
+- [jsoneditor](https://github.com/josdejong/jsoneditor) - a web-based tool to view, edit, format, and validate JSON http://jsoneditoronline.org
+- [JSON Schema Lint](https://github.com/nickcmaynard/jsonschemalint) - a web tool to validate JSON/YAML document against a single JSON-schema http://jsonschemalint.com
+- [objection](https://github.com/vincit/objection.js) - SQL-friendly ORM for Node.js
+- [table](https://github.com/gajus/table) - formats data into a string table
+- [ripple-lib](https://github.com/ripple/ripple-lib) - a JavaScript API for interacting with [Ripple](https://ripple.com) in Node.js and the browser
+- [restbase](https://github.com/wikimedia/restbase) - distributed storage with REST API & dispatcher for backend services built to provide a low-latency & high-throughput API for Wikipedia / Wikimedia content
+- [hippie-swagger](https://github.com/CacheControl/hippie-swagger) - [Hippie](https://github.com/vesln/hippie) wrapper that provides end to end API testing with swagger validation
+- [react-form-controlled](https://github.com/seeden/react-form-controlled) - React controlled form components with validation
+- [rabbitmq-schema](https://github.com/tjmehta/rabbitmq-schema) - a schema definition module for RabbitMQ graphs and messages
+- [@query/schema](https://www.npmjs.com/package/@query/schema) - stream filtering with a URI-safe query syntax parsing to JSON Schema
+- [chai-ajv-json-schema](https://github.com/peon374/chai-ajv-json-schema) - chai plugin to us JSON-schema with expect in mocha tests
+- [grunt-jsonschema-ajv](https://github.com/SignpostMarv/grunt-jsonschema-ajv) - Grunt plugin for validating files against JSON Schema
+- [extract-text-webpack-plugin](https://github.com/webpack-contrib/extract-text-webpack-plugin) - extract text from bundle into a file
+- [electron-builder](https://github.com/electron-userland/electron-builder) - a solution to package and build a ready for distribution Electron app
+- [addons-linter](https://github.com/mozilla/addons-linter) - Mozilla Add-ons Linter
+- [gh-pages-generator](https://github.com/epoberezkin/gh-pages-generator) - multi-page site generator converting markdown files to GitHub pages
+
+
+## Tests
+
+```
+npm install
+git submodule update --init
+npm test
+```
+
+## Contributing
+
+All validation functions are generated using doT templates in [dot](https://github.com/epoberezkin/ajv/tree/master/lib/dot) folder. Templates are precompiled so doT is not a run-time dependency.
+
+`npm run build` - compiles templates to [dotjs](https://github.com/epoberezkin/ajv/tree/master/lib/dotjs) folder.
+
+`npm run watch` - automatically compiles templates when files in dot folder change
+
+Please see [Contributing guidelines](https://github.com/epoberezkin/ajv/blob/master/CONTRIBUTING.md)
+
+
+## Changes history
+
+See https://github.com/epoberezkin/ajv/releases
+
+__Please note__: [Changes in version 5.0.0](https://github.com/epoberezkin/ajv/releases/tag/5.0.0).
+
+[Changes in version 4.6.0](https://github.com/epoberezkin/ajv/releases/tag/4.6.0).
+
+[Changes in version 4.0.0](https://github.com/epoberezkin/ajv/releases/tag/4.0.0).
+
+[Changes in version 3.0.0](https://github.com/epoberezkin/ajv/releases/tag/3.0.0).
+
+[Changes in version 2.0.0](https://github.com/epoberezkin/ajv/releases/tag/2.0.0).
+
+
+## License
+
+[MIT](https://github.com/epoberezkin/ajv/blob/master/LICENSE)
diff --git a/deps/npm/node_modules/request/node_modules/har-validator/node_modules/ajv/dist/ajv.bundle.js b/deps/npm/node_modules/ajv/dist/ajv.bundle.js
similarity index 94%
rename from deps/npm/node_modules/request/node_modules/har-validator/node_modules/ajv/dist/ajv.bundle.js
rename to deps/npm/node_modules/ajv/dist/ajv.bundle.js
index 2329e81c395fb9..25843d30c8535d 100644
--- a/deps/npm/node_modules/request/node_modules/har-validator/node_modules/ajv/dist/ajv.bundle.js
+++ b/deps/npm/node_modules/ajv/dist/ajv.bundle.js
@@ -381,7 +381,7 @@ function regex(str) {
var resolve = require('./resolve')
, util = require('./util')
, errorClasses = require('./error_classes')
- , stableStringify = require('json-stable-stringify');
+ , stableStringify = require('fast-json-stable-stringify');
var validateGenerator = require('../dotjs/validate');
@@ -482,6 +482,7 @@ function compile(schema, root, localRefs, baseId) {
useCustomRule: useCustomRule,
opts: opts,
formats: formats,
+ logger: self.logger,
self: self
});
@@ -524,7 +525,7 @@ function compile(schema, root, localRefs, baseId) {
refVal[0] = validate;
} catch(e) {
- console.error('Error compiling schema, function code:', sourceCode);
+ self.logger.error('Error compiling schema, function code:', sourceCode);
throw e;
}
@@ -638,7 +639,7 @@ function compile(schema, root, localRefs, baseId) {
var valid = validateSchema(schema);
if (!valid) {
var message = 'keyword schema is invalid: ' + self.errorsText(validateSchema.errors);
- if (self._opts.validateSchema == 'log') console.error(message);
+ if (self._opts.validateSchema == 'log') self.logger.error(message);
else throw new Error(message);
}
}
@@ -756,7 +757,7 @@ function vars(arr, statement) {
return code;
}
-},{"../dotjs/validate":35,"./error_classes":5,"./resolve":8,"./util":12,"co":40,"fast-deep-equal":41,"json-stable-stringify":43}],8:[function(require,module,exports){
+},{"../dotjs/validate":35,"./error_classes":5,"./resolve":8,"./util":12,"co":40,"fast-deep-equal":41,"fast-json-stable-stringify":42}],8:[function(require,module,exports){
'use strict';
var url = require('url')
@@ -1029,7 +1030,7 @@ function resolveIds(schema) {
return localRefs;
}
-},{"./schema_obj":10,"./util":12,"fast-deep-equal":41,"json-schema-traverse":42,"url":51}],9:[function(require,module,exports){
+},{"./schema_obj":10,"./util":12,"fast-deep-equal":41,"json-schema-traverse":43,"url":48}],9:[function(require,module,exports){
'use strict';
var ruleModules = require('./_rules')
@@ -1052,7 +1053,7 @@ module.exports = function rules() {
var ALL = [ 'type' ];
var KEYWORDS = [
- 'additionalItems', '$schema', 'id', 'title',
+ 'additionalItems', '$schema', '$id', 'id', 'title',
'description', 'default', 'definitions'
];
var TYPES = [ 'number', 'integer', 'string', 'array', 'object', 'boolean', 'null' ];
@@ -2563,7 +2564,7 @@ module.exports = function generate_format(it, $keyword, $ruleType) {
var $format = it.formats[$schema];
if (!$format) {
if ($unknownFormats == 'ignore') {
- console.warn('unknown format "' + $schema + '" ignored in schema at path "' + it.errSchemaPath + '"');
+ it.logger.warn('unknown format "' + $schema + '" ignored in schema at path "' + it.errSchemaPath + '"');
if ($breakOnError) {
out += ' if (true) { ';
}
@@ -3687,7 +3688,7 @@ module.exports = function generate_ref(it, $keyword, $ruleType) {
if ($refVal === undefined) {
var $message = it.MissingRefError.message(it.baseId, $schema);
if (it.opts.missingRefs == 'fail') {
- console.error($message);
+ it.logger.error($message);
var $$outStack = $$outStack || [];
$$outStack.push(out);
out = ''; /* istanbul ignore else */
@@ -3718,7 +3719,7 @@ module.exports = function generate_ref(it, $keyword, $ruleType) {
out += ' if (false) { ';
}
} else if (it.opts.missingRefs == 'ignore') {
- console.warn($message);
+ it.logger.warn($message);
if ($breakOnError) {
out += ' if (true) { ';
}
@@ -4256,7 +4257,7 @@ module.exports = function generate_validate(it, $keyword, $ruleType) {
throw new Error('$ref: validation keywords used in schema at path "' + it.errSchemaPath + '" (see option extendRefs)');
} else if (it.opts.extendRefs !== true) {
$refKeywords = false;
- console.warn('$ref: keywords ignored in schema at path "' + it.errSchemaPath + '"');
+ it.logger.warn('$ref: keywords ignored in schema at path "' + it.errSchemaPath + '"');
}
}
if ($typeSchema) {
@@ -4414,7 +4415,7 @@ module.exports = function generate_validate(it, $keyword, $ruleType) {
}
} else {
if (it.opts.v5 && it.schema.patternGroups) {
- console.warn('keyword "patternGroups" is deprecated and disabled. Use option patternGroups: true to enable.');
+ it.logger.warn('keyword "patternGroups" is deprecated and disabled. Use option patternGroups: true to enable.');
}
var arr2 = it.RULES;
if (arr2) {
@@ -4579,10 +4580,10 @@ module.exports = function generate_validate(it, $keyword, $ruleType) {
}
function $shouldUseRule($rule) {
- return it.schema[$rule.keyword] !== undefined || ($rule.implements && $ruleImlementsSomeKeyword($rule));
+ return it.schema[$rule.keyword] !== undefined || ($rule.implements && $ruleImplementsSomeKeyword($rule));
}
- function $ruleImlementsSomeKeyword($rule) {
+ function $ruleImplementsSomeKeyword($rule) {
var impl = $rule.implements;
for (var i = 0; i < impl.length; i++)
if (it.schema[impl[i]] !== undefined) return true;
@@ -4607,6 +4608,7 @@ module.exports = {
* @this Ajv
* @param {String} keyword custom keyword, should be unique (including different from all standard, custom and macro keywords).
* @param {Object} definition keyword definition object with properties `type` (type(s) which the keyword applies to), `validate` or `compile`.
+ * @return {Ajv} this for method chaining
*/
function addKeyword(keyword, definition) {
/* jshint validthis: true */
@@ -4684,6 +4686,8 @@ function addKeyword(keyword, definition) {
function checkDataType(dataType) {
if (!RULES.types[dataType]) throw new Error('Unknown type ' + dataType);
}
+
+ return this;
}
@@ -4704,6 +4708,7 @@ function getKeyword(keyword) {
* Remove keyword
* @this Ajv
* @param {String} keyword pre-defined or custom keyword.
+ * @return {Ajv} this for method chaining
*/
function removeKeyword(keyword) {
/* jshint validthis: true */
@@ -4720,6 +4725,7 @@ function removeKeyword(keyword) {
}
}
}
+ return this;
}
},{"./dotjs/custom":21}],37:[function(require,module,exports){
@@ -4839,6 +4845,10 @@ module.exports={
"type": "string"
},
"default": {},
+ "examples": {
+ "type": "array",
+ "items": {}
+ },
"multipleOf": {
"type": "number",
"exclusiveMinimum": 0
@@ -5218,6 +5228,67 @@ module.exports = function equal(a, b) {
},{}],42:[function(require,module,exports){
'use strict';
+module.exports = function (data, opts) {
+ if (!opts) opts = {};
+ if (typeof opts === 'function') opts = { cmp: opts };
+ var cycles = (typeof opts.cycles === 'boolean') ? opts.cycles : false;
+
+ var cmp = opts.cmp && (function (f) {
+ return function (node) {
+ return function (a, b) {
+ var aobj = { key: a, value: node[a] };
+ var bobj = { key: b, value: node[b] };
+ return f(aobj, bobj);
+ };
+ };
+ })(opts.cmp);
+
+ var seen = [];
+ return (function stringify (node) {
+ if (node && node.toJSON && typeof node.toJSON === 'function') {
+ node = node.toJSON();
+ }
+
+ if (node === undefined) return;
+ if (typeof node == 'number') return isFinite(node) ? '' + node : 'null';
+ if (typeof node !== 'object') return JSON.stringify(node);
+
+ var i, out;
+ if (Array.isArray(node)) {
+ out = '[';
+ for (i = 0; i < node.length; i++) {
+ if (i) out += ',';
+ out += stringify(node[i]) || 'null';
+ }
+ return out + ']';
+ }
+
+ if (node === null) return 'null';
+
+ if (seen.indexOf(node) !== -1) {
+ if (cycles) return JSON.stringify('__cycle__');
+ throw new TypeError('Converting circular structure to JSON');
+ }
+
+ var seenIndex = seen.push(node) - 1;
+ var keys = Object.keys(node).sort(cmp && cmp(node));
+ out = '';
+ for (i = 0; i < keys.length; i++) {
+ var key = keys[i];
+ var value = stringify(node[key]);
+
+ if (!value) continue;
+ if (out) out += ',';
+ out += JSON.stringify(key) + ':' + value;
+ }
+ seen.splice(seenIndex, 1);
+ return '{' + out + '}';
+ })(data);
+};
+
+},{}],43:[function(require,module,exports){
+'use strict';
+
var traverse = module.exports = function (schema, opts, cb) {
if (typeof opts == 'function') {
cb = opts;
@@ -5298,528 +5369,7 @@ function escapeJsonPtr(str) {
return str.replace(/~/g, '~0').replace(/\//g, '~1');
}
-},{}],43:[function(require,module,exports){
-var json = typeof JSON !== 'undefined' ? JSON : require('jsonify');
-
-module.exports = function (obj, opts) {
- if (!opts) opts = {};
- if (typeof opts === 'function') opts = { cmp: opts };
- var space = opts.space || '';
- if (typeof space === 'number') space = Array(space+1).join(' ');
- var cycles = (typeof opts.cycles === 'boolean') ? opts.cycles : false;
- var replacer = opts.replacer || function(key, value) { return value; };
-
- var cmp = opts.cmp && (function (f) {
- return function (node) {
- return function (a, b) {
- var aobj = { key: a, value: node[a] };
- var bobj = { key: b, value: node[b] };
- return f(aobj, bobj);
- };
- };
- })(opts.cmp);
-
- var seen = [];
- return (function stringify (parent, key, node, level) {
- var indent = space ? ('\n' + new Array(level + 1).join(space)) : '';
- var colonSeparator = space ? ': ' : ':';
-
- if (node && node.toJSON && typeof node.toJSON === 'function') {
- node = node.toJSON();
- }
-
- node = replacer.call(parent, key, node);
-
- if (node === undefined) {
- return;
- }
- if (typeof node !== 'object' || node === null) {
- return json.stringify(node);
- }
- if (isArray(node)) {
- var out = [];
- for (var i = 0; i < node.length; i++) {
- var item = stringify(node, i, node[i], level+1) || json.stringify(null);
- out.push(indent + space + item);
- }
- return '[' + out.join(',') + indent + ']';
- }
- else {
- if (seen.indexOf(node) !== -1) {
- if (cycles) return json.stringify('__cycle__');
- throw new TypeError('Converting circular structure to JSON');
- }
- else seen.push(node);
-
- var keys = objectKeys(node).sort(cmp && cmp(node));
- var out = [];
- for (var i = 0; i < keys.length; i++) {
- var key = keys[i];
- var value = stringify(node, key, node[key], level+1);
-
- if(!value) continue;
-
- var keyValue = json.stringify(key)
- + colonSeparator
- + value;
- ;
- out.push(indent + space + keyValue);
- }
- seen.splice(seen.indexOf(node), 1);
- return '{' + out.join(',') + indent + '}';
- }
- })({ '': obj }, '', obj, 0);
-};
-
-var isArray = Array.isArray || function (x) {
- return {}.toString.call(x) === '[object Array]';
-};
-
-var objectKeys = Object.keys || function (obj) {
- var has = Object.prototype.hasOwnProperty || function () { return true };
- var keys = [];
- for (var key in obj) {
- if (has.call(obj, key)) keys.push(key);
- }
- return keys;
-};
-
-},{"jsonify":44}],44:[function(require,module,exports){
-exports.parse = require('./lib/parse');
-exports.stringify = require('./lib/stringify');
-
-},{"./lib/parse":45,"./lib/stringify":46}],45:[function(require,module,exports){
-var at, // The index of the current character
- ch, // The current character
- escapee = {
- '"': '"',
- '\\': '\\',
- '/': '/',
- b: '\b',
- f: '\f',
- n: '\n',
- r: '\r',
- t: '\t'
- },
- text,
-
- error = function (m) {
- // Call error when something is wrong.
- throw {
- name: 'SyntaxError',
- message: m,
- at: at,
- text: text
- };
- },
-
- next = function (c) {
- // If a c parameter is provided, verify that it matches the current character.
- if (c && c !== ch) {
- error("Expected '" + c + "' instead of '" + ch + "'");
- }
-
- // Get the next character. When there are no more characters,
- // return the empty string.
-
- ch = text.charAt(at);
- at += 1;
- return ch;
- },
-
- number = function () {
- // Parse a number value.
- var number,
- string = '';
-
- if (ch === '-') {
- string = '-';
- next('-');
- }
- while (ch >= '0' && ch <= '9') {
- string += ch;
- next();
- }
- if (ch === '.') {
- string += '.';
- while (next() && ch >= '0' && ch <= '9') {
- string += ch;
- }
- }
- if (ch === 'e' || ch === 'E') {
- string += ch;
- next();
- if (ch === '-' || ch === '+') {
- string += ch;
- next();
- }
- while (ch >= '0' && ch <= '9') {
- string += ch;
- next();
- }
- }
- number = +string;
- if (!isFinite(number)) {
- error("Bad number");
- } else {
- return number;
- }
- },
-
- string = function () {
- // Parse a string value.
- var hex,
- i,
- string = '',
- uffff;
-
- // When parsing for string values, we must look for " and \ characters.
- if (ch === '"') {
- while (next()) {
- if (ch === '"') {
- next();
- return string;
- } else if (ch === '\\') {
- next();
- if (ch === 'u') {
- uffff = 0;
- for (i = 0; i < 4; i += 1) {
- hex = parseInt(next(), 16);
- if (!isFinite(hex)) {
- break;
- }
- uffff = uffff * 16 + hex;
- }
- string += String.fromCharCode(uffff);
- } else if (typeof escapee[ch] === 'string') {
- string += escapee[ch];
- } else {
- break;
- }
- } else {
- string += ch;
- }
- }
- }
- error("Bad string");
- },
-
- white = function () {
-
-// Skip whitespace.
-
- while (ch && ch <= ' ') {
- next();
- }
- },
-
- word = function () {
-
-// true, false, or null.
-
- switch (ch) {
- case 't':
- next('t');
- next('r');
- next('u');
- next('e');
- return true;
- case 'f':
- next('f');
- next('a');
- next('l');
- next('s');
- next('e');
- return false;
- case 'n':
- next('n');
- next('u');
- next('l');
- next('l');
- return null;
- }
- error("Unexpected '" + ch + "'");
- },
-
- value, // Place holder for the value function.
-
- array = function () {
-
-// Parse an array value.
-
- var array = [];
-
- if (ch === '[') {
- next('[');
- white();
- if (ch === ']') {
- next(']');
- return array; // empty array
- }
- while (ch) {
- array.push(value());
- white();
- if (ch === ']') {
- next(']');
- return array;
- }
- next(',');
- white();
- }
- }
- error("Bad array");
- },
-
- object = function () {
-
-// Parse an object value.
-
- var key,
- object = {};
-
- if (ch === '{') {
- next('{');
- white();
- if (ch === '}') {
- next('}');
- return object; // empty object
- }
- while (ch) {
- key = string();
- white();
- next(':');
- if (Object.hasOwnProperty.call(object, key)) {
- error('Duplicate key "' + key + '"');
- }
- object[key] = value();
- white();
- if (ch === '}') {
- next('}');
- return object;
- }
- next(',');
- white();
- }
- }
- error("Bad object");
- };
-
-value = function () {
-
-// Parse a JSON value. It could be an object, an array, a string, a number,
-// or a word.
-
- white();
- switch (ch) {
- case '{':
- return object();
- case '[':
- return array();
- case '"':
- return string();
- case '-':
- return number();
- default:
- return ch >= '0' && ch <= '9' ? number() : word();
- }
-};
-
-// Return the json_parse function. It will have access to all of the above
-// functions and variables.
-
-module.exports = function (source, reviver) {
- var result;
-
- text = source;
- at = 0;
- ch = ' ';
- result = value();
- white();
- if (ch) {
- error("Syntax error");
- }
-
- // If there is a reviver function, we recursively walk the new structure,
- // passing each name/value pair to the reviver function for possible
- // transformation, starting with a temporary root object that holds the result
- // in an empty key. If there is not a reviver function, we simply return the
- // result.
-
- return typeof reviver === 'function' ? (function walk(holder, key) {
- var k, v, value = holder[key];
- if (value && typeof value === 'object') {
- for (k in value) {
- if (Object.prototype.hasOwnProperty.call(value, k)) {
- v = walk(value, k);
- if (v !== undefined) {
- value[k] = v;
- } else {
- delete value[k];
- }
- }
- }
- }
- return reviver.call(holder, key, value);
- }({'': result}, '')) : result;
-};
-
-},{}],46:[function(require,module,exports){
-var cx = /[\u0000\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,
- escapable = /[\\\"\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g,
- gap,
- indent,
- meta = { // table of character substitutions
- '\b': '\\b',
- '\t': '\\t',
- '\n': '\\n',
- '\f': '\\f',
- '\r': '\\r',
- '"' : '\\"',
- '\\': '\\\\'
- },
- rep;
-
-function quote(string) {
- // If the string contains no control characters, no quote characters, and no
- // backslash characters, then we can safely slap some quotes around it.
- // Otherwise we must also replace the offending characters with safe escape
- // sequences.
-
- escapable.lastIndex = 0;
- return escapable.test(string) ? '"' + string.replace(escapable, function (a) {
- var c = meta[a];
- return typeof c === 'string' ? c :
- '\\u' + ('0000' + a.charCodeAt(0).toString(16)).slice(-4);
- }) + '"' : '"' + string + '"';
-}
-
-function str(key, holder) {
- // Produce a string from holder[key].
- var i, // The loop counter.
- k, // The member key.
- v, // The member value.
- length,
- mind = gap,
- partial,
- value = holder[key];
-
- // If the value has a toJSON method, call it to obtain a replacement value.
- if (value && typeof value === 'object' &&
- typeof value.toJSON === 'function') {
- value = value.toJSON(key);
- }
-
- // If we were called with a replacer function, then call the replacer to
- // obtain a replacement value.
- if (typeof rep === 'function') {
- value = rep.call(holder, key, value);
- }
-
- // What happens next depends on the value's type.
- switch (typeof value) {
- case 'string':
- return quote(value);
-
- case 'number':
- // JSON numbers must be finite. Encode non-finite numbers as null.
- return isFinite(value) ? String(value) : 'null';
-
- case 'boolean':
- case 'null':
- // If the value is a boolean or null, convert it to a string. Note:
- // typeof null does not produce 'null'. The case is included here in
- // the remote chance that this gets fixed someday.
- return String(value);
-
- case 'object':
- if (!value) return 'null';
- gap += indent;
- partial = [];
-
- // Array.isArray
- if (Object.prototype.toString.apply(value) === '[object Array]') {
- length = value.length;
- for (i = 0; i < length; i += 1) {
- partial[i] = str(i, value) || 'null';
- }
-
- // Join all of the elements together, separated with commas, and
- // wrap them in brackets.
- v = partial.length === 0 ? '[]' : gap ?
- '[\n' + gap + partial.join(',\n' + gap) + '\n' + mind + ']' :
- '[' + partial.join(',') + ']';
- gap = mind;
- return v;
- }
-
- // If the replacer is an array, use it to select the members to be
- // stringified.
- if (rep && typeof rep === 'object') {
- length = rep.length;
- for (i = 0; i < length; i += 1) {
- k = rep[i];
- if (typeof k === 'string') {
- v = str(k, value);
- if (v) {
- partial.push(quote(k) + (gap ? ': ' : ':') + v);
- }
- }
- }
- }
- else {
- // Otherwise, iterate through all of the keys in the object.
- for (k in value) {
- if (Object.prototype.hasOwnProperty.call(value, k)) {
- v = str(k, value);
- if (v) {
- partial.push(quote(k) + (gap ? ': ' : ':') + v);
- }
- }
- }
- }
-
- // Join all of the member texts together, separated with commas,
- // and wrap them in braces.
-
- v = partial.length === 0 ? '{}' : gap ?
- '{\n' + gap + partial.join(',\n' + gap) + '\n' + mind + '}' :
- '{' + partial.join(',') + '}';
- gap = mind;
- return v;
- }
-}
-
-module.exports = function (value, replacer, space) {
- var i;
- gap = '';
- indent = '';
-
- // If the space parameter is a number, make an indent string containing that
- // many spaces.
- if (typeof space === 'number') {
- for (i = 0; i < space; i += 1) {
- indent += ' ';
- }
- }
- // If the space parameter is a string, it will be used as the indent string.
- else if (typeof space === 'string') {
- indent = space;
- }
-
- // If there is a replacer, it must be a function or an array.
- // Otherwise, throw an error.
- rep = replacer;
- if (replacer && typeof replacer !== 'function'
- && (typeof replacer !== 'object' || typeof replacer.length !== 'number')) {
- throw new Error('JSON.stringify');
- }
-
- // Make a fake root object containing our value under the key of ''.
- // Return the result of stringifying the value.
- return str('', {'': value});
-};
-
-},{}],47:[function(require,module,exports){
+},{}],44:[function(require,module,exports){
(function (global){
/*! https://mths.be/punycode v1.4.1 by @mathias */
;(function(root) {
@@ -6356,7 +5906,7 @@ module.exports = function (value, replacer, space) {
}(this));
}).call(this,typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : typeof window !== "undefined" ? window : {})
-},{}],48:[function(require,module,exports){
+},{}],45:[function(require,module,exports){
// Copyright Joyent, Inc. and other Node contributors.
//
// Permission is hereby granted, free of charge, to any person obtaining a
@@ -6442,7 +5992,7 @@ var isArray = Array.isArray || function (xs) {
return Object.prototype.toString.call(xs) === '[object Array]';
};
-},{}],49:[function(require,module,exports){
+},{}],46:[function(require,module,exports){
// Copyright Joyent, Inc. and other Node contributors.
//
// Permission is hereby granted, free of charge, to any person obtaining a
@@ -6529,13 +6079,13 @@ var objectKeys = Object.keys || function (obj) {
return res;
};
-},{}],50:[function(require,module,exports){
+},{}],47:[function(require,module,exports){
'use strict';
exports.decode = exports.parse = require('./decode');
exports.encode = exports.stringify = require('./encode');
-},{"./decode":48,"./encode":49}],51:[function(require,module,exports){
+},{"./decode":45,"./encode":46}],48:[function(require,module,exports){
// Copyright Joyent, Inc. and other Node contributors.
//
// Permission is hereby granted, free of charge, to any person obtaining a
@@ -7269,7 +6819,7 @@ Url.prototype.parseHost = function() {
if (host) this.hostname = host;
};
-},{"./util":52,"punycode":47,"querystring":50}],52:[function(require,module,exports){
+},{"./util":49,"punycode":44,"querystring":47}],49:[function(require,module,exports){
'use strict';
module.exports = {
@@ -7294,7 +6844,7 @@ var compileSchema = require('./compile')
, resolve = require('./compile/resolve')
, Cache = require('./cache')
, SchemaObject = require('./compile/schema_obj')
- , stableStringify = require('json-stable-stringify')
+ , stableStringify = require('fast-json-stable-stringify')
, formats = require('./compile/formats')
, rules = require('./compile/rules')
, $dataMetaSchema = require('./$data')
@@ -7342,6 +6892,7 @@ var META_SUPPORT_DATA = ['/properties'];
function Ajv(opts) {
if (!(this instanceof Ajv)) return new Ajv(opts);
opts = this._opts = util.copy(opts) || {};
+ setLogger(this);
this._schemas = {};
this._refs = {};
this._fragments = {};
@@ -7371,7 +6922,7 @@ function Ajv(opts) {
/**
* Validate data using schema
- * Schema will be compiled and cached (using serialized JSON as key. [json-stable-stringify](https://github.com/substack/json-stable-stringify) is used to serialize.
+ * Schema will be compiled and cached (using serialized JSON as key. [fast-json-stable-stringify](https://github.com/epoberezkin/fast-json-stable-stringify) is used to serialize.
* @this Ajv
* @param {String|Object} schemaKeyRef key, ref or schema object
* @param {Any} data to be validated
@@ -7415,11 +6966,12 @@ function compile(schema, _meta) {
* @param {String} key Optional schema key. Can be passed to `validate` method instead of schema object or id/ref. One schema per instance can have empty `id` and `key`.
* @param {Boolean} _skipValidation true to skip schema validation. Used internally, option validateSchema should be used instead.
* @param {Boolean} _meta true if schema is a meta-schema. Used internally, addMetaSchema should be used instead.
+ * @return {Ajv} this for method chaining
*/
function addSchema(schema, key, _skipValidation, _meta) {
if (Array.isArray(schema)){
for (var i=0; i=1&&t<=12&&a>=1&&a<=h[t]}function o(e,r){var t=e.match(u);if(!t)return!1;return t[1]<=23&&t[2]<=59&&t[3]<=59&&(!r||t[5])}function i(e){if(E.test(e))return!1;try{return new RegExp(e),!0}catch(e){return!1}}var n=e("./util"),l=/^\d\d\d\d-(\d\d)-(\d\d)$/,h=[0,31,29,31,30,31,30,31,31,30,31,30,31],u=/^(\d\d):(\d\d):(\d\d)(\.\d+)?(z|[+-]\d\d:\d\d)?$/i,c=/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[-0-9a-z]{0,61}[0-9a-z])?)*$/i,d=/^(?:[a-z][a-z0-9+\-.]*:)(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*)*)(?:\?(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i,f=/^(?:(?:[^\x00-\x20"'<>%\\^`{|}]|%[0-9a-f]{2})|\{[+#./;?&=,!@|]?(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?(?:,(?:[a-z0-9_]|%[0-9a-f]{2})+(?::[1-9][0-9]{0,3}|\*)?)*\})*$/i,p=/^(?:(?:http[s\u017F]?|ftp):\/\/)(?:(?:[\0-\x08\x0E-\x1F!-\x9F\xA1-\u167F\u1681-\u1FFF\u200B-\u2027\u202A-\u202E\u2030-\u205E\u2060-\u2FFF\u3001-\uD7FF\uE000-\uFEFE\uFF00-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])+(?::(?:[\0-\x08\x0E-\x1F!-\x9F\xA1-\u167F\u1681-\u1FFF\u200B-\u2027\u202A-\u202E\u2030-\u205E\u2060-\u2FFF\u3001-\uD7FF\uE000-\uFEFE\uFF00-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])*)?@)?(?:(?!10(?:\.[0-9]{1,3}){3})(?!127(?:\.[0-9]{1,3}){3})(?!169\.254(?:\.[0-9]{1,3}){2})(?!192\.168(?:\.[0-9]{1,3}){2})(?!172\.(?:1[6-9]|2[0-9]|3[01])(?:\.[0-9]{1,3}){2})(?:[1-9][0-9]?|1[0-9][0-9]|2[01][0-9]|22[0-3])(?:\.(?:1?[0-9]{1,2}|2[0-4][0-9]|25[0-5])){2}(?:\.(?:[1-9][0-9]?|1[0-9][0-9]|2[0-4][0-9]|25[0-4]))|(?:(?:(?:[0-9KSa-z\xA1-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])+-?)*(?:[0-9KSa-z\xA1-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])+)(?:\.(?:(?:[0-9KSa-z\xA1-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])+-?)*(?:[0-9KSa-z\xA1-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])+)*(?:\.(?:(?:[KSa-z\xA1-\uD7FF\uE000-\uFFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF]){2,})))(?::[0-9]{2,5})?(?:\/(?:[\0-\x08\x0E-\x1F!-\x9F\xA1-\u167F\u1681-\u1FFF\u200B-\u2027\u202A-\u202E\u2030-\u205E\u2060-\u2FFF\u3001-\uD7FF\uE000-\uFEFE\uFF00-\uFFFF]|[\uD800-\uDBFF][\uDC00-\uDFFF]|[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?:[^\uD800-\uDBFF]|^)[\uDC00-\uDFFF])*)?$/i,m=/^(?:urn:uuid:)?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i,v=/^(?:\/(?:[^~/]|~0|~1)*)*$|^#(?:\/(?:[a-z0-9_\-.!$&'()*+,;:=@]|%[0-9a-f]{2}|~0|~1)*)*$/i,y=/^(?:0|[1-9][0-9]*)(?:#|(?:\/(?:[^~/]|~0|~1)*)*)$/;r.exports=a,a.fast={date:/^\d\d\d\d-[0-1]\d-[0-3]\d$/,time:/^[0-2]\d:[0-5]\d:[0-5]\d(?:\.\d+)?(?:z|[+-]\d\d:\d\d)?$/i,"date-time":/^\d\d\d\d-[0-1]\d-[0-3]\d[t\s][0-2]\d:[0-5]\d:[0-5]\d(?:\.\d+)?(?:z|[+-]\d\d:\d\d)$/i,uri:/^(?:[a-z][a-z0-9+-.]*)(?::|\/)\/?[^\s]*$/i,"uri-reference":/^(?:(?:[a-z][a-z0-9+-.]*:)?\/\/)?[^\s]*$/i,"uri-template":f,url:p,email:/^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/i,hostname:c,ipv4:/^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$/,ipv6:/^\s*(?:(?:(?:[0-9a-f]{1,4}:){7}(?:[0-9a-f]{1,4}|:))|(?:(?:[0-9a-f]{1,4}:){6}(?::[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(?:(?:[0-9a-f]{1,4}:){5}(?:(?:(?::[0-9a-f]{1,4}){1,2})|:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(?:(?:[0-9a-f]{1,4}:){4}(?:(?:(?::[0-9a-f]{1,4}){1,3})|(?:(?::[0-9a-f]{1,4})?:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(?:(?:[0-9a-f]{1,4}:){3}(?:(?:(?::[0-9a-f]{1,4}){1,4})|(?:(?::[0-9a-f]{1,4}){0,2}:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(?:(?:[0-9a-f]{1,4}:){2}(?:(?:(?::[0-9a-f]{1,4}){1,5})|(?:(?::[0-9a-f]{1,4}){0,3}:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(?:(?:[0-9a-f]{1,4}:){1}(?:(?:(?::[0-9a-f]{1,4}){1,6})|(?:(?::[0-9a-f]{1,4}){0,4}:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(?::(?:(?:(?::[0-9a-f]{1,4}){1,7})|(?:(?::[0-9a-f]{1,4}){0,5}:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(?:%.+)?\s*$/i,regex:i,uuid:m,"json-pointer":v,"relative-json-pointer":y},a.full={date:s,time:o,"date-time":function(e){var r=e.split(g);return 2==r.length&&s(r[0])&&o(r[1],!0)},uri:function(e){return P.test(e)&&d.test(e)},"uri-reference":/^(?:[a-z][a-z0-9+\-.]*:)?(?:\/?\/(?:(?:[a-z0-9\-._~!$&'()*+,;=:]|%[0-9a-f]{2})*@)?(?:\[(?:(?:(?:(?:[0-9a-f]{1,4}:){6}|::(?:[0-9a-f]{1,4}:){5}|(?:[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){4}|(?:(?:[0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){3}|(?:(?:[0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::(?:[0-9a-f]{1,4}:){2}|(?:(?:[0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:|(?:(?:[0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::)(?:[0-9a-f]{1,4}:[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?))|(?:(?:[0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4}|(?:(?:[0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::)|[Vv][0-9a-f]+\.[a-z0-9\-._~!$&'()*+,;=:]+)\]|(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)|(?:[a-z0-9\-._~!$&'"()*+,;=]|%[0-9a-f]{2})*)(?::\d*)?(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*|\/(?:(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?|(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})+(?:\/(?:[a-z0-9\-._~!$&'"()*+,;=:@]|%[0-9a-f]{2})*)*)?(?:\?(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?(?:#(?:[a-z0-9\-._~!$&'"()*+,;=:@/?]|%[0-9a-f]{2})*)?$/i,"uri-template":f,url:p,email:/^[a-z0-9!#$%&'*+/=?^_`{|}~-]+(?:\.[a-z0-9!#$%&''*+/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i,hostname:function(e){return e.length<=255&&c.test(e)},ipv4:/^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)$/,ipv6:/^\s*(?:(?:(?:[0-9a-f]{1,4}:){7}(?:[0-9a-f]{1,4}|:))|(?:(?:[0-9a-f]{1,4}:){6}(?::[0-9a-f]{1,4}|(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(?:(?:[0-9a-f]{1,4}:){5}(?:(?:(?::[0-9a-f]{1,4}){1,2})|:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(?:(?:[0-9a-f]{1,4}:){4}(?:(?:(?::[0-9a-f]{1,4}){1,3})|(?:(?::[0-9a-f]{1,4})?:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(?:(?:[0-9a-f]{1,4}:){3}(?:(?:(?::[0-9a-f]{1,4}){1,4})|(?:(?::[0-9a-f]{1,4}){0,2}:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(?:(?:[0-9a-f]{1,4}:){2}(?:(?:(?::[0-9a-f]{1,4}){1,5})|(?:(?::[0-9a-f]{1,4}){0,3}:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(?:(?:[0-9a-f]{1,4}:){1}(?:(?:(?::[0-9a-f]{1,4}){1,6})|(?:(?::[0-9a-f]{1,4}){0,4}:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(?::(?:(?:(?::[0-9a-f]{1,4}){1,7})|(?:(?::[0-9a-f]{1,4}){0,5}:(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(?:%.+)?\s*$/i,regex:i,uuid:m,"json-pointer":v,"relative-json-pointer":y};var g=/t|\s/i,P=/\/|:/,E=/[^\\]\\Z/},{"./util":12}],7:[function(e,r,t){"use strict";function a(e,r,t,P){function E(){var e=C.validate,r=e.apply(null,arguments);return E.errors=e.errors,r}function w(e,t,s,f){var P=!t||t&&t.schema==e;if(t.schema!=r.schema)return a.call($,e,t,s,f);var E=!0===e.$async,w=p({isTop:!0,schema:e,isRoot:P,baseId:f,root:t,schemaPath:"",errSchemaPath:"#",errorPath:'""',MissingRefError:d.MissingRef,RULES:U,validate:p,util:c,resolve:u,resolveRef:b,usePattern:_,useDefault:x,useCustomRule:F,opts:R,formats:Q,logger:$.logger,self:$});w=h(O,n)+h(I,o)+h(k,i)+h(L,l)+w,R.processCode&&(w=R.processCode(w));var S;try{S=new Function("self","RULES","formats","root","refVal","defaults","customRules","co","equal","ucs2length","ValidationError",w)($,U,Q,r,O,k,L,m,y,v,g),O[0]=S}catch(e){throw $.logger.error("Error compiling schema, function code:",w),e}return S.schema=e,S.errors=null,S.refs=D,S.refVal=O,S.root=P?S:t,E&&(S.$async=!0),!0===R.sourceCode&&(S.source={code:w,patterns:I,defaults:k}),S}function b(e,s,o){s=u.url(e,s);var i,n,l=D[s];if(void 0!==l)return i=O[l],n="refVal["+l+"]",j(i,n);if(!o&&r.refs){var h=r.refs[s];if(void 0!==h)return i=r.refVal[h],n=S(s,i),j(i,n)}n=S(s);var c=u.call($,w,r,s);if(void 0===c){var d=t&&t[s];d&&(c=u.inlineRef(d,R.inlineRefs)?d:a.call($,d,r,t,e))}if(void 0!==c)return function(e,r){O[D[e]]=r}(s,c),j(c,n);!function(e){delete D[e]}(s)}function S(e,r){var t=O.length;return O[t]=r,D[e]=t,"refVal"+t}function j(e,r){return"object"==typeof e||"boolean"==typeof e?{code:r,schema:e,inline:!0}:{code:r,$async:e&&e.$async}}function _(e){var r=A[e];return void 0===r&&(r=A[e]=I.length,I[r]=e),"pattern"+r}function x(e){switch(typeof e){case"boolean":case"number":return""+e;case"string":return c.toQuotedString(e);case"object":if(null===e)return"null";var r=f(e),t=q[r];return void 0===t&&(t=q[r]=k.length,k[t]=e),"default"+t}}function F(e,r,t,a){var s=e.definition.validateSchema;if(s&&!1!==$._opts.validateSchema){if(!s(r)){var o="keyword schema is invalid: "+$.errorsText(s.errors);if("log"!=$._opts.validateSchema)throw new Error(o);$.logger.error(o)}}var i,n=e.definition.compile,l=e.definition.inline,h=e.definition.macro;if(n)i=n.call($,r,t,a);else if(h)i=h.call($,r,t,a),!1!==R.validateSchema&&$.validateSchema(i,!0);else if(l)i=l.call($,a,e.keyword,r,t);else if(!(i=e.definition.validate))return;if(void 0===i)throw new Error('custom keyword "'+e.keyword+'"failed to compile');var u=L.length;return L[u]=i,{code:"customRule"+u,validate:i}}var $=this,R=this._opts,O=[void 0],D={},I=[],A={},k=[],q={},L=[],z=function(e,r,t){var a=s.call(this,e,r,t);return a>=0?{index:a,compiling:!0}:(a=this._compilations.length,this._compilations[a]={schema:e,root:r,baseId:t},{index:a,compiling:!1})}.call(this,e,r=r||{schema:e,refVal:O,refs:D},P),C=this._compilations[z.index];if(z.compiling)return C.callValidate=E;var Q=this._formats,U=this.RULES;try{var V=w(e,r,t,P);C.validate=V;var N=C.callValidate;return N&&(N.schema=V.schema,N.errors=null,N.refs=V.refs,N.refVal=V.refVal,N.root=V.root,N.$async=V.$async,R.sourceCode&&(N.source=V.source)),V}finally{(function(e,r,t){var a=s.call(this,e,r,t);a>=0&&this._compilations.splice(a,1)}).call(this,e,r,P)}}function s(e,r,t){for(var a=0;a=55296&&r<=56319&&s=r)throw new Error("Cannot access property/index "+a+" levels up, current level is "+r);return t[r-a]}if(a>r)throw new Error("Cannot access data "+a+" levels up, current level is "+r);if(i="data"+(r-a||""),!s)return i}for(var l=i,h=s.split("/"),c=0;c",y=f?">":"<",g=void 0;if(e.opts.$data&&m&&m.$data){var P=e.util.getData(m.$data,i,e.dataPathArr),E="exclusive"+o,w="exclType"+o,b="exclIsNumber"+o,S="' + "+(_="op"+o)+" + '";s+=" var schemaExcl"+o+" = "+P+"; ",s+=" var "+E+"; var "+w+" = typeof "+(P="schemaExcl"+o)+"; if ("+w+" != 'boolean' && "+w+" != 'undefined' && "+w+" != 'number') { ";g=p;(x=x||[]).push(s),s="",!1!==e.createErrors?(s+=" { keyword: '"+(g||"_exclusiveLimit")+"' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(h)+" , params: {} ",!1!==e.opts.messages&&(s+=" , message: '"+p+" should be boolean' "),e.opts.verbose&&(s+=" , schema: validate.schema"+l+" , parentSchema: validate.schema"+e.schemaPath+" , data: "+c+" "),s+=" } "):s+=" {} ";var j=s;s=x.pop(),s+=!e.compositeRule&&u?e.async?" throw new ValidationError(["+j+"]); ":" validate.errors = ["+j+"]; return false; ":" var err = "+j+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",s+=" } else if ( ",d&&(s+=" ("+a+" !== undefined && typeof "+a+" != 'number') || "),s+=" "+w+" == 'number' ? ( ("+E+" = "+a+" === undefined || "+P+" "+v+"= "+a+") ? "+c+" "+y+"= "+P+" : "+c+" "+y+" "+a+" ) : ( ("+E+" = "+P+" === true) ? "+c+" "+y+"= "+a+" : "+c+" "+y+" "+a+" ) || "+c+" !== "+c+") { var op"+o+" = "+E+" ? '"+v+"' : '"+v+"=';"}else{S=v;if((b="number"==typeof m)&&d){var _="'"+S+"'";s+=" if ( ",d&&(s+=" ("+a+" !== undefined && typeof "+a+" != 'number') || "),s+=" ( "+a+" === undefined || "+m+" "+v+"= "+a+" ? "+c+" "+y+"= "+m+" : "+c+" "+y+" "+a+" ) || "+c+" !== "+c+") { "}else{b&&void 0===n?(E=!0,g=p,h=e.errSchemaPath+"/"+p,a=m,y+="="):(b&&(a=Math[f?"min":"max"](m,n)),m===(!b||a)?(E=!0,g=p,h=e.errSchemaPath+"/"+p,y+="="):(E=!1,S+="="));_="'"+S+"'";s+=" if ( ",d&&(s+=" ("+a+" !== undefined && typeof "+a+" != 'number') || "),s+=" "+c+" "+y+" "+a+" || "+c+" !== "+c+") { "}}g=g||r;var x;(x=x||[]).push(s),s="",!1!==e.createErrors?(s+=" { keyword: '"+(g||"_limit")+"' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(h)+" , params: { comparison: "+_+", limit: "+a+", exclusive: "+E+" } ",!1!==e.opts.messages&&(s+=" , message: 'should be "+S+" ",s+=d?"' + "+a:a+"'"),e.opts.verbose&&(s+=" , schema: ",s+=d?"validate.schema"+l:""+n,s+=" , parentSchema: validate.schema"+e.schemaPath+" , data: "+c+" "),s+=" } "):s+=" {} ";j=s;return s=x.pop(),s+=!e.compositeRule&&u?e.async?" throw new ValidationError(["+j+"]); ":" validate.errors = ["+j+"]; return false; ":" var err = "+j+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",s+=" } ",u&&(s+=" else { "),s}},{}],14:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a,s=" ",o=e.level,i=e.dataLevel,n=e.schema[r],l=e.schemaPath+e.util.getProperty(r),h=e.errSchemaPath+"/"+r,u=!e.opts.allErrors,c="data"+(i||""),d=e.opts.$data&&n&&n.$data;d?(s+=" var schema"+o+" = "+e.util.getData(n.$data,i,e.dataPathArr)+"; ",a="schema"+o):a=n;s+="if ( ",d&&(s+=" ("+a+" !== undefined && typeof "+a+" != 'number') || "),s+=" "+c+".length "+("maxItems"==r?">":"<")+" "+a+") { ";var f=r,p=p||[];p.push(s),s="",!1!==e.createErrors?(s+=" { keyword: '"+(f||"_limitItems")+"' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(h)+" , params: { limit: "+a+" } ",!1!==e.opts.messages&&(s+=" , message: 'should NOT have ",s+="maxItems"==r?"more":"less",s+=" than ",s+=d?"' + "+a+" + '":""+n,s+=" items' "),e.opts.verbose&&(s+=" , schema: ",s+=d?"validate.schema"+l:""+n,s+=" , parentSchema: validate.schema"+e.schemaPath+" , data: "+c+" "),s+=" } "):s+=" {} ";var m=s;return s=p.pop(),s+=!e.compositeRule&&u?e.async?" throw new ValidationError(["+m+"]); ":" validate.errors = ["+m+"]; return false; ":" var err = "+m+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",s+="} ",u&&(s+=" else { "),s}},{}],15:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a,s=" ",o=e.level,i=e.dataLevel,n=e.schema[r],l=e.schemaPath+e.util.getProperty(r),h=e.errSchemaPath+"/"+r,u=!e.opts.allErrors,c="data"+(i||""),d=e.opts.$data&&n&&n.$data;d?(s+=" var schema"+o+" = "+e.util.getData(n.$data,i,e.dataPathArr)+"; ",a="schema"+o):a=n;s+="if ( ",d&&(s+=" ("+a+" !== undefined && typeof "+a+" != 'number') || "),s+=!1===e.opts.unicode?" "+c+".length ":" ucs2length("+c+") ",s+=" "+("maxLength"==r?">":"<")+" "+a+") { ";var f=r,p=p||[];p.push(s),s="",!1!==e.createErrors?(s+=" { keyword: '"+(f||"_limitLength")+"' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(h)+" , params: { limit: "+a+" } ",!1!==e.opts.messages&&(s+=" , message: 'should NOT be ",s+="maxLength"==r?"longer":"shorter",s+=" than ",s+=d?"' + "+a+" + '":""+n,s+=" characters' "),e.opts.verbose&&(s+=" , schema: ",s+=d?"validate.schema"+l:""+n,s+=" , parentSchema: validate.schema"+e.schemaPath+" , data: "+c+" "),s+=" } "):s+=" {} ";var m=s;return s=p.pop(),s+=!e.compositeRule&&u?e.async?" throw new ValidationError(["+m+"]); ":" validate.errors = ["+m+"]; return false; ":" var err = "+m+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",s+="} ",u&&(s+=" else { "),s}},{}],16:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a,s=" ",o=e.level,i=e.dataLevel,n=e.schema[r],l=e.schemaPath+e.util.getProperty(r),h=e.errSchemaPath+"/"+r,u=!e.opts.allErrors,c="data"+(i||""),d=e.opts.$data&&n&&n.$data;d?(s+=" var schema"+o+" = "+e.util.getData(n.$data,i,e.dataPathArr)+"; ",a="schema"+o):a=n;s+="if ( ",d&&(s+=" ("+a+" !== undefined && typeof "+a+" != 'number') || "),s+=" Object.keys("+c+").length "+("maxProperties"==r?">":"<")+" "+a+") { ";var f=r,p=p||[];p.push(s),s="",!1!==e.createErrors?(s+=" { keyword: '"+(f||"_limitProperties")+"' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(h)+" , params: { limit: "+a+" } ",!1!==e.opts.messages&&(s+=" , message: 'should NOT have ",s+="maxProperties"==r?"more":"less",s+=" than ",s+=d?"' + "+a+" + '":""+n,s+=" properties' "),e.opts.verbose&&(s+=" , schema: ",s+=d?"validate.schema"+l:""+n,s+=" , parentSchema: validate.schema"+e.schemaPath+" , data: "+c+" "),s+=" } "):s+=" {} ";var m=s;return s=p.pop(),s+=!e.compositeRule&&u?e.async?" throw new ValidationError(["+m+"]); ":" validate.errors = ["+m+"]; return false; ":" var err = "+m+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",s+="} ",u&&(s+=" else { "),s}},{}],17:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a=" ",s=e.schema[r],o=e.schemaPath+e.util.getProperty(r),i=e.errSchemaPath+"/"+r,n=!e.opts.allErrors,l=e.util.copy(e),h="";l.level++;var u="valid"+l.level,c=l.baseId,d=!0,f=s;if(f)for(var p,m=-1,v=f.length-1;m=0)return h&&(a+=" if (true) { "),a;throw new Error('unknown format "'+i+'" is used in schema at path "'+e.errSchemaPath+'"')}var v,y=(v="object"==typeof m&&!(m instanceof RegExp)&&m.validate)&&m.type||"string";if(v){var g=!0===m.async;m=m.validate}if(y!=t)return h&&(a+=" if (true) { "),a;if(g){if(!e.async)throw new Error("async format in sync schema");var P="formats"+e.util.getProperty(i)+".validate";a+=" if (!("+e.yieldAwait+" "+P+"("+u+"))) { "}else{a+=" if (! ";P="formats"+e.util.getProperty(i);v&&(P+=".validate"),a+="function"==typeof m?" "+P+"("+u+") ":" "+P+".test("+u+") ",a+=") { "}}var E=E||[];E.push(a),a="",!1!==e.createErrors?(a+=" { keyword: 'format' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(l)+" , params: { format: ",a+=d?""+c:""+e.util.toQuotedString(i),a+=" } ",!1!==e.opts.messages&&(a+=" , message: 'should match format \"",a+=d?"' + "+c+" + '":""+e.util.escapeQuotes(i),a+="\"' "),e.opts.verbose&&(a+=" , schema: ",a+=d?"validate.schema"+n:""+e.util.toQuotedString(i),a+=" , parentSchema: validate.schema"+e.schemaPath+" , data: "+u+" "),a+=" } "):a+=" {} ";var w=a;return a=E.pop(),a+=!e.compositeRule&&h?e.async?" throw new ValidationError(["+w+"]); ":" validate.errors = ["+w+"]; return false; ":" var err = "+w+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",a+=" } ",h&&(a+=" else { "),a}},{}],25:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a=" ",s=e.level,o=e.dataLevel,i=e.schema[r],n=e.schemaPath+e.util.getProperty(r),l=e.errSchemaPath+"/"+r,h=!e.opts.allErrors,u="data"+(o||""),c="valid"+s,d="errs__"+s,f=e.util.copy(e),p="";f.level++;var m="valid"+f.level,v="i"+s,y=f.dataLevel=e.dataLevel+1,g="data"+y,P=e.baseId;if(a+="var "+d+" = errors;var "+c+";",Array.isArray(i)){var E=e.schema.additionalItems;if(!1===E){a+=" "+c+" = "+u+".length <= "+i.length+"; ";var w=l;l=e.errSchemaPath+"/additionalItems",a+=" if (!"+c+") { ";var b=b||[];b.push(a),a="",!1!==e.createErrors?(a+=" { keyword: 'additionalItems' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(l)+" , params: { limit: "+i.length+" } ",!1!==e.opts.messages&&(a+=" , message: 'should NOT have more than "+i.length+" items' "),e.opts.verbose&&(a+=" , schema: false , parentSchema: validate.schema"+e.schemaPath+" , data: "+u+" "),a+=" } "):a+=" {} ";var S=a;a=b.pop(),a+=!e.compositeRule&&h?e.async?" throw new ValidationError(["+S+"]); ":" validate.errors = ["+S+"]; return false; ":" var err = "+S+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",a+=" } ",l=w,h&&(p+="}",a+=" else { ")}var j=i;if(j)for(var _,x=-1,F=j.length-1;x "+x+") { ";var $=u+"["+x+"]";f.schema=_,f.schemaPath=n+"["+x+"]",f.errSchemaPath=l+"/"+x,f.errorPath=e.util.getPathExpr(e.errorPath,x,e.opts.jsonPointers,!0),f.dataPathArr[y]=x;var R=e.validate(f);f.baseId=P,e.util.varOccurences(R,g)<2?a+=" "+e.util.varReplace(R,g,$)+" ":a+=" var "+g+" = "+$+"; "+R+" ",a+=" } ",h&&(a+=" if ("+m+") { ",p+="}")}if("object"==typeof E&&e.util.schemaHasRules(E,e.RULES.all)){f.schema=E,f.schemaPath=e.schemaPath+".additionalItems",f.errSchemaPath=e.errSchemaPath+"/additionalItems",a+=" "+m+" = true; if ("+u+".length > "+i.length+") { for (var "+v+" = "+i.length+"; "+v+" < "+u+".length; "+v+"++) { ",f.errorPath=e.util.getPathExpr(e.errorPath,v,e.opts.jsonPointers,!0);$=u+"["+v+"]";f.dataPathArr[y]=v;R=e.validate(f);f.baseId=P,e.util.varOccurences(R,g)<2?a+=" "+e.util.varReplace(R,g,$)+" ":a+=" var "+g+" = "+$+"; "+R+" ",h&&(a+=" if (!"+m+") break; "),a+=" } } ",h&&(a+=" if ("+m+") { ",p+="}")}}else if(e.util.schemaHasRules(i,e.RULES.all)){f.schema=i,f.schemaPath=n,f.errSchemaPath=l,a+=" for (var "+v+" = 0; "+v+" < "+u+".length; "+v+"++) { ",f.errorPath=e.util.getPathExpr(e.errorPath,v,e.opts.jsonPointers,!0);$=u+"["+v+"]";f.dataPathArr[y]=v;R=e.validate(f);f.baseId=P,e.util.varOccurences(R,g)<2?a+=" "+e.util.varReplace(R,g,$)+" ":a+=" var "+g+" = "+$+"; "+R+" ",h&&(a+=" if (!"+m+") break; "),a+=" }"}return h&&(a+=" "+p+" if ("+d+" == errors) {"),a=e.util.cleanUpCode(a)}},{}],26:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a,s=" ",o=e.level,i=e.dataLevel,n=e.schema[r],l=e.schemaPath+e.util.getProperty(r),h=e.errSchemaPath+"/"+r,u=!e.opts.allErrors,c="data"+(i||""),d=e.opts.$data&&n&&n.$data;d?(s+=" var schema"+o+" = "+e.util.getData(n.$data,i,e.dataPathArr)+"; ",a="schema"+o):a=n,s+="var division"+o+";if (",d&&(s+=" "+a+" !== undefined && ( typeof "+a+" != 'number' || "),s+=" (division"+o+" = "+c+" / "+a+", ",s+=e.opts.multipleOfPrecision?" Math.abs(Math.round(division"+o+") - division"+o+") > 1e-"+e.opts.multipleOfPrecision+" ":" division"+o+" !== parseInt(division"+o+") ",s+=" ) ",d&&(s+=" ) "),s+=" ) { ";var f=f||[];f.push(s),s="",!1!==e.createErrors?(s+=" { keyword: 'multipleOf' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(h)+" , params: { multipleOf: "+a+" } ",!1!==e.opts.messages&&(s+=" , message: 'should be multiple of ",s+=d?"' + "+a:a+"'"),e.opts.verbose&&(s+=" , schema: ",s+=d?"validate.schema"+l:""+n,s+=" , parentSchema: validate.schema"+e.schemaPath+" , data: "+c+" "),s+=" } "):s+=" {} ";var p=s;return s=f.pop(),s+=!e.compositeRule&&u?e.async?" throw new ValidationError(["+p+"]); ":" validate.errors = ["+p+"]; return false; ":" var err = "+p+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",s+="} ",u&&(s+=" else { "),s}},{}],27:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a=" ",s=e.level,o=e.dataLevel,i=e.schema[r],n=e.schemaPath+e.util.getProperty(r),l=e.errSchemaPath+"/"+r,h=!e.opts.allErrors,u="data"+(o||""),c="errs__"+s,d=e.util.copy(e);d.level++;var f="valid"+d.level;if(e.util.schemaHasRules(i,e.RULES.all)){d.schema=i,d.schemaPath=n,d.errSchemaPath=l,a+=" var "+c+" = errors; ";var p=e.compositeRule;e.compositeRule=d.compositeRule=!0,d.createErrors=!1;var m;d.opts.allErrors&&(m=d.opts.allErrors,d.opts.allErrors=!1),a+=" "+e.validate(d)+" ",d.createErrors=!0,m&&(d.opts.allErrors=m),e.compositeRule=d.compositeRule=p,a+=" if ("+f+") { ";var v=v||[];v.push(a),a="",!1!==e.createErrors?(a+=" { keyword: 'not' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(l)+" , params: {} ",!1!==e.opts.messages&&(a+=" , message: 'should NOT be valid' "),e.opts.verbose&&(a+=" , schema: validate.schema"+n+" , parentSchema: validate.schema"+e.schemaPath+" , data: "+u+" "),a+=" } "):a+=" {} ";var y=a;a=v.pop(),a+=!e.compositeRule&&h?e.async?" throw new ValidationError(["+y+"]); ":" validate.errors = ["+y+"]; return false; ":" var err = "+y+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",a+=" } else { errors = "+c+"; if (vErrors !== null) { if ("+c+") vErrors.length = "+c+"; else vErrors = null; } ",e.opts.allErrors&&(a+=" } ")}else a+=" var err = ",!1!==e.createErrors?(a+=" { keyword: 'not' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(l)+" , params: {} ",!1!==e.opts.messages&&(a+=" , message: 'should NOT be valid' "),e.opts.verbose&&(a+=" , schema: validate.schema"+n+" , parentSchema: validate.schema"+e.schemaPath+" , data: "+u+" "),a+=" } "):a+=" {} ",a+="; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",h&&(a+=" if (false) { ");return a}},{}],28:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a=" ",s=e.level,o=e.dataLevel,i=e.schema[r],n=e.schemaPath+e.util.getProperty(r),l=e.errSchemaPath+"/"+r,h=!e.opts.allErrors,u="data"+(o||""),c="valid"+s,d="errs__"+s,f=e.util.copy(e),p="";f.level++;var m="valid"+f.level;a+="var "+d+" = errors;var prevValid"+s+" = false;var "+c+" = false;";var v=f.baseId,y=e.compositeRule;e.compositeRule=f.compositeRule=!0;var g=i;if(g)for(var P,E=-1,w=g.length-1;E5)a+=" || validate.schema"+n+"["+v+"] ";else{var L=w;if(L)for(var z=-1,C=L.length-1;z= "+ve+"; ",l=e.errSchemaPath+"/patternGroups/minimum",a+=" if (!"+c+") { ";(we=we||[]).push(a),a="",!1!==e.createErrors?(a+=" { keyword: 'patternGroups' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(l)+" , params: { reason: '"+Pe+"', limit: "+ge+", pattern: '"+e.util.escapeQuotes(ce)+"' } ",!1!==e.opts.messages&&(a+=" , message: 'should NOT have "+Ee+" than "+ge+' properties matching pattern "'+e.util.escapeQuotes(ce)+"\"' "),e.opts.verbose&&(a+=" , schema: validate.schema"+n+" , parentSchema: validate.schema"+e.schemaPath+" , data: "+u+" "),a+=" } "):a+=" {} ";B=a;a=we.pop(),a+=!e.compositeRule&&h?e.async?" throw new ValidationError(["+B+"]); ":" validate.errors = ["+B+"]; return false; ":" var err = "+B+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",a+=" } ",void 0!==ye&&(a+=" else ")}if(void 0!==ye){ge=ye,Pe="maximum",Ee="more";a+=" "+c+" = pgPropCount"+s+" <= "+ye+"; ",l=e.errSchemaPath+"/patternGroups/maximum",a+=" if (!"+c+") { ";var we;(we=we||[]).push(a),a="",!1!==e.createErrors?(a+=" { keyword: 'patternGroups' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(l)+" , params: { reason: '"+Pe+"', limit: "+ge+", pattern: '"+e.util.escapeQuotes(ce)+"' } ",!1!==e.opts.messages&&(a+=" , message: 'should NOT have "+Ee+" than "+ge+' properties matching pattern "'+e.util.escapeQuotes(ce)+"\"' "),e.opts.verbose&&(a+=" , schema: validate.schema"+n+" , parentSchema: validate.schema"+e.schemaPath+" , data: "+u+" "),a+=" } "):a+=" {} ";B=a;a=we.pop(),a+=!e.compositeRule&&h?e.async?" throw new ValidationError(["+B+"]); ":" validate.errors = ["+B+"]; return false; ":" var err = "+B+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",a+=" } "}l=K,h&&(a+=" if ("+c+") { ",p+="}")}}}}return h&&(a+=" "+p+" if ("+d+" == errors) {"),a=e.util.cleanUpCode(a)}},{}],31:[function(e,r,t){"use strict";r.exports=function(e,r,t){var a=" ",s=e.level,o=e.dataLevel,i=e.schema[r],n=e.schemaPath+e.util.getProperty(r),l=e.errSchemaPath+"/"+r,h=!e.opts.allErrors,u="data"+(o||""),c="errs__"+s,d=e.util.copy(e);d.level++;var f="valid"+d.level;if(e.util.schemaHasRules(i,e.RULES.all)){d.schema=i,d.schemaPath=n,d.errSchemaPath=l;var p="key"+s,m="idx"+s,v="i"+s,y="' + "+p+" + '",g="data"+(d.dataLevel=e.dataLevel+1),P="dataProperties"+s,E=e.opts.ownProperties,w=e.baseId;a+=" var "+c+" = errors; ",E&&(a+=" var "+P+" = undefined; "),a+=E?" "+P+" = "+P+" || Object.keys("+u+"); for (var "+m+"=0; "+m+"<"+P+".length; "+m+"++) { var "+p+" = "+P+"["+m+"]; ":" for (var "+p+" in "+u+") { ",a+=" var startErrs"+s+" = errors; ";var b=p,S=e.compositeRule;e.compositeRule=d.compositeRule=!0;var j=e.validate(d);d.baseId=w,e.util.varOccurences(j,g)<2?a+=" "+e.util.varReplace(j,g,b)+" ":a+=" var "+g+" = "+b+"; "+j+" ",e.compositeRule=d.compositeRule=S,a+=" if (!"+f+") { for (var "+v+"=startErrs"+s+"; "+v+"=e.opts.loopRequired,b=e.opts.ownProperties;if(h)if(a+=" var missing"+s+"; ",w){d||(a+=" var "+f+" = validate.schema"+n+"; ");var S="' + "+(R="schema"+s+"["+(x="i"+s)+"]")+" + '";e.opts._errorDataPathProperty&&(e.errorPath=e.util.getPathExpr(E,R,e.opts.jsonPointers)),a+=" var "+c+" = true; ",d&&(a+=" if (schema"+s+" === undefined) "+c+" = true; else if (!Array.isArray(schema"+s+")) "+c+" = false; else {"),a+=" for (var "+x+" = 0; "+x+" < "+f+".length; "+x+"++) { "+c+" = "+u+"["+f+"["+x+"]] !== undefined ",b&&(a+=" && Object.prototype.hasOwnProperty.call("+u+", "+f+"["+x+"]) "),a+="; if (!"+c+") break; } ",d&&(a+=" } "),a+=" if (!"+c+") { ";($=$||[]).push(a),a="",!1!==e.createErrors?(a+=" { keyword: 'required' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(l)+" , params: { missingProperty: '"+S+"' } ",!1!==e.opts.messages&&(a+=" , message: '",a+=e.opts._errorDataPathProperty?"is a required property":"should have required property \\'"+S+"\\'",a+="' "),e.opts.verbose&&(a+=" , schema: validate.schema"+n+" , parentSchema: validate.schema"+e.schemaPath+" , data: "+u+" "),a+=" } "):a+=" {} ";var j=a;a=$.pop(),a+=!e.compositeRule&&h?e.async?" throw new ValidationError(["+j+"]); ":" validate.errors = ["+j+"]; return false; ":" var err = "+j+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",a+=" } else { "}else{a+=" if ( ";var _=p;if(_)for(var x=-1,F=_.length-1;x 1) { var i = "+c+".length, j; outer: for (;i--;) { for (j = i; j--;) { if (equal("+c+"[i], "+c+"[j])) { "+d+" = false; break outer; } } } } ",f&&(s+=" } "),s+=" if (!"+d+") { ";var p=p||[];p.push(s),s="",!1!==e.createErrors?(s+=" { keyword: 'uniqueItems' , dataPath: (dataPath || '') + "+e.errorPath+" , schemaPath: "+e.util.toQuotedString(h)+" , params: { i: i, j: j } ",!1!==e.opts.messages&&(s+=" , message: 'should NOT have duplicate items (items ## ' + j + ' and ' + i + ' are identical)' "),e.opts.verbose&&(s+=" , schema: ",s+=f?"validate.schema"+l:""+n,s+=" , parentSchema: validate.schema"+e.schemaPath+" , data: "+c+" "),s+=" } "):s+=" {} ";var m=s;s=p.pop(),s+=!e.compositeRule&&u?e.async?" throw new ValidationError(["+m+"]); ":" validate.errors = ["+m+"]; return false; ":" var err = "+m+"; if (vErrors === null) vErrors = [err]; else vErrors.push(err); errors++; ",s+=" } ",u&&(s+=" else { ")}else u&&(s+=" if (true) { ");return s}},{}],35:[function(e,r,t){"use strict";r.exports=function(e,r,t){function a(e){for(var r=e.rules,t=0;t2&&(r=n.call(arguments,1)),t(r)})})}.call(this,e):Array.isArray(e)?function(e){return Promise.all(e.map(s,this))}.call(this,e):function(e){return Object==e.constructor}(e)?function(e){for(var r=new e.constructor,t=Object.keys(e),a=[],i=0;i1&&(a=t[0]+"@",e=t[1]);return a+o((e=e.replace(O,".")).split("."),r).join(".")}function n(e){for(var r,t,a=[],s=0,o=e.length;s=55296&&r<=56319&&s65535&&(r+=k((e-=65536)>>>10&1023|55296),e=56320|1023&e),r+=k(e)}).join("")}function h(e){return e-48<10?e-22:e-65<26?e-65:e-97<26?e-97:E}function u(e,r){return e+22+75*(e<26)-((0!=r)<<5)}function c(e,r,t){var a=0;for(e=t?A(e/j):e>>1,e+=A(e/r);e>I*b>>1;a+=E)e=A(e/I);return A(a+(I+1)*e/(e+S))}function d(e){var r,t,a,o,i,n,u,d,f,p,m=[],v=e.length,y=0,g=x,S=_;for((t=e.lastIndexOf(F))<0&&(t=0),a=0;a=128&&s("not-basic"),m.push(e.charCodeAt(a));for(o=t>0?t+1:0;o=v&&s("invalid-input"),((d=h(e.charCodeAt(o++)))>=E||d>A((P-y)/n))&&s("overflow"),y+=d*n,f=u<=S?w:u>=S+b?b:u-S,!(dA(P/(p=E-f))&&s("overflow"),n*=p;S=c(y-i,r=m.length+1,0==i),A(y/r)>P-g&&s("overflow"),g+=A(y/r),y%=r,m.splice(y++,0,g)}return l(m)}function f(e){var r,t,a,o,i,l,h,d,f,p,m,v,y,g,S,j=[];for(v=(e=n(e)).length,r=x,t=0,i=_,l=0;l=r&&mA((P-t)/(y=a+1))&&s("overflow"),t+=(h-r)*y,r=h,l=0;lP&&s("overflow"),m==r){for(d=t,f=E;p=f<=i?w:f>=i+b?b:f-i,!(d= 0x80 (not a basic code point)","invalid-input":"Invalid input"},I=E-w,A=Math.floor,k=String.fromCharCode;if(y={version:"1.4.1",ucs2:{decode:n,encode:l},decode:d,encode:f,toASCII:function(e){return i(e,function(e){return R.test(e)?"xn--"+f(e):e})},toUnicode:function(e){return i(e,function(e){return $.test(e)?d(e.slice(4).toLowerCase()):e})}},p&&m)if(r.exports==p)m.exports=y;else for(g in y)y.hasOwnProperty(g)&&(p[g]=y[g]);else a.punycode=y}(this)}).call(this,"undefined"!=typeof global?global:"undefined"!=typeof self?self:"undefined"!=typeof window?window:{})},{}],45:[function(e,r,t){"use strict";function a(e,r){return Object.prototype.hasOwnProperty.call(e,r)}r.exports=function(e,r,t,o){r=r||"&",t=t||"=";var i={};if("string"!=typeof e||0===e.length)return i;var n=/\+/g;e=e.split(r);var l=1e3;o&&"number"==typeof o.maxKeys&&(l=o.maxKeys);var h=e.length;l>0&&h>l&&(h=l);for(var u=0;u=0?(c=m.substr(0,v),d=m.substr(v+1)):(c=m,d=""),f=decodeURIComponent(c),p=decodeURIComponent(d),a(i,f)?s(i[f])?i[f].push(p):i[f]=[i[f],p]:i[f]=p}return i};var s=Array.isArray||function(e){return"[object Array]"===Object.prototype.toString.call(e)}},{}],46:[function(e,r,t){"use strict";function a(e,r){if(e.map)return e.map(r);for(var t=[],a=0;a",'"',"`"," ","\r","\n","\t"]),c=["'"].concat(u),d=["%","/","?",";","#"].concat(c),f=["/","?","#"],p=/^[+a-z0-9A-Z_-]{0,63}$/,m=/^([+a-z0-9A-Z_-]{0,63})(.*)$/,v={javascript:!0,"javascript:":!0},y={javascript:!0,"javascript:":!0},g={http:!0,https:!0,ftp:!0,gopher:!0,file:!0,"http:":!0,"https:":!0,"ftp:":!0,"gopher:":!0,"file:":!0},P=e("querystring");a.prototype.parse=function(e,r,t){if(!i.isString(e))throw new TypeError("Parameter 'url' must be a string, not "+typeof e);var a=e.indexOf("?"),s=-1!==a&&a127?A+="x":A+=I[k];if(!A.match(p)){var L=O.slice(0,_),z=O.slice(_+1),C=I.match(m);C&&(L.push(C[1]),z.unshift(C[2])),z.length&&(u="/"+z.join(".")+u),this.hostname=L.join(".");break}}}this.hostname=this.hostname.length>255?"":this.hostname.toLowerCase(),R||(this.hostname=o.toASCII(this.hostname));var Q=this.port?":"+this.port:"";this.host=(this.hostname||"")+Q,this.href+=this.host,R&&(this.hostname=this.hostname.substr(1,this.hostname.length-2),"/"!==u[0]&&(u="/"+u))}if(!v[b])for(_=0,D=c.length;_0)&&t.host.split("@"))&&(t.auth=$.shift(),t.host=t.hostname=$.shift())}return t.search=e.search,t.query=e.query,i.isNull(t.pathname)&&i.isNull(t.search)||(t.path=(t.pathname?t.pathname:"")+(t.search?t.search:"")),t.href=t.format(),t}if(!w.length)return t.pathname=null,t.path=t.search?"/"+t.search:null,t.href=t.format(),t;for(var S=w.slice(-1)[0],j=(t.host||e.host||w.length>1)&&("."===S||".."===S)||""===S,_=0,x=w.length;x>=0;x--)"."===(S=w[x])?w.splice(x,1):".."===S?(w.splice(x,1),_++):_&&(w.splice(x,1),_--);if(!P&&!E)for(;_--;_)w.unshift("..");!P||""===w[0]||w[0]&&"/"===w[0].charAt(0)||w.unshift(""),j&&"/"!==w.join("/").substr(-1)&&w.push("");var F=""===w[0]||w[0]&&"/"===w[0].charAt(0);if(b){t.hostname=t.host=F?"":w.length?w.shift():"";var $;($=!!(t.host&&t.host.indexOf("@")>0)&&t.host.split("@"))&&(t.auth=$.shift(),t.host=t.hostname=$.shift())}return(P=P||t.host&&w.length)&&!F&&w.unshift(""),w.length?t.pathname=w.join("/"):(t.pathname=null,t.path=null),i.isNull(t.pathname)&&i.isNull(t.search)||(t.path=(t.pathname?t.pathname:"")+(t.search?t.search:"")),t.auth=e.auth||t.auth,t.slashes=t.slashes||e.slashes,t.href=t.format(),t},a.prototype.parseHost=function(){var e=this.host,r=l.exec(e);r&&(":"!==(r=r[0])&&(this.port=r.substr(1)),e=e.substr(0,e.length-r.length)),e&&(this.hostname=e)}},{"./util":49,punycode:44,querystring:47}],49:[function(e,r,t){"use strict";r.exports={isString:function(e){return"string"==typeof e},isObject:function(e){return"object"==typeof e&&null!==e},isNull:function(e){return null===e},isNullOrUndefined:function(e){return null==e}}},{}],ajv:[function(e,r,t){"use strict";function a(r){if(!(this instanceof a))return new a(r);r=this._opts=E.copy(r)||{},function(e){var r=e._opts.logger;if(!1===r)e.logger={log:u,warn:u,error:u};else{if(void 0===r&&(r=console),!("object"==typeof r&&r.log&&r.warn&&r.error))throw new Error("logger must implement log, warn and error methods");e.logger=r}}(this),this._schemas={},this._refs={},this._fragments={},this._formats=v(r.format);var t=this._schemaUriFormat=this._formats["uri-reference"];this._schemaUriFormatFunc=function(e){return t.test(e)},this._cache=r.cache||new f,this._loadingSchemas={},this._compilations=[],this.RULES=y(),this._getId=function(e){switch(e.schemaId){case"$id":return n;case"id":return i;default:return l}}(r),r.loopRequired=r.loopRequired||1/0,"property"==r.errorDataPath&&(r._errorDataPathProperty=!0),void 0===r.serialize&&(r.serialize=m),this._metaOpts=function(e){for(var r=E.copy(e._opts),t=0;t<_.length;t++)delete r[_[t]];return r}(this),r.formats&&function(e){for(var r in e._opts.formats){var t=e._opts.formats[r];e.addFormat(r,t)}}(this),function(r){var t;r._opts.$data&&(t=e("./refs/$data.json"),r.addMetaSchema(t,t.$id,!0));if(!1===r._opts.meta)return;var a=e("./refs/json-schema-draft-06.json");r._opts.$data&&(a=g(a,x));r.addMetaSchema(a,j,!0),r._refs["http://json-schema.org/schema"]=j}(this),"object"==typeof r.meta&&this.addMetaSchema(r.meta),function(e){var r=e._opts.schemas;if(!r)return;if(Array.isArray(r))e.addSchema(r);else for(var t in r)e.addSchema(r[t],t)}(this),r.patternGroups&&P(this)}function s(e,r){return r=d.normalizeId(r),e._schemas[r]||e._refs[r]||e._fragments[r]}function o(e,r,t){for(var a in r){var s=r[a];s.meta||t&&!t.test(a)||(e._cache.del(s.cacheKey),delete r[a])}}function i(e){return e.$id&&this.logger.warn("schema $id ignored",e.$id),e.id}function n(e){return e.id&&this.logger.warn("schema id ignored",e.id),e.$id}function l(e){if(e.$id&&e.id&&e.$id!=e.id)throw new Error("schema $id is different from id");return e.$id||e.id}function h(e,r){if(e._schemas[r]||e._refs[r])throw new Error('schema with key or id "'+r+'" already exists')}function u(){}var c=e("./compile"),d=e("./compile/resolve"),f=e("./cache"),p=e("./compile/schema_obj"),m=e("fast-json-stable-stringify"),v=e("./compile/formats"),y=e("./compile/rules"),g=e("./$data"),P=e("./patternGroups"),E=e("./compile/util"),w=e("co");r.exports=a,a.prototype.validate=function(e,r){var t;if("string"==typeof e){if(!(t=this.getSchema(e)))throw new Error('no schema with key or ref "'+e+'"')}else{var a=this._addSchema(e);t=a.validate||this._compile(a)}var s=t(r);return!0===t.$async?"*"==this._opts.async?w(s):s:(this.errors=t.errors,s)},a.prototype.compile=function(e,r){var t=this._addSchema(e,void 0,r);return t.validate||this._compile(t)},a.prototype.addSchema=function(e,r,t,a){if(Array.isArray(e)){for(var s=0;s=t}function i(e,t,n){var r=t.input.slice(t.start);return n&&(r=r.replace(l,"$1 $3")),e.test(r)}function s(e,t,n,r){var i=new e.constructor(e.options,e.input,t);if(n)for(var s in n)i[s]=n[s];var o=e,a=i;return["inFunction","inAsyncFunction","inAsync","inGenerator","inModule"].forEach(function(e){e in o&&(a[e]=o[e])}),r&&(i.options.preserveParens=!0),i.nextToken(),i}var o={},a=/^async[\t ]+(return|throw)/,u=/^async[\t ]+function/,c=/^\s*[():;]/,l=/([^\n])\/\*(\*(?!\/)|[^\n*])*\*\/([^\n])/g,p=/\s*(get|set)\s*\(/;t.exports=function(e,t){var n=function(){};e.extend("initialContext",function(r){return function(){return this.options.ecmaVersion<7&&(n=function(t){e.raise(t.start,"async/await keywords only available when ecmaVersion>=7")}),this.reservedWords=new RegExp(this.reservedWords.toString().replace(/await|async/g,"").replace("|/","/").replace("/|","/").replace("||","|")),this.reservedWordsStrict=new RegExp(this.reservedWordsStrict.toString().replace(/await|async/g,"").replace("|/","/").replace("/|","/").replace("||","|")),this.reservedWordsStrictBind=new RegExp(this.reservedWordsStrictBind.toString().replace(/await|async/g,"").replace("|/","/").replace("/|","/").replace("||","|")),this.inAsyncFunction=t.inAsyncFunction,t.awaitAnywhere&&t.inAsyncFunction&&e.raise(node.start,"The options awaitAnywhere and inAsyncFunction are mutually exclusive"),r.apply(this,arguments)}}),e.extend("shouldParseExportStatement",function(e){return function(){return!("name"!==this.type.label||"async"!==this.value||!i(u,this))||e.apply(this,arguments)}}),e.extend("parseStatement",function(e){return function(n,r){var s=this.start,o=this.startLoc;if("name"===this.type.label)if(i(u,this,!0)){var c=this.inAsyncFunction;try{return this.inAsyncFunction=!0,this.next(),(l=this.parseStatement(n,r)).async=!0,l.start=s,l.loc&&(l.loc.start=o),l.range&&(l.range[0]=s),l}finally{this.inAsyncFunction=c}}else if("object"==typeof t&&t.asyncExits&&i(a,this)){this.next();var l;return(l=this.parseStatement(n,r)).async=!0,l.start=s,l.loc&&(l.loc.start=o),l.range&&(l.range[0]=s),l}return e.apply(this,arguments)}}),e.extend("parseIdent",function(e){return function(t){var n=e.apply(this,arguments);return this.inAsyncFunction&&"await"===n.name&&0===arguments.length&&this.raise(n.start,"'await' is reserved within async functions"),n}}),e.extend("parseExprAtom",function(e){return function(i){var a,u=this.start,l=this.startLoc,p=e.apply(this,arguments);if("Identifier"===p.type)if("async"!==p.name||r(this,p.end)){if("await"===p.name){var h=this.startNodeAt(p.start,p.loc&&p.loc.start);if(this.inAsyncFunction)return a=this.parseExprSubscripts(),h.operator="await",h.argument=a,h=this.finishNodeAt(h,"AwaitExpression",a.end,a.loc&&a.loc.end),n(h),h;if(this.input.slice(p.end).match(c))return t.awaitAnywhere||"module"!==this.options.sourceType?p:this.raise(p.start,"'await' is reserved within modules");if("object"==typeof t&&t.awaitAnywhere&&(u=this.start,(a=s(this,u-4).parseExprSubscripts()).end<=u))return a=s(this,u).parseExprSubscripts(),h.operator="await",h.argument=a,h=this.finishNodeAt(h,"AwaitExpression",a.end,a.loc&&a.loc.end),this.pos=a.end,this.end=a.end,this.endLoc=a.endLoc,this.next(),n(h),h;if(!t.awaitAnywhere&&"module"===this.options.sourceType)return this.raise(p.start,"'await' is reserved within modules")}}else{var f=this.inAsyncFunction;try{this.inAsyncFunction=!0;var d=this,y=!1,m={parseFunctionBody:function(e,t){try{var n=y;return y=!0,d.parseFunctionBody.apply(this,arguments)}finally{y=n}},raise:function(){try{return d.raise.apply(this,arguments)}catch(e){throw y?e:o}}};if("SequenceExpression"===(a=s(this,this.start,m,!0).parseExpression()).type&&(a=a.expressions[0]),"CallExpression"===a.type&&(a=a.callee),"FunctionExpression"===a.type||"FunctionDeclaration"===a.type||"ArrowFunctionExpression"===a.type)return"SequenceExpression"===(a=s(this,this.start,m).parseExpression()).type&&(a=a.expressions[0]),"CallExpression"===a.type&&(a=a.callee),a.async=!0,a.start=u,a.loc&&(a.loc.start=l),a.range&&(a.range[0]=u),this.pos=a.end,this.end=a.end,this.endLoc=a.endLoc,this.next(),n(a),a}catch(e){if(e!==o)throw e}finally{this.inAsyncFunction=f}}return p}}),e.extend("finishNodeAt",function(e){return function(t,n,r,i){return t.__asyncValue&&(delete t.__asyncValue,t.value.async=!0),e.apply(this,arguments)}}),e.extend("finishNode",function(e){return function(t,n){return t.__asyncValue&&(delete t.__asyncValue,t.value.async=!0),e.apply(this,arguments)}}),e.extend("parsePropertyName",function(e){return function(t){t.key&&t.key.name;var i=e.apply(this,arguments);return"Identifier"!==i.type||"async"!==i.name||r(this,i.end)||this.input.slice(i.end).match(c)||(p.test(this.input.slice(i.end))?(i=e.apply(this,arguments),t.__asyncValue=!0):(n(t),"set"===t.kind&&this.raise(i.start,"'set (value)' cannot be be async"),"Identifier"===(i=e.apply(this,arguments)).type&&"set"===i.name&&this.raise(i.start,"'set (value)' cannot be be async"),t.__asyncValue=!0)),i}}),e.extend("parseClassMethod",function(e){return function(t,n,r){var i;n.__asyncValue&&("constructor"===n.kind&&this.raise(n.start,"class constructor() cannot be be async"),i=this.inAsyncFunction,this.inAsyncFunction=!0);var s=e.apply(this,arguments);return this.inAsyncFunction=i,s}}),e.extend("parseMethod",function(e){return function(t){var n;this.__currentProperty&&this.__currentProperty.__asyncValue&&(n=this.inAsyncFunction,this.inAsyncFunction=!0);var r=e.apply(this,arguments);return this.inAsyncFunction=n,r}}),e.extend("parsePropertyValue",function(e){return function(t,n,r,i,s,o){var a=this.__currentProperty;this.__currentProperty=t;var u;t.__asyncValue&&(u=this.inAsyncFunction,this.inAsyncFunction=!0);var c=e.apply(this,arguments);return this.inAsyncFunction=u,this.__currentProperty=a,c}})}},{}],3:[function(e,t,n){function r(e,t,n){var r=new e.constructor(e.options,e.input,t);if(n)for(var i in n)r[i]=n[i];var s=e,o=r;return["inFunction","inAsync","inGenerator","inModule"].forEach(function(e){e in s&&(o[e]=s[e])}),r.nextToken(),r}var i=/^async[\t ]+(return|throw)/,s=/^\s*[):;]/,o=/([^\n])\/\*(\*(?!\/)|[^\n*])*\*\/([^\n])/g;t.exports=function(e,t){t&&"object"==typeof t||(t={}),e.extend("parse",function(n){return function(){return this.inAsync=t.inAsyncFunction,t.awaitAnywhere&&t.inAsyncFunction&&e.raise(node.start,"The options awaitAnywhere and inAsyncFunction are mutually exclusive"),n.apply(this,arguments)}}),e.extend("parseStatement",function(e){return function(n,r){var s=this.start,a=this.startLoc;if("name"===this.type.label&&t.asyncExits&&function(e,t,n){var r=t.input.slice(t.start);return n&&(r=r.replace(o,"$1 $3")),e.test(r)}(i,this)){this.next();var u=this.parseStatement(n,r);return u.async=!0,u.start=s,u.loc&&(u.loc.start=a),u.range&&(u.range[0]=s),u}return e.apply(this,arguments)}}),e.extend("parseIdent",function(e){return function(n){return"module"===this.options.sourceType&&this.options.ecmaVersion>=8&&t.awaitAnywhere?e.call(this,!0):e.apply(this,arguments)}}),e.extend("parseExprAtom",function(e){var n={};return function(i){var s,o=this.start,a=(this.startLoc,e.apply(this,arguments));if("Identifier"===a.type&&"await"===a.name&&!this.inAsync&&t.awaitAnywhere){var u=this.startNodeAt(a.start,a.loc&&a.loc.start);o=this.start;var c={raise:function(){try{return pp.raise.apply(this,arguments)}catch(e){throw n}}};try{if((s=r(this,o-4,c).parseExprSubscripts()).end<=o)return s=r(this,o,c).parseExprSubscripts(),u.argument=s,u=this.finishNodeAt(u,"AwaitExpression",s.end,s.loc&&s.loc.end),this.pos=s.end,this.end=s.end,this.endLoc=s.endLoc,this.next(),u}catch(e){if(e===n)return a;throw e}}return a}});var n={undefined:!0,get:!0,set:!0,static:!0,async:!0,constructor:!0};e.extend("parsePropertyName",function(e){return function(t){var r=t.key&&t.key.name,i=e.apply(this,arguments);return"get"===this.value&&(t.__maybeStaticAsyncGetter=!0),n[this.value]?i:("Identifier"!==i.type||"async"!==i.name&&"async"!==r||function(e,t){return e.lineStart>=t}(this,i.end)||this.input.slice(i.end).match(s)?delete t.__maybeStaticAsyncGetter:"set"===t.kind||"set"===i.name?this.raise(i.start,"'set (value)' cannot be be async"):(this.__isAsyncProp=!0,"Identifier"===(i=e.apply(this,arguments)).type&&"set"===i.name&&this.raise(i.start,"'set (value)' cannot be be async")),i)}}),e.extend("parseClassMethod",function(e){return function(t,n,r){var i=e.apply(this,arguments);return n.__maybeStaticAsyncGetter&&(delete n.__maybeStaticAsyncGetter,"get"!==n.key.name&&(n.kind="get")),i}}),e.extend("parseFunctionBody",function(e){return function(t,n){var r=this.inAsync;this.__isAsyncProp&&(t.async=!0,this.inAsync=!0,delete this.__isAsyncProp);var i=e.apply(this,arguments);return this.inAsync=r,i}})}},{}],4:[function(e,t,n){!function(e,r){"object"==typeof n&&void 0!==t?r(n):"function"==typeof define&&define.amd?define(["exports"],r):r(e.acorn=e.acorn||{})}(this,function(e){"use strict";function t(e,t){for(var n=65536,r=0;re)return!1;if((n+=t[r+1])>=e)return!0}}function n(e,n){return e<65?36===e:e<91||(e<97?95===e:e<123||(e<=65535?e>=170&&x.test(String.fromCharCode(e)):!1!==n&&t(e,E)))}function r(e,n){return e<48?36===e:e<58||!(e<65)&&(e<91||(e<97?95===e:e<123||(e<=65535?e>=170&&w.test(String.fromCharCode(e)):!1!==n&&(t(e,E)||t(e,S)))))}function i(e,t){return new k(e,{beforeExpr:!0,binop:t})}function s(e,t){return void 0===t&&(t={}),t.keyword=e,_[e]=new k(e,t)}function o(e){return 10===e||13===e||8232===e||8233===e}function a(e,t){return $.call(e,t)}function u(e,t){for(var n=1,r=0;;){T.lastIndex=r;var i=T.exec(e);if(!(i&&i.index=2015&&(t.ecmaVersion-=2009),null==t.allowReserved&&(t.allowReserved=t.ecmaVersion<5),R(t.onToken)){var r=t.onToken;t.onToken=function(e){return r.push(e)}}return R(t.onComment)&&(t.onComment=function(e,t){return function(n,r,i,s,o,a){var u={type:n?"Block":"Line",value:r,start:i,end:s};e.locations&&(u.loc=new j(this,o,a)),e.ranges&&(u.range=[i,s]),t.push(u)}}(t,t.onComment)),t}function l(e){return new RegExp("^(?:"+e.replace(/ /g,"|")+")$")}function p(){this.shorthandAssign=this.trailingComma=this.parenthesizedAssign=this.parenthesizedBind=-1}function h(e,t,n,r){return e.type=t,e.end=n,this.options.locations&&(e.loc.end=r),this.options.ranges&&(e.range[1]=n),e}function f(e,t,n,r){try{return new RegExp(e,t)}catch(e){if(void 0!==n)throw e instanceof SyntaxError&&r.raise(n,"Error parsing regular expression: "+e.message),e}}function d(e){return e<=65535?String.fromCharCode(e):(e-=65536,String.fromCharCode(55296+(e>>10),56320+(1023&e)))}var y={3:"abstract boolean byte char class double enum export extends final float goto implements import int interface long native package private protected public short static super synchronized throws transient volatile",5:"class enum extends super const export import",6:"enum",strict:"implements interface let package private protected public static yield",strictBind:"eval arguments"},m="break case catch continue debugger default do else finally for function if return switch throw try var while with null true false instanceof typeof void delete new in this",g={5:m,6:m+" const class extends export import super"},v="ªµºÀ-ÖØ-öø-ˁˆ-ˑˠ-ˤˬˮͰ-ʹͶͷͺ-ͽͿΆΈ-ΊΌΎ-ΡΣ-ϵϷ-ҁҊ-ԯԱ-Ֆՙա-ևא-תװ-ײؠ-يٮٯٱ-ۓەۥۦۮۯۺ-ۼۿܐܒ-ܯݍ-ޥޱߊ-ߪߴߵߺࠀ-ࠕࠚࠤࠨࡀ-ࡘࢠ-ࢴࢶ-ࢽऄ-हऽॐक़-ॡॱ-ঀঅ-ঌএঐও-নপ-রলশ-হঽৎড়ঢ়য়-ৡৰৱਅ-ਊਏਐਓ-ਨਪ-ਰਲਲ਼ਵਸ਼ਸਹਖ਼-ੜਫ਼ੲ-ੴઅ-ઍએ-ઑઓ-નપ-રલળવ-હઽૐૠૡૹଅ-ଌଏଐଓ-ନପ-ରଲଳଵ-ହଽଡ଼ଢ଼ୟ-ୡୱஃஅ-ஊஎ-ஐஒ-கஙசஜஞடணதந-பம-ஹௐఅ-ఌఎ-ఐఒ-నప-హఽౘ-ౚౠౡಀಅ-ಌಎ-ಐಒ-ನಪ-ಳವ-ಹಽೞೠೡೱೲഅ-ഌഎ-ഐഒ-ഺഽൎൔ-ൖൟ-ൡൺ-ൿඅ-ඖක-නඳ-රලව-ෆก-ะาำเ-ๆກຂຄງຈຊຍດ-ທນ-ຟມ-ຣລວສຫອ-ະາຳຽເ-ໄໆໜ-ໟༀཀ-ཇཉ-ཬྈ-ྌက-ဪဿၐ-ၕၚ-ၝၡၥၦၮ-ၰၵ-ႁႎႠ-ჅჇჍა-ჺჼ-ቈቊ-ቍቐ-ቖቘቚ-ቝበ-ኈኊ-ኍነ-ኰኲ-ኵኸ-ኾዀዂ-ዅወ-ዖዘ-ጐጒ-ጕጘ-ፚᎀ-ᎏᎠ-Ᏽᏸ-ᏽᐁ-ᙬᙯ-ᙿᚁ-ᚚᚠ-ᛪᛮ-ᛸᜀ-ᜌᜎ-ᜑᜠ-ᜱᝀ-ᝑᝠ-ᝬᝮ-ᝰក-ឳៗៜᠠ-ᡷᢀ-ᢨᢪᢰ-ᣵᤀ-ᤞᥐ-ᥭᥰ-ᥴᦀ-ᦫᦰ-ᧉᨀ-ᨖᨠ-ᩔᪧᬅ-ᬳᭅ-ᭋᮃ-ᮠᮮᮯᮺ-ᯥᰀ-ᰣᱍ-ᱏᱚ-ᱽᲀ-ᲈᳩ-ᳬᳮ-ᳱᳵᳶᴀ-ᶿḀ-ἕἘ-Ἕἠ-ὅὈ-Ὅὐ-ὗὙὛὝὟ-ώᾀ-ᾴᾶ-ᾼιῂ-ῄῆ-ῌῐ-ΐῖ-Ίῠ-Ῥῲ-ῴῶ-ῼⁱⁿₐ-ₜℂℇℊ-ℓℕ℘-ℝℤΩℨK-ℹℼ-ℿⅅ-ⅉⅎⅠ-ↈⰀ-Ⱞⰰ-ⱞⱠ-ⳤⳫ-ⳮⳲⳳⴀ-ⴥⴧⴭⴰ-ⵧⵯⶀ-ⶖⶠ-ⶦⶨ-ⶮⶰ-ⶶⶸ-ⶾⷀ-ⷆⷈ-ⷎⷐ-ⷖⷘ-ⷞ々-〇〡-〩〱-〵〸-〼ぁ-ゖ゛-ゟァ-ヺー-ヿㄅ-ㄭㄱ-ㆎㆠ-ㆺㇰ-ㇿ㐀-䶵一-鿕ꀀ-ꒌꓐ-ꓽꔀ-ꘌꘐ-ꘟꘪꘫꙀ-ꙮꙿ-ꚝꚠ-ꛯꜗ-ꜟꜢ-ꞈꞋ-ꞮꞰ-ꞷꟷ-ꠁꠃ-ꠅꠇ-ꠊꠌ-ꠢꡀ-ꡳꢂ-ꢳꣲ-ꣷꣻꣽꤊ-ꤥꤰ-ꥆꥠ-ꥼꦄ-ꦲꧏꧠ-ꧤꧦ-ꧯꧺ-ꧾꨀ-ꨨꩀ-ꩂꩄ-ꩋꩠ-ꩶꩺꩾ-ꪯꪱꪵꪶꪹ-ꪽꫀꫂꫛ-ꫝꫠ-ꫪꫲ-ꫴꬁ-ꬆꬉ-ꬎꬑ-ꬖꬠ-ꬦꬨ-ꬮꬰ-ꭚꭜ-ꭥꭰ-ꯢ가-힣ힰ-ퟆퟋ-ퟻ豈-舘並-龎ff-stﬓ-ﬗיִײַ-ﬨשׁ-זּטּ-לּמּנּסּףּפּצּ-ﮱﯓ-ﴽﵐ-ﶏﶒ-ﷇﷰ-ﷻﹰ-ﹴﹶ-ﻼA-Za-zヲ-하-ᅦᅧ-ᅬᅭ-ᅲᅳ-ᅵ",b="·̀-ͯ·҃-֑҇-ׇֽֿׁׂׅׄؐ-ًؚ-٩ٰۖ-ۜ۟-۪ۤۧۨ-ۭ۰-۹ܑܰ-݊ަ-ް߀-߉߫-߳ࠖ-࠙ࠛ-ࠣࠥ-ࠧࠩ-࡙࠭-࡛ࣔ-ࣣ࣡-ःऺ-़ा-ॏ॑-ॗॢॣ०-९ঁ-ঃ়া-ৄেৈো-্ৗৢৣ০-৯ਁ-ਃ਼ਾ-ੂੇੈੋ-੍ੑ੦-ੱੵઁ-ઃ઼ા-ૅે-ૉો-્ૢૣ૦-૯ଁ-ଃ଼ା-ୄେୈୋ-୍ୖୗୢୣ୦-୯ஂா-ூெ-ைொ-்ௗ௦-௯ఀ-ఃా-ౄె-ైొ-్ౕౖౢౣ౦-౯ಁ-ಃ಼ಾ-ೄೆ-ೈೊ-್ೕೖೢೣ೦-೯ഁ-ഃാ-ൄെ-ൈൊ-്ൗൢൣ൦-൯ංඃ්ා-ුූෘ-ෟ෦-෯ෲෳัิ-ฺ็-๎๐-๙ັິ-ູົຼ່-ໍ໐-໙༘༙༠-༩༹༵༷༾༿ཱ-྄྆྇ྍ-ྗྙ-ྼ࿆ါ-ှ၀-၉ၖ-ၙၞ-ၠၢ-ၤၧ-ၭၱ-ၴႂ-ႍႏ-ႝ፝-፟፩-፱ᜒ-᜔ᜲ-᜴ᝒᝓᝲᝳ឴-៓៝០-៩᠋-᠍᠐-᠙ᢩᤠ-ᤫᤰ-᤻᥆-᥏᧐-᧚ᨗ-ᨛᩕ-ᩞ᩠-᩿᩼-᪉᪐-᪙᪰-᪽ᬀ-ᬄ᬴-᭄᭐-᭙᭫-᭳ᮀ-ᮂᮡ-ᮭ᮰-᮹᯦-᯳ᰤ-᰷᱀-᱉᱐-᱙᳐-᳔᳒-᳨᳭ᳲ-᳴᳸᳹᷀-᷵᷻-᷿‿⁀⁔⃐-⃥⃜⃡-⃰⳯-⵿⳱ⷠ-〪ⷿ-゙゚〯꘠-꘩꙯ꙴ-꙽ꚞꚟ꛰꛱ꠂ꠆ꠋꠣ-ꠧꢀꢁꢴ-ꣅ꣐-꣙꣠-꣱꤀-꤉ꤦ-꤭ꥇ-꥓ꦀ-ꦃ꦳-꧀꧐-꧙ꧥ꧰-꧹ꨩ-ꨶꩃꩌꩍ꩐-꩙ꩻ-ꩽꪰꪲ-ꪴꪷꪸꪾ꪿꫁ꫫ-ꫯꫵ꫶ꯣ-ꯪ꯬꯭꯰-꯹ﬞ︀-️︠-︯︳︴﹍-﹏0-9_",x=new RegExp("["+v+"]"),w=new RegExp("["+v+b+"]");v=b=null;var E=[0,11,2,25,2,18,2,1,2,14,3,13,35,122,70,52,268,28,4,48,48,31,17,26,6,37,11,29,3,35,5,7,2,4,43,157,19,35,5,35,5,39,9,51,157,310,10,21,11,7,153,5,3,0,2,43,2,1,4,0,3,22,11,22,10,30,66,18,2,1,11,21,11,25,71,55,7,1,65,0,16,3,2,2,2,26,45,28,4,28,36,7,2,27,28,53,11,21,11,18,14,17,111,72,56,50,14,50,785,52,76,44,33,24,27,35,42,34,4,0,13,47,15,3,22,0,2,0,36,17,2,24,85,6,2,0,2,3,2,14,2,9,8,46,39,7,3,1,3,21,2,6,2,1,2,4,4,0,19,0,13,4,159,52,19,3,54,47,21,1,2,0,185,46,42,3,37,47,21,0,60,42,86,25,391,63,32,0,449,56,264,8,2,36,18,0,50,29,881,921,103,110,18,195,2749,1070,4050,582,8634,568,8,30,114,29,19,47,17,3,32,20,6,18,881,68,12,0,67,12,65,0,32,6124,20,754,9486,1,3071,106,6,12,4,8,8,9,5991,84,2,70,2,1,3,0,3,1,3,3,2,11,2,0,2,6,2,64,2,3,3,7,2,6,2,27,2,3,2,4,2,0,4,6,2,339,3,24,2,24,2,30,2,24,2,30,2,24,2,30,2,24,2,30,2,24,2,7,4149,196,60,67,1213,3,2,26,2,1,2,0,3,0,2,9,2,3,2,0,2,0,7,0,5,0,2,0,2,0,2,2,2,1,2,0,3,0,2,0,2,0,2,0,2,0,2,1,2,0,3,3,2,6,2,3,2,3,2,0,2,9,2,16,6,2,2,4,2,16,4421,42710,42,4148,12,221,3,5761,10591,541],S=[509,0,227,0,150,4,294,9,1368,2,2,1,6,3,41,2,5,0,166,1,1306,2,54,14,32,9,16,3,46,10,54,9,7,2,37,13,2,9,52,0,13,2,49,13,10,2,4,9,83,11,7,0,161,11,6,9,7,3,57,0,2,6,3,1,3,2,10,0,11,1,3,6,4,4,193,17,10,9,87,19,13,9,214,6,3,8,28,1,83,16,16,9,82,12,9,9,84,14,5,9,423,9,838,7,2,7,17,9,57,21,2,13,19882,9,135,4,60,6,26,9,1016,45,17,3,19723,1,5319,4,4,5,9,7,3,6,31,3,149,2,1418,49,513,54,5,49,9,0,15,0,23,4,2,14,1361,6,2,16,3,6,2,1,2,4,2214,6,110,6,6,9,792487,239],k=function(e,t){void 0===t&&(t={}),this.label=e,this.keyword=t.keyword,this.beforeExpr=!!t.beforeExpr,this.startsExpr=!!t.startsExpr,this.isLoop=!!t.isLoop,this.isAssign=!!t.isAssign,this.prefix=!!t.prefix,this.postfix=!!t.postfix,this.binop=t.binop||null,this.updateContext=null},A={beforeExpr:!0},C={startsExpr:!0},_={},L={num:new k("num",C),regexp:new k("regexp",C),string:new k("string",C),name:new k("name",C),eof:new k("eof"),bracketL:new k("[",{beforeExpr:!0,startsExpr:!0}),bracketR:new k("]"),braceL:new k("{",{beforeExpr:!0,startsExpr:!0}),braceR:new k("}"),parenL:new k("(",{beforeExpr:!0,startsExpr:!0}),parenR:new k(")"),comma:new k(",",A),semi:new k(";",A),colon:new k(":",A),dot:new k("."),question:new k("?",A),arrow:new k("=>",A),template:new k("template"),invalidTemplate:new k("invalidTemplate"),ellipsis:new k("...",A),backQuote:new k("`",C),dollarBraceL:new k("${",{beforeExpr:!0,startsExpr:!0}),eq:new k("=",{beforeExpr:!0,isAssign:!0}),assign:new k("_=",{beforeExpr:!0,isAssign:!0}),incDec:new k("++/--",{prefix:!0,postfix:!0,startsExpr:!0}),prefix:new k("!/~",{beforeExpr:!0,prefix:!0,startsExpr:!0}),logicalOR:i("||",1),logicalAND:i("&&",2),bitwiseOR:i("|",3),bitwiseXOR:i("^",4),bitwiseAND:i("&",5),equality:i("==/!=/===/!==",6),relational:i(">/<=/>=",7),bitShift:i("<>>/>>>",8),plusMin:new k("+/-",{beforeExpr:!0,binop:9,prefix:!0,startsExpr:!0}),modulo:i("%",10),star:i("*",10),slash:i("/",10),starstar:new k("**",{beforeExpr:!0}),_break:s("break"),_case:s("case",A),_catch:s("catch"),_continue:s("continue"),_debugger:s("debugger"),_default:s("default",A),_do:s("do",{isLoop:!0,beforeExpr:!0}),_else:s("else",A),_finally:s("finally"),_for:s("for",{isLoop:!0}),_function:s("function",C),_if:s("if"),_return:s("return",A),_switch:s("switch"),_throw:s("throw",A),_try:s("try"),_var:s("var"),_const:s("const"),_while:s("while",{isLoop:!0}),_with:s("with"),_new:s("new",{beforeExpr:!0,startsExpr:!0}),_this:s("this",C),_super:s("super",C),_class:s("class",C),_extends:s("extends",A),_export:s("export"),_import:s("import"),_null:s("null",C),_true:s("true",C),_false:s("false",C),_in:s("in",{beforeExpr:!0,binop:7}),_instanceof:s("instanceof",{beforeExpr:!0,binop:7}),_typeof:s("typeof",{beforeExpr:!0,prefix:!0,startsExpr:!0}),_void:s("void",{beforeExpr:!0,prefix:!0,startsExpr:!0}),_delete:s("delete",{beforeExpr:!0,prefix:!0,startsExpr:!0})},O=/\r\n?|\n|\u2028|\u2029/,T=new RegExp(O.source,"g"),N=/[\u1680\u180e\u2000-\u200a\u202f\u205f\u3000\ufeff]/,P=/(?:\s|\/\/.*|\/\*[^]*?\*\/)*/g,F=Object.prototype,$=F.hasOwnProperty,B=F.toString,R=Array.isArray||function(e){return"[object Array]"===B.call(e)},I=function(e,t){this.line=e,this.column=t};I.prototype.offset=function(e){return new I(this.line,this.column+e)};var j=function(e,t,n){this.start=t,this.end=n,null!==e.sourceFile&&(this.source=e.sourceFile)},D={ecmaVersion:7,sourceType:"script",onInsertedSemicolon:null,onTrailingComma:null,allowReserved:null,allowReturnOutsideFunction:!1,allowImportExportEverywhere:!1,allowHashBang:!1,locations:!1,onToken:null,onComment:null,ranges:!1,program:null,sourceFile:null,directSourceFile:null,preserveParens:!1,plugins:{}},M={},V=function(e,t,n){this.options=e=c(e),this.sourceFile=e.sourceFile,this.keywords=l(g[e.ecmaVersion>=6?6:5]);var r="";if(!e.allowReserved){for(var i=e.ecmaVersion;!(r=y[i]);i--);"module"==e.sourceType&&(r+=" await")}this.reservedWords=l(r);var s=(r?r+" ":"")+y.strict;this.reservedWordsStrict=l(s),this.reservedWordsStrictBind=l(s+" "+y.strictBind),this.input=String(t),this.containsEsc=!1,this.loadPlugins(e.plugins),n?(this.pos=n,this.lineStart=this.input.lastIndexOf("\n",n-1)+1,this.curLine=this.input.slice(0,this.lineStart).split(O).length):(this.pos=this.lineStart=0,this.curLine=1),this.type=L.eof,this.value=null,this.start=this.end=this.pos,this.startLoc=this.endLoc=this.curPosition(),this.lastTokEndLoc=this.lastTokStartLoc=null,this.lastTokStart=this.lastTokEnd=this.pos,this.context=this.initialContext(),this.exprAllowed=!0,this.inModule="module"===e.sourceType,this.strict=this.inModule||this.strictDirective(this.pos),this.potentialArrowAt=-1,this.inFunction=this.inGenerator=this.inAsync=!1,this.yieldPos=this.awaitPos=0,this.labels=[],0===this.pos&&e.allowHashBang&&"#!"===this.input.slice(0,2)&&this.skipLineComment(2),this.scopeStack=[],this.enterFunctionScope()};V.prototype.isKeyword=function(e){return this.keywords.test(e)},V.prototype.isReservedWord=function(e){return this.reservedWords.test(e)},V.prototype.extend=function(e,t){this[e]=t(this[e])},V.prototype.loadPlugins=function(e){for(var t in e){var n=M[t];if(!n)throw new Error("Plugin '"+t+"' not found");n(this,e[t])}},V.prototype.parse=function(){var e=this.options.program||this.startNode();return this.nextToken(),this.parseTopLevel(e)};var q=V.prototype,U=/^(?:'((?:\\.|[^'])*?)'|"((?:\\.|[^"])*?)"|;)/;q.strictDirective=function(e){for(;;){P.lastIndex=e,e+=P.exec(this.input)[0].length;var t=U.exec(this.input.slice(e));if(!t)return!1;if("use strict"==(t[1]||t[2]))return!0;e+=t[0].length}},q.eat=function(e){return this.type===e&&(this.next(),!0)},q.isContextual=function(e){return this.type===L.name&&this.value===e},q.eatContextual=function(e){return this.value===e&&this.eat(L.name)},q.expectContextual=function(e){this.eatContextual(e)||this.unexpected()},q.canInsertSemicolon=function(){return this.type===L.eof||this.type===L.braceR||O.test(this.input.slice(this.lastTokEnd,this.start))},q.insertSemicolon=function(){if(this.canInsertSemicolon())return this.options.onInsertedSemicolon&&this.options.onInsertedSemicolon(this.lastTokEnd,this.lastTokEndLoc),!0},q.semicolon=function(){this.eat(L.semi)||this.insertSemicolon()||this.unexpected()},q.afterTrailingComma=function(e,t){if(this.type==e)return this.options.onTrailingComma&&this.options.onTrailingComma(this.lastTokStart,this.lastTokStartLoc),t||this.next(),!0},q.expect=function(e){this.eat(e)||this.unexpected()},q.unexpected=function(e){this.raise(null!=e?e:this.start,"Unexpected token")},q.checkPatternErrors=function(e,t){if(e){e.trailingComma>-1&&this.raiseRecoverable(e.trailingComma,"Comma is not permitted after the rest element");var n=t?e.parenthesizedAssign:e.parenthesizedBind;n>-1&&this.raiseRecoverable(n,"Parenthesized pattern")}},q.checkExpressionErrors=function(e,t){var n=e?e.shorthandAssign:-1;if(!t)return n>=0;n>-1&&this.raise(n,"Shorthand property assignments are valid only in destructuring patterns")},q.checkYieldAwaitInDefaultParams=function(){this.yieldPos&&(!this.awaitPos||this.yieldPos=6&&(e.sourceType=this.options.sourceType),this.finishNode(e,"Program")};var W={kind:"loop"},G={kind:"switch"};z.isLet=function(){if(this.type!==L.name||this.options.ecmaVersion<6||"let"!=this.value)return!1;P.lastIndex=this.pos;var e=P.exec(this.input),t=this.pos+e[0].length,i=this.input.charCodeAt(t);if(91===i||123==i)return!0;if(n(i,!0)){for(var s=t+1;r(this.input.charCodeAt(s),!0);)++s;var o=this.input.slice(t,s);if(!this.isKeyword(o))return!0}return!1},z.isAsyncFunction=function(){if(this.type!==L.name||this.options.ecmaVersion<8||"async"!=this.value)return!1;P.lastIndex=this.pos;var e=P.exec(this.input),t=this.pos+e[0].length;return!(O.test(this.input.slice(this.pos,t))||"function"!==this.input.slice(t,t+8)||t+8!=this.input.length&&r(this.input.charAt(t+8)))},z.parseStatement=function(e,t,n){var r,i=this.type,s=this.startNode();switch(this.isLet()&&(i=L._var,r="let"),i){case L._break:case L._continue:return this.parseBreakContinueStatement(s,i.keyword);case L._debugger:return this.parseDebuggerStatement(s);case L._do:return this.parseDoStatement(s);case L._for:return this.parseForStatement(s);case L._function:return!e&&this.options.ecmaVersion>=6&&this.unexpected(),this.parseFunctionStatement(s,!1);case L._class:return e||this.unexpected(),this.parseClass(s,!0);case L._if:return this.parseIfStatement(s);case L._return:return this.parseReturnStatement(s);case L._switch:return this.parseSwitchStatement(s);case L._throw:return this.parseThrowStatement(s);case L._try:return this.parseTryStatement(s);case L._const:case L._var:return r=r||this.value,e||"var"==r||this.unexpected(),this.parseVarStatement(s,r);case L._while:return this.parseWhileStatement(s);case L._with:return this.parseWithStatement(s);case L.braceL:return this.parseBlock();case L.semi:return this.parseEmptyStatement(s);case L._export:case L._import:return this.options.allowImportExportEverywhere||(t||this.raise(this.start,"'import' and 'export' may only appear at the top level"),this.inModule||this.raise(this.start,"'import' and 'export' may appear only with 'sourceType: module'")),i===L._import?this.parseImport(s):this.parseExport(s,n);default:if(this.isAsyncFunction()&&e)return this.next(),this.parseFunctionStatement(s,!0);var o=this.value,a=this.parseExpression();return i===L.name&&"Identifier"===a.type&&this.eat(L.colon)?this.parseLabeledStatement(s,o,a):this.parseExpressionStatement(s,a)}},z.parseBreakContinueStatement=function(e,t){var n="break"==t;this.next(),this.eat(L.semi)||this.insertSemicolon()?e.label=null:this.type!==L.name?this.unexpected():(e.label=this.parseIdent(),this.semicolon());for(var r=0;r=6?this.eat(L.semi):this.semicolon(),this.finishNode(e,"DoWhileStatement")},z.parseForStatement=function(e){if(this.next(),this.labels.push(W),this.enterLexicalScope(),this.expect(L.parenL),this.type===L.semi)return this.parseFor(e,null);var t=this.isLet();if(this.type===L._var||this.type===L._const||t){var n=this.startNode(),r=t?"let":this.value;return this.next(),this.parseVar(n,!0,r),this.finishNode(n,"VariableDeclaration"),!(this.type===L._in||this.options.ecmaVersion>=6&&this.isContextual("of"))||1!==n.declarations.length||"var"!==r&&n.declarations[0].init?this.parseFor(e,n):this.parseForIn(e,n)}var i=new p,s=this.parseExpression(!0,i);return this.type===L._in||this.options.ecmaVersion>=6&&this.isContextual("of")?(this.toAssignable(s),this.checkLVal(s),this.checkPatternErrors(i,!0),this.parseForIn(e,s)):(this.checkExpressionErrors(i,!0),this.parseFor(e,s))},z.parseFunctionStatement=function(e,t){return this.next(),this.parseFunction(e,!0,!1,t)},z.isFunction=function(){return this.type===L._function||this.isAsyncFunction()},z.parseIfStatement=function(e){return this.next(),e.test=this.parseParenExpression(),e.consequent=this.parseStatement(!this.strict&&this.isFunction()),e.alternate=this.eat(L._else)?this.parseStatement(!this.strict&&this.isFunction()):null,this.finishNode(e,"IfStatement")},z.parseReturnStatement=function(e){return this.inFunction||this.options.allowReturnOutsideFunction||this.raise(this.start,"'return' outside of function"),this.next(),this.eat(L.semi)||this.insertSemicolon()?e.argument=null:(e.argument=this.parseExpression(),this.semicolon()),this.finishNode(e,"ReturnStatement")},z.parseSwitchStatement=function(e){this.next(),e.discriminant=this.parseParenExpression(),e.cases=[],this.expect(L.braceL),this.labels.push(G),this.enterLexicalScope();for(var t,n=!1;this.type!=L.braceR;)if(this.type===L._case||this.type===L._default){var r=this.type===L._case;t&&this.finishNode(t,"SwitchCase"),e.cases.push(t=this.startNode()),t.consequent=[],this.next(),r?t.test=this.parseExpression():(n&&this.raiseRecoverable(this.lastTokStart,"Multiple default clauses"),n=!0,t.test=null),this.expect(L.colon)}else t||this.unexpected(),t.consequent.push(this.parseStatement(!0));return this.exitLexicalScope(),t&&this.finishNode(t,"SwitchCase"),this.next(),this.labels.pop(),this.finishNode(e,"SwitchStatement")},z.parseThrowStatement=function(e){return this.next(),O.test(this.input.slice(this.lastTokEnd,this.start))&&this.raise(this.lastTokEnd,"Illegal newline after throw"),e.argument=this.parseExpression(),this.semicolon(),this.finishNode(e,"ThrowStatement")};var J=[];z.parseTryStatement=function(e){if(this.next(),e.block=this.parseBlock(),e.handler=null,this.type===L._catch){var t=this.startNode();this.next(),this.expect(L.parenL),t.param=this.parseBindingAtom(),this.enterLexicalScope(),this.checkLVal(t.param,"let"),this.expect(L.parenR),t.body=this.parseBlock(!1),this.exitLexicalScope(),e.handler=this.finishNode(t,"CatchClause")}return e.finalizer=this.eat(L._finally)?this.parseBlock():null,e.handler||e.finalizer||this.raise(e.start,"Missing catch or finally clause"),this.finishNode(e,"TryStatement")},z.parseVarStatement=function(e,t){return this.next(),this.parseVar(e,!1,t),this.semicolon(),this.finishNode(e,"VariableDeclaration")},z.parseWhileStatement=function(e){return this.next(),e.test=this.parseParenExpression(),this.labels.push(W),e.body=this.parseStatement(!1),this.labels.pop(),this.finishNode(e,"WhileStatement")},z.parseWithStatement=function(e){return this.strict&&this.raise(this.start,"'with' in strict mode"),this.next(),e.object=this.parseParenExpression(),e.body=this.parseStatement(!1),this.finishNode(e,"WithStatement")},z.parseEmptyStatement=function(e){return this.next(),this.finishNode(e,"EmptyStatement")},z.parseLabeledStatement=function(e,t,n){for(var r=0,i=this.labels;r=0;o--){var a=this.labels[o];if(a.statementStart!=e.start)break;a.statementStart=this.start,a.kind=s}return this.labels.push({name:t,kind:s,statementStart:this.start}),e.body=this.parseStatement(!0),("ClassDeclaration"==e.body.type||"VariableDeclaration"==e.body.type&&"var"!=e.body.kind||"FunctionDeclaration"==e.body.type&&(this.strict||e.body.generator))&&this.raiseRecoverable(e.body.start,"Invalid labeled declaration"),this.labels.pop(),e.label=n,this.finishNode(e,"LabeledStatement")},z.parseExpressionStatement=function(e,t){return e.expression=t,this.semicolon(),this.finishNode(e,"ExpressionStatement")},z.parseBlock=function(e){void 0===e&&(e=!0);var t=this.startNode();for(t.body=[],this.expect(L.braceL),e&&this.enterLexicalScope();!this.eat(L.braceR);){var n=this.parseStatement(!0);t.body.push(n)}return e&&this.exitLexicalScope(),this.finishNode(t,"BlockStatement")},z.parseFor=function(e,t){return e.init=t,this.expect(L.semi),e.test=this.type===L.semi?null:this.parseExpression(),this.expect(L.semi),e.update=this.type===L.parenR?null:this.parseExpression(),this.expect(L.parenR),this.exitLexicalScope(),e.body=this.parseStatement(!1),this.labels.pop(),this.finishNode(e,"ForStatement")},z.parseForIn=function(e,t){var n=this.type===L._in?"ForInStatement":"ForOfStatement";return this.next(),e.left=t,e.right=this.parseExpression(),this.expect(L.parenR),this.exitLexicalScope(),e.body=this.parseStatement(!1),this.labels.pop(),this.finishNode(e,n)},z.parseVar=function(e,t,n){for(e.declarations=[],e.kind=n;;){var r=this.startNode();if(this.parseVarId(r,n),this.eat(L.eq)?r.init=this.parseMaybeAssign(t):"const"!==n||this.type===L._in||this.options.ecmaVersion>=6&&this.isContextual("of")?"Identifier"==r.id.type||t&&(this.type===L._in||this.isContextual("of"))?r.init=null:this.raise(this.lastTokEnd,"Complex binding patterns require an initialization value"):this.unexpected(),e.declarations.push(this.finishNode(r,"VariableDeclarator")),!this.eat(L.comma))break}return e},z.parseVarId=function(e,t){e.id=this.parseBindingAtom(t),this.checkLVal(e.id,t,!1)},z.parseFunction=function(e,t,n,r){this.initFunction(e),this.options.ecmaVersion>=6&&!r&&(e.generator=this.eat(L.star)),this.options.ecmaVersion>=8&&(e.async=!!r),t&&(e.id="nullableID"===t&&this.type!=L.name?null:this.parseIdent(),e.id&&this.checkLVal(e.id,"var"));var i=this.inGenerator,s=this.inAsync,o=this.yieldPos,a=this.awaitPos,u=this.inFunction;return this.inGenerator=e.generator,this.inAsync=e.async,this.yieldPos=0,this.awaitPos=0,this.inFunction=!0,this.enterFunctionScope(),t||(e.id=this.type==L.name?this.parseIdent():null),this.parseFunctionParams(e),this.parseFunctionBody(e,n),this.inGenerator=i,this.inAsync=s,this.yieldPos=o,this.awaitPos=a,this.inFunction=u,this.finishNode(e,t?"FunctionDeclaration":"FunctionExpression")},z.parseFunctionParams=function(e){this.expect(L.parenL),e.params=this.parseBindingList(L.parenR,!1,this.options.ecmaVersion>=8),this.checkYieldAwaitInDefaultParams()},z.parseClass=function(e,t){this.next(),this.parseClassId(e,t),this.parseClassSuper(e);var n=this.startNode(),r=!1;for(n.body=[],this.expect(L.braceL);!this.eat(L.braceR);)if(!this.eat(L.semi)){var i=this.startNode(),s=this.eat(L.star),o=!1,a=this.type===L.name&&"static"===this.value;this.parsePropertyName(i),i.static=a&&this.type!==L.parenL,i.static&&(s&&this.unexpected(),s=this.eat(L.star),this.parsePropertyName(i)),this.options.ecmaVersion>=8&&!s&&!i.computed&&"Identifier"===i.key.type&&"async"===i.key.name&&this.type!==L.parenL&&!this.canInsertSemicolon()&&(o=!0,this.parsePropertyName(i)),i.kind="method";var u=!1;if(!i.computed){var c=i.key;s||o||"Identifier"!==c.type||this.type===L.parenL||"get"!==c.name&&"set"!==c.name||(u=!0,i.kind=c.name,c=this.parsePropertyName(i)),!i.static&&("Identifier"===c.type&&"constructor"===c.name||"Literal"===c.type&&"constructor"===c.value)&&(r&&this.raise(c.start,"Duplicate constructor in the same class"),u&&this.raise(c.start,"Constructor can't have get/set modifier"),s&&this.raise(c.start,"Constructor can't be a generator"),o&&this.raise(c.start,"Constructor can't be an async method"),i.kind="constructor",r=!0)}if(this.parseClassMethod(n,i,s,o),u){var l="get"===i.kind?0:1;if(i.value.params.length!==l){var p=i.value.start;"get"===i.kind?this.raiseRecoverable(p,"getter should have no params"):this.raiseRecoverable(p,"setter should have exactly one param")}else"set"===i.kind&&"RestElement"===i.value.params[0].type&&this.raiseRecoverable(i.value.params[0].start,"Setter cannot use rest params")}}return e.body=this.finishNode(n,"ClassBody"),this.finishNode(e,t?"ClassDeclaration":"ClassExpression")},z.parseClassMethod=function(e,t,n,r){t.value=this.parseMethod(n,r),e.body.push(this.finishNode(t,"MethodDefinition"))},z.parseClassId=function(e,t){e.id=this.type===L.name?this.parseIdent():!0===t?this.unexpected():null},z.parseClassSuper=function(e){e.superClass=this.eat(L._extends)?this.parseExprSubscripts():null},z.parseExport=function(e,t){if(this.next(),this.eat(L.star))return this.expectContextual("from"),e.source=this.type===L.string?this.parseExprAtom():this.unexpected(),this.semicolon(),this.finishNode(e,"ExportAllDeclaration");if(this.eat(L._default)){this.checkExport(t,"default",this.lastTokStart);var n;if(this.type===L._function||(n=this.isAsyncFunction())){var r=this.startNode();this.next(),n&&this.next(),e.declaration=this.parseFunction(r,"nullableID",!1,n)}else if(this.type===L._class){var i=this.startNode();e.declaration=this.parseClass(i,"nullableID")}else e.declaration=this.parseMaybeAssign(),this.semicolon();return this.finishNode(e,"ExportDefaultDeclaration")}if(this.shouldParseExportStatement())e.declaration=this.parseStatement(!0),"VariableDeclaration"===e.declaration.type?this.checkVariableExport(t,e.declaration.declarations):this.checkExport(t,e.declaration.id.name,e.declaration.id.start),e.specifiers=[],e.source=null;else{if(e.declaration=null,e.specifiers=this.parseExportSpecifiers(t),this.eatContextual("from"))e.source=this.type===L.string?this.parseExprAtom():this.unexpected();else{for(var s=0,o=e.specifiers;s=6&&e)switch(e.type){case"Identifier":this.inAsync&&"await"===e.name&&this.raise(e.start,"Can not use 'await' as identifier inside an async function");break;case"ObjectPattern":case"ArrayPattern":break;case"ObjectExpression":e.type="ObjectPattern";for(var n=0,r=e.properties;n=6)switch(this.type){case L.bracketL:var e=this.startNode();return this.next(),e.elements=this.parseBindingList(L.bracketR,!0,!0),this.finishNode(e,"ArrayPattern");case L.braceL:return this.parseObj(!0)}return this.parseIdent()},H.parseBindingList=function(e,t,n){for(var r=[],i=!0;!this.eat(e);)if(i?i=!1:this.expect(L.comma),t&&this.type===L.comma)r.push(null);else{if(n&&this.afterTrailingComma(e))break;if(this.type===L.ellipsis){var s=this.parseRestBinding();this.parseBindingListItem(s),r.push(s),this.type===L.comma&&this.raise(this.start,"Comma is not permitted after the rest element"),this.expect(e);break}var o=this.parseMaybeDefault(this.start,this.startLoc);this.parseBindingListItem(o),r.push(o)}return r},H.parseBindingListItem=function(e){return e},H.parseMaybeDefault=function(e,t,n){if(n=n||this.parseBindingAtom(),this.options.ecmaVersion<6||!this.eat(L.eq))return n;var r=this.startNodeAt(e,t);return r.left=n,r.right=this.parseMaybeAssign(),this.finishNode(r,"AssignmentPattern")},H.checkLVal=function(e,t,n){switch(e.type){case"Identifier":this.strict&&this.reservedWordsStrictBind.test(e.name)&&this.raiseRecoverable(e.start,(t?"Binding ":"Assigning to ")+e.name+" in strict mode"),n&&(a(n,e.name)&&this.raiseRecoverable(e.start,"Argument name clash"),n[e.name]=!0),t&&"none"!==t&&(("var"===t&&!this.canDeclareVarName(e.name)||"var"!==t&&!this.canDeclareLexicalName(e.name))&&this.raiseRecoverable(e.start,"Identifier '"+e.name+"' has already been declared"),"var"===t?this.declareVarName(e.name):this.declareLexicalName(e.name));break;case"MemberExpression":t&&this.raiseRecoverable(e.start,(t?"Binding":"Assigning to")+" member expression");break;case"ObjectPattern":for(var r=0,i=e.properties;r=6&&(e.computed||e.method||e.shorthand))){var n,r=e.key;switch(r.type){case"Identifier":n=r.name;break;case"Literal":n=String(r.value);break;default:return}var i=e.kind;if(this.options.ecmaVersion>=6)"__proto__"===n&&"init"===i&&(t.proto&&this.raiseRecoverable(r.start,"Redefinition of __proto__ property"),t.proto=!0);else{var s=t[n="$"+n];if(s){("init"===i?this.strict&&s.init||s.get||s.set:s.init||s[i])&&this.raiseRecoverable(r.start,"Redefinition of property")}else s=t[n]={init:!1,get:!1,set:!1};s[i]=!0}}},Y.parseExpression=function(e,t){var n=this.start,r=this.startLoc,i=this.parseMaybeAssign(e,t);if(this.type===L.comma){var s=this.startNodeAt(n,r);for(s.expressions=[i];this.eat(L.comma);)s.expressions.push(this.parseMaybeAssign(e,t));return this.finishNode(s,"SequenceExpression")}return i},Y.parseMaybeAssign=function(e,t,n){if(this.inGenerator&&this.isContextual("yield"))return this.parseYield();var r=!1,i=-1,s=-1;t?(i=t.parenthesizedAssign,s=t.trailingComma,t.parenthesizedAssign=t.trailingComma=-1):(t=new p,r=!0);var o=this.start,a=this.startLoc;this.type!=L.parenL&&this.type!=L.name||(this.potentialArrowAt=this.start);var u=this.parseMaybeConditional(e,t);if(n&&(u=n.call(this,u,o,a)),this.type.isAssign){this.checkPatternErrors(t,!0),r||p.call(t);var c=this.startNodeAt(o,a);return c.operator=this.value,c.left=this.type===L.eq?this.toAssignable(u):u,t.shorthandAssign=-1,this.checkLVal(u),this.next(),c.right=this.parseMaybeAssign(e),this.finishNode(c,"AssignmentExpression")}return r&&this.checkExpressionErrors(t,!0),i>-1&&(t.parenthesizedAssign=i),s>-1&&(t.trailingComma=s),u},Y.parseMaybeConditional=function(e,t){var n=this.start,r=this.startLoc,i=this.parseExprOps(e,t);if(this.checkExpressionErrors(t))return i;if(this.eat(L.question)){var s=this.startNodeAt(n,r);return s.test=i,s.consequent=this.parseMaybeAssign(),this.expect(L.colon),s.alternate=this.parseMaybeAssign(e),this.finishNode(s,"ConditionalExpression")}return i},Y.parseExprOps=function(e,t){var n=this.start,r=this.startLoc,i=this.parseMaybeUnary(t,!1);return this.checkExpressionErrors(t)?i:i.start==n&&"ArrowFunctionExpression"===i.type?i:this.parseExprOp(i,n,r,-1,e)},Y.parseExprOp=function(e,t,n,r,i){var s=this.type.binop;if(null!=s&&(!i||this.type!==L._in)&&s>r){var o=this.type===L.logicalOR||this.type===L.logicalAND,a=this.value;this.next();var u=this.start,c=this.startLoc,l=this.parseExprOp(this.parseMaybeUnary(null,!1),u,c,s,i),p=this.buildBinary(t,n,e,l,a,o);return this.parseExprOp(p,t,n,r,i)}return e},Y.buildBinary=function(e,t,n,r,i,s){var o=this.startNodeAt(e,t);return o.left=n,o.operator=i,o.right=r,this.finishNode(o,s?"LogicalExpression":"BinaryExpression")},Y.parseMaybeUnary=function(e,t){var n,r=this.start,i=this.startLoc;if(this.inAsync&&this.isContextual("await"))n=this.parseAwait(),t=!0;else if(this.type.prefix){var s=this.startNode(),o=this.type===L.incDec;s.operator=this.value,s.prefix=!0,this.next(),s.argument=this.parseMaybeUnary(null,!0),this.checkExpressionErrors(e,!0),o?this.checkLVal(s.argument):this.strict&&"delete"===s.operator&&"Identifier"===s.argument.type?this.raiseRecoverable(s.start,"Deleting local variable in strict mode"):t=!0,n=this.finishNode(s,o?"UpdateExpression":"UnaryExpression")}else{if(n=this.parseExprSubscripts(e),this.checkExpressionErrors(e))return n;for(;this.type.postfix&&!this.canInsertSemicolon();){var a=this.startNodeAt(r,i);a.operator=this.value,a.prefix=!1,a.argument=n,this.checkLVal(n),this.next(),n=this.finishNode(a,"UpdateExpression")}}return!t&&this.eat(L.starstar)?this.buildBinary(r,i,n,this.parseMaybeUnary(null,!1),"**",!1):n},Y.parseExprSubscripts=function(e){var t=this.start,n=this.startLoc,r=this.parseExprAtom(e),i="ArrowFunctionExpression"===r.type&&")"!==this.input.slice(this.lastTokStart,this.lastTokEnd);if(this.checkExpressionErrors(e)||i)return r;var s=this.parseSubscripts(r,t,n);return e&&"MemberExpression"===s.type&&(e.parenthesizedAssign>=s.start&&(e.parenthesizedAssign=-1),e.parenthesizedBind>=s.start&&(e.parenthesizedBind=-1)),s},Y.parseSubscripts=function(e,t,n,r){for(var i=this.options.ecmaVersion>=8&&"Identifier"===e.type&&"async"===e.name&&this.lastTokEnd==e.end&&!this.canInsertSemicolon(),s=void 0;;)if((s=this.eat(L.bracketL))||this.eat(L.dot)){var o=this.startNodeAt(t,n);o.object=e,o.property=s?this.parseExpression():this.parseIdent(!0),o.computed=!!s,s&&this.expect(L.bracketR),e=this.finishNode(o,"MemberExpression")}else if(!r&&this.eat(L.parenL)){var a=new p,u=this.yieldPos,c=this.awaitPos;this.yieldPos=0,this.awaitPos=0;var l=this.parseExprList(L.parenR,this.options.ecmaVersion>=8,!1,a);if(i&&!this.canInsertSemicolon()&&this.eat(L.arrow))return this.checkPatternErrors(a,!1),this.checkYieldAwaitInDefaultParams(),this.yieldPos=u,this.awaitPos=c,this.parseArrowExpression(this.startNodeAt(t,n),l,!0);this.checkExpressionErrors(a,!0),this.yieldPos=u||this.yieldPos,this.awaitPos=c||this.awaitPos;var h=this.startNodeAt(t,n);h.callee=e,h.arguments=l,e=this.finishNode(h,"CallExpression")}else{if(this.type!==L.backQuote)return e;var f=this.startNodeAt(t,n);f.tag=e,f.quasi=this.parseTemplate({isTagged:!0}),e=this.finishNode(f,"TaggedTemplateExpression")}},Y.parseExprAtom=function(e){var t,n=this.potentialArrowAt==this.start;switch(this.type){case L._super:return this.inFunction||this.raise(this.start,"'super' outside of function or class"),t=this.startNode(),this.next(),this.type!==L.dot&&this.type!==L.bracketL&&this.type!==L.parenL&&this.unexpected(),this.finishNode(t,"Super");case L._this:return t=this.startNode(),this.next(),this.finishNode(t,"ThisExpression");case L.name:var r=this.start,i=this.startLoc,s=this.parseIdent(this.type!==L.name);if(this.options.ecmaVersion>=8&&"async"===s.name&&!this.canInsertSemicolon()&&this.eat(L._function))return this.parseFunction(this.startNodeAt(r,i),!1,!1,!0);if(n&&!this.canInsertSemicolon()){if(this.eat(L.arrow))return this.parseArrowExpression(this.startNodeAt(r,i),[s],!1);if(this.options.ecmaVersion>=8&&"async"===s.name&&this.type===L.name)return s=this.parseIdent(),!this.canInsertSemicolon()&&this.eat(L.arrow)||this.unexpected(),this.parseArrowExpression(this.startNodeAt(r,i),[s],!0)}return s;case L.regexp:var o=this.value;return t=this.parseLiteral(o.value),t.regex={pattern:o.pattern,flags:o.flags},t;case L.num:case L.string:return this.parseLiteral(this.value);case L._null:case L._true:case L._false:return t=this.startNode(),t.value=this.type===L._null?null:this.type===L._true,t.raw=this.type.keyword,this.next(),this.finishNode(t,"Literal");case L.parenL:var a=this.start,u=this.parseParenAndDistinguishExpression(n);return e&&(e.parenthesizedAssign<0&&!this.isSimpleAssignTarget(u)&&(e.parenthesizedAssign=a),e.parenthesizedBind<0&&(e.parenthesizedBind=a)),u;case L.bracketL:return t=this.startNode(),this.next(),t.elements=this.parseExprList(L.bracketR,!0,!0,e),this.finishNode(t,"ArrayExpression");case L.braceL:return this.parseObj(!1,e);case L._function:return t=this.startNode(),this.next(),this.parseFunction(t,!1);case L._class:return this.parseClass(this.startNode(),!1);case L._new:return this.parseNew();case L.backQuote:return this.parseTemplate();default:this.unexpected()}},Y.parseLiteral=function(e){var t=this.startNode();return t.value=e,t.raw=this.input.slice(this.start,this.end),this.next(),this.finishNode(t,"Literal")},Y.parseParenExpression=function(){this.expect(L.parenL);var e=this.parseExpression();return this.expect(L.parenR),e},Y.parseParenAndDistinguishExpression=function(e){var t,n=this.start,r=this.startLoc,i=this.options.ecmaVersion>=8;if(this.options.ecmaVersion>=6){this.next();var s,o,a=this.start,u=this.startLoc,c=[],l=!0,h=!1,f=new p,d=this.yieldPos,y=this.awaitPos;for(this.yieldPos=0,this.awaitPos=0;this.type!==L.parenR;){if(l?l=!1:this.expect(L.comma),i&&this.afterTrailingComma(L.parenR,!0)){h=!0;break}if(this.type===L.ellipsis){s=this.start,c.push(this.parseParenItem(this.parseRestBinding())),this.type===L.comma&&this.raise(this.start,"Comma is not permitted after the rest element");break}this.type!==L.parenL||o||(o=this.start),c.push(this.parseMaybeAssign(!1,f,this.parseParenItem))}var m=this.start,g=this.startLoc;if(this.expect(L.parenR),e&&!this.canInsertSemicolon()&&this.eat(L.arrow))return this.checkPatternErrors(f,!1),this.checkYieldAwaitInDefaultParams(),o&&this.unexpected(o),this.yieldPos=d,this.awaitPos=y,this.parseParenArrowList(n,r,c);c.length&&!h||this.unexpected(this.lastTokStart),s&&this.unexpected(s),this.checkExpressionErrors(f,!0),this.yieldPos=d||this.yieldPos,this.awaitPos=y||this.awaitPos,c.length>1?((t=this.startNodeAt(a,u)).expressions=c,this.finishNodeAt(t,"SequenceExpression",m,g)):t=c[0]}else t=this.parseParenExpression();if(this.options.preserveParens){var v=this.startNodeAt(n,r);return v.expression=t,this.finishNode(v,"ParenthesizedExpression")}return t},Y.parseParenItem=function(e){return e},Y.parseParenArrowList=function(e,t,n){return this.parseArrowExpression(this.startNodeAt(e,t),n)};var Q=[];Y.parseNew=function(){var e=this.startNode(),t=this.parseIdent(!0);if(this.options.ecmaVersion>=6&&this.eat(L.dot))return e.meta=t,e.property=this.parseIdent(!0),"target"!==e.property.name&&this.raiseRecoverable(e.property.start,"The only valid meta property for new is new.target"),this.inFunction||this.raiseRecoverable(e.start,"new.target can only be used in functions"),this.finishNode(e,"MetaProperty");var n=this.start,r=this.startLoc;return e.callee=this.parseSubscripts(this.parseExprAtom(),n,r,!0),this.eat(L.parenL)?e.arguments=this.parseExprList(L.parenR,this.options.ecmaVersion>=8,!1):e.arguments=Q,this.finishNode(e,"NewExpression")},Y.parseTemplateElement=function(e){var t=e.isTagged,n=this.startNode();return this.type===L.invalidTemplate?(t||this.raiseRecoverable(this.start,"Bad escape sequence in untagged template literal"),n.value={raw:this.value,cooked:null}):n.value={raw:this.input.slice(this.start,this.end).replace(/\r\n?/g,"\n"),cooked:this.value},this.next(),n.tail=this.type===L.backQuote,this.finishNode(n,"TemplateElement")},Y.parseTemplate=function(e){void 0===e&&(e={});var t=e.isTagged;void 0===t&&(t=!1);var n=this.startNode();this.next(),n.expressions=[];var r=this.parseTemplateElement({isTagged:t});for(n.quasis=[r];!r.tail;)this.expect(L.dollarBraceL),n.expressions.push(this.parseExpression()),this.expect(L.braceR),n.quasis.push(r=this.parseTemplateElement({isTagged:t}));return this.next(),this.finishNode(n,"TemplateLiteral")},Y.isAsyncProp=function(e){return!e.computed&&"Identifier"===e.key.type&&"async"===e.key.name&&(this.type===L.name||this.type===L.num||this.type===L.string||this.type===L.bracketL||this.type.keyword)&&!O.test(this.input.slice(this.lastTokEnd,this.start))},Y.parseObj=function(e,t){var n=this.startNode(),r=!0,i={};for(n.properties=[],this.next();!this.eat(L.braceR);){if(r)r=!1;else if(this.expect(L.comma),this.afterTrailingComma(L.braceR))break;var s=this.parseProperty(e,t);this.checkPropClash(s,i),n.properties.push(s)}return this.finishNode(n,e?"ObjectPattern":"ObjectExpression")},Y.parseProperty=function(e,t){var n,r,i,s,o=this.startNode();return this.options.ecmaVersion>=6&&(o.method=!1,o.shorthand=!1,(e||t)&&(i=this.start,s=this.startLoc),e||(n=this.eat(L.star))),this.parsePropertyName(o),!e&&this.options.ecmaVersion>=8&&!n&&this.isAsyncProp(o)?(r=!0,this.parsePropertyName(o,t)):r=!1,this.parsePropertyValue(o,e,n,r,i,s,t),this.finishNode(o,"Property")},Y.parsePropertyValue=function(e,t,n,r,i,s,o){if((n||r)&&this.type===L.colon&&this.unexpected(),this.eat(L.colon))e.value=t?this.parseMaybeDefault(this.start,this.startLoc):this.parseMaybeAssign(!1,o),e.kind="init";else if(this.options.ecmaVersion>=6&&this.type===L.parenL)t&&this.unexpected(),e.kind="init",e.method=!0,e.value=this.parseMethod(n,r);else if(t||!(this.options.ecmaVersion>=5)||e.computed||"Identifier"!==e.key.type||"get"!==e.key.name&&"set"!==e.key.name||this.type==L.comma||this.type==L.braceR)this.options.ecmaVersion>=6&&!e.computed&&"Identifier"===e.key.type?(this.checkUnreserved(e.key),e.kind="init",t?e.value=this.parseMaybeDefault(i,s,e.key):this.type===L.eq&&o?(o.shorthandAssign<0&&(o.shorthandAssign=this.start),e.value=this.parseMaybeDefault(i,s,e.key)):e.value=e.key,e.shorthand=!0):this.unexpected();else{(n||r)&&this.unexpected(),e.kind=e.key.name,this.parsePropertyName(e),e.value=this.parseMethod(!1);var a="get"===e.kind?0:1;if(e.value.params.length!==a){var u=e.value.start;"get"===e.kind?this.raiseRecoverable(u,"getter should have no params"):this.raiseRecoverable(u,"setter should have exactly one param")}else"set"===e.kind&&"RestElement"===e.value.params[0].type&&this.raiseRecoverable(e.value.params[0].start,"Setter cannot use rest params")}},Y.parsePropertyName=function(e){if(this.options.ecmaVersion>=6){if(this.eat(L.bracketL))return e.computed=!0,e.key=this.parseMaybeAssign(),this.expect(L.bracketR),e.key;e.computed=!1}return e.key=this.type===L.num||this.type===L.string?this.parseExprAtom():this.parseIdent(!0)},Y.initFunction=function(e){e.id=null,this.options.ecmaVersion>=6&&(e.generator=!1,e.expression=!1),this.options.ecmaVersion>=8&&(e.async=!1)},Y.parseMethod=function(e,t){var n=this.startNode(),r=this.inGenerator,i=this.inAsync,s=this.yieldPos,o=this.awaitPos,a=this.inFunction;return this.initFunction(n),this.options.ecmaVersion>=6&&(n.generator=e),this.options.ecmaVersion>=8&&(n.async=!!t),this.inGenerator=n.generator,this.inAsync=n.async,this.yieldPos=0,this.awaitPos=0,this.inFunction=!0,this.enterFunctionScope(),this.expect(L.parenL),n.params=this.parseBindingList(L.parenR,!1,this.options.ecmaVersion>=8),this.checkYieldAwaitInDefaultParams(),this.parseFunctionBody(n,!1),this.inGenerator=r,this.inAsync=i,this.yieldPos=s,this.awaitPos=o,this.inFunction=a,this.finishNode(n,"FunctionExpression")},Y.parseArrowExpression=function(e,t,n){var r=this.inGenerator,i=this.inAsync,s=this.yieldPos,o=this.awaitPos,a=this.inFunction;return this.enterFunctionScope(),this.initFunction(e),this.options.ecmaVersion>=8&&(e.async=!!n),this.inGenerator=!1,this.inAsync=e.async,this.yieldPos=0,this.awaitPos=0,this.inFunction=!0,e.params=this.toAssignableList(t,!0),this.parseFunctionBody(e,!0),this.inGenerator=r,this.inAsync=i,this.yieldPos=s,this.awaitPos=o,this.inFunction=a,this.finishNode(e,"ArrowFunctionExpression")},Y.parseFunctionBody=function(e,t){var n=t&&this.type!==L.braceL,r=this.strict,i=!1;if(n)e.body=this.parseMaybeAssign(),e.expression=!0,this.checkParams(e,!1);else{var s=this.options.ecmaVersion>=7&&!this.isSimpleParamList(e.params);r&&!s||(i=this.strictDirective(this.end))&&s&&this.raiseRecoverable(e.start,"Illegal 'use strict' directive in function with non-simple parameter list");var o=this.labels;this.labels=[],i&&(this.strict=!0),this.checkParams(e,!r&&!i&&!t&&this.isSimpleParamList(e.params)),e.body=this.parseBlock(!1),e.expression=!1,this.adaptDirectivePrologue(e.body.body),this.labels=o}this.exitFunctionScope(),this.strict&&e.id&&this.checkLVal(e.id,"none"),this.strict=r},Y.isSimpleParamList=function(e){for(var t=0,n=e;t0;)t[n]=arguments[n+1];for(var r=0,i=t;r=1;e--){var t=this.context[e];if("function"===t.token)return t.generator}return!1},ie.updateContext=function(e){var t,n=this.type;n.keyword&&e==L.dot?this.exprAllowed=!1:(t=n.updateContext)?t.call(this,e):this.exprAllowed=n.beforeExpr},L.parenR.updateContext=L.braceR.updateContext=function(){if(1!=this.context.length){var e=this.context.pop();e===re.b_stat&&"function"===this.curContext().token&&(e=this.context.pop()),this.exprAllowed=!e.isExpr}else this.exprAllowed=!0},L.braceL.updateContext=function(e){this.context.push(this.braceIsBlock(e)?re.b_stat:re.b_expr),this.exprAllowed=!0},L.dollarBraceL.updateContext=function(){this.context.push(re.b_tmpl),this.exprAllowed=!0},L.parenL.updateContext=function(e){var t=e===L._if||e===L._for||e===L._with||e===L._while;this.context.push(t?re.p_stat:re.p_expr),this.exprAllowed=!0},L.incDec.updateContext=function(){},L._function.updateContext=L._class.updateContext=function(e){e.beforeExpr&&e!==L.semi&&e!==L._else&&(e!==L.colon&&e!==L.braceL||this.curContext()!==re.b_stat)?this.context.push(re.f_expr):this.context.push(re.f_stat),this.exprAllowed=!1},L.backQuote.updateContext=function(){this.curContext()===re.q_tmpl?this.context.pop():this.context.push(re.q_tmpl),this.exprAllowed=!1},L.star.updateContext=function(e){if(e==L._function){var t=this.context.length-1;this.context[t]===re.f_expr?this.context[t]=re.f_expr_gen:this.context[t]=re.f_gen}this.exprAllowed=!0},L.name.updateContext=function(e){var t=!1;this.options.ecmaVersion>=6&&("of"==this.value&&!this.exprAllowed||"yield"==this.value&&this.inGeneratorContext())&&(t=!0),this.exprAllowed=t};var se=function(e){this.type=e.type,this.value=e.value,this.start=e.start,this.end=e.end,e.options.locations&&(this.loc=new j(e,e.startLoc,e.endLoc)),e.options.ranges&&(this.range=[e.start,e.end])},oe=V.prototype,ae="object"==typeof Packages&&"[object JavaPackage]"==Object.prototype.toString.call(Packages);oe.next=function(){this.options.onToken&&this.options.onToken(new se(this)),this.lastTokEnd=this.end,this.lastTokStart=this.start,this.lastTokEndLoc=this.endLoc,this.lastTokStartLoc=this.startLoc,this.nextToken()},oe.getToken=function(){return this.next(),new se(this)},"undefined"!=typeof Symbol&&(oe[Symbol.iterator]=function(){var e=this;return{next:function(){var t=e.getToken();return{done:t.type===L.eof,value:t}}}}),oe.curContext=function(){return this.context[this.context.length-1]},oe.nextToken=function(){var e=this.curContext();return e&&e.preserveSpace||this.skipSpace(),this.start=this.pos,this.options.locations&&(this.startLoc=this.curPosition()),this.pos>=this.input.length?this.finishToken(L.eof):e.override?e.override(this):void this.readToken(this.fullCharCodeAtPos())},oe.readToken=function(e){return n(e,this.options.ecmaVersion>=6)||92===e?this.readWord():this.getTokenFromCode(e)},oe.fullCharCodeAtPos=function(){var e=this.input.charCodeAt(this.pos);if(e<=55295||e>=57344)return e;return(e<<10)+this.input.charCodeAt(this.pos+1)-56613888},oe.skipBlockComment=function(){var e=this.options.onComment&&this.curPosition(),t=this.pos,n=this.input.indexOf("*/",this.pos+=2);if(-1===n&&this.raise(this.pos-2,"Unterminated comment"),this.pos=n+2,this.options.locations){T.lastIndex=t;for(var r;(r=T.exec(this.input))&&r.index8&&e<14||e>=5760&&N.test(String.fromCharCode(e))))break e;++this.pos}}},oe.finishToken=function(e,t){this.end=this.pos,this.options.locations&&(this.endLoc=this.curPosition());var n=this.type;this.type=e,this.value=t,this.updateContext(n)},oe.readToken_dot=function(){var e=this.input.charCodeAt(this.pos+1);if(e>=48&&e<=57)return this.readNumber(!0);var t=this.input.charCodeAt(this.pos+2);return this.options.ecmaVersion>=6&&46===e&&46===t?(this.pos+=3,this.finishToken(L.ellipsis)):(++this.pos,this.finishToken(L.dot))},oe.readToken_slash=function(){var e=this.input.charCodeAt(this.pos+1);return this.exprAllowed?(++this.pos,this.readRegexp()):61===e?this.finishOp(L.assign,2):this.finishOp(L.slash,1)},oe.readToken_mult_modulo_exp=function(e){var t=this.input.charCodeAt(this.pos+1),n=1,r=42===e?L.star:L.modulo;return this.options.ecmaVersion>=7&&42==e&&42===t&&(++n,r=L.starstar,t=this.input.charCodeAt(this.pos+2)),61===t?this.finishOp(L.assign,n+1):this.finishOp(r,n)},oe.readToken_pipe_amp=function(e){var t=this.input.charCodeAt(this.pos+1);return t===e?this.finishOp(124===e?L.logicalOR:L.logicalAND,2):61===t?this.finishOp(L.assign,2):this.finishOp(124===e?L.bitwiseOR:L.bitwiseAND,1)},oe.readToken_caret=function(){return 61===this.input.charCodeAt(this.pos+1)?this.finishOp(L.assign,2):this.finishOp(L.bitwiseXOR,1)},oe.readToken_plus_min=function(e){var t=this.input.charCodeAt(this.pos+1);return t===e?45!=t||this.inModule||62!=this.input.charCodeAt(this.pos+2)||0!==this.lastTokEnd&&!O.test(this.input.slice(this.lastTokEnd,this.pos))?this.finishOp(L.incDec,2):(this.skipLineComment(3),this.skipSpace(),this.nextToken()):61===t?this.finishOp(L.assign,2):this.finishOp(L.plusMin,1)},oe.readToken_lt_gt=function(e){var t=this.input.charCodeAt(this.pos+1),n=1;return t===e?(n=62===e&&62===this.input.charCodeAt(this.pos+2)?3:2,61===this.input.charCodeAt(this.pos+n)?this.finishOp(L.assign,n+1):this.finishOp(L.bitShift,n)):33!=t||60!=e||this.inModule||45!=this.input.charCodeAt(this.pos+2)||45!=this.input.charCodeAt(this.pos+3)?(61===t&&(n=2),this.finishOp(L.relational,n)):(this.skipLineComment(4),this.skipSpace(),this.nextToken())},oe.readToken_eq_excl=function(e){var t=this.input.charCodeAt(this.pos+1);return 61===t?this.finishOp(L.equality,61===this.input.charCodeAt(this.pos+2)?3:2):61===e&&62===t&&this.options.ecmaVersion>=6?(this.pos+=2,this.finishToken(L.arrow)):this.finishOp(61===e?L.eq:L.prefix,1)},oe.getTokenFromCode=function(e){switch(e){case 46:return this.readToken_dot();case 40:return++this.pos,this.finishToken(L.parenL);case 41:return++this.pos,this.finishToken(L.parenR);case 59:return++this.pos,this.finishToken(L.semi);case 44:return++this.pos,this.finishToken(L.comma);case 91:return++this.pos,this.finishToken(L.bracketL);case 93:return++this.pos,this.finishToken(L.bracketR);case 123:return++this.pos,this.finishToken(L.braceL);case 125:return++this.pos,this.finishToken(L.braceR);case 58:return++this.pos,this.finishToken(L.colon);case 63:return++this.pos,this.finishToken(L.question);case 96:if(this.options.ecmaVersion<6)break;return++this.pos,this.finishToken(L.backQuote);case 48:var t=this.input.charCodeAt(this.pos+1);if(120===t||88===t)return this.readRadixNumber(16);if(this.options.ecmaVersion>=6){if(111===t||79===t)return this.readRadixNumber(8);if(98===t||66===t)return this.readRadixNumber(2)}case 49:case 50:case 51:case 52:case 53:case 54:case 55:case 56:case 57:return this.readNumber(!1);case 34:case 39:return this.readString(e);case 47:return this.readToken_slash();case 37:case 42:return this.readToken_mult_modulo_exp(e);case 124:case 38:return this.readToken_pipe_amp(e);case 94:return this.readToken_caret();case 43:case 45:return this.readToken_plus_min(e);case 60:case 62:return this.readToken_lt_gt(e);case 61:case 33:return this.readToken_eq_excl(e);case 126:return this.finishOp(L.prefix,1)}this.raise(this.pos,"Unexpected character '"+d(e)+"'")},oe.finishOp=function(e,t){var n=this.input.slice(this.pos,this.pos+t);return this.pos+=t,this.finishToken(e,n)};var ue=!!f("","u");oe.readRegexp=function(){for(var e,t,n=this,r=this.pos;;){n.pos>=n.input.length&&n.raise(r,"Unterminated regular expression");var i=n.input.charAt(n.pos);if(O.test(i)&&n.raise(r,"Unterminated regular expression"),e)e=!1;else{if("["===i)t=!0;else if("]"===i&&t)t=!1;else if("/"===i&&!t)break;e="\\"===i}++n.pos}var s=this.input.slice(r,this.pos);++this.pos;var o=this.readWord1(),a=s,u="";if(o){var c=/^[gim]*$/;this.options.ecmaVersion>=6&&(c=/^[gimuy]*$/),c.test(o)||this.raise(r,"Invalid regular expression flag"),o.indexOf("u")>=0&&(ue?u="u":(a=(a=a.replace(/\\u\{([0-9a-fA-F]+)\}/g,function(e,t,i){return(t=Number("0x"+t))>1114111&&n.raise(r+i+3,"Code point out of bounds"),"x"})).replace(/\\u([a-fA-F0-9]{4})|[\uD800-\uDBFF][\uDC00-\uDFFF]/g,"x"),u=u.replace("u","")))}var l=null;return ae||(f(a,u,r,this),l=f(s,o)),this.finishToken(L.regexp,{pattern:s,flags:o,value:l})},oe.readInt=function(e,t){for(var n=this.pos,r=0,i=0,s=null==t?1/0:t;i=97?o-97+10:o>=65?o-65+10:o>=48&&o<=57?o-48:1/0)>=e)break;++this.pos,r=r*e+a}return this.pos===n||null!=t&&this.pos-n!==t?null:r},oe.readRadixNumber=function(e){this.pos+=2;var t=this.readInt(e);return null==t&&this.raise(this.start+2,"Expected number in radix "+e),n(this.fullCharCodeAtPos())&&this.raise(this.pos,"Identifier directly after number"),this.finishToken(L.num,t)},oe.readNumber=function(e){var t=this.pos,r=!1,i=48===this.input.charCodeAt(this.pos);e||null!==this.readInt(10)||this.raise(t,"Invalid number"),i&&this.pos==t+1&&(i=!1);var s=this.input.charCodeAt(this.pos);46!==s||i||(++this.pos,this.readInt(10),r=!0,s=this.input.charCodeAt(this.pos)),69!==s&&101!==s||i||(43!==(s=this.input.charCodeAt(++this.pos))&&45!==s||++this.pos,null===this.readInt(10)&&this.raise(t,"Invalid number"),r=!0),n(this.fullCharCodeAtPos())&&this.raise(this.pos,"Identifier directly after number");var o,a=this.input.slice(t,this.pos);return r?o=parseFloat(a):i&&1!==a.length?this.strict?this.raise(t,"Invalid number"):o=/[89]/.test(a)?parseInt(a,10):parseInt(a,8):o=parseInt(a,10),this.finishToken(L.num,o)},oe.readCodePoint=function(){var e;if(123===this.input.charCodeAt(this.pos)){this.options.ecmaVersion<6&&this.unexpected();var t=++this.pos;e=this.readHexChar(this.input.indexOf("}",this.pos)-this.pos),++this.pos,e>1114111&&this.invalidStringToken(t,"Code point out of bounds")}else e=this.readHexChar(4);return e},oe.readString=function(e){for(var t="",n=++this.pos;;){this.pos>=this.input.length&&this.raise(this.start,"Unterminated string constant");var r=this.input.charCodeAt(this.pos);if(r===e)break;92===r?(t+=this.input.slice(n,this.pos),t+=this.readEscapedChar(!1),n=this.pos):(o(r)&&this.raise(this.start,"Unterminated string constant"),++this.pos)}return t+=this.input.slice(n,this.pos++),this.finishToken(L.string,t)};var ce={};oe.tryReadTemplateToken=function(){this.inTemplateElement=!0;try{this.readTmplToken()}catch(e){if(e!==ce)throw e;this.readInvalidTemplateToken()}this.inTemplateElement=!1},oe.invalidStringToken=function(e,t){if(this.inTemplateElement&&this.options.ecmaVersion>=9)throw ce;this.raise(e,t)},oe.readTmplToken=function(){for(var e="",t=this.pos;;){this.pos>=this.input.length&&this.raise(this.start,"Unterminated template");var n=this.input.charCodeAt(this.pos);if(96===n||36===n&&123===this.input.charCodeAt(this.pos+1))return this.pos!==this.start||this.type!==L.template&&this.type!==L.invalidTemplate?(e+=this.input.slice(t,this.pos),this.finishToken(L.template,e)):36===n?(this.pos+=2,this.finishToken(L.dollarBraceL)):(++this.pos,this.finishToken(L.backQuote));if(92===n)e+=this.input.slice(t,this.pos),e+=this.readEscapedChar(!0),t=this.pos;else if(o(n)){switch(e+=this.input.slice(t,this.pos),++this.pos,n){case 13:10===this.input.charCodeAt(this.pos)&&++this.pos;case 10:e+="\n";break;default:e+=String.fromCharCode(n)}this.options.locations&&(++this.curLine,this.lineStart=this.pos),t=this.pos}else++this.pos}},oe.readInvalidTemplateToken=function(){for(;this.pos=48&&t<=55){var n=this.input.substr(this.pos-1,3).match(/^[0-7]+/)[0],r=parseInt(n,8);return r>255&&(n=n.slice(0,-1),r=parseInt(n,8)),"0"!==n&&(this.strict||e)&&this.invalidStringToken(this.pos-2,"Octal literal in strict mode"),this.pos+=n.length-1,String.fromCharCode(r)}return String.fromCharCode(t)}},oe.readHexChar=function(e){var t=this.pos,n=this.readInt(16,e);return null===n&&this.invalidStringToken(t,"Bad character escape sequence"),n},oe.readWord1=function(){this.containsEsc=!1;for(var e="",t=!0,i=this.pos,s=this.options.ecmaVersion>=6;this.pos=s)&&a[c](t,n,e),(null==r||t.start==r)&&(null==s||t.end==s)&&o(c,t))throw new i(t,n)}(n,u)}catch(e){if(e instanceof i)return e;throw e}},e.findNodeAround=function(n,r,s,o,a){s=t(s),o||(o=e.base);try{!function e(t,n,a){var u=a||t.type;if(!(t.start>r||t.end