chore(deps): update dependency npm to v8.11.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
npm (source)	8.9.0 -> 8.11.0

GitHub Vulnerability Alerts

CVE-2022-29244

Impact

npm pack ignores root-level .gitignore & .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. --workspaces, --workspace=<name>). Anyone who has run npm pack or npm publish with workspaces, as of v7.9.0 & v7.13.0 respectively, may be affected and have published files into the npm registry they did not intend to include.

Patch

• Upgrade to the latest, patched version of npm (v8.11.0 or greater), run: npm i -g npm@latest
• Node.js versions v16.15.1, v17.19.1 & v18.3.0 include the patched v8.11.0 version of npm

Steps to take to see if you're impacted

1. Run npm publish --dry-run or npm pack with an npm version >=7.9.0 & <8.11.0 inside the project's root directory using a workspace flag like: --workspaces or --workspace=<name> (ex. npm pack --workspace=foo)
2. Check the output in your terminal which will list the package contents (note: tar -tvf <package-on-disk> also works)
3. If you find that there are files included you did not expect, you should:
   3.1. Create & publish a new release excluding those files (ref. "Keeping files out of your Package")
   3.2. Deprecate the old package (ex. npm deprecate <pkg>[@&#8203;<version>] <message>)
   3.3. Revoke or rotate any sensitive information (ex. passwords, tokens, secrets etc.) which might have been exposed

References

• CVE-2022-29244
• npm-packlist
• libnpmpack
• libnpmpublish

---

Release Notes

npm/cli (npm)

v8.11.0

Compare Source

v8.11.0 (2022-05-25)

Features

• 8898710 #​4879 feat: deprecated set-script, birthday, --global, and --local (@​fritzy)
• 7307c8d #​4940 feat(libnpmpack): bump pacote for better workspace awareness (@​nlf)

Bug Fixes

• 400c80f #​4913 fix(ci): remove node_modules post-validation (@​wraithgar)
• 124df81 #​4910 fix: clean up npm cache tests (@​wraithgar)
• ee3308a fix: remove dead code from get-identity (@​wraithgar)
• 357b0af #​4917 fix: pass prefix and workspaces to libnpmpack (@​nlf)
• 0f89e07 #​4935 fix: add global getter to npm class (@​nlf)

Documentation

• 83ed8d0 #​4922 docs: update roadmap link in readme (@​OmriBarZik)
• ed054d4 #​4933 docs: fix broken link in changelog (@​yonran)

Dependencies

• 632ce87 #​4915 deps: cacache@16.1.0
• 7b2b77a #​4915 deps: make-fetch-happen@10.1.5
• f3b0a24 #​4915 deps: pacote@13.4.1
• 0df3011 #​4915 deps: ssri@9.0.1
• dc38ab9 #​4919 deps: npm-packlist@5.0.4
• 353e2f9 #​4940 deps: pacote@13.5.0 npm-packlist@5.1.0
• f4d4126 #​4941 deps: libnpmpack@4.1.0

v8.10.0

Compare Source

v8.10.0 (2022-05-11)

Features

• 911f55d #​4864 feat: add --iwr alias for --include-workspace-root (@​fritzy)
• bfb8bcc #​4874 feat: add flag --omit-lockfile-registry-resolved (@​fritzy) (Caleb ツ Everett)

Bug Fixes

• 48d2db6 #​4862 fix: remove test coverage map (@​wraithgar)
• 38cf29a #​4868 fix: cleanup star/unstar (@​wraithgar)
• 5baa4a7 #​4857 fix: consolidate bugs, docs, repo command logic (@​wraithgar)
• 5a50762 #​4875 fix(arborist): link deps lifecycle scripts (@​ruyadorno)

Dependencies

• d58bf40 #​4856 deps: npm-packlist@5.0.3
• 86f443e #​4872 deps: make-fetch-happen@10.1.3
• f9984e6 #​4880 deps: @npmcli/arborist@5.2.0
• ba59915 #​4881 deps: socks-proxy-agent@6.2.0
• c0806ba #​4881 deps: http-proxy-agent@5.0.1
• cc7be6b #​4881 deps: is-core-module@2.9.0
• 0432c7d #​4881 deps: lru-cache@7.9.0
• 5778820 #​4881 deps: just-diff@5.0.2
• 893dd00 #​4881 deps: ip@1.1.8
• 6ab85bd #​4881 deps: builtins@5.0.1

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.