deps: upgrade npm to 8.3.2

PR-URL: #41621
Reviewed-By: Ruy Adorno <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Mohammed Keyvanzadeh <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

deps/npm/docs/content/commands/npm-dedupe.md

@@ -72,6 +72,12 @@ result in new modules being installed.
 
 Using `npm find-dupes` will run the command in `--dry-run` mode.
 
+Note that by default `npm dedupe` will not update the semver values of direct
+dependencies in your project `package.json`, if you want to also update
+values in `package.json` you can run: `npm dedupe --save` (or add the
+`save=true` option to a [configuration file](/configuring-npm/npmrc)
+to make that the default behavior).
+
 ### Configuration
 
 <!-- AUTOGENERATED CONFIG DESCRIPTIONS START -->

deps/npm/docs/content/commands/npm-update.md

@@ -27,6 +27,12 @@ packages.
 If no package name is specified, all packages in the specified location (global
 or local) will be updated.
 
+Note that by default `npm update` will not update the semver values of direct
+dependencies in your project `package.json`, if you want to also update
+values in `package.json` you can run: `npm update --save` (or add the
+`save=true` option to a [configuration file](/configuring-npm/npmrc)
+to make that the default behavior).
+
 ### Example
 
 For the examples below, assume that the current package is `app` and it depends

deps/npm/docs/content/using-npm/config.md

@@ -1326,13 +1326,16 @@ The base URL of the npm registry.
 
 #### `save`
 
-* Default: true
+* Default: `true` unless when using `npm update` or `npm dedupe` where it
+  defaults to `false`
 * Type: Boolean
 
-Save installed packages to a package.json file as dependencies.
+Save installed packages to a `package.json` file as dependencies.
 
 When used with the `npm rm` command, removes the dependency from
-package.json.
+`package.json`.
+
+Will also prevent writing to `package-lock.json` if set to `false`.
 
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->

deps/npm/docs/output/commands/npm-dedupe.html

@@ -192,6 +192,11 @@ <h3 id="description">Description</h3>
 <p>Note that this operation transforms the dependency tree, but will never
 result in new modules being installed.</p>
 <p>Using <code>npm find-dupes</code> will run the command in <code>--dry-run</code> mode.</p>
+<p>Note that by default <code>npm dedupe</code> will not update the semver values of direct
+dependencies in your project <code>package.json</code>, if you want to also update
+values in <code>package.json</code> you can run: <code>npm dedupe --save</code> (or add the
+<code>save=true</code> option to a <a href="../configuring-npm/npmrc.html">configuration file</a>
+to make that the default behavior).</p>
 <h3 id="configuration">Configuration</h3>
 <!-- raw HTML omitted -->
 <!-- raw HTML omitted -->

deps/npm/docs/output/commands/npm-ls.html

@@ -160,7 +160,7 @@ <h3 id="description">Description</h3>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre lang="bash"><code>[email protected].1 /path/to/npm
+<pre lang="bash"><code>[email protected].2 /path/to/npm
 └─┬ [email protected]
   └── [email protected]
 </code></pre>

deps/npm/docs/output/commands/npm-update.html

@@ -160,6 +160,11 @@ <h3 id="description">Description</h3>
 packages.</p>
 <p>If no package name is specified, all packages in the specified location (global
 or local) will be updated.</p>
+<p>Note that by default <code>npm update</code> will not update the semver values of direct
+dependencies in your project <code>package.json</code>, if you want to also update
+values in <code>package.json</code> you can run: <code>npm update --save</code> (or add the
+<code>save=true</code> option to a <a href="../configuring-npm/npmrc.html">configuration file</a>
+to make that the default behavior).</p>
 <h3 id="example">Example</h3>
 <p>For the examples below, assume that the current package is <code>app</code> and it depends
 on dependencies, <code>dep1</code> (<code>dep2</code>, .. etc.).  The published versions of <code>dep1</code>

deps/npm/docs/output/commands/npm.html

@@ -149,7 +149,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 <pre lang="bash"><code>npm &lt;command&gt; [args]
 </code></pre>
 <h3 id="version">Version</h3>
-<p>8.3.1</p>
+<p>8.3.2</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/docs/output/using-npm/config.html

@@ -1210,12 +1210,14 @@ <h4 id="registry"><code>registry</code></h4>
 <!-- raw HTML omitted -->
 <h4 id="save"><code>save</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: <code>true</code> unless when using <code>npm update</code> or <code>npm dedupe</code> where it
+defaults to <code>false</code></li>
 <li>Type: Boolean</li>
 </ul>
-<p>Save installed packages to a package.json file as dependencies.</p>
+<p>Save installed packages to a <code>package.json</code> file as dependencies.</p>
 <p>When used with the <code>npm rm</code> command, removes the dependency from
-package.json.</p>
+<code>package.json</code>.</p>
+<p>Will also prevent writing to <code>package-lock.json</code> if set to <code>false</code>.</p>
 <!-- raw HTML omitted -->
 <!-- raw HTML omitted -->
 <h4 id="save-bundle"><code>save-bundle</code></h4>

deps/npm/lib/base-command.js

@@ -1,4 +1,7 @@
 // Base class for npm commands
+
+const { relative } = require('path')
+
 const usageUtil = require('./utils/usage.js')
 const ConfigDefinitions = require('./utils/config/definitions.js')
 const getWorkspaces = require('./workspaces/get-workspaces.js')
@@ -78,9 +81,14 @@ class BaseCommand {
       this.includeWorkspaceRoot = false
     }
 
+    const relativeFrom = relative(this.npm.localPrefix, process.cwd()).startsWith('..')
+      ? this.npm.localPrefix
+      : process.cwd()
+
     const ws = await getWorkspaces(filters, {
       path: this.npm.localPrefix,
       includeWorkspaceRoot: this.includeWorkspaceRoot,
+      relativeFrom,
     })
     this.workspaces = ws
     this.workspaceNames = [...ws.keys()]

deps/npm/lib/commands/dedupe.js

@@ -13,6 +13,7 @@ class Dedupe extends ArboristWorkspaceCmd {
     'legacy-bundling',
     'strict-peer-deps',
     'package-lock',
+    'save',
     'omit',
     'ignore-scripts',
     'audit',
@@ -29,13 +30,20 @@ class Dedupe extends ArboristWorkspaceCmd {
       throw er
     }
 
+    // In the context of `npm dedupe` the save
+    // config value should default to `false`
+    const save = this.npm.config.isDefault('save')
+      ? false
+      : this.npm.config.get('save')
+
     const dryRun = this.npm.config.get('dry-run')
     const where = this.npm.prefix
     const opts = {
       ...this.npm.flatOptions,
       log,
       path: where,
       dryRun,
+      save,
       workspaces: this.workspaceNames,
     }
     const arb = new Arborist(opts)

deps/npm/lib/commands/update.js

@@ -16,6 +16,7 @@ class Update extends ArboristWorkspaceCmd {
     'legacy-bundling',
     'strict-peer-deps',
     'package-lock',
+    'save',
     'omit',
     'ignore-scripts',
     'audit',
@@ -40,19 +41,27 @@ class Update extends ArboristWorkspaceCmd {
       ? global
       : this.npm.prefix
 
+    // In the context of `npm update` the save
+    // config value should default to `false`
+    const save = this.npm.config.isDefault('save')
+      ? false
+      : this.npm.config.get('save')
+
     if (this.npm.config.get('depth')) {
       log.warn('update', 'The --depth option no longer has any effect. See RFC0019.\n' +
         'https://github.com/npm/rfcs/blob/latest/implemented/0019-remove-update-depth-option.md')
     }
 
-    const arb = new Arborist({
+    const opts = {
       ...this.npm.flatOptions,
       log,
       path: where,
+      save,
       workspaces: this.workspaceNames,
-    })
+    }
+    const arb = new Arborist(opts)
 
-    await arb.reify({ update })
+    await arb.reify({ ...opts, update })
     await reifyFinish(this.npm, arb)
   }
 }

deps/npm/lib/utils/config/definitions.js

@@ -1583,14 +1583,18 @@ define('registry', {
 
 define('save', {
   default: true,
+  defaultDescription: `\`true\` unless when using \`npm update\` or
+  \`npm dedupe\` where it defaults to \`false\``,
   usage: '-S|--save|--no-save|--save-prod|--save-dev|--save-optional|--save-peer',
   type: Boolean,
   short: 'S',
   description: `
-    Save installed packages to a package.json file as dependencies.
+    Save installed packages to a \`package.json\` file as dependencies.
 
     When used with the \`npm rm\` command, removes the dependency from
-    package.json.
+    \`package.json\`.
+
+    Will also prevent writing to \`package-lock.json\` if set to \`false\`.
   `,
   flatten,
 })

deps/npm/lib/workspaces/get-workspaces.js

@@ -5,7 +5,7 @@ const rpj = require('read-package-json-fast')
 
 // Returns an Map of paths to workspaces indexed by workspace name
 // { foo => '/path/to/foo' }
-const getWorkspaces = async (filters, { path, includeWorkspaceRoot }) => {
+const getWorkspaces = async (filters, { path, includeWorkspaceRoot, relativeFrom }) => {
   // TODO we need a better error to be bubbled up here if this rpj call fails
   const pkg = await rpj(resolve(path, 'package.json'))
   const workspaces = await mapWorkspaces({ cwd: path, pkg })
@@ -21,8 +21,8 @@ const getWorkspaces = async (filters, { path, includeWorkspaceRoot }) => {
   for (const filterArg of filters) {
     for (const [workspaceName, workspacePath] of workspaces.entries()) {
       if (filterArg === workspaceName
-        || resolve(path, filterArg) === workspacePath
-        || minimatch(workspacePath, `${resolve(path, filterArg)}/*`)) {
+        || resolve(relativeFrom || path, filterArg) === workspacePath
+        || minimatch(workspacePath, `${resolve(relativeFrom || path, filterArg)}/*`)) {
         res.set(workspaceName, workspacePath)
       }
     }

deps/npm/man/man1/npm-dedupe.1

@@ -75,6 +75,12 @@ Note that this operation transforms the dependency tree, but will never
 result in new modules being installed\.
 .P
 Using \fBnpm find\-dupes\fP will run the command in \fB\-\-dry\-run\fP mode\.
+.P
+Note that by default \fBnpm dedupe\fP will not update the semver values of direct
+dependencies in your project \fBpackage\.json\fP, if you want to also update
+values in \fBpackage\.json\fP you can run: \fBnpm dedupe \-\-save\fP (or add the
+\fBsave=true\fP option to a npm help configuration file
+to make that the default behavior)\.
 .SS Configuration
 <!\-\- AUTOGENERATED CONFIG DESCRIPTIONS START \-\->
 <!\-\- automatically generated, do not edit manually \-\->

deps/npm/man/man1/npm-ls.1

@@ -26,7 +26,7 @@ example, running \fBnpm ls promzard\fP in npm's source tree will show:
 .P
 .RS 2
 .nf
-npm@8\.3\.1 /path/to/npm
+npm@8\.3\.2 /path/to/npm
 └─┬ init\-package\-json@0\.0\.4
   └── promzard@0\.1\.5
 .fi

deps/npm/man/man1/npm-update.1

@@ -24,6 +24,12 @@ packages\.
 .P
 If no package name is specified, all packages in the specified location (global
 or local) will be updated\.
+.P
+Note that by default \fBnpm update\fP will not update the semver values of direct
+dependencies in your project \fBpackage\.json\fP, if you want to also update
+values in \fBpackage\.json\fP you can run: \fBnpm update \-\-save\fP (or add the
+\fBsave=true\fP option to a npm help configuration file
+to make that the default behavior)\.
 .SS Example
 .P
 For the examples below, assume that the current package is \fBapp\fP and it depends

deps/npm/man/man1/npm.1

@@ -10,7 +10,7 @@ npm <command> [args]
 .RE
 .SS Version
 .P
-8\.3\.1
+8\.3\.2
 .SS Description
 .P
 npm is the package manager for the Node JavaScript platform\.  It puts

deps/npm/man/man7/config.7

@@ -1673,16 +1673,19 @@ The base URL of the npm registry\.
 .SS \fBsave\fP
 .RS 0
 .IP \(bu 2
-Default: true
+Default: \fBtrue\fP unless when using \fBnpm update\fP or \fBnpm dedupe\fP where it
+defaults to \fBfalse\fP
 .IP \(bu 2
 Type: Boolean
 
 .RE
 .P
-Save installed packages to a package\.json file as dependencies\.
+Save installed packages to a \fBpackage\.json\fP file as dependencies\.
 .P
 When used with the \fBnpm rm\fP command, removes the dependency from
-package\.json\.
+\fBpackage\.json\fP\|\.
+.P
+Will also prevent writing to \fBpackage\-lock\.json\fP if set to \fBfalse\fP\|\.
 <!\-\- automatically generated, do not edit manually \-\->
 <!\-\- see lib/utils/config/definitions\.js \-\->