diff --git a/deps/npm/AUTHORS b/deps/npm/AUTHORS
index d731ad8ca64f03..3032e1e5459d36 100644
--- a/deps/npm/AUTHORS
+++ b/deps/npm/AUTHORS
@@ -750,3 +750,6 @@ Gar
dr-js
Pavan Bellamkonda <31280326+pavanbellamkonda@users.noreply.github.com>
Alexander Riccio
+RA80533 <32469082+RA80533@users.noreply.github.com>
+Ikko Ashimine
+MrBrain295 <66077254+MrBrain295@users.noreply.github.com>
diff --git a/deps/npm/CHANGELOG.md b/deps/npm/CHANGELOG.md
index 77322b9f587baf..9e76a074739e51 100644
--- a/deps/npm/CHANGELOG.md
+++ b/deps/npm/CHANGELOG.md
@@ -1,3 +1,179 @@
+## v7.5.6 (2021-02-22
+
+### BUG FIXES
+
+* [`4e58274ed`](https://github.com/npm/cli/commit/4e58274ed0fd2dd29d3c8d6c7c47f37a37dc0f0f)
+ [#2742](https://github.com/npm/cli/issues/2742)
+ Do not print error banner for shell proxy commands
+ ([@isaacs](https://github.com/isaacs))
+
+### DOCS
+
+* [`3c72ab441`](https://github.com/npm/cli/commit/3c72ab4412111c708736e3a7b8342150372a4af4)
+ [#2749](https://github.com/npm/cli/issues/2749)
+ Capitalize Package in a Heading
+ ([@MrBrain295](https://github.com/MrBrain295))
+
+### DEPENDENCIES
+
+* [`f3ae6ed0d`](https://github.com/npm/cli/commit/f3ae6ed0d25ce80868f59353ef71c09ac77b1cf5)
+ `read-package-json@3.0.1`, `read-package-json-fast@2.0.2`
+* [`9b311fe52`](https://github.com/npm/cli/commit/9b311fe522077c7f8a242b94b0e1dbe746992bef)
+ [#2736](https://github.com/npm/cli/issue/2736) `@npmcli/arborist@2.2.4`:
+ * Do not rely on underscore fields in `package.json` files
+ * Do not remove global packages when updating by name
+ * Keep `yarn.lock` and `package-lock.json` more in sync
+
+## v7.5.5 (2021-02-22)
+
+### BUG FIXES
+* [`49c95375a`](https://github.com/npm/cli/commit/49c95375af49308e2db6ba28e91c65193754e091)
+ [#2688](https://github.com/npm/cli/issues/2688)
+ fix shrinkwrap in node v10.0
+ ([@ljharb](https://github.com/ljharb))
+* [`00afa3161`](https://github.com/npm/cli/commit/00afa316195f2db903146110a07ffdaec9bb6aa2)
+ [#2718](https://github.com/npm/cli/issues/2718)
+ restore the prefix on output from `npm version `
+ ([@nlf](https://github.com/nlf))
+* [`69e0c4e8c`](https://github.com/npm/cli/commit/69e0c4e8cd684c475a4450c40dfb32c995061aea)
+ [#2716](https://github.com/npm/cli/issues/2716)
+ throw an error when trying to dedupe in global mode
+ ([@nlf](https://github.com/nlf))
+* [`b018eb842`](https://github.com/npm/cli/commit/b018eb84266dc5a02274849135ca148cb59cc349)
+ [#2719](https://github.com/npm/cli/issues/2719)
+ obey silent loglevel in run-script
+ ([@wraithgar](https://github.com/wraithgar))
+
+### DEPENDENCIES
+* [`8c36697df`](https://github.com/npm/cli/commit/8c36697dfffe8b5e853fe889c9ead5578100c413)
+ `@npmcli/arborist@2.2.3`
+ * [#1875](https://github.com/npm/cli/issues/1875)
+ [arborist#230](https://github.com/npm/arborist/pull/230)
+ Set default advisory `severity`/`vulnerable_range` when missing from audit endpoint data
+ ([@isaacs](https://github.com/isaacs))
+ * [npm/arborist#231](https://github.com/npm/arborist/pull/231)
+ skip optional deps with mismatched platform or engine
+ ([@nlf](https://github.com/nlf))
+ * [#2251](https://github.com/npm/cli/issues/2251)
+ Unpack shrinkwrapped deps not already unpacked
+ ([@isaacs](https://github.com/isaacs),
+ [@nlf](https://github.com/nlf))
+ * [#2714](https://github.com/npm/cli/issues/2714)
+ Do not write package.json if nothing changed
+ ([@isaacs](https://github.com/isaacs))
+ * [npm/rfcs#324](https://github.com/npm/rfcs/issues/324)
+ Prefer peer over prod dep, if both specified
+ ([@isaacs](https://github.com/isaacs))
+ * [npm/arborist#236](https://github.com/npm/arborist/issues/236)
+ Fix additional peerOptional conflict cases
+ ([@isaacs](https://github.com/isaacs))
+* [`d865b101f`](https://github.com/npm/cli/commit/d865b101f72142619531311645479f0596a68a1a)
+ `libnpmpack@2.0.1`
+ * respect silent loglevel
+* [`e606953e5`](https://github.com/npm/cli/commit/e606953e5795803a7c4eddb4ea993735ef65ec95)
+ `libnpmversion@1.0.11`
+ * respect silent loglevel
+* [`9c51005a1`](https://github.com/npm/cli/commit/9c51005a19fd4c3e7cd4c987d2e39d1b763036bf)
+ `npm-package-arg@8.1.1`
+ * do a better job of detecting git specifiers like `git@github.com:npm/cli`
+* [`8b6bf0db4`](https://github.com/npm/cli/commit/8b6bf0db49a3378bd85a0d1ffdd19fbdd68a944a)
+ `pacote@11.2.7`
+ * respect silent loglevel
+ * fix INVALID_URL errors for certain git dependencies
+
+### TESTS
+* [`80c2ac995`](https://github.com/npm/cli/commit/80c2ac995170a05b26856a2b72fe9c8163b2c999)
+ [#2717](https://github.com/npm/cli/issues/2717)
+ refactor publish tests
+ ([@wraithgar](https://github.com/wraithgar))
+* [`9d81e0ceb`](https://github.com/npm/cli/commit/9d81e0ceba7d69e0651662508415ee3705bddfd9)
+ [#2729](https://github.com/npm/cli/issues/2729)
+ fix typo in shrinkwrap tests
+ ([@eltociear](https://github.com/eltociear))
+
+### DOCUMENTATION
+* [`e3de7befb`](https://github.com/npm/cli/commit/e3de7befb3a9e2fcb7aac5b740d09b3b7d99d724)
+ [#2685](https://github.com/npm/cli/issues/2685)
+ docs(readme): add note back about branding/origin
+ ([@darcyclarke](https://github.com/darcyclarke))
+* [`38d87e7c2`](https://github.com/npm/cli/commit/38d87e7c24aea13b0f1c1157aad58d9d15bf8e63)
+ [#2698](https://github.com/npm/cli/issues/2698)
+ mention nodenv in README.md
+ ([@RA80533](https://github.com/RA80533))
+* [`af4422cdb`](https://github.com/npm/cli/commit/af4422cdbc110f93203667efc08b16f7aa74ac2f)
+ [#2711](https://github.com/npm/cli/issues/2711)
+ validate that the docs can be parsed by mdx
+ ([@ethomson](https://github.com/ethomson))
+
+
+## v7.5.4 (2021-02-12)
+
+### BUG FIXES
+
+* [`ef687f545`](https://github.com/npm/cli/commit/ef687f545b177d0496ce74faacf1bf738978355a)
+ [#2655](https://github.com/npm/cli/issues/2655)
+ fix(env): Do not clobber defined 'env' script
+ ([@isaacs](https://github.com/isaacs))
+* [`868954a72`](https://github.com/npm/cli/commit/868954a72c06ff2210b35e1e75571f4ec3357c43)
+ [#2654](https://github.com/npm/cli/issues/2654)
+ [fix] node v10.0 lacks `fs.promises`
+ ([@ljharb](https://github.com/ljharb))
+
+
+### DEPENDENCIES
+
+* [`14dd93853`](https://github.com/npm/cli/commit/14dd9385358b3815c2285526f7c2e53ed3c5e8da)
+ fix(package.json): resetdeps
+ ([@wraithgar](https://github.com/wraithgar))
+* [`39e4a6401`](https://github.com/npm/cli/commit/39e4a640130b85d62199a33cc2026b04390520ee)
+ `graceful-fs@4.2.6`
+* [`96dffab98`](https://github.com/npm/cli/commit/96dffab988048164516d8cf73c1fbf66781f86df)
+ `eslint-plugin-promise@4.3.1`
+* [`9a6e9d38a`](https://github.com/npm/cli/commit/9a6e9d38abccec793b6ac14871c2b639d62a6c41)
+ `@npmcli/run-script@1.8.3`
+ * fix fs.promises reference to run in node v10.0
+* [`584b746a2`](https://github.com/npm/cli/commit/584b746a2c8cdc697629298be27dd23d19de1231)
+ `@npmcli/git@2.0.5`
+* [`6305ebde4`](https://github.com/npm/cli/commit/6305ebde43796737014aedbe019db8cd81dcbbec)
+ `make-fetch-happen@8.0.14`
+* [`e99881117`](https://github.com/npm/cli/commit/e998811170ce5df00a725b2d683b4bff124c6792)
+ `libnpmversion@1.0.10`
+* [`554d91cdf`](https://github.com/npm/cli/commit/554d91cdf82e9c92c2ac3752ed91e7081c2271e5)
+ chore(package-lock): rebuild package-lock
+ ([@wraithgar](https://github.com/wraithgar))
+* [`37e8cc507`](https://github.com/npm/cli/commit/37e8cc507b2ce0b89f92e7e77b1d909d1bf5513f)
+ `@npmcli/arborist@2.2.2`
+ * [#2505](https://github.com/npm/cli/issues/2505) properly install
+ dependenciess of linked dependencies
+ ([@ruyadorno](https://github.com/ruyadorno))
+ * [#2504](https://github.com/npm/cli/issues/2504) Allow `--force` to
+ override conflicted optional peerDependencies
+ ([@isaacs](https://github.com/isaacs))
+ * Ensure correct flags on shrinkwrapped module deps
+ ([@isaacs](https://github.com/isaacs))
+ * Correct relative paths for global packages installed from tarball files
+ ([nlf](https://github.com/nlf))
+* [`7788ce47b`](https://github.com/npm/cli/commit/7788ce47bc264d9d951055da85f2b695eb8b3f15)
+ `@npmcli/map-workspaces@1.0.3`
+
+### TESTS
+
+* [`3a159d27e`](https://github.com/npm/cli/commit/3a159d27e976933098ec18fa9c3e474c85b5b332)
+ [#2681](https://github.com/npm/cli/issues/2681)
+ fix(tests): rewrite doctor tests
+ ([@ljharb](https://github.com/ljharb))
+* [`abcc96a20`](https://github.com/npm/cli/commit/abcc96a204ed581fc7cd603f47cdca0afe299530)
+ [#2682](https://github.com/npm/cli/issues/2682)
+ [tests] separate tests from linting and license validation
+ ([@ljharb](https://github.com/ljharb))
+
+### DOCUMENTATION
+
+* [`7e1e84181`](https://github.com/npm/cli/commit/7e1e84181ccaca8a8b499a21b1aa7d731a14d5b7)
+ [#2662](https://github.com/npm/cli/issues/2662)
+ fix(docs): fix angle brackets in npm diff docs
+ ([@ethomson](https://github.com/ethomson))
+
## v7.5.3 (2021-02-08)
### BUG FIXES
diff --git a/deps/npm/README.md b/deps/npm/README.md
index 3b6b30513db5d2..8a649847ecaab6 100644
--- a/deps/npm/README.md
+++ b/deps/npm/README.md
@@ -27,6 +27,7 @@ If you're looking to manage multiple versions of **`node`** &/or **`npm`**, cons
* [**`nave`**](https://github.com/isaacs/nave)
* [**`n`**](https://github.com/tj/n)
* [**`volta`**](https://github.com/volta-cli/volta)
+* [**`nodenv`**](https://github.com/nodenv/nodenv)
### Usage
@@ -51,3 +52,13 @@ npm
* `npm` is configured to use the **npm Public Registry** at [https://registry.npmjs.org](https://registry.npmjs.org) by default; Usage of this registry is subject to **Terms of Use** available at [https://npmjs.com/policies/terms](https://npmjs.com/policies/terms)
* You can configure `npm` to use any other compatible registry you prefer. You can read more about configuring third-party registries [here](https://docs.npmjs.com/cli/v7/using-npm/registry)
+
+### FAQ on Branding
+
+#### Is it "npm" or "NPM" or "Npm"?
+
+**`npm`** should never be capitalized unless it is being displayed in a location that is customarily all-capitals (ex. titles on `man` pages).
+
+#### Is "npm" an acronym for "Node Package Manager"?
+
+Contrary to popular belief, **`npm`** **is not** in fact an acronym for "Node Package Manager"; It is a recursive bacronymic abbreviation for **"npm is not an acronym"** (if the project was named "ninaa", then it would be an acronym). The precursor to **`npm`** was actually a bash utility named **"pm"**, which was the shortform name of **"pkgmakeinst"** - a bash function that installed various things on various platforms. If **`npm`** were to ever have been considered an acronym, it would be as "node pm" or, potentially "new pm".
diff --git a/deps/npm/docs/content/commands/npm-diff.md b/deps/npm/docs/content/commands/npm-diff.md
index 0ce5e8dc8baee6..0fe6a68fa2f0fe 100644
--- a/deps/npm/docs/content/commands/npm-diff.md
+++ b/deps/npm/docs/content/commands/npm-diff.md
@@ -82,11 +82,11 @@ of files for packages published to the npm registry.
When using a single package name (with no version or tag specifier) as an
argument, `npm diff` will work in a similar way to
[`npm-outdated`](npm-outdated) and reach for the registry to figure out
- what current published version of the package named will satisfy
- its dependent declared semver-range. Once that specific version is known
- `npm diff` will print diff patches comparing the current version of
- found in the local file system with that specific version
- returned by the registry.
+ what current published version of the package named ``
+ will satisfy its dependent declared semver-range. Once that specific
+ version is known `npm diff` will print diff patches comparing the
+ current version of `` found in the local file system with
+ that specific version returned by the registry.
Given a package named `abbrev` that is currently installed:
@@ -155,7 +155,7 @@ located within the folder `./lib/` and changed lines of code within the
#### diff
-* Type: Array
+* Type: Array
* Default: null
Defines npm package specifiers to compare using the `npm diff` command.
diff --git a/deps/npm/docs/content/using-npm/developers.md b/deps/npm/docs/content/using-npm/developers.md
index bce615cfeb3d14..627ce7c7073c68 100644
--- a/deps/npm/docs/content/using-npm/developers.md
+++ b/deps/npm/docs/content/using-npm/developers.md
@@ -20,7 +20,7 @@ These are man pages. If you install npm, you should be able to
then do `man npm-thing` to get the documentation on a particular
topic, or `npm help thing` to see the same information.
-### What is a package
+### What is a Package
A package is:
diff --git a/deps/npm/docs/dockhand.js b/deps/npm/docs/dockhand.js
index 41d01b1cff6856..ae68e3fbb830c7 100644
--- a/deps/npm/docs/dockhand.js
+++ b/deps/npm/docs/dockhand.js
@@ -4,6 +4,7 @@ const path = require('path');
const fs = require('fs');
const yaml = require('yaml');
const cmark = require('cmark-gfm');
+const mdx = require('@mdx-js/mdx');
const mkdirp = require('mkdirp');
const jsdom = require('jsdom');
const npm = require('../lib/npm.js')
@@ -16,25 +17,35 @@ const outputRoot = path.join(docsRoot, 'output');
const template = fs.readFileSync('template.html').toString();
-walk(inputRoot);
+const run = async function() {
+ try {
+ await walk(inputRoot);
+ }
+ catch (error) {
+ console.error(error);
+ }
+}
-function walk(root, dirRelative) {
+run();
+
+async function walk(root, dirRelative) {
const dirPath = dirRelative ? path.join(root, dirRelative) : root;
+ const children = fs.readdirSync(dirPath);
- fs.readdirSync(dirPath).forEach((childFilename) => {
+ for (const childFilename of children) {
const childRelative = dirRelative ? path.join(dirRelative, childFilename) : childFilename;
const childPath = path.join(root, childRelative);
if (fs.lstatSync(childPath).isDirectory()) {
- walk(root, childRelative);
+ await walk(root, childRelative);
}
else {
- translate(childRelative);
+ await translate(childRelative);
}
- });
+ }
}
-function translate(childPath) {
+async function translate(childPath) {
const inputPath = path.join(inputRoot, childPath);
if (!inputPath.match(/\.md$/)) {
@@ -70,6 +81,16 @@ function translate(childPath) {
}
});
+ // Test that mdx can parse this markdown file. We don't actually
+ // use the output, it's just to ensure that the upstream docs
+ // site (docs.npmjs.com) can parse it when this file gets there.
+ try {
+ await mdx(md, { skipExport: true });
+ }
+ catch (error) {
+ throw new MarkdownError(childPath, error);
+ }
+
// Inject this data into the template, using a mustache-like
// replacement scheme.
const html = template.replace(/\{\{\s*([\w\.]+)\s*\}\}/g, (token, key) => {
@@ -225,3 +246,11 @@ function headerLevel(node) {
function debug(str) {
console.log(str);
}
+
+class MarkdownError extends Error {
+ constructor(file, inner) {
+ super(`failed to parse ${file}`);
+ this.file = file;
+ this.inner = inner;
+ }
+}
diff --git a/deps/npm/docs/output/commands/npm-diff.html b/deps/npm/docs/output/commands/npm-diff.html
index 43840ea9a2984a..bc526a3e47e0ee 100644
--- a/deps/npm/docs/output/commands/npm-diff.html
+++ b/deps/npm/docs/output/commands/npm-diff.html
@@ -206,11 +206,11 @@ Description
When using a single package name (with no version or tag specifier) as an
argument, npm diff
will work in a similar way to
npm-outdated
and reach for the registry to figure out
-what current published version of the package named will satisfy
-its dependent declared semver-range. Once that specific version is known
-npm diff
will print diff patches comparing the current version of
- found in the local file system with that specific version
-returned by the registry.
+what current published version of the package named <pkg-name>
+will satisfy its dependent declared semver-range. Once that specific
+version is known npm diff
will print diff patches comparing the
+current version of <pkg-name>
found in the local file system with
+that specific version returned by the registry.
Given a package named abbrev
that is currently installed:
npm diff --diff=abbrev
@@ -260,7 +260,7 @@ Filtering files
Configuration
diff
-- Type: Array
+- Type: Array
- Default: null
Defines npm package specifiers to compare using the npm diff
command.
diff --git a/deps/npm/docs/output/commands/npm-ls.html b/deps/npm/docs/output/commands/npm-ls.html
index 3496d20dcf16a2..f4cfc919c07029 100644
--- a/deps/npm/docs/output/commands/npm-ls.html
+++ b/deps/npm/docs/output/commands/npm-ls.html
@@ -159,7 +159,7 @@ Description
the results to only the paths to the packages named. Note that nested
packages will also show the paths to the specified packages. For
example, running npm ls promzard
in npm’s source tree will show:
-npm@7.5.3 /path/to/npm
+npm@7.5.6 /path/to/npm
└─┬ init-package-json@0.0.4
└── promzard@0.1.5
diff --git a/deps/npm/docs/output/commands/npm.html b/deps/npm/docs/output/commands/npm.html
index 3eda5376a36313..9cc6b055db0315 100644
--- a/deps/npm/docs/output/commands/npm.html
+++ b/deps/npm/docs/output/commands/npm.html
@@ -148,7 +148,7 @@ Table of contents
npm <command> [args]
Version
-7.5.3
+7.5.6
Description
npm is the package manager for the Node JavaScript platform. It puts
modules in place so that node can find them, and manages dependency
diff --git a/deps/npm/docs/output/using-npm/developers.html b/deps/npm/docs/output/using-npm/developers.html
index 05545060cf9b22..25d6ae8fa1efd2 100644
--- a/deps/npm/docs/output/using-npm/developers.html
+++ b/deps/npm/docs/output/using-npm/developers.html
@@ -141,7 +141,7 @@
developers
Description
@@ -154,7 +154,7 @@
About These Documents
These are man pages. If you install npm, you should be able to
then do man npm-thing
to get the documentation on a particular
topic, or npm help thing
to see the same information.
-
What is a package
+
What is a Package
A package is:
- a) a folder containing a program described by a package.json file
diff --git a/deps/npm/lib/birthday.js b/deps/npm/lib/birthday.js
index 097ffd92542fec..6c71a9e7156689 100644
--- a/deps/npm/lib/birthday.js
+++ b/deps/npm/lib/birthday.js
@@ -1,21 +1,11 @@
-/* eslint-disable max-len */
-// happy birthday! 🎂
-
-module.exports = (_, c) => {
- const B = global[Buffer.from([66, 117, 102, 102, 101, 114])]
- const f = B.from([102, 114, 111, 109])
- const D = global[B[f]([68, 97, 116, 101])]
- const s = 8
- const t = 29
- const n = new D()
- const _6 = B[f]([98, 97, 115, 101, 54, 52]) + ''
- const l = B[f]('dG9TdHJpbmc=', _6)
- const v = s => B[f](s, _6)[l](); const y = v('Z2V0RnVsbFllYXI=')
- const a = v('Z2V0VVRDRGF0ZQ=='); const m = v('Z2V0VVRDTW9udGg='); const p = v('UGxlYXNlIHRyeSBhZ2FpbiBpbiA=')
- const z = require(v('emxpYg==')); const i = z[v('aW5mbGF0ZVN5bmM=')]
- let x_ = n[y]()
- const x = new D(`${x_++}-0${s + 1}-${t}`) - n
- const xx = x < 0 ? new D(`${x_}-0${s + 1}-${t}`) - n : x
-
- c(...(`${n[a]()}${n[m]()}` !== `${t}${s}` ? [`${p}${xx}ms`] : [null, console.log(i(B[f](B[f](JSON.parse(i(B[f]('eJw1U9Gx5DAIa4gPExsDtby5/ts4SXhnspNNAkIS8p8vtzzm32e+rp2t2007ae7HTuEWdq/VtvysHM/4rbTEdfEvLNhclqgL/Nv67AvVR+AAQHF9lguTllXrRtAmIvs9ZnJYpXXxdQ1QtzX6VnOA4JxMMBvwhZlF6DiaCL63+So3yykhCeMCDF6kCmheLaWUmHrtn5Opu4SCLYh0ilQIPvewupKylsXSJOclnZy55gm1V3bcK3RYSgd7GOCh5TvUQ2IB67Kdk0gHBsV5ek5LcchwF+WWathBoo9VUE7A6WJFfsMBX5wzD6VQGqm7HCPNkRxbJPZ82cSuaapZDKGG5ttJpXC18SBYTDPogtV94ViisUZpa+dXTrCJm/GrDtfO6uXAtdp8T+IZ/ksPJmI8bSgljH4LTV6QK6P6kkniJezk65dPeRzy9Gjh3zTeliZ0sYJJjZ9c0mCaWMrglj7IsHwGaUNaxGYuBPbNOViz6blxpk7E+QURA+n54qI1a5Ydv1QrUkeBocNFpKe8Z5ld71y29gAG78xg5zSS5/VMsat4ODL7a1BllY4OTKLhd+IruSB7/d9/b7zQBA==', _6))[l]()))[l](), _6))[l]())]))
+const npm = require('./npm.js')
+module.exports = (_, cb) => {
+ Object.defineProperty(npm, 'flatOptions', {
+ value: {
+ ...npm.flatOptions,
+ package: ['@npmcli/npm-birthday'],
+ yes: true,
+ },
+ })
+ return npm.commands.exec(['npm-birthday'], cb)
}
diff --git a/deps/npm/lib/ci.js b/deps/npm/lib/ci.js
index 36410616fb9bfb..80b9dbb2236487 100644
--- a/deps/npm/lib/ci.js
+++ b/deps/npm/lib/ci.js
@@ -68,6 +68,7 @@ const ci = async () => {
scriptShell,
stdio: 'inherit',
stdioString: true,
+ banner: log.level !== 'silent',
event,
})
}
diff --git a/deps/npm/lib/dedupe.js b/deps/npm/lib/dedupe.js
index fe8243e21e43d2..5e455192bcab0a 100644
--- a/deps/npm/lib/dedupe.js
+++ b/deps/npm/lib/dedupe.js
@@ -10,6 +10,12 @@ const completion = require('./utils/completion/none.js')
const cmd = (args, cb) => dedupe(args).then(() => cb()).catch(cb)
const dedupe = async (args) => {
+ if (npm.flatOptions.global) {
+ const er = new Error('`npm dedupe` does not work in global mode.')
+ er.code = 'EDEDUPEGLOBAL'
+ throw er
+ }
+
const dryRun = (args && args.dryRun) || npm.flatOptions.dryRun
const where = npm.prefix
const arb = new Arborist({
diff --git a/deps/npm/lib/install.js b/deps/npm/lib/install.js
index 303370594a0623..d4ee7047f746fd 100644
--- a/deps/npm/lib/install.js
+++ b/deps/npm/lib/install.js
@@ -57,6 +57,7 @@ const install = async args => {
scriptShell,
stdio: 'inherit',
stdioString: true,
+ banner: log.level !== 'silent',
event,
})
}
diff --git a/deps/npm/lib/npm.js b/deps/npm/lib/npm.js
index 40aa9bbd9b5061..85dc67a78aac68 100644
--- a/deps/npm/lib/npm.js
+++ b/deps/npm/lib/npm.js
@@ -49,6 +49,7 @@ const makeCmd = cmd => {
}
const { types, defaults, shorthands } = require('./utils/config.js')
+const { shellouts } = require('./utils/cmd-list.js')
let warnedNonDashArg = false
const _runCmd = Symbol('_runCmd')
@@ -81,6 +82,10 @@ const npm = module.exports = new class extends EventEmitter {
this.updateNotification = null
}
+ get shelloutCommands () {
+ return shellouts
+ }
+
deref (c) {
return deref(c)
}
diff --git a/deps/npm/lib/publish.js b/deps/npm/lib/publish.js
index 190d381a8aeeb4..3e8df0076efa22 100644
--- a/deps/npm/lib/publish.js
+++ b/deps/npm/lib/publish.js
@@ -85,6 +85,7 @@ const publish_ = async (arg, opts) => {
path: spec.fetchSpec,
stdio: 'inherit',
pkg: manifest,
+ banner: log.level !== 'silent',
})
}
@@ -121,6 +122,7 @@ const publish_ = async (arg, opts) => {
path: spec.fetchSpec,
stdio: 'inherit',
pkg: manifest,
+ banner: log.level !== 'silent',
})
await runScript({
@@ -128,6 +130,7 @@ const publish_ = async (arg, opts) => {
path: spec.fetchSpec,
stdio: 'inherit',
pkg: manifest,
+ banner: log.level !== 'silent',
})
}
diff --git a/deps/npm/lib/restart.js b/deps/npm/lib/restart.js
index 41f9c3a7568622..1462cf6051d0fb 100644
--- a/deps/npm/lib/restart.js
+++ b/deps/npm/lib/restart.js
@@ -1 +1,2 @@
-module.exports = require('./utils/lifecycle-cmd.js')('restart')
+const npm = require('./npm.js')
+module.exports = require('./utils/lifecycle-cmd.js')(npm, 'restart')
diff --git a/deps/npm/lib/run-script.js b/deps/npm/lib/run-script.js
index c095e6decd4032..8e24a8a44e99d6 100644
--- a/deps/npm/lib/run-script.js
+++ b/deps/npm/lib/run-script.js
@@ -1,5 +1,5 @@
-const run = require('@npmcli/run-script')
-const { isServerPackage } = run
+const runScript = require('@npmcli/run-script')
+const { isServerPackage } = runScript
const npm = require('./npm.js')
const readJson = require('read-package-json-fast')
const { resolve } = require('path')
@@ -27,11 +27,11 @@ const completion = async (opts, cb) => {
}
const cmd = (args, cb) => {
- const fn = args.length ? runScript : list
+ const fn = args.length ? doRun : list
return fn(args).then(() => cb()).catch(cb)
}
-const runScript = async (args) => {
+const doRun = async (args) => {
const path = npm.localPrefix
const event = args.shift()
const { scriptShell } = npm.flatOptions
@@ -41,7 +41,7 @@ const runScript = async (args) => {
if (event === 'restart' && !scripts.restart)
scripts.restart = 'npm stop --if-present && npm start'
- else if (event === 'env')
+ else if (event === 'env' && !scripts.env)
scripts.env = isWindowsShell ? 'SET' : 'env'
pkg.scripts = scripts
@@ -76,7 +76,7 @@ const runScript = async (args) => {
}
for (const [event, args] of events) {
- await run({
+ await runScript({
...opts,
event,
args,
diff --git a/deps/npm/lib/shrinkwrap.js b/deps/npm/lib/shrinkwrap.js
index 74e129297b6cf8..f1146206db64b9 100644
--- a/deps/npm/lib/shrinkwrap.js
+++ b/deps/npm/lib/shrinkwrap.js
@@ -1,5 +1,7 @@
const { resolve, basename } = require('path')
-const { promises: { unlink } } = require('fs')
+const util = require('util')
+const fs = require('fs')
+const { unlink } = fs.promises || { unlink: util.promisify(fs.unlink) }
const Arborist = require('@npmcli/arborist')
const log = require('npmlog')
diff --git a/deps/npm/lib/start.js b/deps/npm/lib/start.js
index e9785365007771..9fa076d5e35f54 100644
--- a/deps/npm/lib/start.js
+++ b/deps/npm/lib/start.js
@@ -1 +1,2 @@
-module.exports = require('./utils/lifecycle-cmd.js')('start')
+const npm = require('./npm.js')
+module.exports = require('./utils/lifecycle-cmd.js')(npm, 'start')
diff --git a/deps/npm/lib/stop.js b/deps/npm/lib/stop.js
index fd43d08fc12edf..827d414d1384c7 100644
--- a/deps/npm/lib/stop.js
+++ b/deps/npm/lib/stop.js
@@ -1 +1,2 @@
-module.exports = require('./utils/lifecycle-cmd.js')('stop')
+const npm = require('./npm.js')
+module.exports = require('./utils/lifecycle-cmd.js')(npm, 'stop')
diff --git a/deps/npm/lib/test.js b/deps/npm/lib/test.js
index e224aa2de62c73..ea5914ea38a1a5 100644
--- a/deps/npm/lib/test.js
+++ b/deps/npm/lib/test.js
@@ -1,4 +1,5 @@
-const testCmd = require('./utils/lifecycle-cmd.js')('test')
+const npm = require('./npm.js')
+const testCmd = require('./utils/lifecycle-cmd.js')(npm, 'test')
const { completion, usage } = testCmd
const cmd = (args, cb) => testCmd(args, er => {
if (er && er.code === 'ELIFECYCLE') {
diff --git a/deps/npm/lib/utils/cmd-list.js b/deps/npm/lib/utils/cmd-list.js
index 4e088c12d43f64..c865cdabb4014e 100644
--- a/deps/npm/lib/utils/cmd-list.js
+++ b/deps/npm/lib/utils/cmd-list.js
@@ -136,10 +136,25 @@ const cmdList = [
]
const plumbing = ['birthday', 'help-search']
+
+// these commands just shell out to something else or handle the
+// error themselves, so it's confusing and weird to write out
+// our full error log banner when they exit non-zero
+const shellouts = [
+ 'exec',
+ 'run-script',
+ 'test',
+ 'start',
+ 'stop',
+ 'restart',
+ 'birthday',
+]
+
module.exports = {
aliases: Object.assign({}, shorthands, affordances),
shorthands,
affordances,
cmdList,
plumbing,
+ shellouts,
}
diff --git a/deps/npm/lib/utils/error-handler.js b/deps/npm/lib/utils/error-handler.js
index f9685c91d72125..1fc31df44ffb9b 100644
--- a/deps/npm/lib/utils/error-handler.js
+++ b/deps/npm/lib/utils/error-handler.js
@@ -105,8 +105,7 @@ const exit = (code, noLog) => {
if (code && !noLog)
writeLogFile()
- else
- reallyExit()
+ reallyExit()
}
const errorHandler = (er) => {
@@ -130,7 +129,16 @@ const errorHandler = (er) => {
cbCalled = true
if (!er)
return exit(0)
- if (typeof er === 'string') {
+
+ // if we got a command that just shells out to something else, then it
+ // will presumably print its own errors and exit with a proper status
+ // code if there's a problem. If we got an error with a code=0, then...
+ // something else went wrong along the way, so maybe an npm problem?
+ const isShellout = npm.shelloutCommands.includes(npm.command)
+ const quietShellout = isShellout && typeof er.code === 'number' && er.code
+ if (quietShellout)
+ return exit(er.code, true)
+ else if (typeof er === 'string') {
log.error('', er)
return exit(1, true)
} else if (!(er instanceof Error)) {
diff --git a/deps/npm/lib/utils/lifecycle-cmd.js b/deps/npm/lib/utils/lifecycle-cmd.js
index 40a90aa20b1991..83a712cf409460 100644
--- a/deps/npm/lib/utils/lifecycle-cmd.js
+++ b/deps/npm/lib/utils/lifecycle-cmd.js
@@ -1,12 +1,11 @@
// The implementation of commands that are just "run a script"
// test, start, stop, restart
-const npm = require('../npm.js')
const usageUtil = require('./usage.js')
+const completion = require('./completion/none.js')
-module.exports = stage => {
- const cmd = (args, cb) => npm.commands.run([stage, ...args], cb)
+module.exports = (npm, stage) => {
+ const cmd = (args, cb) => npm.commands['run-script']([stage, ...args], cb)
const usage = usageUtil(stage, `npm ${stage} [-- ]`)
- const completion = require('./completion/none.js')
return Object.assign(cmd, { usage, completion })
}
diff --git a/deps/npm/lib/utils/reify-finish.js b/deps/npm/lib/utils/reify-finish.js
index 76dba06cb570c8..9c95e9fcff24ed 100644
--- a/deps/npm/lib/utils/reify-finish.js
+++ b/deps/npm/lib/utils/reify-finish.js
@@ -1,7 +1,9 @@
const reifyOutput = require('./reify-output.js')
const npm = require('../npm.js')
const ini = require('ini')
-const {writeFile} = require('fs').promises
+const util = require('util')
+const fs = require('fs')
+const { writeFile } = fs.promises || { writeFile: util.promisify(fs.writeFile) }
const {resolve} = require('path')
const reifyFinish = async arb => {
diff --git a/deps/npm/lib/version.js b/deps/npm/lib/version.js
index a96f5d6051fafb..3a46efae19bf3d 100644
--- a/deps/npm/lib/version.js
+++ b/deps/npm/lib/version.js
@@ -37,15 +37,21 @@ const version = async args => {
case 0:
return list()
case 1:
- return output(await libversion(args[0], {
- ...npm.flatOptions,
- path: npm.prefix,
- }))
+ return version_(args)
default:
throw usage
}
}
+const version_ = async (args) => {
+ const prefix = npm.flatOptions.tagVersionPrefix
+ const version = await libversion(args[0], {
+ ...npm.flatOptions,
+ path: npm.prefix,
+ })
+ return output(`${prefix}${version}`)
+}
+
const list = async () => {
const results = {}
const { promisify } = require('util')
diff --git a/deps/npm/man/man1/npm-diff.1 b/deps/npm/man/man1/npm-diff.1
index 16c5c82863bfce..3249611b135b7e 100644
--- a/deps/npm/man/man1/npm-diff.1
+++ b/deps/npm/man/man1/npm-diff.1
@@ -78,11 +78,11 @@ of files for packages published to the npm registry\.
When using a single package name (with no version or tag specifier) as an
argument, \fBnpm diff\fP will work in a similar way to
\fBnpm\-outdated\fP \fInpm\-outdated\fR and reach for the registry to figure out
- what current published version of the package named will satisfy
- its dependent declared semver\-range\. Once that specific version is known
- \fBnpm diff\fP will print diff patches comparing the current version of
- found in the local file system with that specific version
- returned by the registry\.
+ what current published version of the package named \fB\fP
+ will satisfy its dependent declared semver\-range\. Once that specific
+ version is known \fBnpm diff\fP will print diff patches comparing the
+ current version of \fB\fP found in the local file system with
+ that specific version returned by the registry\.
Given a package named \fBabbrev\fP that is currently installed:
.P
.RS 2
@@ -150,7 +150,7 @@ located within the folder \fB\|\./lib/\fP and changed lines of code within the
.SS diff
.RS 0
.IP \(bu 2
-Type: Array
+Type: Array
.IP \(bu 2
Default: null
diff --git a/deps/npm/man/man1/npm-ls.1 b/deps/npm/man/man1/npm-ls.1
index 09a0729591f1ce..1db5ccb0efebef 100644
--- a/deps/npm/man/man1/npm-ls.1
+++ b/deps/npm/man/man1/npm-ls.1
@@ -26,7 +26,7 @@ example, running \fBnpm ls promzard\fP in npm's source tree will show:
.P
.RS 2
.nf
-npm@7\.5\.3 /path/to/npm
+npm@7\.5\.6 /path/to/npm
└─┬ init\-package\-json@0\.0\.4
└── promzard@0\.1\.5
.fi
diff --git a/deps/npm/man/man1/npm.1 b/deps/npm/man/man1/npm.1
index 041838e698b496..2a94ac6608e6f6 100644
--- a/deps/npm/man/man1/npm.1
+++ b/deps/npm/man/man1/npm.1
@@ -10,7 +10,7 @@ npm [args]
.RE
.SS Version
.P
-7\.5\.3
+7\.5\.6
.SS Description
.P
npm is the package manager for the Node JavaScript platform\. It puts
diff --git a/deps/npm/man/man5/package-locks.5 b/deps/npm/man/man5/package-locks.5
new file mode 100644
index 00000000000000..0fc35cfb5a0298
--- /dev/null
+++ b/deps/npm/man/man5/package-locks.5
@@ -0,0 +1,200 @@
+.TH "PACKAGE\-LOCKS" "5" "December 2020" "" ""
+.SH "NAME"
+\fBpackage-locks\fR \- An explanation of npm lockfiles
+.SS Description
+.P
+Conceptually, the "input" to npm help \fBinstall\fP is a npm help package\.json, while its
+"output" is a fully\-formed \fBnode_modules\fP tree: a representation of the
+dependencies you declared\. In an ideal world, npm would work like a pure
+function: the same \fBpackage\.json\fP should produce the exact same \fBnode_modules\fP
+tree, any time\. In some cases, this is indeed true\. But in many others, npm is
+unable to do this\. There are multiple reasons for this:
+.RS 0
+.IP \(bu 2
+different versions of npm (or other package managers) may have been used to install a package, each using slightly different installation algorithms\.
+.IP \(bu 2
+a new version of a direct semver\-range package may have been published since the last time your packages were installed, and thus a newer version will be used\.
+.IP \(bu 2
+A dependency of one of your dependencies may have published a new version, which will update even if you used pinned dependency specifiers (\fB1\.2\.3\fP instead of \fB^1\.2\.3\fP)
+.IP \(bu 2
+The registry you installed from is no longer available, or allows mutation of versions (unlike the primary npm registry), and a different version of a package exists under the same version number now\.
+
+.RE
+.P
+As an example, consider package A:
+.P
+.RS 2
+.nf
+{
+ "name": "A",
+ "version": "0\.1\.0",
+ "dependencies": {
+ "B": "<0\.1\.0"
+ }
+}
+.fi
+.RE
+.P
+package B:
+.P
+.RS 2
+.nf
+{
+ "name": "B",
+ "version": "0\.0\.1",
+ "dependencies": {
+ "C": "<0\.1\.0"
+ }
+}
+.fi
+.RE
+.P
+and package C:
+.P
+.RS 2
+.nf
+{
+ "name": "C",
+ "version": "0\.0\.1"
+}
+.fi
+.RE
+.P
+If these are the only versions of A, B, and C available in the
+registry, then a normal \fBnpm install A\fP will install:
+.P
+.RS 2
+.nf
+A@0\.1\.0
+`\-\- B@0\.0\.1
+ `\-\- C@0\.0\.1
+.fi
+.RE
+.P
+However, if B@0\.0\.2 is published, then a fresh \fBnpm install A\fP will
+install:
+.P
+.RS 2
+.nf
+A@0\.1\.0
+`\-\- B@0\.0\.2
+ `\-\- C@0\.0\.1
+.fi
+.RE
+.P
+assuming the new version did not modify B's dependencies\. Of course,
+the new version of B could include a new version of C and any number
+of new dependencies\. If such changes are undesirable, the author of A
+could specify a dependency on B@0\.0\.1\|\. However, if A's author and B's
+author are not the same person, there's no way for A's author to say
+that he or she does not want to pull in newly published versions of C
+when B hasn't changed at all\.
+.P
+To prevent this potential issue, npm uses npm help package\-lock\.json or, if present, npm help npm\-shrinkwrap\.json\. These files are called package locks, or lockfiles\.
+.P
+Whenever you run \fBnpm install\fP, npm generates or updates your package lock,
+which will look something like this:
+.P
+.RS 2
+.nf
+{
+ "name": "A",
+ "version": "0\.1\.0",
+ \.\.\.metadata fields\.\.\.
+ "dependencies": {
+ "B": {
+ "version": "0\.0\.1",
+ "resolved": "https://registry\.npmjs\.org/B/\-/B\-0\.0\.1\.tgz",
+ "integrity": "sha512\-DeAdb33F+"
+ "dependencies": {
+ "C": {
+ "version": "git://github\.com/org/C\.git#5c380ae319fc4efe9e7f2d9c78b0faa588fd99b4"
+ }
+ }
+ }
+ }
+}
+.fi
+.RE
+.P
+This file describes an \fIexact\fR, and more importantly \fIreproducible\fR
+\fBnode_modules\fP tree\. Once it's present, any future installation will base its
+work off this file, instead of recalculating dependency versions off
+npm help package\.json\.
+.P
+The presence of a package lock changes the installation behavior such that:
+.RS 0
+.IP 1. 3
+The module tree described by the package lock is reproduced\. This means
+reproducing the structure described in the file, using the specific files
+referenced in "resolved" if available, falling back to normal package resolution
+using "version" if one isn't\.
+.IP 2. 3
+The tree is walked and any missing dependencies are installed in the usual
+fashion\.
+
+.RE
+.P
+If \fBpreshrinkwrap\fP, \fBshrinkwrap\fP or \fBpostshrinkwrap\fP are in the \fBscripts\fP
+property of the \fBpackage\.json\fP, they will be executed in order\. \fBpreshrinkwrap\fP
+and \fBshrinkwrap\fP are executed before the shrinkwrap, \fBpostshrinkwrap\fP is
+executed afterwards\. These scripts run for both \fBpackage\-lock\.json\fP and
+\fBnpm\-shrinkwrap\.json\fP\|\. For example to run some postprocessing on the generated
+file:
+.P
+.RS 2
+.nf
+ "scripts": {
+ "postshrinkwrap": "json \-I \-e \\"this\.myMetadata = $MY_APP_METADATA\\""
+ }
+.fi
+.RE
+.SS Using locked packages
+.P
+Using a locked package is no different than using any package without a package
+lock: any commands that update \fBnode_modules\fP and/or \fBpackage\.json\fP\|'s
+dependencies will automatically sync the existing lockfile\. This includes \fBnpm
+install\fP, \fBnpm rm\fP, \fBnpm update\fP, etc\. To prevent this update from happening,
+you can use the \fB\-\-no\-save\fP option to prevent saving altogether, or
+\fB\-\-no\-shrinkwrap\fP to allow \fBpackage\.json\fP to be updated while leaving
+\fBpackage\-lock\.json\fP or \fBnpm\-shrinkwrap\.json\fP intact\.
+.P
+It is highly recommended you commit the generated package lock to source
+control: this will allow anyone else on your team, your deployments, your
+CI/continuous integration, and anyone else who runs \fBnpm install\fP in your
+package source to get the exact same dependency tree that you were developing
+on\. Additionally, the diffs from these changes are human\-readable and will
+inform you of any changes npm has made to your \fBnode_modules\fP, so you can notice
+if any transitive dependencies were updated, hoisted, etc\.
+.SS Resolving lockfile conflicts
+.P
+Occasionally, two separate npm install will create package locks that cause
+merge conflicts in source control systems\. As of \fBnpm@5\.7\.0\fP, these conflicts
+can be resolved by manually fixing any \fBpackage\.json\fP conflicts, and then
+running \fBnpm install [\-\-package\-lock\-only]\fP again\. npm will automatically
+resolve any conflicts for you and write a merged package lock that includes all
+the dependencies from both branches in a reasonable tree\. If
+\fB\-\-package\-lock\-only\fP is provided, it will do this without also modifying your
+local \fBnode_modules/\fP\|\.
+.P
+To make this process seamless on git, consider installing
+\fBnpm\-merge\-driver\fP \fIhttps://npm\.im/npm\-merge\-driver\fR, which will teach git how
+to do this itself without any user interaction\. In short: \fB$ npx
+npm\-merge\-driver install \-g\fP will let you do this, and even works with
+pre\-\fBnpm@5\.7\.0\fP versions of npm 5, albeit a bit more noisily\. Note that if
+\fBpackage\.json\fP itself conflicts, you will have to resolve that by hand and run
+\fBnpm install\fP manually, even with the merge driver\.
+.SS See Also
+.RS 0
+.IP \(bu 2
+https://medium\.com/@sdboyer/so\-you\-want\-to\-write\-a\-package\-manager\-4ae9c17d9527
+.IP \(bu 2
+npm help package\.json
+.IP \(bu 2
+npm help package\-lock\.json
+.IP \(bu 2
+npm help shrinkwrap\.json
+.IP \(bu 2
+npm help shrinkwrap
+
+.RE
diff --git a/deps/npm/man/man5/shrinkwrap-json.5 b/deps/npm/man/man5/shrinkwrap-json.5
new file mode 100644
index 00000000000000..7457df20e4bf32
--- /dev/null
+++ b/deps/npm/man/man5/shrinkwrap-json.5
@@ -0,0 +1,32 @@
+.TH "SHRINKWRAP\.JSON" "5" "December 2020" "" ""
+.SH "NAME"
+\fBshrinkwrap.json\fR \- A publishable lockfile
+.SS Description
+.P
+\fBnpm\-shrinkwrap\.json\fP is a file created by npm help \fBshrinkwrap\fP\|\. It is identical to
+\fBpackage\-lock\.json\fP, with one major caveat: Unlike \fBpackage\-lock\.json\fP,
+\fBnpm\-shrinkwrap\.json\fP may be included when publishing a package\.
+.P
+The recommended use\-case for \fBnpm\-shrinkwrap\.json\fP is applications deployed
+through the publishing process on the registry: for example, daemons and
+command\-line tools intended as global installs or \fBdevDependencies\fP\|\. It's
+strongly discouraged for library authors to publish this file, since that would
+prevent end users from having control over transitive dependency updates\.
+.P
+Additionally, if both \fBpackage\-lock\.json\fP and \fBnpm\-shrinkwrap\.json\fP are present
+in a package root, \fBpackage\-lock\.json\fP will be ignored in favor of this file\.
+.P
+For full details and description of the \fBnpm\-shrinkwrap\.json\fP file format, refer
+to the manual page for npm help package\-lock\.json\.
+.SS See also
+.RS 0
+.IP \(bu 2
+npm help shrinkwrap
+.IP \(bu 2
+npm help package\-lock\.json
+.IP \(bu 2
+npm help package\.json
+.IP \(bu 2
+npm help install
+
+.RE
diff --git a/deps/npm/man/man7/developers.7 b/deps/npm/man/man7/developers.7
index e371508a0dc239..ba421431aecd09 100644
--- a/deps/npm/man/man7/developers.7
+++ b/deps/npm/man/man7/developers.7
@@ -15,7 +15,7 @@ that your users will do to install your program\.
These are man pages\. If you install npm, you should be able to
then do \fBman npm\-thing\fP to get the documentation on a particular
topic, or \fBnpm help thing\fP to see the same information\.
-.SS What is a package
+.SS What is a Package
.P
A package is:
.RS 0
diff --git a/deps/npm/man/man7/disputes.7 b/deps/npm/man/man7/disputes.7
new file mode 100644
index 00000000000000..8e955059910560
--- /dev/null
+++ b/deps/npm/man/man7/disputes.7
@@ -0,0 +1,149 @@
+.TH "DISPUTES" "7" "December 2020" "" ""
+.SH "NAME"
+\fBdisputes\fR \- Handling Module Name Disputes
+.P
+This document describes the steps that you should take to resolve module name
+disputes with other npm publishers\. It also describes special steps you should
+take about names you think infringe your trademarks\.
+.P
+This document is a clarification of the acceptable behavior outlined in the
+npm Code of Conduct \fIhttps://www\.npmjs\.com/policies/conduct\fR, and nothing in
+this document should be interpreted to contradict any aspect of the npm Code of
+Conduct\.
+.SS TL;DR
+.RS 0
+.IP 1. 3
+Get the author email with \fBnpm owner ls \fP
+.IP 2. 3
+Email the author, CC support@npmjs\.com
+.IP 3. 3
+After a few weeks, if there's no resolution, we'll sort it out\.
+
+.RE
+.P
+Don't squat on package names\. Publish code or move out of the way\.
+.SS Description
+.P
+There sometimes arise cases where a user publishes a module, and then later,
+some other user wants to use that name\. Here are some common ways that happens
+(each of these is based on actual events\.)
+.RS 0
+.IP 1. 3
+Alice writes a JavaScript module \fBfoo\fP, which is not node\-specific\. Alice
+doesn't use node at all\. Yusuf wants to use \fBfoo\fP in node, so he wraps it in
+an npm module\. Some time later, Alice starts using node, and wants to take
+over management of her program\.
+.IP 2. 3
+Yusuf writes an npm module \fBfoo\fP, and publishes it\. Perhaps much later, Alice
+finds a bug in \fBfoo\fP, and fixes it\. She sends a pull request to Yusuf, but
+Yusuf doesn't have the time to deal with it, because he has a new job and a
+new baby and is focused on his new Erlang project, and kind of not involved
+with node any more\. Alice would like to publish a new \fBfoo\fP, but can't,
+because the name is taken\.
+.IP 3. 3
+Yusuf writes a 10\-line flow\-control library, and calls it \fBfoo\fP, and
+publishes it to the npm registry\. Being a simple little thing, it never
+really has to be updated\. Alice works for Foo Inc, the makers of the
+critically acclaimed and widely\-marketed \fBfoo\fP JavaScript toolkit framework\.
+They publish it to npm as \fBfoojs\fP, but people are routinely confused when
+\fBnpm install foo\fP is some different thing\.
+.IP 4. 3
+Yusuf writes a parser for the widely\-known \fBfoo\fP file format, because he
+needs it for work\. Then, he gets a new job, and never updates the prototype\.
+Later on, Alice writes a much more complete \fBfoo\fP parser, but can't publish,
+because Yusuf's \fBfoo\fP is in the way\.
+.IP 5. 3
+\fBnpm owner ls foo\fP\|\. This will tell Alice the email address of the owner
+(Yusuf)\.
+.IP 6. 3
+Alice emails Yusuf, explaining the situation \fBas respectfully as possible\fR,
+and what she would like to do with the module name\. She adds the npm support
+staff support@npmjs\.com to the CC list of the email\. Mention in the email
+that Yusuf can run npm owner \fBadd alice foo\fP to add Alice as an owner of the
+foo package\.
+.IP 7. 3
+After a reasonable amount of time, if Yusuf has not responded, or if Yusuf
+and Alice can't come to any sort of resolution, email support
+support@npmjs\.com and we'll sort it out\. ("Reasonable" is usually at least
+4 weeks\.)
+
+.RE
+.SS Reasoning
+.P
+In almost every case so far, the parties involved have been able to reach an
+amicable resolution without any major intervention\. Most people really do want
+to be reasonable, and are probably not even aware that they're in your way\.
+.P
+Module ecosystems are most vibrant and powerful when they are as self\-directed
+as possible\. If an admin one day deletes something you had worked on, then that
+is going to make most people quite upset, regardless of the justification\. When
+humans solve their problems by talking to other humans with respect, everyone
+has the chance to end up feeling good about the interaction\.
+.SS Exceptions
+.P
+Some things are not allowed, and will be removed without discussion if they are
+brought to the attention of the npm registry admins, including but not limited
+to:
+.RS 0
+.IP 1. 3
+Malware (that is, a package designed to exploit or harm the machine on which
+it is installed)\.
+.IP 2. 3
+Violations of copyright or licenses (for example, cloning an MIT\-licensed
+program, and then removing or changing the copyright and license statement)\.
+.IP 3. 3
+Illegal content\.
+.IP 4. 3
+"Squatting" on a package name that you plan to use, but aren't actually
+using\. Sorry, I don't care how great the name is, or how perfect a fit it is
+for the thing that someday might happen\. If someone wants to use it today,
+and you're just taking up space with an empty tarball, you're going to be
+evicted\.
+.IP 5. 3
+Putting empty packages in the registry\. Packages must have SOME
+functionality\. It can be silly, but it can't be nothing\. (See also:
+squatting\.)
+.IP 6. 3
+Doing weird things with the registry, like using it as your own personal
+application database or otherwise putting non\-packagey things into it\.
+.IP 7. 3
+Other things forbidden by the npm
+Code of Conduct \fIhttps://www\.npmjs\.com/policies/conduct\fR such as hateful
+language, pornographic content, or harassment\.
+
+.RE
+.P
+If you see bad behavior like this, please report it to abuse@npmjs\.com right
+away\. \fBYou are never expected to resolve abusive behavior on your own\. We are
+here to help\.\fR
+.SS Trademarks
+.P
+If you think another npm publisher is infringing your trademark, such as by
+using a confusingly similar package name, email abuse@npmjs\.com with a link to
+the package or user account on https://www\.npmjs\.com/ \fIhttps://www\.npmjs\.com/\fR\|\.
+Attach a copy of your trademark registration certificate\.
+.P
+If we see that the package's publisher is intentionally misleading others by
+misusing your registered mark without permission, we will transfer the package
+name to you\. Otherwise, we will contact the package publisher and ask them to
+clear up any confusion with changes to their package's \fBREADME\fP file or
+metadata\.
+.SS Changes
+.P
+This is a living document and may be updated from time to time\. Please refer to
+the git history for this document \fIhttps://github\.com/npm/cli/commits/latest/doc/misc/npm\-disputes\.md\fR
+to view the changes\.
+.SS License
+.P
+Copyright (C) npm, Inc\., All rights reserved
+.P
+This document may be reused under a Creative Commons Attribution\-ShareAlike
+License\.
+.SS See also
+.RS 0
+.IP \(bu 2
+npm help registry
+.IP \(bu 2
+npm help owner
+
+.RE
diff --git a/deps/npm/man/man7/semver.7 b/deps/npm/man/man7/semver.7
new file mode 100644
index 00000000000000..0a08bf9abb3eed
--- /dev/null
+++ b/deps/npm/man/man7/semver.7
@@ -0,0 +1,510 @@
+.TH "SEMVER" "7" "December 2020" "" ""
+.SH "NAME"
+\fBsemver\fR \- The semantic versioner for npm
+.SH Install
+.P
+.RS 2
+.nf
+npm install \-\-save semver
+.fi
+.RE
+.SH Usage
+.P
+As a node module:
+.P
+.RS 2
+.nf
+const semver = require('semver')
+
+semver\.valid('1\.2\.3') // '1\.2\.3'
+semver\.valid('a\.b\.c') // null
+semver\.clean(' =v1\.2\.3 ') // '1\.2\.3'
+semver\.satisfies('1\.2\.3', '1\.x || >=2\.5\.0 || 5\.0\.0 \- 7\.2\.3') // true
+semver\.gt('1\.2\.3', '9\.8\.7') // false
+semver\.lt('1\.2\.3', '9\.8\.7') // true
+semver\.minVersion('>=1\.0\.0') // '1\.0\.0'
+semver\.valid(semver\.coerce('v2')) // '2\.0\.0'
+semver\.valid(semver\.coerce('42\.6\.7\.9\.3\-alpha')) // '42\.6\.7'
+.fi
+.RE
+.P
+As a command\-line utility:
+.P
+.RS 2
+.nf
+$ semver \-h
+
+A JavaScript implementation of the https://semver\.org/ specification
+Copyright Isaac Z\. Schlueter
+
+Usage: semver [options] [ [\.\.\.]]
+Prints valid versions sorted by SemVer precedence
+
+Options:
+\-r \-\-range
+ Print versions that match the specified range\.
+
+\-i \-\-increment []
+ Increment a version by the specified level\. Level can
+ be one of: major, minor, patch, premajor, preminor,
+ prepatch, or prerelease\. Default level is 'patch'\.
+ Only one version may be specified\.
+
+\-\-preid
+ Identifier to be used to prefix premajor, preminor,
+ prepatch or prerelease version increments\.
+
+\-l \-\-loose
+ Interpret versions and ranges loosely
+
+\-p \-\-include\-prerelease
+ Always include prerelease versions in range matching
+
+\-c \-\-coerce
+ Coerce a string into SemVer if possible
+ (does not imply \-\-loose)
+
+Program exits successfully if any valid version satisfies
+all supplied ranges, and prints all satisfying versions\.
+
+If no satisfying versions are found, then exits failure\.
+
+Versions are printed in ascending order, so supplying
+multiple versions to the utility will just sort them\.
+.fi
+.RE
+.SH Versions
+.P
+A "version" is described by the \fBv2\.0\.0\fP specification found at
+https://semver\.org/\|\.
+.P
+A leading \fB"="\fP or \fB"v"\fP character is stripped off and ignored\.
+.SH Ranges
+.P
+A \fBversion range\fP is a set of \fBcomparators\fP which specify versions
+that satisfy the range\.
+.P
+A \fBcomparator\fP is composed of an \fBoperator\fP and a \fBversion\fP\|\. The set
+of primitive \fBoperators\fP is:
+.RS 0
+.IP \(bu 2
+\fB<\fP Less than
+.IP \(bu 2
+\fB<=\fP Less than or equal to
+.IP \(bu 2
+\fB>\fP Greater than
+.IP \(bu 2
+\fB>=\fP Greater than or equal to
+.IP \(bu 2
+\fB=\fP Equal\. If no operator is specified, then equality is assumed,
+so this operator is optional, but MAY be included\.
+
+.RE
+.P
+For example, the comparator \fB>=1\.2\.7\fP would match the versions
+\fB1\.2\.7\fP, \fB1\.2\.8\fP, \fB2\.5\.3\fP, and \fB1\.3\.9\fP, but not the versions \fB1\.2\.6\fP
+or \fB1\.1\.0\fP\|\.
+.P
+Comparators can be joined by whitespace to form a \fBcomparator set\fP,
+which is satisfied by the \fBintersection\fR of all of the comparators
+it includes\.
+.P
+A range is composed of one or more comparator sets, joined by \fB||\fP\|\. A
+version matches a range if and only if every comparator in at least
+one of the \fB||\fP\-separated comparator sets is satisfied by the version\.
+.P
+For example, the range \fB>=1\.2\.7 <1\.3\.0\fP would match the versions
+\fB1\.2\.7\fP, \fB1\.2\.8\fP, and \fB1\.2\.99\fP, but not the versions \fB1\.2\.6\fP, \fB1\.3\.0\fP,
+or \fB1\.1\.0\fP\|\.
+.P
+The range \fB1\.2\.7 || >=1\.2\.9 <2\.0\.0\fP would match the versions \fB1\.2\.7\fP,
+\fB1\.2\.9\fP, and \fB1\.4\.6\fP, but not the versions \fB1\.2\.8\fP or \fB2\.0\.0\fP\|\.
+.SS Prerelease Tags
+.P
+If a version has a prerelease tag (for example, \fB1\.2\.3\-alpha\.3\fP) then
+it will only be allowed to satisfy comparator sets if at least one
+comparator with the same \fB[major, minor, patch]\fP tuple also has a
+prerelease tag\.
+.P
+For example, the range \fB>1\.2\.3\-alpha\.3\fP would be allowed to match the
+version \fB1\.2\.3\-alpha\.7\fP, but it would \fInot\fR be satisfied by
+\fB3\.4\.5\-alpha\.9\fP, even though \fB3\.4\.5\-alpha\.9\fP is technically "greater
+than" \fB1\.2\.3\-alpha\.3\fP according to the SemVer sort rules\. The version
+range only accepts prerelease tags on the \fB1\.2\.3\fP version\. The
+version \fB3\.4\.5\fP \fIwould\fR satisfy the range, because it does not have a
+prerelease flag, and \fB3\.4\.5\fP is greater than \fB1\.2\.3\-alpha\.7\fP\|\.
+.P
+The purpose for this behavior is twofold\. First, prerelease versions
+frequently are updated very quickly, and contain many breaking changes
+that are (by the author's design) not yet fit for public consumption\.
+Therefore, by default, they are excluded from range matching
+semantics\.
+.P
+Second, a user who has opted into using a prerelease version has
+clearly indicated the intent to use \fIthat specific\fR set of
+alpha/beta/rc versions\. By including a prerelease tag in the range,
+the user is indicating that they are aware of the risk\. However, it
+is still not appropriate to assume that they have opted into taking a
+similar risk on the \fInext\fR set of prerelease versions\.
+.P
+Note that this behavior can be suppressed (treating all prerelease
+versions as if they were normal versions, for the purpose of range
+matching) by setting the \fBincludePrerelease\fP flag on the options
+object to any
+functions \fIhttps://github\.com/npm/node\-semver#functions\fR that do
+range matching\.
+.SS Prerelease Identifiers
+.P
+The method \fB\|\.inc\fP takes an additional \fBidentifier\fP string argument that
+will append the value of the string as a prerelease identifier:
+.P
+.RS 2
+.nf
+semver\.inc('1\.2\.3', 'prerelease', 'beta')
+// '1\.2\.4\-beta\.0'
+.fi
+.RE
+.P
+command\-line example:
+.P
+.RS 2
+.nf
+$ semver 1\.2\.3 \-i prerelease \-\-preid beta
+1\.2\.4\-beta\.0
+.fi
+.RE
+.P
+Which then can be used to increment further:
+.P
+.RS 2
+.nf
+$ semver 1\.2\.4\-beta\.0 \-i prerelease
+1\.2\.4\-beta\.1
+.fi
+.RE
+.SS Advanced Range Syntax
+.P
+Advanced range syntax desugars to primitive comparators in
+deterministic ways\.
+.P
+Advanced ranges may be combined in the same way as primitive
+comparators using white space or \fB||\fP\|\.
+.SS Hyphen Ranges \fBX\.Y\.Z \- A\.B\.C\fP
+.P
+Specifies an inclusive set\.
+.RS 0
+.IP \(bu 2
+\fB1\.2\.3 \- 2\.3\.4\fP := \fB>=1\.2\.3 <=2\.3\.4\fP
+
+.RE
+.P
+If a partial version is provided as the first version in the inclusive
+range, then the missing pieces are replaced with zeroes\.
+.RS 0
+.IP \(bu 2
+\fB1\.2 \- 2\.3\.4\fP := \fB>=1\.2\.0 <=2\.3\.4\fP
+
+.RE
+.P
+If a partial version is provided as the second version in the
+inclusive range, then all versions that start with the supplied parts
+of the tuple are accepted, but nothing that would be greater than the
+provided tuple parts\.
+.RS 0
+.IP \(bu 2
+\fB1\.2\.3 \- 2\.3\fP := \fB>=1\.2\.3 <2\.4\.0\fP
+.IP \(bu 2
+\fB1\.2\.3 \- 2\fP := \fB>=1\.2\.3 <3\.0\.0\fP
+
+.RE
+.SS X\-Ranges \fB1\.2\.x\fP \fB1\.X\fP \fB1\.2\.*\fP \fB*\fP
+.P
+Any of \fBX\fP, \fBx\fP, or \fB*\fP may be used to "stand in" for one of the
+numeric values in the \fB[major, minor, patch]\fP tuple\.
+.RS 0
+.IP \(bu 2
+\fB*\fP := \fB>=0\.0\.0\fP (Any version satisfies)
+.IP \(bu 2
+\fB1\.x\fP := \fB>=1\.0\.0 <2\.0\.0\fP (Matching major version)
+.IP \(bu 2
+\fB1\.2\.x\fP := \fB>=1\.2\.0 <1\.3\.0\fP (Matching major and minor versions)
+
+.RE
+.P
+A partial version range is treated as an X\-Range, so the special
+character is in fact optional\.
+.RS 0
+.IP \(bu 2
+\fB""\fP (empty string) := \fB*\fP := \fB>=0\.0\.0\fP
+.IP \(bu 2
+\fB1\fP := \fB1\.x\.x\fP := \fB>=1\.0\.0 <2\.0\.0\fP
+.IP \(bu 2
+\fB1\.2\fP := \fB1\.2\.x\fP := \fB>=1\.2\.0 <1\.3\.0\fP
+
+.RE
+.SS Tilde Ranges \fB~1\.2\.3\fP \fB~1\.2\fP \fB~1\fP
+.P
+Allows patch\-level changes if a minor version is specified on the
+comparator\. Allows minor\-level changes if not\.
+.RS 0
+.IP \(bu 2
+\fB~1\.2\.3\fP := \fB>=1\.2\.3 <1\.(2+1)\.0\fP := \fB>=1\.2\.3 <1\.3\.0\fP
+.IP \(bu 2
+\fB~1\.2\fP := \fB>=1\.2\.0 <1\.(2+1)\.0\fP := \fB>=1\.2\.0 <1\.3\.0\fP (Same as \fB1\.2\.x\fP)
+.IP \(bu 2
+\fB~1\fP := \fB>=1\.0\.0 <(1+1)\.0\.0\fP := \fB>=1\.0\.0 <2\.0\.0\fP (Same as \fB1\.x\fP)
+.IP \(bu 2
+\fB~0\.2\.3\fP := \fB>=0\.2\.3 <0\.(2+1)\.0\fP := \fB>=0\.2\.3 <0\.3\.0\fP
+.IP \(bu 2
+\fB~0\.2\fP := \fB>=0\.2\.0 <0\.(2+1)\.0\fP := \fB>=0\.2\.0 <0\.3\.0\fP (Same as \fB0\.2\.x\fP)
+.IP \(bu 2
+\fB~0\fP := \fB>=0\.0\.0 <(0+1)\.0\.0\fP := \fB>=0\.0\.0 <1\.0\.0\fP (Same as \fB0\.x\fP)
+.IP \(bu 2
+\fB~1\.2\.3\-beta\.2\fP := \fB>=1\.2\.3\-beta\.2 <1\.3\.0\fP Note that prereleases in
+the \fB1\.2\.3\fP version will be allowed, if they are greater than or
+equal to \fBbeta\.2\fP\|\. So, \fB1\.2\.3\-beta\.4\fP would be allowed, but
+\fB1\.2\.4\-beta\.2\fP would not, because it is a prerelease of a
+different \fB[major, minor, patch]\fP tuple\.
+
+.RE
+.SS Caret Ranges \fB^1\.2\.3\fP \fB^0\.2\.5\fP \fB^0\.0\.4\fP
+.P
+Allows changes that do not modify the left\-most non\-zero digit in the
+\fB[major, minor, patch]\fP tuple\. In other words, this allows patch and
+minor updates for versions \fB1\.0\.0\fP and above, patch updates for
+versions \fB0\.X >=0\.1\.0\fP, and \fIno\fR updates for versions \fB0\.0\.X\fP\|\.
+.P
+Many authors treat a \fB0\.x\fP version as if the \fBx\fP were the major
+"breaking\-change" indicator\.
+.P
+Caret ranges are ideal when an author may make breaking changes
+between \fB0\.2\.4\fP and \fB0\.3\.0\fP releases, which is a common practice\.
+However, it presumes that there will \fInot\fR be breaking changes between
+\fB0\.2\.4\fP and \fB0\.2\.5\fP\|\. It allows for changes that are presumed to be
+additive (but non\-breaking), according to commonly observed practices\.
+.RS 0
+.IP \(bu 2
+\fB^1\.2\.3\fP := \fB>=1\.2\.3 <2\.0\.0\fP
+.IP \(bu 2
+\fB^0\.2\.3\fP := \fB>=0\.2\.3 <0\.3\.0\fP
+.IP \(bu 2
+\fB^0\.0\.3\fP := \fB>=0\.0\.3 <0\.0\.4\fP
+.IP \(bu 2
+\fB^1\.2\.3\-beta\.2\fP := \fB>=1\.2\.3\-beta\.2 <2\.0\.0\fP Note that prereleases in
+the \fB1\.2\.3\fP version will be allowed, if they are greater than or
+equal to \fBbeta\.2\fP\|\. So, \fB1\.2\.3\-beta\.4\fP would be allowed, but
+\fB1\.2\.4\-beta\.2\fP would not, because it is a prerelease of a
+different \fB[major, minor, patch]\fP tuple\.
+.IP \(bu 2
+\fB^0\.0\.3\-beta\fP := \fB>=0\.0\.3\-beta <0\.0\.4\fP Note that prereleases in the
+\fB0\.0\.3\fP version \fIonly\fR will be allowed, if they are greater than or
+equal to \fBbeta\fP\|\. So, \fB0\.0\.3\-pr\.2\fP would be allowed\.
+
+.RE
+.P
+When parsing caret ranges, a missing \fBpatch\fP value desugars to the
+number \fB0\fP, but will allow flexibility within that value, even if the
+major and minor versions are both \fB0\fP\|\.
+.RS 0
+.IP \(bu 2
+\fB^1\.2\.x\fP := \fB>=1\.2\.0 <2\.0\.0\fP
+.IP \(bu 2
+\fB^0\.0\.x\fP := \fB>=0\.0\.0 <0\.1\.0\fP
+.IP \(bu 2
+\fB^0\.0\fP := \fB>=0\.0\.0 <0\.1\.0\fP
+
+.RE
+.P
+A missing \fBminor\fP and \fBpatch\fP values will desugar to zero, but also
+allow flexibility within those values, even if the major version is
+zero\.
+.RS 0
+.IP \(bu 2
+\fB^1\.x\fP := \fB>=1\.0\.0 <2\.0\.0\fP
+.IP \(bu 2
+\fB^0\.x\fP := \fB>=0\.0\.0 <1\.0\.0\fP
+
+.RE
+.SS Range Grammar
+.P
+Putting all this together, here is a Backus\-Naur grammar for ranges,
+for the benefit of parser authors:
+.P
+.RS 2
+.nf
+range\-set ::= range ( logical\-or range ) *
+logical\-or ::= ( ' ' ) * '||' ( ' ' ) *
+range ::= hyphen | simple ( ' ' simple ) * | ''
+hyphen ::= partial ' \- ' partial
+simple ::= primitive | partial | tilde | caret
+primitive ::= ( '<' | '>' | '>=' | '<=' | '=' ) partial
+partial ::= xr ( '\.' xr ( '\.' xr qualifier ? )? )?
+xr ::= 'x' | 'X' | '*' | nr
+nr ::= '0' | ['1'\-'9'] ( ['0'\-'9'] ) *
+tilde ::= '~' partial
+caret ::= '^' partial
+qualifier ::= ( '\-' pre )? ( '+' build )?
+pre ::= parts
+build ::= parts
+parts ::= part ( '\.' part ) *
+part ::= nr | [\-0\-9A\-Za\-z]+
+.fi
+.RE
+.SH Functions
+.P
+All methods and classes take a final \fBoptions\fP object argument\. All
+options in this object are \fBfalse\fP by default\. The options supported
+are:
+.RS 0
+.IP \(bu 2
+\fBloose\fP Be more forgiving about not\-quite\-valid semver strings\.
+(Any resulting output will always be 100% strict compliant, of
+course\.) For backwards compatibility reasons, if the \fBoptions\fP
+argument is a boolean value instead of an object, it is interpreted
+to be the \fBloose\fP param\.
+.IP \(bu 2
+\fBincludePrerelease\fP Set to suppress the default
+behavior \fIhttps://github\.com/npm/node\-semver#prerelease\-tags\fR of
+excluding prerelease tagged versions from ranges unless they are
+explicitly opted into\.
+
+.RE
+.P
+Strict\-mode Comparators and Ranges will be strict about the SemVer
+strings that they parse\.
+.RS 0
+.IP \(bu 2
+\fBvalid(v)\fP: Return the parsed version, or null if it's not valid\.
+.IP \(bu 2
+\fBinc(v, release)\fP: Return the version incremented by the release
+type (\fBmajor\fP, \fBpremajor\fP, \fBminor\fP, \fBpreminor\fP, \fBpatch\fP,
+\fBprepatch\fP, or \fBprerelease\fP), or null if it's not valid
+.RS
+.IP \(bu 2
+\fBpremajor\fP in one call will bump the version up to the next major
+version and down to a prerelease of that major version\.
+\fBpreminor\fP, and \fBprepatch\fP work the same way\.
+.IP \(bu 2
+If called from a non\-prerelease version, the \fBprerelease\fP will work the
+same as \fBprepatch\fP\|\. It increments the patch version, then makes a
+prerelease\. If the input version is already a prerelease it simply
+increments it\.
+
+.RE
+.IP \(bu 2
+\fBprerelease(v)\fP: Returns an array of prerelease components, or null
+if none exist\. Example: \fBprerelease('1\.2\.3\-alpha\.1') \-> ['alpha', 1]\fP
+.IP \(bu 2
+\fBmajor(v)\fP: Return the major version number\.
+.IP \(bu 2
+\fBminor(v)\fP: Return the minor version number\.
+.IP \(bu 2
+\fBpatch(v)\fP: Return the patch version number\.
+.IP \(bu 2
+\fBintersects(r1, r2, loose)\fP: Return true if the two supplied ranges
+or comparators intersect\.
+.IP \(bu 2
+\fBparse(v)\fP: Attempt to parse a string as a semantic version, returning either
+a \fBSemVer\fP object or \fBnull\fP\|\.
+
+.RE
+.SS Comparison
+.RS 0
+.IP \(bu 2
+\fBgt(v1, v2)\fP: \fBv1 > v2\fP
+.IP \(bu 2
+\fBgte(v1, v2)\fP: \fBv1 >= v2\fP
+.IP \(bu 2
+\fBlt(v1, v2)\fP: \fBv1 < v2\fP
+.IP \(bu 2
+\fBlte(v1, v2)\fP: \fBv1 <= v2\fP
+.IP \(bu 2
+\fBeq(v1, v2)\fP: \fBv1 == v2\fP This is true if they're logically equivalent,
+even if they're not the exact same string\. You already know how to
+compare strings\.
+.IP \(bu 2
+\fBneq(v1, v2)\fP: \fBv1 != v2\fP The opposite of \fBeq\fP\|\.
+.IP \(bu 2
+\fBcmp(v1, comparator, v2)\fP: Pass in a comparison string, and it'll call
+the corresponding function above\. \fB"==="\fP and \fB"!=="\fP do simple
+string comparison, but are included for completeness\. Throws if an
+invalid comparison string is provided\.
+.IP \(bu 2
+\fBcompare(v1, v2)\fP: Return \fB0\fP if \fBv1 == v2\fP, or \fB1\fP if \fBv1\fP is greater, or \fB\-1\fP if
+\fBv2\fP is greater\. Sorts in ascending order if passed to \fBArray\.sort()\fP\|\.
+.IP \(bu 2
+\fBrcompare(v1, v2)\fP: The reverse of compare\. Sorts an array of versions
+in descending order when passed to \fBArray\.sort()\fP\|\.
+.IP \(bu 2
+\fBdiff(v1, v2)\fP: Returns difference between two versions by the release type
+(\fBmajor\fP, \fBpremajor\fP, \fBminor\fP, \fBpreminor\fP, \fBpatch\fP, \fBprepatch\fP, or \fBprerelease\fP),
+or null if the versions are the same\.
+
+.RE
+.SS Comparators
+.RS 0
+.IP \(bu 2
+\fBintersects(comparator)\fP: Return true if the comparators intersect
+
+.RE
+.SS Ranges
+.RS 0
+.IP \(bu 2
+\fBvalidRange(range)\fP: Return the valid range or null if it's not valid
+.IP \(bu 2
+\fBsatisfies(version, range)\fP: Return true if the version satisfies the
+range\.
+.IP \(bu 2
+\fBmaxSatisfying(versions, range)\fP: Return the highest version in the list
+that satisfies the range, or \fBnull\fP if none of them do\.
+.IP \(bu 2
+\fBminSatisfying(versions, range)\fP: Return the lowest version in the list
+that satisfies the range, or \fBnull\fP if none of them do\.
+.IP \(bu 2
+\fBminVersion(range)\fP: Return the lowest version that can possibly match
+the given range\.
+.IP \(bu 2
+\fBgtr(version, range)\fP: Return \fBtrue\fP if version is greater than all the
+versions possible in the range\.
+.IP \(bu 2
+\fBltr(version, range)\fP: Return \fBtrue\fP if version is less than all the
+versions possible in the range\.
+.IP \(bu 2
+\fBoutside(version, range, hilo)\fP: Return true if the version is outside
+the bounds of the range in either the high or low direction\. The
+\fBhilo\fP argument must be either the string \fB\|'>'\fP or \fB\|'<'\fP\|\. (This is
+the function called by \fBgtr\fP and \fBltr\fP\|\.)
+.IP \(bu 2
+\fBintersects(range)\fP: Return true if any of the ranges comparators intersect
+
+.RE
+.P
+Note that, since ranges may be non\-contiguous, a version might not be
+greater than a range, less than a range, \fIor\fR satisfy a range! For
+example, the range \fB1\.2 <1\.2\.9 || >2\.0\.0\fP would have a hole from \fB1\.2\.9\fP
+until \fB2\.0\.0\fP, so the version \fB1\.2\.10\fP would not be greater than the
+range (because \fB2\.0\.1\fP satisfies, which is higher), nor less than the
+range (since \fB1\.2\.8\fP satisfies, which is lower), and it also does not
+satisfy the range\.
+.P
+If you want to know if a version satisfies or does not satisfy a
+range, use the \fBsatisfies(version, range)\fP function\.
+.SS Coercion
+.RS 0
+.IP \(bu 2
+\fBcoerce(version)\fP: Coerces a string to semver if possible
+
+.RE
+.P
+This aims to provide a very forgiving translation of a non\-semver string to
+semver\. It looks for the first digit in a string, and consumes all
+remaining characters which satisfy at least a partial semver (e\.g\., \fB1\fP,
+\fB1\.2\fP, \fB1\.2\.3\fP) up to the max permitted length (256 characters)\. Longer
+versions are simply truncated (\fB4\.6\.3\.9\.2\-alpha2\fP becomes \fB4\.6\.3\fP)\. All
+surrounding text is simply ignored (\fBv3\.4 replaces v3\.3\.1\fP becomes
+\fB3\.4\.0\fP)\. Only text which lacks digits will fail coercion (\fBversion one\fP
+is not valid)\. The maximum length for any semver component considered for
+coercion is 16 characters; longer components will be ignored
+(\fB10000000000000000\.4\.7\.4\fP becomes \fB4\.7\.4\fP)\. The maximum value for any
+semver component is \fBNumber\.MAX_SAFE_INTEGER || (2**53 \- 1)\fP; higher value
+components are invalid (\fB9999999999999999\.4\.7\.4\fP is likely invalid)\.
diff --git a/deps/npm/node_modules/@npmcli/arborist/bin/ideal.js b/deps/npm/node_modules/@npmcli/arborist/bin/ideal.js
index 18a5b9eb310869..74d79ce0a51e96 100644
--- a/deps/npm/node_modules/@npmcli/arborist/bin/ideal.js
+++ b/deps/npm/node_modules/@npmcli/arborist/bin/ideal.js
@@ -1,59 +1,11 @@
const Arborist = require('../')
+const { inspect } = require('util')
const options = require('./lib/options.js')
const print = require('./lib/print-tree.js')
require('./lib/logging.js')
require('./lib/timers.js')
-const c = require('chalk')
-
-const whichIsA = (name, dependents, indent = ' ') => {
- if (!dependents || dependents.length === 0)
- return ''
- const str = `\nfor: ` +
- dependents.map(dep => {
- return dep.more ? `${dep.more} more (${dep.names.join(', ')})`
- : `${dep.type} dependency ` +
- `${c.bold(name)}@"${c.bold(dep.spec)}"` + `\nfrom:` +
- (dep.from.location ? (dep.from.name
- ? ` ${c.bold(dep.from.name)}@${c.bold(dep.from.version)} ` +
- c.dim(`at ${dep.from.location}`)
- : ' the root project')
- : ` ${c.bold(dep.from.name)}@${c.bold(dep.from.version)}`) +
- whichIsA(dep.from.name, dep.from.dependents, ' ')
- }).join('\nand: ')
-
- return str.split(/\n/).join(`\n${indent}`)
-}
-
-const explainEresolve = ({ dep, current, peerConflict, fixWithForce }) => {
- return (!dep.whileInstalling ? '' : `While resolving: ` +
- `${c.bold(dep.whileInstalling.name)}@${c.bold(dep.whileInstalling.version)}\n`) +
-
- `Found: ` +
- `${c.bold(current.name)}@${c.bold(current.version)} ` +
- c.dim(`at ${current.location}`) +
- `${whichIsA(current.name, current.dependents)}` +
-
- `\n\nCould not add conflicting dependency: ` +
- `${c.bold(dep.name)}@${c.bold(dep.version)} ` +
- c.dim(`at ${dep.location}`) +
- `${whichIsA(dep.name, dep.dependents)}\n` +
-
- (!peerConflict ? '' :
- `\nConflicting peer dependency: ` +
- `${c.bold(peerConflict.name)}@${c.bold(peerConflict.version)} ` +
- c.dim(`at ${peerConflict.location}`) +
- `${whichIsA(peerConflict.name, peerConflict.dependents)}\n`
- ) +
-
- `\nFix the upstream dependency conflict, or
-run this command with --legacy-peer-deps${
- fixWithForce ? ' or --force' : ''}
-to accept an incorrect (and potentially broken) dependency resolution.
-`
-}
-
const start = process.hrtime()
new Arborist(options).buildIdealTree(options).then(tree => {
const end = process.hrtime(start)
@@ -62,7 +14,7 @@ new Arborist(options).buildIdealTree(options).then(tree => {
if (tree.meta && options.save)
tree.meta.save()
}).catch(er => {
- console.error(er)
- if (er.code === 'ERESOLVE')
- console.error(explainEresolve(er))
+ const opt = { depth: Infinity, color: true }
+ console.error(er.code === 'ERESOLVE' ? inspect(er, opt) : er)
+ process.exitCode = 1
})
diff --git a/deps/npm/node_modules/@npmcli/arborist/bin/lib/logging.js b/deps/npm/node_modules/@npmcli/arborist/bin/lib/logging.js
index 57597b2e509e44..a7d20a1f536470 100644
--- a/deps/npm/node_modules/@npmcli/arborist/bin/lib/logging.js
+++ b/deps/npm/node_modules/@npmcli/arborist/bin/lib/logging.js
@@ -26,7 +26,7 @@ if (loglevel !== 'silent') {
return
const pref = `${process.pid} ${level} `
if (level === 'warn' && args[0] === 'ERESOLVE')
- args[2] = inspect(args[2], { depth: Infinity })
+ args[2] = inspect(args[2], { depth: 10 })
const msg = pref + format(...args).trim().split('\n').join(`\n${pref}`)
console.error(msg)
})
diff --git a/deps/npm/node_modules/@npmcli/arborist/bin/lib/options.js b/deps/npm/node_modules/@npmcli/arborist/bin/lib/options.js
index 8f0dc2f1203240..bf8e08ec22a57a 100644
--- a/deps/npm/node_modules/@npmcli/arborist/bin/lib/options.js
+++ b/deps/npm/node_modules/@npmcli/arborist/bin/lib/options.js
@@ -31,7 +31,9 @@ for (const arg of process.argv.slice(2)) {
} else if (/^--omit=/.test(arg)) {
options.omit = options.omit || []
options.omit.push(arg.substr('--omit='.length))
- } else if (/^--[^=]+=/.test(arg)) {
+ } else if (/^--before=/.test(arg))
+ options.before = new Date(arg.substr('--before='.length))
+ else if (/^--[^=]+=/.test(arg)) {
const [key, ...v] = arg.replace(/^--/, '').split('=')
const val = v.join('=')
options[key] = val === 'false' ? false : val === 'true' ? true : val
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
index 4c266502101a4c..17b42f81bb39a7 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
@@ -397,7 +397,9 @@ module.exports = cls => class IdealTreeBuilder extends cls {
// that they're there, and not reinstall the world unnecessarily.
if (this[_global] && (this[_updateAll] || this[_updateNames].length)) {
const nm = resolve(this.path, 'node_modules')
- for (const name of await readdir(nm)) {
+ for (const name of await readdir(nm).catch(() => [])) {
+ if (this[_updateNames].includes(name))
+ this[_explicitRequests].add(name)
tree.package.dependencies = tree.package.dependencies || {}
if (this[_updateAll] || this[_updateNames].includes(name))
tree.package.dependencies[name] = '*'
@@ -491,7 +493,8 @@ module.exports = cls => class IdealTreeBuilder extends cls {
/* istanbul ignore else - should also be covered by realpath failure */
if (filepath) {
const { name } = spec
- spec = npa(`file:${relpath(this.path, filepath)}`, this.path)
+ const tree = this.idealTree.target || this.idealTree
+ spec = npa(`file:${relpath(tree.path, filepath)}`, tree.path)
spec.name = name
}
return spec
@@ -663,6 +666,11 @@ This is a one-time fix-up, please be patient...
})
}
await promiseCallLimit(queue)
+
+ // have to re-calc dep flags, because the nodes don't have edges
+ // until their packages get assigned, so everything looks extraneous
+ calcDepFlags(this.idealTree)
+
// yes, yes, this isn't the "original" version, but now that it's been
// upgraded, we need to make sure we don't do the work to upgrade it
// again, since it's now as new as can be.
@@ -800,6 +808,7 @@ This is a one-time fix-up, please be patient...
// a virtual root of whatever brought in THIS node.
// so we VR the node itself if the edge is not a peer
const source = edge.peer ? peerSource : node
+
const virtualRoot = this[_virtualRoot](source, true)
// reuse virtual root if we already have one, but don't
// try to do the override ahead of time, since we MAY be able
@@ -821,13 +830,17 @@ This is a one-time fix-up, please be patient...
// +-- z@1
// But if x and y are loaded in the same virtual root, then they will
// be forced to agree on a version of z.
+ const required = new Set([edge.from])
+ const parent = edge.peer ? virtualRoot : null
const dep = vrDep && vrDep.satisfies(edge) ? vrDep
- : await this[_nodeFromEdge](edge, edge.peer ? virtualRoot : null)
+ : await this[_nodeFromEdge](edge, parent, null, required)
+
/* istanbul ignore next */
debug(() => {
if (!dep)
throw new Error('no dep??')
})
+
tasks.push({edge, dep})
}
@@ -864,7 +877,7 @@ This is a one-time fix-up, please be patient...
// loads a node from an edge, and then loads its peer deps (and their
// peer deps, on down the line) into a virtual root parent.
- async [_nodeFromEdge] (edge, parent_, secondEdge = null) {
+ async [_nodeFromEdge] (edge, parent_, secondEdge, required) {
// create a virtual root node with the same deps as the node that
// is requesting this one, so that we can get all the peer deps in
// a context where they're likely to be resolvable.
@@ -895,6 +908,11 @@ This is a one-time fix-up, please be patient...
// ensure the one we want is the one that's placed
node.parent = parent
+ if (required.has(edge.from) && edge.type !== 'peerOptional' ||
+ secondEdge && (
+ required.has(secondEdge.from) && secondEdge.type !== 'peerOptional'))
+ required.add(node)
+
// handle otherwise unresolvable dependency nesting loops by
// creating a symbolic link
// a1 -> b1 -> a2 -> b2 -> a1 -> ...
@@ -908,7 +926,7 @@ This is a one-time fix-up, please be patient...
// keep track of the thing that caused this node to be included.
const src = parent.sourceReference
this[_peerSetSource].set(node, src)
- return this[_loadPeerSet](node)
+ return this[_loadPeerSet](node, required)
}
[_virtualRoot] (node, reuse = false) {
@@ -1053,7 +1071,7 @@ This is a one-time fix-up, please be patient...
// gets placed first. In non-strict mode, we behave strictly if the
// virtual root is based on the root project, and allow non-peer parent
// deps to override, but throw if no preference can be determined.
- async [_loadPeerSet] (node) {
+ async [_loadPeerSet] (node, required) {
const peerEdges = [...node.edgesOut.values()]
// we typically only install non-optional peers, but we have to
// factor them into the peerSet so that we can avoid conflicts
@@ -1068,10 +1086,12 @@ This is a one-time fix-up, please be patient...
const parentEdge = node.parent.edgesOut.get(edge.name)
const {isProjectRoot, isWorkspace} = node.parent.sourceReference
const isMine = isProjectRoot || isWorkspace
+ const conflictOK = this[_force] || !isMine && !this[_strictPeerDeps]
+
if (!edge.to) {
if (!parentEdge) {
// easy, just put the thing there
- await this[_nodeFromEdge](edge, node.parent)
+ await this[_nodeFromEdge](edge, node.parent, null, required)
continue
} else {
// if the parent's edge is very broad like >=1, and the edge in
@@ -1082,14 +1102,16 @@ This is a one-time fix-up, please be patient...
// a conflict. this is always a problem in strict mode, never
// in force mode, and a problem in non-strict mode if this isn't
// on behalf of our project. in all such cases, we warn at least.
- await this[_nodeFromEdge](parentEdge, node.parent, edge)
+ const dep = await this[_nodeFromEdge](parentEdge, node.parent, edge, required)
// hooray! that worked!
if (edge.valid)
continue
- // allow it
- if (this[_force] || !isMine && !this[_strictPeerDeps])
+ // allow it. either we're overriding, or it's not something
+ // that will be installed by default anyway, and we'll fail when
+ // we get to the point where we need to, if we need to.
+ if (conflictOK || !required.has(dep))
continue
// problem
@@ -1101,8 +1123,11 @@ This is a one-time fix-up, please be patient...
// we don't like it. always fail strictly, always allow forcibly or
// in non-strict mode if it's not our fault. don't warn here, because
// we are going to warn again when we place the deps, if we end up
- // overriding for something else.
- if (this[_force] || !isMine && !this[_strictPeerDeps])
+ // overriding for something else. If the thing that has this dep
+ // isn't also required, then there's a good chance we won't need it,
+ // so allow it for now and let it conflict if it turns out to actually
+ // be necessary for the installation.
+ if (conflictOK || !required.has(edge.from))
continue
// ok, it's the root, or we're in unforced strict mode, so this is bad
@@ -1198,8 +1223,25 @@ This is a one-time fix-up, please be patient...
break
}
- if (!target)
- this[_failPeerConflict](edge)
+ // if we can't find a target, that means that the last placed checked
+ // (and all the places before it) had a copy already. if we're in
+ // --force mode, then the user has explicitly said that they're ok
+ // with conflicts. This can only occur in --force mode in the case
+ // when a node was added to the tree with a peerOptional dep that we
+ // ignored, and then later, that edge became invalid, and we fail to
+ // resolve it. We will warn about it in a moment.
+ if (!target) {
+ if (this[_force]) {
+ // we know that there is a dep (not the root) which is the target
+ // of this edge, or else it wouldn't have been a conflict.
+ target = edge.to.resolveParent
+ canPlace = KEEP
+ } else
+ this[_failPeerConflict](edge)
+ } else {
+ // it worked, so we clearly have no peer conflicts at this point.
+ this[_peerConflict] = null
+ }
this.log.silly(
'placeDep',
@@ -1210,9 +1252,6 @@ This is a one-time fix-up, please be patient...
`want: ${edge.spec || '*'}`
)
- // it worked, so we clearly have no peer conflicts at this point.
- this[_peerConflict] = null
-
// Can only get KEEP here if the original edge was valid,
// and we're checking for an update but it's already up to date.
if (canPlace === KEEP) {
@@ -1398,6 +1437,7 @@ This is a one-time fix-up, please be patient...
})
const entryEdge = peerEntryEdge || edge
const source = this[_peerSetSource].get(dep)
+
isSource = isSource || target === source
// if we're overriding the source, then we care if the *target* is
// ours, even if it wasn't actually the original source, since we
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-virtual.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-virtual.js
index f03bd80c460dec..3a38905b77433d 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-virtual.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-virtual.js
@@ -24,6 +24,7 @@ const loadWorkspacesVirtual = Symbol.for('loadWorkspacesVirtual')
const flagsSuspect = Symbol.for('flagsSuspect')
const reCalcDepFlags = Symbol('reCalcDepFlags')
const checkRootEdges = Symbol('checkRootEdges')
+const rootOptionProvided = Symbol('rootOptionProvided')
const depsToEdges = (type, deps) =>
Object.entries(deps).map(d => [type, ...d])
@@ -63,6 +64,8 @@ module.exports = cls => class VirtualLoader extends cls {
root = await this[loadRoot](s),
} = options
+ this[rootOptionProvided] = options.root
+
await this[loadFromShrinkwrap](s, root)
return treeCheck(this.virtualTree)
}
@@ -74,13 +77,17 @@ module.exports = cls => class VirtualLoader extends cls {
}
async [loadFromShrinkwrap] (s, root) {
- // root is never any of these things, but might be a brand new
- // baby Node object that never had its dep flags calculated.
- root.extraneous = false
- root.dev = false
- root.optional = false
- root.devOptional = false
- root.peer = false
+ if (!this[rootOptionProvided]) {
+ // root is never any of these things, but might be a brand new
+ // baby Node object that never had its dep flags calculated.
+ root.extraneous = false
+ root.dev = false
+ root.optional = false
+ root.devOptional = false
+ root.peer = false
+ } else
+ this[flagsSuspect] = true
+
this[checkRootEdges](s, root)
root.meta = s
this.virtualTree = root
@@ -88,20 +95,23 @@ module.exports = cls => class VirtualLoader extends cls {
await this[resolveLinks](links, nodes)
this[assignBundles](nodes)
if (this[flagsSuspect])
- this[reCalcDepFlags]()
+ this[reCalcDepFlags](nodes.values())
return root
}
- [reCalcDepFlags] () {
+ [reCalcDepFlags] (nodes) {
// reset all dep flags
- for (const node of this.virtualTree.inventory.values()) {
+ // can't use inventory here, because virtualTree might not be root
+ for (const node of nodes) {
+ if (node.isRoot || node === this[rootOptionProvided])
+ continue
node.extraneous = true
node.dev = true
node.optional = true
node.devOptional = true
node.peer = true
}
- calcDepFlags(this.virtualTree, true)
+ calcDepFlags(this.virtualTree, !this[rootOptionProvided])
}
// check the lockfile deps, and see if they match. if they do not
@@ -237,6 +247,12 @@ module.exports = cls => class VirtualLoader extends cls {
// shrinkwrap doesn't include package name unless necessary
if (!sw.name)
sw.name = nameFromFolder(path)
+
+ const dev = sw.dev
+ const optional = sw.optional
+ const devOptional = dev || optional || sw.devOptional
+ const peer = sw.peer
+
const node = new Node({
legacyPeerDeps: this.legacyPeerDeps,
root: this.virtualTree,
@@ -246,6 +262,10 @@ module.exports = cls => class VirtualLoader extends cls {
resolved: consistentResolve(sw.resolved, this.path, path),
pkg: sw,
hasShrinkwrap: sw.hasShrinkwrap,
+ dev,
+ optional,
+ devOptional,
+ peer,
})
// cast to boolean because they're undefined in the lock file when false
node.extraneous = !!sw.extraneous
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js
index 1dd4b4b0f19317..c3ea1b43bbc76f 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js
@@ -16,6 +16,7 @@ const mkdirp = require('mkdirp-infer-owner')
const moveFile = require('@npmcli/move-file')
const rimraf = promisify(require('rimraf'))
const packageContents = require('@npmcli/installed-package-contents')
+const { checkEngine, checkPlatform } = require('npm-install-checks')
const treeCheck = require('../tree-check.js')
const relpath = require('../relpath.js')
@@ -43,6 +44,7 @@ const _loadTrees = Symbol.for('loadTrees')
const _diffTrees = Symbol.for('diffTrees')
const _createSparseTree = Symbol.for('createSparseTree')
const _loadShrinkwrapsAndUpdateTrees = Symbol.for('loadShrinkwrapsAndUpdateTrees')
+const _shrinkwrapUnpacked = Symbol('shrinkwrapUnpacked')
const _reifyNode = Symbol.for('reifyNode')
const _extractOrLink = Symbol('extractOrLink')
// defined by rebuild mixin
@@ -102,6 +104,7 @@ module.exports = cls => class Reifier extends cls {
this.diff = null
this[_retiredPaths] = {}
+ this[_shrinkwrapUnpacked] = new Set()
this[_retiredUnchanged] = {}
this[_sparseTreeDirs] = new Set()
this[_sparseTreeRoots] = new Set()
@@ -233,9 +236,9 @@ module.exports = cls => class Reifier extends cls {
const actualOpt = this[_global] ? {
ignoreMissing: true,
global: true,
- filter: (node, kid) => this[_explicitRequests].size === 0 || !node.isProjectRoot
- ? true
- : (node.edgesOut.has(kid) || this[_explicitRequests].has(kid)),
+ filter: (node, kid) =>
+ this[_explicitRequests].size === 0 || !node.isProjectRoot ? true
+ : (this.idealTree.edgesOut.has(kid) || this[_explicitRequests].has(kid)),
} : { ignoreMissing: true }
if (!this[_global]) {
@@ -404,7 +407,8 @@ module.exports = cls => class Reifier extends cls {
// shrinkwrap nodes define their dependency branches with a file, so
// we need to unpack them, read that shrinkwrap file, and then update
// the tree by calling loadVirtual with the node as the root.
- [_loadShrinkwrapsAndUpdateTrees] (seen = new Set()) {
+ [_loadShrinkwrapsAndUpdateTrees] () {
+ const seen = this[_shrinkwrapUnpacked]
const shrinkwraps = this.diff.leaves
.filter(d => (d.action === 'CHANGE' || d.action === 'ADD') &&
d.ideal.hasShrinkwrap && !seen.has(d.ideal) &&
@@ -428,6 +432,8 @@ module.exports = cls => class Reifier extends cls {
// reload the diff and sparse tree because the ideal tree changed
.then(() => this[_diffTrees]())
.then(() => this[_createSparseTree]())
+ .then(() => this[_addOmitsToTrashList]())
+ .then(() => this[_loadShrinkwrapsAndUpdateTrees]())
.then(() => process.emit('timeEnd', 'reify:loadShrinkwraps'))
}
@@ -442,10 +448,23 @@ module.exports = cls => class Reifier extends cls {
if (this[_trashList].has(node.path))
return node
- process.emit('time', `reifyNode:${node.location}`)
+ const timer = `reifyNode:${node.location}`
+ process.emit('time', timer)
this.addTracker('reify', node.name, node.location)
+ const { npmVersion, nodeVersion } = this.options
const p = Promise.resolve()
+ .then(() => {
+ // when we reify an optional node, check the engine and platform
+ // first. be sure to ignore the --force and --engine-strict flags,
+ // since we always want to skip any optional packages we can't install.
+ // these checks throwing will result in a rollback and removal
+ // of the mismatches
+ if (node.optional) {
+ checkEngine(node.package, npmVersion, nodeVersion, false)
+ checkPlatform(node.package, false)
+ }
+ })
.then(() => this[_checkBins](node))
.then(() => this[_extractOrLink](node))
.then(() => this[_warnDeprecated](node))
@@ -454,7 +473,7 @@ module.exports = cls => class Reifier extends cls {
return this[_handleOptionalFailure](node, p)
.then(() => {
this.finishTracker('reify', node.name, node.location)
- process.emit('timeEnd', `reifyNode:${node.location}`)
+ process.emit('timeEnd', timer)
return node
})
}
@@ -474,9 +493,14 @@ module.exports = cls => class Reifier extends cls {
// no idea what this thing is. remove it from the tree.
if (!res) {
- node.parent = null
+ const warning = 'invalid or damaged lockfile detected\n' +
+ 'please re-try this operation once it completes\n' +
+ 'so that the damage can be corrected, or perform\n' +
+ 'a fresh install with no lockfile if the problem persists.'
+ this.log.warn('reify', warning)
this.log.verbose('reify', 'unrecognized node in tree', node.path)
node.parent = null
+ node.fsParent = null
this[_addNodeToTrashList](node)
return
}
@@ -712,7 +736,7 @@ module.exports = cls => class Reifier extends cls {
const node = diff.ideal
const bd = node.package.bundleDependencies
- const sw = node.hasShrinkwrap
+ const sw = this[_shrinkwrapUnpacked].has(node)
// check whether we still need to unpack this one.
// test the inDepBundle last, since that's potentially a tree walk.
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js b/deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js
index 15e17330addc0d..77cd6511aea3b5 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js
@@ -268,8 +268,8 @@ class AuditReport extends Map {
id,
url,
title,
- severity,
- vulnerable_versions,
+ severity = 'high',
+ vulnerable_versions = '*',
module_name: name,
} = advisory
bulk[name] = bulk[name] || []
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/calc-dep-flags.js b/deps/npm/node_modules/@npmcli/arborist/lib/calc-dep-flags.js
index 73f1e60d7ce97b..d6ae266db3bb05 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/calc-dep-flags.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/calc-dep-flags.js
@@ -11,7 +11,7 @@ const calcDepFlags = (tree, resetRoot = true) => {
tree,
visit: node => calcDepFlagsStep(node),
filter: node => node,
- getChildren: node => [...node.edgesOut.values()].map(edge => edge.to),
+ getChildren: (node, tree) => [...tree.edgesOut.values()].map(edge => edge.to),
})
return ret
}
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/node.js b/deps/npm/node_modules/@npmcli/arborist/lib/node.js
index 9a6b86e4021b8f..fa39bed5ef9d4a 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/node.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/node.js
@@ -731,7 +731,6 @@ class Node {
// Note the subtle breaking change from v6: it is no longer possible
// to have a different spec for a devDep than production dep.
this[_loadDepType](this.package.optionalDependencies, 'optional')
- this[_loadDepType](this.package.dependencies, 'prod')
// Linked targets that are disconnected from the tree are tops,
// but don't have a 'path' field, only a 'realpath', because we
@@ -755,6 +754,8 @@ class Node {
this[_loadDepType](peerDependencies, 'peer')
this[_loadDepType](peerOptional, 'peerOptional')
}
+
+ this[_loadDepType](this.package.dependencies, 'prod')
}
[_loadDepType] (obj, type) {
@@ -763,8 +764,10 @@ class Node {
for (const [name, spec] of Object.entries(obj || {})) {
const accept = ad[name]
// if it's already set, then we keep the existing edge
+ // Prod deps should not be marked as dev, however.
// NB: the Edge ctor adds itself to from.edgesOut
- if (!this.edgesOut.get(name))
+ const current = this.edgesOut.get(name)
+ if (!current || current.dev && type === 'prod')
new Edge({ from, name, spec, accept, type })
}
}
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/shrinkwrap.js b/deps/npm/node_modules/@npmcli/arborist/lib/shrinkwrap.js
index 9254531e49d4aa..f9f4297dbae867 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/shrinkwrap.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/shrinkwrap.js
@@ -59,6 +59,10 @@ const swKeyOrder = [
'dependencies',
]
+// used to rewrite from yarn registry to npm registry
+const yarnRegRe = /^https?:\/\/registry.yarnpkg.com\//
+const npmRegRe = /^https?:\/\/registry.npmjs.org\//
+
// sometimes resolved: is weird or broken, or something npa can't handle
const specFromResolved = resolved => {
try {
@@ -291,8 +295,6 @@ class Shrinkwrap {
if (fromYarn && fromYarn.version) {
// if it's the yarn or npm default registry, use the version as
// our effective spec. if it's any other kind of thing, use that.
- const yarnRegRe = /^https?:\/\/registry.yarnpkg.com\//
- const npmRegRe = /^https?:\/\/registry.npmjs.org\//
const {resolved, version, integrity} = fromYarn
const isYarnReg = spec.registry && yarnRegRe.test(resolved)
const isnpmReg = spec.registry && !isYarnReg && npmRegRe.test(resolved)
@@ -733,6 +735,7 @@ class Shrinkwrap {
: !/file:/.test(node.resolved) ? node.resolved
: consistentResolve(node.resolved, node.path, this.path, true)
+ const spec = npa(`${node.name}@${edge.spec}`)
const entry = this.yarnLock.entries.get(`${node.name}@${edge.spec}`)
if (!entry ||
@@ -741,6 +744,9 @@ class Shrinkwrap {
mismatch(pathFixed, entry.resolved))
return
+ if (entry.resolved && yarnRegRe.test(entry.resolved) && spec.registry)
+ entry.resolved = entry.resolved.replace(yarnRegRe, 'https://registry.npmjs.org/')
+
node.integrity = node.integrity || entry.integrity || null
node.resolved = node.resolved ||
consistentResolve(entry.resolved, this.path, node.path) || null
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/update-root-package-json.js b/deps/npm/node_modules/@npmcli/arborist/lib/update-root-package-json.js
index 735ebd10ad16ff..aba5614924ec77 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/update-root-package-json.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/update-root-package-json.js
@@ -15,11 +15,18 @@ const depTypes = new Set([
'peerDependencies',
])
+const parseJsonSafe = json => {
+ try {
+ return parseJSON(json)
+ } catch (er) {
+ return null
+ }
+}
+
const updateRootPackageJson = async tree => {
const filename = resolve(tree.path, 'package.json')
- const originalContent = await readFile(filename, 'utf8')
- .then(data => parseJSON(data))
- .catch(() => null)
+ const originalJson = await readFile(filename, 'utf8').catch(() => null)
+ const originalContent = parseJsonSafe(originalJson)
const depsData = orderDeps({
...tree.package,
@@ -36,12 +43,29 @@ const updateRootPackageJson = async tree => {
}
// if there's no package.json, just use internal pkg info as source of truth
- const packageJsonContent = originalContent || depsData
+ // clone the object though, so we can still refer to what it originally was
+ const packageJsonContent = !originalContent ? depsData
+ : Object.assign({}, originalContent)
// loop through all types of dependencies and update package json content
for (const type of depTypes)
packageJsonContent[type] = depsData[type]
+ // if original package.json had dep in peerDeps AND deps, preserve that.
+ const { dependencies: origProd, peerDependencies: origPeer } =
+ originalContent || {}
+ const { peerDependencies: newPeer } = packageJsonContent
+ if (origProd && origPeer && newPeer) {
+ // we have original prod/peer deps, and new peer deps
+ // copy over any that were in both in the original
+ for (const name of Object.keys(origPeer)) {
+ if (origProd[name] !== undefined && newPeer[name] !== undefined) {
+ packageJsonContent.dependencies = packageJsonContent.dependencies || {}
+ packageJsonContent.dependencies[name] = newPeer[name]
+ }
+ }
+ }
+
// format content
const {
[Symbol.for('indent')]: indent,
@@ -52,7 +76,8 @@ const updateRootPackageJson = async tree => {
const content = (JSON.stringify(packageJsonContent, null, format) + '\n')
.replace(/\n/g, eol)
- return writeFile(filename, content)
+ if (content !== originalJson)
+ return writeFile(filename, content)
}
module.exports = updateRootPackageJson
diff --git a/deps/npm/node_modules/@npmcli/arborist/package.json b/deps/npm/node_modules/@npmcli/arborist/package.json
index 6e88b9cbb57a10..77c11e72218160 100644
--- a/deps/npm/node_modules/@npmcli/arborist/package.json
+++ b/deps/npm/node_modules/@npmcli/arborist/package.json
@@ -1,11 +1,11 @@
{
"name": "@npmcli/arborist",
- "version": "2.2.1",
+ "version": "2.2.4",
"description": "Manage node_modules trees",
"dependencies": {
"@npmcli/installed-package-contents": "^1.0.6",
"@npmcli/map-workspaces": "^1.0.2",
- "@npmcli/metavuln-calculator": "^1.0.1",
+ "@npmcli/metavuln-calculator": "^1.1.0",
"@npmcli/move-file": "^1.1.0",
"@npmcli/name-from-folder": "^1.0.1",
"@npmcli/node-gyp": "^1.0.1",
@@ -24,7 +24,7 @@
"parse-conflict-json": "^1.1.1",
"promise-all-reject-late": "^1.0.0",
"promise-call-limit": "^1.0.1",
- "read-package-json-fast": "^2.0.1",
+ "read-package-json-fast": "^2.0.2",
"readdir-scoped-modules": "^1.1.0",
"semver": "^7.3.4",
"tar": "^6.1.0",
diff --git a/deps/npm/node_modules/@npmcli/git/package.json b/deps/npm/node_modules/@npmcli/git/package.json
index bb07188560b4c7..0e01efaf2fbce9 100644
--- a/deps/npm/node_modules/@npmcli/git/package.json
+++ b/deps/npm/node_modules/@npmcli/git/package.json
@@ -1,6 +1,6 @@
{
"name": "@npmcli/git",
- "version": "2.0.4",
+ "version": "2.0.6",
"main": "lib/index.js",
"files": [
"lib/*.js"
@@ -33,7 +33,7 @@
"mkdirp": "^1.0.3",
"npm-pick-manifest": "^6.0.0",
"promise-inflight": "^1.0.1",
- "promise-retry": "^1.1.1",
+ "promise-retry": "^2.0.1",
"semver": "^7.3.2",
"unique-filename": "^1.1.1",
"which": "^2.0.2"
diff --git a/deps/npm/node_modules/@npmcli/map-workspaces/README.md b/deps/npm/node_modules/@npmcli/map-workspaces/README.md
index f8e114c2a14ca3..52e4a42d37abe6 100644
--- a/deps/npm/node_modules/@npmcli/map-workspaces/README.md
+++ b/deps/npm/node_modules/@npmcli/map-workspaces/README.md
@@ -17,13 +17,16 @@ Long version: Reads the `workspaces` property from a valid **workspaces configur
```js
const mapWorkspaces = require('@npmcli/map-workspaces')
await mapWorkspaces({
- workspaces: {
- packages: [
- "a",
- "b"
- ]
+ cwd,
+ pkg: {
+ workspaces: {
+ packages: [
+ "a",
+ "b"
+ ]
+ }
}
-}, { cwd })
+})
// ->
// Map {
// 'a': '/a'
@@ -51,10 +54,13 @@ Given a folder structure such as:
```js
const mapWorkspaces = require('@npmcli/map-workspaces')
await mapWorkspaces({
- workspaces: [
- "apps/*"
- ]
-}, { cwd })
+ cwd,
+ pkg: {
+ workspaces: [
+ "apps/*"
+ ]
+ }
+})
// ->
// Map {
// 'a': '/apps/a'
@@ -65,10 +71,10 @@ await mapWorkspaces({
## API:
-### `mapWorkspaces(pkg, opts = {}) -> Promise