npm explain
the results to only the paths to the packages named. Note that nested
packages will also show the paths to the specified packages. For
example, running npm ls promzard
in npm's source tree will show:
-npm@11.4.2 /path/to/npm
+npm@11.5.1 /path/to/npm
└─┬ init-package-json@0.0.4
└── promzard@0.1.5
diff --git a/deps/npm/docs/output/commands/npm-org.html b/deps/npm/docs/output/commands/npm-org.html
index 896cf57dee7..51fc57e6b05 100644
--- a/deps/npm/docs/output/commands/npm-org.html
+++ b/deps/npm/docs/output/commands/npm-org.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-org
- @11.4.2
+ @11.5.1
Manage orgs
diff --git a/deps/npm/docs/output/commands/npm-outdated.html b/deps/npm/docs/output/commands/npm-outdated.html
index d5adb4c41cb..8f1c40aa729 100644
--- a/deps/npm/docs/output/commands/npm-outdated.html
+++ b/deps/npm/docs/output/commands/npm-outdated.html
@@ -141,16 +141,16 @@ npm command-line interface
-
+
npm-outdated
- @11.4.2
+ @11.5.1
Check for outdated packages
Synopsis
@@ -289,6 +289,19 @@ workspaces within that folder)
workspace which does not yet exist, to create the folder and set it up as a
brand new workspace within the project.
This value is not exported to the environment for child processes.
+
before
+
+Default: null
+Type: null or Date
+
+
If passed to npm install
, will rebuild the npm tree such that only
+versions that were available on or before the given date are installed.
+If there are no versions available for the current set of dependencies, the
+command will error.
+
If the requested version is a dist-tag
and the given tag does not pass the
+--before
filter, the most recent version less than or equal to that tag
+will be used. For example, foo@latest
might install foo@1.2
even though
+latest
is 2.0
.
See Also
package spec
diff --git a/deps/npm/docs/output/commands/npm-owner.html b/deps/npm/docs/output/commands/npm-owner.html
index a501eba3b2a..ccc611dbf61 100644
--- a/deps/npm/docs/output/commands/npm-owner.html
+++ b/deps/npm/docs/output/commands/npm-owner.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-owner
- @11.4.2
+ @11.5.1
Manage package owners
diff --git a/deps/npm/docs/output/commands/npm-pack.html b/deps/npm/docs/output/commands/npm-pack.html
index 421eecdc7eb..6a9165dfcd1 100644
--- a/deps/npm/docs/output/commands/npm-pack.html
+++ b/deps/npm/docs/output/commands/npm-pack.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-pack
- @11.4.2
+ @11.5.1
Create a tarball from a package
diff --git a/deps/npm/docs/output/commands/npm-ping.html b/deps/npm/docs/output/commands/npm-ping.html
index e7d3a97fb21..5862980f080 100644
--- a/deps/npm/docs/output/commands/npm-ping.html
+++ b/deps/npm/docs/output/commands/npm-ping.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-ping
- @11.4.2
+ @11.5.1
Ping npm registry
diff --git a/deps/npm/docs/output/commands/npm-pkg.html b/deps/npm/docs/output/commands/npm-pkg.html
index cdeb3d7e4df..3ea7c0658e1 100644
--- a/deps/npm/docs/output/commands/npm-pkg.html
+++ b/deps/npm/docs/output/commands/npm-pkg.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-pkg
- @11.4.2
+ @11.5.1
Manages your package.json
diff --git a/deps/npm/docs/output/commands/npm-prefix.html b/deps/npm/docs/output/commands/npm-prefix.html
index fd4df3887ae..ac6a195b142 100644
--- a/deps/npm/docs/output/commands/npm-prefix.html
+++ b/deps/npm/docs/output/commands/npm-prefix.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-prefix
- @11.4.2
+ @11.5.1
Display prefix
diff --git a/deps/npm/docs/output/commands/npm-profile.html b/deps/npm/docs/output/commands/npm-profile.html
index 0843f9435a3..7ac7aaca433 100644
--- a/deps/npm/docs/output/commands/npm-profile.html
+++ b/deps/npm/docs/output/commands/npm-profile.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-profile
- @11.4.2
+ @11.5.1
Change settings on your registry profile
diff --git a/deps/npm/docs/output/commands/npm-prune.html b/deps/npm/docs/output/commands/npm-prune.html
index ea84261a164..a1c56766648 100644
--- a/deps/npm/docs/output/commands/npm-prune.html
+++ b/deps/npm/docs/output/commands/npm-prune.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-prune
- @11.4.2
+ @11.5.1
Remove extraneous packages
diff --git a/deps/npm/docs/output/commands/npm-publish.html b/deps/npm/docs/output/commands/npm-publish.html
index 0a17b7cd264..f2a075fdc52 100644
--- a/deps/npm/docs/output/commands/npm-publish.html
+++ b/deps/npm/docs/output/commands/npm-publish.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-publish
- @11.4.2
+ @11.5.1
Publish a package
diff --git a/deps/npm/docs/output/commands/npm-query.html b/deps/npm/docs/output/commands/npm-query.html
index a2f851bc210..a196efe399d 100644
--- a/deps/npm/docs/output/commands/npm-query.html
+++ b/deps/npm/docs/output/commands/npm-query.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-query
- @11.4.2
+ @11.5.1
Dependency selector query
diff --git a/deps/npm/docs/output/commands/npm-rebuild.html b/deps/npm/docs/output/commands/npm-rebuild.html
index 39c056ecf00..3d2ad013a06 100644
--- a/deps/npm/docs/output/commands/npm-rebuild.html
+++ b/deps/npm/docs/output/commands/npm-rebuild.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-rebuild
- @11.4.2
+ @11.5.1
Rebuild a package
diff --git a/deps/npm/docs/output/commands/npm-repo.html b/deps/npm/docs/output/commands/npm-repo.html
index d4806355ca9..0ea012c5205 100644
--- a/deps/npm/docs/output/commands/npm-repo.html
+++ b/deps/npm/docs/output/commands/npm-repo.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-repo
- @11.4.2
+ @11.5.1
Open package repository page in the browser
@@ -165,7 +165,7 @@ provided, it will search for a package.json
in the current folder a
Configuration
browser
-Default: OS X: "open"
, Windows: "start"
, Others: "xdg-open"
+Default: macOS: "open"
, Windows: "start"
, Others: "xdg-open"
Type: null, Boolean, or String
The browser that is called by npm commands to open websites.
diff --git a/deps/npm/docs/output/commands/npm-restart.html b/deps/npm/docs/output/commands/npm-restart.html
index 5bef966b523..eaac195de4b 100644
--- a/deps/npm/docs/output/commands/npm-restart.html
+++ b/deps/npm/docs/output/commands/npm-restart.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-restart
- @11.4.2
+ @11.5.1
Restart a package
diff --git a/deps/npm/docs/output/commands/npm-root.html b/deps/npm/docs/output/commands/npm-root.html
index 126d80b251d..7b6093cda28 100644
--- a/deps/npm/docs/output/commands/npm-root.html
+++ b/deps/npm/docs/output/commands/npm-root.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-root
- @11.4.2
+ @11.5.1
Display npm root
diff --git a/deps/npm/docs/output/commands/npm-run.html b/deps/npm/docs/output/commands/npm-run.html
index bd301d4157e..018d5ed6bda 100644
--- a/deps/npm/docs/output/commands/npm-run.html
+++ b/deps/npm/docs/output/commands/npm-run.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-run
- @11.4.2
+ @11.5.1
Run arbitrary package scripts
diff --git a/deps/npm/docs/output/commands/npm-sbom.html b/deps/npm/docs/output/commands/npm-sbom.html
index 27bf7deeb7f..a3e44f0ec23 100644
--- a/deps/npm/docs/output/commands/npm-sbom.html
+++ b/deps/npm/docs/output/commands/npm-sbom.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-sbom
- @11.4.2
+ @11.5.1
Generate a Software Bill of Materials (SBOM)
diff --git a/deps/npm/docs/output/commands/npm-search.html b/deps/npm/docs/output/commands/npm-search.html
index 2bb6b034ffd..1dbc2fcd740 100644
--- a/deps/npm/docs/output/commands/npm-search.html
+++ b/deps/npm/docs/output/commands/npm-search.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-search
- @11.4.2
+ @11.5.1
Search for packages
diff --git a/deps/npm/docs/output/commands/npm-shrinkwrap.html b/deps/npm/docs/output/commands/npm-shrinkwrap.html
index 99937f8f953..88c25fa7be9 100644
--- a/deps/npm/docs/output/commands/npm-shrinkwrap.html
+++ b/deps/npm/docs/output/commands/npm-shrinkwrap.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-shrinkwrap
- @11.4.2
+ @11.5.1
Lock down dependency versions for publication
diff --git a/deps/npm/docs/output/commands/npm-star.html b/deps/npm/docs/output/commands/npm-star.html
index 66acaab166f..15c1362721b 100644
--- a/deps/npm/docs/output/commands/npm-star.html
+++ b/deps/npm/docs/output/commands/npm-star.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-star
- @11.4.2
+ @11.5.1
Mark your favorite packages
diff --git a/deps/npm/docs/output/commands/npm-stars.html b/deps/npm/docs/output/commands/npm-stars.html
index 9c77d3489cc..d7fdd214579 100644
--- a/deps/npm/docs/output/commands/npm-stars.html
+++ b/deps/npm/docs/output/commands/npm-stars.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-stars
- @11.4.2
+ @11.5.1
View packages marked as favorites
diff --git a/deps/npm/docs/output/commands/npm-start.html b/deps/npm/docs/output/commands/npm-start.html
index 711a35b1e27..4c9be28e943 100644
--- a/deps/npm/docs/output/commands/npm-start.html
+++ b/deps/npm/docs/output/commands/npm-start.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-start
- @11.4.2
+ @11.5.1
Start a package
diff --git a/deps/npm/docs/output/commands/npm-stop.html b/deps/npm/docs/output/commands/npm-stop.html
index 7b5075fd586..4ee13d0edce 100644
--- a/deps/npm/docs/output/commands/npm-stop.html
+++ b/deps/npm/docs/output/commands/npm-stop.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-stop
- @11.4.2
+ @11.5.1
Stop a package
diff --git a/deps/npm/docs/output/commands/npm-team.html b/deps/npm/docs/output/commands/npm-team.html
index b018b6b7804..afb95a9c50a 100644
--- a/deps/npm/docs/output/commands/npm-team.html
+++ b/deps/npm/docs/output/commands/npm-team.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-team
- @11.4.2
+ @11.5.1
Manage organization teams and team memberships
diff --git a/deps/npm/docs/output/commands/npm-test.html b/deps/npm/docs/output/commands/npm-test.html
index a6be8820716..181c14e1011 100644
--- a/deps/npm/docs/output/commands/npm-test.html
+++ b/deps/npm/docs/output/commands/npm-test.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-test
- @11.4.2
+ @11.5.1
Test a package
diff --git a/deps/npm/docs/output/commands/npm-token.html b/deps/npm/docs/output/commands/npm-token.html
index 9170ac8969c..e493aba66e7 100644
--- a/deps/npm/docs/output/commands/npm-token.html
+++ b/deps/npm/docs/output/commands/npm-token.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-token
- @11.4.2
+ @11.5.1
Manage your authentication tokens
diff --git a/deps/npm/docs/output/commands/npm-undeprecate.html b/deps/npm/docs/output/commands/npm-undeprecate.html
index 9dc57535c28..bff4c3722d2 100644
--- a/deps/npm/docs/output/commands/npm-undeprecate.html
+++ b/deps/npm/docs/output/commands/npm-undeprecate.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-undeprecate
- @11.4.2
+ @11.5.1
Undeprecate a version of a package
diff --git a/deps/npm/docs/output/commands/npm-uninstall.html b/deps/npm/docs/output/commands/npm-uninstall.html
index b93b52dc737..1a6bdfc68a8 100644
--- a/deps/npm/docs/output/commands/npm-uninstall.html
+++ b/deps/npm/docs/output/commands/npm-uninstall.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-uninstall
- @11.4.2
+ @11.5.1
Remove a package
diff --git a/deps/npm/docs/output/commands/npm-unpublish.html b/deps/npm/docs/output/commands/npm-unpublish.html
index 0802fafdfe4..806f6ff9c1c 100644
--- a/deps/npm/docs/output/commands/npm-unpublish.html
+++ b/deps/npm/docs/output/commands/npm-unpublish.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-unpublish
- @11.4.2
+ @11.5.1
Remove a package from the registry
diff --git a/deps/npm/docs/output/commands/npm-unstar.html b/deps/npm/docs/output/commands/npm-unstar.html
index e85d91d050e..ed467c5e617 100644
--- a/deps/npm/docs/output/commands/npm-unstar.html
+++ b/deps/npm/docs/output/commands/npm-unstar.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-unstar
- @11.4.2
+ @11.5.1
Remove an item from your favorite packages
diff --git a/deps/npm/docs/output/commands/npm-update.html b/deps/npm/docs/output/commands/npm-update.html
index b4aed934bdb..44a28c7538a 100644
--- a/deps/npm/docs/output/commands/npm-update.html
+++ b/deps/npm/docs/output/commands/npm-update.html
@@ -141,16 +141,16 @@ npm command-line interface
-
+
npm-update
- @11.4.2
+ @11.5.1
Update packages
Synopsis
@@ -388,6 +388,19 @@ run any pre- or post-scripts.
default registry and all registries configured for scopes. See the
documentation for
npm audit
for details on what is
submitted.
+
before
+
+Default: null
+Type: null or Date
+
+
If passed to npm install
, will rebuild the npm tree such that only
+versions that were available on or before the given date are installed.
+If there are no versions available for the current set of dependencies, the
+command will error.
+
If the requested version is a dist-tag
and the given tag does not pass the
+--before
filter, the most recent version less than or equal to that tag
+will be used. For example, foo@latest
might install foo@1.2
even though
+latest
is 2.0
.
bin-links
Default: true
diff --git a/deps/npm/docs/output/commands/npm-version.html b/deps/npm/docs/output/commands/npm-version.html
index 8c99560bfa1..b521405869c 100644
--- a/deps/npm/docs/output/commands/npm-version.html
+++ b/deps/npm/docs/output/commands/npm-version.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-version
- @11.4.2
+ @11.5.1
Bump a package version
diff --git a/deps/npm/docs/output/commands/npm-view.html b/deps/npm/docs/output/commands/npm-view.html
index a6dfd363317..eec33cff83e 100644
--- a/deps/npm/docs/output/commands/npm-view.html
+++ b/deps/npm/docs/output/commands/npm-view.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-view
- @11.4.2
+ @11.5.1
View registry info
diff --git a/deps/npm/docs/output/commands/npm-whoami.html b/deps/npm/docs/output/commands/npm-whoami.html
index 752fb97d987..5612f622414 100644
--- a/deps/npm/docs/output/commands/npm-whoami.html
+++ b/deps/npm/docs/output/commands/npm-whoami.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-whoami
- @11.4.2
+ @11.5.1
Display npm username
diff --git a/deps/npm/docs/output/commands/npm.html b/deps/npm/docs/output/commands/npm.html
index d84a6a2e0d2..77763591853 100644
--- a/deps/npm/docs/output/commands/npm.html
+++ b/deps/npm/docs/output/commands/npm.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm
- @11.4.2
+ @11.5.1
javascript package manager
@@ -158,7 +158,7 @@ npm command-line interface
Note: This command is unaware of workspaces.
Version
-11.4.2
+11.5.1
Description
npm is the package manager for the Node JavaScript platform. It puts
modules in place so that node can find them, and manages dependency
diff --git a/deps/npm/docs/output/commands/npx.html b/deps/npm/docs/output/commands/npx.html
index 8074dd3e6fe..9d393a2b498 100644
--- a/deps/npm/docs/output/commands/npx.html
+++ b/deps/npm/docs/output/commands/npx.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npx
- @11.4.2
+ @11.5.1
Run a command from a local or remote npm package
diff --git a/deps/npm/docs/output/configuring-npm/folders.html b/deps/npm/docs/output/configuring-npm/folders.html
index 91a8e91fe0a..7619de3198a 100644
--- a/deps/npm/docs/output/configuring-npm/folders.html
+++ b/deps/npm/docs/output/configuring-npm/folders.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
folders
- @11.4.2
+ @11.5.1
Folder Structures Used by npm
diff --git a/deps/npm/docs/output/configuring-npm/install.html b/deps/npm/docs/output/configuring-npm/install.html
index f5405419403..ebeb2a6ba06 100644
--- a/deps/npm/docs/output/configuring-npm/install.html
+++ b/deps/npm/docs/output/configuring-npm/install.html
@@ -141,16 +141,16 @@ npm command-line interface
-
+
install
- @11.4.2
+ @11.5.1
Download and install node and npm
Description
@@ -190,8 +190,8 @@ installer to install both Node.js and npm on your system.
NodeSource installer . If
you use Linux, we recommend that you use a NodeSource installer.
-
OS X or Windows Node installers
-
If you're using OS X or Windows, use one of the installers from the
+
macOS or Windows Node installers
+
If you're using macOS or Windows, use one of the installers from the
Node.js download page . Be sure to
install the version labeled LTS . Other versions have not yet been
tested with npm.
@@ -205,10 +205,7 @@ installers:
page
Or see this page to
-install npm for Linux in the way many Linux developers prefer.
-
Less-common operating systems
-
For more information on installing Node.js on a variety of operating
-systems, see this page .
+install npm for Linux in the way many Linux developers prefer.
diff --git a/deps/npm/docs/output/configuring-npm/npm-global.html b/deps/npm/docs/output/configuring-npm/npm-global.html
index 91a8e91fe0a..7619de3198a 100644
--- a/deps/npm/docs/output/configuring-npm/npm-global.html
+++ b/deps/npm/docs/output/configuring-npm/npm-global.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
folders
- @11.4.2
+ @11.5.1
Folder Structures Used by npm
diff --git a/deps/npm/docs/output/configuring-npm/npm-json.html b/deps/npm/docs/output/configuring-npm/npm-json.html
index b3cf8b0d4db..899eddd3373 100644
--- a/deps/npm/docs/output/configuring-npm/npm-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-json.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
package.json
- @11.4.2
+ @11.5.1
Specifics of npm's package.json handling
diff --git a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
index 5fb433dc530..339b2865962 100644
--- a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npm-shrinkwrap.json
- @11.4.2
+ @11.5.1
A publishable lockfile
diff --git a/deps/npm/docs/output/configuring-npm/npmrc.html b/deps/npm/docs/output/configuring-npm/npmrc.html
index 4d179b5f29c..555546c0359 100644
--- a/deps/npm/docs/output/configuring-npm/npmrc.html
+++ b/deps/npm/docs/output/configuring-npm/npmrc.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
npmrc
- @11.4.2
+ @11.5.1
The npm config files
diff --git a/deps/npm/docs/output/configuring-npm/package-json.html b/deps/npm/docs/output/configuring-npm/package-json.html
index b3cf8b0d4db..899eddd3373 100644
--- a/deps/npm/docs/output/configuring-npm/package-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-json.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
package.json
- @11.4.2
+ @11.5.1
Specifics of npm's package.json handling
diff --git a/deps/npm/docs/output/configuring-npm/package-lock-json.html b/deps/npm/docs/output/configuring-npm/package-lock-json.html
index fd5f38e22b3..29cf287806c 100644
--- a/deps/npm/docs/output/configuring-npm/package-lock-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-lock-json.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
package-lock.json
- @11.4.2
+ @11.5.1
A manifestation of the manifest
diff --git a/deps/npm/docs/output/using-npm/config.html b/deps/npm/docs/output/using-npm/config.html
index 17e2e40b0e3..6fbf5de5120 100644
--- a/deps/npm/docs/output/using-npm/config.html
+++ b/deps/npm/docs/output/using-npm/config.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
config
- @11.4.2
+ @11.5.1
More than you probably want to know about npm configuration
@@ -321,9 +321,9 @@ config is given, this value will always be set to legacy
.
Type: null or Date
If passed to npm install
, will rebuild the npm tree such that only
-versions that were available on or before the --before
time get
-installed. If there's no versions available for the current set of direct
-dependencies, the command will error.
+versions that were available
on or before the given date are installed.
+If there are no versions available for the current set of dependencies, the
+command will error.
If the requested version is a dist-tag
and the given tag does not pass the
--before
filter, the most recent version less than or equal to that tag
will be used. For example, foo@latest
might install foo@1.2
even though
@@ -340,7 +340,7 @@ fact that some file systems don't support symlinks, even on ostensibly Unix
systems.
browser
-Default: OS X: "open"
, Windows: "start"
, Others: "xdg-open"
+Default: macOS: "open"
, Windows: "start"
, Others: "xdg-open"
Type: null, Boolean, or String
The browser that is called by npm commands to open websites.
@@ -1049,7 +1049,8 @@ forces non-global commands to run in the specified folder.
a semver. Like the
rc
in
1.2.0-rc.8
.
progress
-Default: true
unless running in a known CI system
+Default: true
when not in CI and both stderr and stdout are TTYs and not
+in a dumb terminal
Type: Boolean
When set to true
, npm will display a progress bar during time intensive
diff --git a/deps/npm/docs/output/using-npm/dependency-selectors.html b/deps/npm/docs/output/using-npm/dependency-selectors.html
index adb922989f6..82f000eec57 100644
--- a/deps/npm/docs/output/using-npm/dependency-selectors.html
+++ b/deps/npm/docs/output/using-npm/dependency-selectors.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
Dependency Selector Syntax & Querying
- @11.4.2
+ @11.5.1
Dependency Selector Syntax & Querying
diff --git a/deps/npm/docs/output/using-npm/developers.html b/deps/npm/docs/output/using-npm/developers.html
index 0ad78f0160b..815cdd863ef 100644
--- a/deps/npm/docs/output/using-npm/developers.html
+++ b/deps/npm/docs/output/using-npm/developers.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
developers
- @11.4.2
+ @11.5.1
Developer Guide
diff --git a/deps/npm/docs/output/using-npm/logging.html b/deps/npm/docs/output/using-npm/logging.html
index 2f0cae595d1..eab52de4c8f 100644
--- a/deps/npm/docs/output/using-npm/logging.html
+++ b/deps/npm/docs/output/using-npm/logging.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
Logging
- @11.4.2
+ @11.5.1
Why, What & How We Log
diff --git a/deps/npm/docs/output/using-npm/orgs.html b/deps/npm/docs/output/using-npm/orgs.html
index 812b91b91e2..40b46e2d71e 100644
--- a/deps/npm/docs/output/using-npm/orgs.html
+++ b/deps/npm/docs/output/using-npm/orgs.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
orgs
- @11.4.2
+ @11.5.1
Working with Teams & Orgs
diff --git a/deps/npm/docs/output/using-npm/package-spec.html b/deps/npm/docs/output/using-npm/package-spec.html
index 223b26ea57d..a223f97e98e 100644
--- a/deps/npm/docs/output/using-npm/package-spec.html
+++ b/deps/npm/docs/output/using-npm/package-spec.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
package-spec
- @11.4.2
+ @11.5.1
Package name specifier
diff --git a/deps/npm/docs/output/using-npm/registry.html b/deps/npm/docs/output/using-npm/registry.html
index 5a1237647a9..8b3b25394d6 100644
--- a/deps/npm/docs/output/using-npm/registry.html
+++ b/deps/npm/docs/output/using-npm/registry.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
registry
- @11.4.2
+ @11.5.1
The JavaScript Package Registry
diff --git a/deps/npm/docs/output/using-npm/removal.html b/deps/npm/docs/output/using-npm/removal.html
index ba60098e2c8..766d293de99 100644
--- a/deps/npm/docs/output/using-npm/removal.html
+++ b/deps/npm/docs/output/using-npm/removal.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
removal
- @11.4.2
+ @11.5.1
Cleaning the Slate
diff --git a/deps/npm/docs/output/using-npm/scope.html b/deps/npm/docs/output/using-npm/scope.html
index 30c8cf3710b..adcc7badd9c 100644
--- a/deps/npm/docs/output/using-npm/scope.html
+++ b/deps/npm/docs/output/using-npm/scope.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
scope
- @11.4.2
+ @11.5.1
Scoped packages
diff --git a/deps/npm/docs/output/using-npm/scripts.html b/deps/npm/docs/output/using-npm/scripts.html
index e79d1e9bb8f..61427ad5a18 100644
--- a/deps/npm/docs/output/using-npm/scripts.html
+++ b/deps/npm/docs/output/using-npm/scripts.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
scripts
- @11.4.2
+ @11.5.1
How npm handles the "scripts" field
@@ -157,7 +157,7 @@ npm command-line interface
The "scripts"
property of your package.json
file supports a number
of built-in scripts and their preset life cycle events as well as
arbitrary scripts. These all can be executed by running
-npm run <stage>
or npm run <stage>
for short. Pre and post
+npm run <stage>
. Pre and post
commands with matching names will be run for those as well (e.g. premyscript
,
myscript
, postmyscript
). Scripts from dependencies can be run with
npm explore <pkg> -- npm run <stage>
.
diff --git a/deps/npm/docs/output/using-npm/workspaces.html b/deps/npm/docs/output/using-npm/workspaces.html
index e5baa273514..7c3f6c391c8 100644
--- a/deps/npm/docs/output/using-npm/workspaces.html
+++ b/deps/npm/docs/output/using-npm/workspaces.html
@@ -141,9 +141,9 @@ npm command-line interface
-
+
workspaces
- @11.4.2
+ @11.5.1
Working with workspaces
diff --git a/deps/npm/lib/cli/exit-handler.js b/deps/npm/lib/cli/exit-handler.js
index e76b08c80a6..efb09138aec 100644
--- a/deps/npm/lib/cli/exit-handler.js
+++ b/deps/npm/lib/cli/exit-handler.js
@@ -43,6 +43,16 @@ class ExitHandler {
registerUncaughtHandlers () {
this.#process.on('uncaughtException', this.#handleExit)
this.#process.on('unhandledRejection', this.#handleExit)
+
+ // Handle signals that might bypass normal exit flow
+ // These signals can cause the process to exit without calling the exit handler
+ const signalsToHandle = ['SIGTERM', 'SIGINT', 'SIGHUP']
+ for (const signal of signalsToHandle) {
+ this.#process.on(signal, () => {
+ // Call the exit handler to ensure proper cleanup
+ this.#handleExit(new Error(`Process received ${signal}`))
+ })
+ }
}
exit (err) {
@@ -57,6 +67,17 @@ class ExitHandler {
this.#process.off('exit', this.#handleProcesExitAndReset)
this.#process.off('uncaughtException', this.#handleExit)
this.#process.off('unhandledRejection', this.#handleExit)
+
+ const signalsToCleanup = ['SIGTERM', 'SIGINT', 'SIGHUP']
+ for (const signal of signalsToCleanup) {
+ try {
+ this.#process.off(signal, this.#handleExit)
+ } catch (err) {
+ // Ignore errors during cleanup - this is defensive programming for edge cases
+ // where the process object might be in an unexpected state during shutdown
+ }
+ }
+
if (this.#loaded) {
this.#npm.unload()
}
diff --git a/deps/npm/lib/commands/install.js b/deps/npm/lib/commands/install.js
index 2b465030b11..7be21582610 100644
--- a/deps/npm/lib/commands/install.js
+++ b/deps/npm/lib/commands/install.js
@@ -29,6 +29,7 @@ class Install extends ArboristWorkspaceCmd {
'foreground-scripts',
'ignore-scripts',
'audit',
+ 'before',
'bin-links',
'fund',
'dry-run',
diff --git a/deps/npm/lib/commands/outdated.js b/deps/npm/lib/commands/outdated.js
index 4e0198a95d6..5421b1ddaab 100644
--- a/deps/npm/lib/commands/outdated.js
+++ b/deps/npm/lib/commands/outdated.js
@@ -30,6 +30,7 @@ class Outdated extends ArboristWorkspaceCmd {
'parseable',
'global',
'workspace',
+ 'before',
]
#tree
diff --git a/deps/npm/lib/commands/publish.js b/deps/npm/lib/commands/publish.js
index cc15087f0b3..6586e652c7b 100644
--- a/deps/npm/lib/commands/publish.js
+++ b/deps/npm/lib/commands/publish.js
@@ -16,6 +16,7 @@ const { getContents, logTar } = require('../utils/tar.js')
const { flatten } = require('@npmcli/config/lib/definitions')
const pkgJson = require('@npmcli/package-json')
const BaseCommand = require('../base-cmd.js')
+const { oidc } = require('../../lib/utils/oidc.js')
class Publish extends BaseCommand {
static description = 'Publish a package'
@@ -136,6 +137,9 @@ class Publish extends BaseCommand {
npa(`${manifest.name}@${defaultTag}`)
const registry = npmFetch.pickRegistry(resolved, opts)
+
+ await oidc({ packageName: manifest.name, registry, opts, config: this.npm.config })
+
const creds = this.npm.config.getCredentialsByURI(registry)
const noCreds = !(creds.token || creds.username || creds.certfile && creds.keyfile)
const outputRegistry = replaceInfo(registry)
diff --git a/deps/npm/lib/commands/update.js b/deps/npm/lib/commands/update.js
index 235a9a41177..0d2fc324d92 100644
--- a/deps/npm/lib/commands/update.js
+++ b/deps/npm/lib/commands/update.js
@@ -20,6 +20,7 @@ class Update extends ArboristWorkspaceCmd {
'foreground-scripts',
'ignore-scripts',
'audit',
+ 'before',
'bin-links',
'fund',
'dry-run',
diff --git a/deps/npm/lib/commands/view.js b/deps/npm/lib/commands/view.js
index eb6f0fcab8e..3d62c2e9083 100644
--- a/deps/npm/lib/commands/view.js
+++ b/deps/npm/lib/commands/view.js
@@ -448,10 +448,12 @@ function cleanup (data) {
}
const keys = Object.keys(data)
+
if (keys.length <= 3 && data.name && (
(keys.length === 1) ||
(keys.length === 3 && data.email && data.url) ||
- (keys.length === 2 && (data.email || data.url))
+ (keys.length === 2 && (data.email || data.url)) ||
+ data.trustedPublisher
)) {
data = unparsePerson(data)
}
diff --git a/deps/npm/lib/utils/error-message.js b/deps/npm/lib/utils/error-message.js
index 4b5582ac8e1..4fc14c92c17 100644
--- a/deps/npm/lib/utils/error-message.js
+++ b/deps/npm/lib/utils/error-message.js
@@ -165,7 +165,11 @@ const errorMessage = (er, npm) => {
const pkg = er.pkgid.replace(/(?!^)@.*$/, '')
detail.push(['404', ''])
- detail.push(['404', '', `'${replaceInfo(er.pkgid)}' is not in this registry.`])
+ detail.push([
+ '404',
+ '',
+ `The requested resource '${replaceInfo(er.pkgid)}' could not be found or you do not have permission to access it.`,
+ ])
const nameValidator = require('validate-npm-package-name')
const valResult = nameValidator(pkg)
diff --git a/deps/npm/lib/utils/oidc.js b/deps/npm/lib/utils/oidc.js
new file mode 100644
index 00000000000..859d5962434
--- /dev/null
+++ b/deps/npm/lib/utils/oidc.js
@@ -0,0 +1,181 @@
+const { log } = require('proc-log')
+const npmFetch = require('npm-registry-fetch')
+const ciInfo = require('ci-info')
+const fetch = require('make-fetch-happen')
+const npa = require('npm-package-arg')
+
+/**
+ * Handles OpenID Connect (OIDC) token retrieval and exchange for CI environments.
+ *
+ * This function is designed to work in Continuous Integration (CI) environments such as GitHub Actions
+ * and GitLab. It retrieves an OIDC token from the CI environment, exchanges it for an npm token, and
+ * sets the token in the provided configuration for authentication with the npm registry.
+ *
+ * This function is intended to never throw, as it mutates the state of the `opts` and `config` objects on success.
+ * OIDC is always an optional feature, and the function should not throw if OIDC is not configured by the registry.
+ *
+ * @see https://github.com/watson/ci-info for CI environment detection.
+ * @see https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect for GitHub Actions OIDC.
+ */
+async function oidc ({ packageName, registry, opts, config }) {
+ /*
+ * This code should never run when people try to publish locally on their machines.
+ * It is designed to execute only in Continuous Integration (CI) environments.
+ */
+
+ try {
+ if (!(
+ /** @see https://github.com/watson/ci-info/blob/v4.2.0/vendors.json#L152 */
+ ciInfo.GITHUB_ACTIONS ||
+ /** @see https://github.com/watson/ci-info/blob/v4.2.0/vendors.json#L161C13-L161C22 */
+ ciInfo.GITLAB
+ )) {
+ return undefined
+ }
+
+ /**
+ * Check if the environment variable `NPM_ID_TOKEN` is set.
+ * In GitLab CI, the ID token is provided via an environment variable,
+ * with `NPM_ID_TOKEN` serving as a predefined default. For consistency,
+ * all supported CI environments are expected to support this variable.
+ * In contrast, GitHub Actions uses a request-based approach to retrieve the ID token.
+ * The presence of this token within GitHub Actions will override the request-based approach.
+ * This variable follows the prefix/suffix convention from sigstore (e.g., `SIGSTORE_ID_TOKEN`).
+ * @see https://docs.sigstore.dev/cosign/signing/overview/
+ */
+ let idToken = process.env.NPM_ID_TOKEN
+
+ if (!idToken && ciInfo.GITHUB_ACTIONS) {
+ /**
+ * GitHub Actions provides these environment variables:
+ * - `ACTIONS_ID_TOKEN_REQUEST_URL`: The URL to request the ID token.
+ * - `ACTIONS_ID_TOKEN_REQUEST_TOKEN`: The token to authenticate the request.
+ * Only when a workflow has the following permissions:
+ * ```
+ * permissions:
+ * id-token: write
+ * ```
+ * @see https://docs.github.com/en/actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#adding-permissions-settings
+ */
+ if (!(
+ process.env.ACTIONS_ID_TOKEN_REQUEST_URL &&
+ process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN
+ )) {
+ log.silly('oidc', 'Skipped because incorrect permissions for id-token within GitHub workflow')
+ return undefined
+ }
+
+ /**
+ * The specification for an audience is `npm:registry.npmjs.org`,
+ * where "registry.npmjs.org" can be any supported registry.
+ */
+ const audience = `npm:${new URL(registry).hostname}`
+ const url = new URL(process.env.ACTIONS_ID_TOKEN_REQUEST_URL)
+ url.searchParams.append('audience', audience)
+ const startTime = Date.now()
+ const response = await fetch(url.href, {
+ retry: opts.retry,
+ headers: {
+ Accept: 'application/json',
+ Authorization: `Bearer ${process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN}`,
+ },
+ })
+
+ const elapsedTime = Date.now() - startTime
+
+ log.http(
+ 'fetch',
+ `GET ${url.href} ${response.status} ${elapsedTime}ms`
+ )
+
+ const json = await response.json()
+
+ if (!response.ok) {
+ log.verbose('oidc', `Failed to fetch id_token from GitHub: received an invalid response`)
+ return undefined
+ }
+
+ if (!json.value) {
+ log.verbose('oidc', `Failed to fetch id_token from GitHub: missing value`)
+ return undefined
+ }
+
+ idToken = json.value
+ }
+
+ if (!idToken) {
+ log.silly('oidc', 'Skipped because no id_token available')
+ return undefined
+ }
+
+ // this checks if the user configured provenance or it's the default unset value
+ const isDefaultProvenance = config.isDefault('provenance')
+ const provenanceIntent = config.get('provenance')
+ let enableProvenance = false
+
+ // if provenance is the default value or the user explicitly set it
+ if (isDefaultProvenance || provenanceIntent) {
+ const [headerB64, payloadB64] = idToken.split('.')
+ if (headerB64 && payloadB64) {
+ const payloadJson = Buffer.from(payloadB64, 'base64').toString('utf8')
+ try {
+ const payload = JSON.parse(payloadJson)
+ if (ciInfo.GITHUB_ACTIONS && payload.repository_visibility === 'public') {
+ enableProvenance = true
+ }
+ // only set provenance for gitlab if SIGSTORE_ID_TOKEN is available
+ if (ciInfo.GITLAB && payload.project_visibility === 'public' && process.env.SIGSTORE_ID_TOKEN) {
+ enableProvenance = true
+ }
+ } catch (e) {
+ // Failed to parse idToken payload as JSON
+ }
+ }
+ }
+
+ const parsedRegistry = new URL(registry)
+ const regKey = `//${parsedRegistry.host}${parsedRegistry.pathname}`
+ const authTokenKey = `${regKey}:_authToken`
+
+ const escapedPackageName = npa(packageName).escapedName
+ let response
+ try {
+ response = await npmFetch.json(new URL(`/-/npm/v1/oidc/token/exchange/package/${escapedPackageName}`, registry), {
+ ...opts,
+ [authTokenKey]: idToken, // Use the idToken as the auth token for the request
+ method: 'POST',
+ })
+ } catch (error) {
+ log.verbose('oidc', `Failed token exchange request with body message: ${error?.body?.message || 'Unknown error'}`)
+ return undefined
+ }
+
+ if (!response?.token) {
+ log.verbose('oidc', 'Failed because token exchange was missing the token in the response body')
+ return undefined
+ }
+
+ if (enableProvenance) {
+ // Repository is public, setting provenance
+ opts.provenance = true
+ config.set('provenance', true, 'user')
+ }
+
+ /*
+ * The "opts" object is a clone of npm.flatOptions and is passed through the `publish` command,
+ * eventually reaching `otplease`. To ensure the token is accessible during the publishing process,
+ * it must be directly attached to the `opts` object.
+ * Additionally, the token is required by the "live" configuration or getters within `config`.
+ */
+ opts[authTokenKey] = response.token
+ config.set(authTokenKey, response.token, 'user')
+ log.verbose('oidc', `Successfully retrieved and set token`)
+ } catch (error) {
+ log.verbose('oidc', `Failure with message: ${error?.message || 'Unknown error'}`)
+ }
+ return undefined
+}
+
+module.exports = {
+ oidc,
+}
diff --git a/deps/npm/man/man1/npm-access.1 b/deps/npm/man/man1/npm-access.1
index f35558fea71..cc3fe580a3c 100644
--- a/deps/npm/man/man1/npm-access.1
+++ b/deps/npm/man/man1/npm-access.1
@@ -1,4 +1,4 @@
-.TH "NPM-ACCESS" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-ACCESS" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-access\fR - Set access level on published packages
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-adduser.1 b/deps/npm/man/man1/npm-adduser.1
index 613d0500c08..a9ffc99427c 100644
--- a/deps/npm/man/man1/npm-adduser.1
+++ b/deps/npm/man/man1/npm-adduser.1
@@ -1,4 +1,4 @@
-.TH "NPM-ADDUSER" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-ADDUSER" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-adduser\fR - Add a registry user account
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-audit.1 b/deps/npm/man/man1/npm-audit.1
index 8e2bfc354ea..ee55dd10253 100644
--- a/deps/npm/man/man1/npm-audit.1
+++ b/deps/npm/man/man1/npm-audit.1
@@ -1,4 +1,4 @@
-.TH "NPM-AUDIT" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-AUDIT" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-audit\fR - Run a security audit
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-bugs.1 b/deps/npm/man/man1/npm-bugs.1
index 5ae3f944769..7999999069e 100644
--- a/deps/npm/man/man1/npm-bugs.1
+++ b/deps/npm/man/man1/npm-bugs.1
@@ -1,4 +1,4 @@
-.TH "NPM-BUGS" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-BUGS" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-bugs\fR - Report bugs for a package in a web browser
.SS "Synopsis"
@@ -17,7 +17,7 @@ This command tries to guess at the likely location of a package's bug tracker UR
.SS "\fBbrowser\fR"
.RS 0
.IP \(bu 4
-Default: OS X: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
+Default: macOS: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
.IP \(bu 4
Type: null, Boolean, or String
.RE 0
diff --git a/deps/npm/man/man1/npm-cache.1 b/deps/npm/man/man1/npm-cache.1
index 698d8c1ac0e..65ffbed6067 100644
--- a/deps/npm/man/man1/npm-cache.1
+++ b/deps/npm/man/man1/npm-cache.1
@@ -1,4 +1,4 @@
-.TH "NPM-CACHE" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-CACHE" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-cache\fR - Manipulates packages cache
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ci.1 b/deps/npm/man/man1/npm-ci.1
index e8a9084affe..d2aca2fb64b 100644
--- a/deps/npm/man/man1/npm-ci.1
+++ b/deps/npm/man/man1/npm-ci.1
@@ -1,4 +1,4 @@
-.TH "NPM-CI" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-CI" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-ci\fR - Clean install a project
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-completion.1 b/deps/npm/man/man1/npm-completion.1
index 625bee533da..d58c21cf2d0 100644
--- a/deps/npm/man/man1/npm-completion.1
+++ b/deps/npm/man/man1/npm-completion.1
@@ -1,4 +1,4 @@
-.TH "NPM-COMPLETION" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-COMPLETION" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-completion\fR - Tab Completion for npm
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-config.1 b/deps/npm/man/man1/npm-config.1
index fad8decf424..67a88bef064 100644
--- a/deps/npm/man/man1/npm-config.1
+++ b/deps/npm/man/man1/npm-config.1
@@ -1,4 +1,4 @@
-.TH "NPM-CONFIG" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-CONFIG" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-config\fR - Manage the npm configuration files
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dedupe.1 b/deps/npm/man/man1/npm-dedupe.1
index 212153eea4a..f1b26e49581 100644
--- a/deps/npm/man/man1/npm-dedupe.1
+++ b/deps/npm/man/man1/npm-dedupe.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEDUPE" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-DEDUPE" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-dedupe\fR - Reduce duplication in the package tree
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deprecate.1 b/deps/npm/man/man1/npm-deprecate.1
index cb8f739b63c..0ce359a2408 100644
--- a/deps/npm/man/man1/npm-deprecate.1
+++ b/deps/npm/man/man1/npm-deprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEPRECATE" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-DEPRECATE" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-deprecate\fR - Deprecate a version of a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-diff.1 b/deps/npm/man/man1/npm-diff.1
index 426b66e65de..3b3a6df1fe0 100644
--- a/deps/npm/man/man1/npm-diff.1
+++ b/deps/npm/man/man1/npm-diff.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIFF" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-DIFF" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-diff\fR - The registry diff command
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dist-tag.1 b/deps/npm/man/man1/npm-dist-tag.1
index a8dee5bff75..73a9dc901d7 100644
--- a/deps/npm/man/man1/npm-dist-tag.1
+++ b/deps/npm/man/man1/npm-dist-tag.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIST-TAG" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-DIST-TAG" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-dist-tag\fR - Modify package distribution tags
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-docs.1 b/deps/npm/man/man1/npm-docs.1
index 642d37e6cac..d4cf707da81 100644
--- a/deps/npm/man/man1/npm-docs.1
+++ b/deps/npm/man/man1/npm-docs.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCS" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-DOCS" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-docs\fR - Open documentation for a package in a web browser
.SS "Synopsis"
@@ -17,7 +17,7 @@ This command tries to guess at the likely location of a package's documentation
.SS "\fBbrowser\fR"
.RS 0
.IP \(bu 4
-Default: OS X: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
+Default: macOS: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
.IP \(bu 4
Type: null, Boolean, or String
.RE 0
diff --git a/deps/npm/man/man1/npm-doctor.1 b/deps/npm/man/man1/npm-doctor.1
index ead145c4821..f850d1783a3 100644
--- a/deps/npm/man/man1/npm-doctor.1
+++ b/deps/npm/man/man1/npm-doctor.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCTOR" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-DOCTOR" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-doctor\fR - Check the health of your npm environment
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-edit.1 b/deps/npm/man/man1/npm-edit.1
index a809c088483..eaf818feab0 100644
--- a/deps/npm/man/man1/npm-edit.1
+++ b/deps/npm/man/man1/npm-edit.1
@@ -1,4 +1,4 @@
-.TH "NPM-EDIT" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-EDIT" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-edit\fR - Edit an installed package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-exec.1 b/deps/npm/man/man1/npm-exec.1
index 6294983fec1..72a408edeba 100644
--- a/deps/npm/man/man1/npm-exec.1
+++ b/deps/npm/man/man1/npm-exec.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXEC" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-EXEC" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-exec\fR - Run a command from a local or remote npm package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explain.1 b/deps/npm/man/man1/npm-explain.1
index b61106e7c5e..05eca8209d0 100644
--- a/deps/npm/man/man1/npm-explain.1
+++ b/deps/npm/man/man1/npm-explain.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLAIN" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-EXPLAIN" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-explain\fR - Explain installed packages
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explore.1 b/deps/npm/man/man1/npm-explore.1
index 3f70212d92e..2579b707ecb 100644
--- a/deps/npm/man/man1/npm-explore.1
+++ b/deps/npm/man/man1/npm-explore.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLORE" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-EXPLORE" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-explore\fR - Browse an installed package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-find-dupes.1 b/deps/npm/man/man1/npm-find-dupes.1
index 00a15e7f1b5..992e6ba3c1e 100644
--- a/deps/npm/man/man1/npm-find-dupes.1
+++ b/deps/npm/man/man1/npm-find-dupes.1
@@ -1,4 +1,4 @@
-.TH "NPM-FIND-DUPES" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-FIND-DUPES" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-find-dupes\fR - Find duplication in the package tree
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-fund.1 b/deps/npm/man/man1/npm-fund.1
index 42946336f91..7145eb2771b 100644
--- a/deps/npm/man/man1/npm-fund.1
+++ b/deps/npm/man/man1/npm-fund.1
@@ -1,4 +1,4 @@
-.TH "NPM-FUND" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-FUND" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-fund\fR - Retrieve funding information
.SS "Synopsis"
@@ -69,7 +69,7 @@ Not supported by all npm commands.
.SS "\fBbrowser\fR"
.RS 0
.IP \(bu 4
-Default: OS X: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
+Default: macOS: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
.IP \(bu 4
Type: null, Boolean, or String
.RE 0
diff --git a/deps/npm/man/man1/npm-help-search.1 b/deps/npm/man/man1/npm-help-search.1
index 1953ed1da15..db61cc6bc1e 100644
--- a/deps/npm/man/man1/npm-help-search.1
+++ b/deps/npm/man/man1/npm-help-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP-SEARCH" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-HELP-SEARCH" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-help-search\fR - Search npm help documentation
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help.1 b/deps/npm/man/man1/npm-help.1
index 651bb5a8da6..cd995949f9e 100644
--- a/deps/npm/man/man1/npm-help.1
+++ b/deps/npm/man/man1/npm-help.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-HELP" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-help\fR - Get help on npm
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-init.1 b/deps/npm/man/man1/npm-init.1
index 80a926267c1..6df4f462224 100644
--- a/deps/npm/man/man1/npm-init.1
+++ b/deps/npm/man/man1/npm-init.1
@@ -1,4 +1,4 @@
-.TH "NPM-INIT" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-INIT" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-init\fR - Create a package.json file
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-ci-test.1 b/deps/npm/man/man1/npm-install-ci-test.1
index afe441dfee0..db2ff4fded9 100644
--- a/deps/npm/man/man1/npm-install-ci-test.1
+++ b/deps/npm/man/man1/npm-install-ci-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-CI-TEST" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-INSTALL-CI-TEST" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-install-ci-test\fR - Install a project with a clean slate and run tests
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-test.1 b/deps/npm/man/man1/npm-install-test.1
index c8dbe734bb8..ae5d7e425ac 100644
--- a/deps/npm/man/man1/npm-install-test.1
+++ b/deps/npm/man/man1/npm-install-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-TEST" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-INSTALL-TEST" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-install-test\fR - Install package(s) and run tests
.SS "Synopsis"
@@ -203,6 +203,18 @@ Type: Boolean
.P
When "true" submit audit reports alongside the current npm command to the default registry and all registries configured for scopes. See the documentation for npm help audit for details on what is submitted.
+.SS "\fBbefore\fR"
+.RS 0
+.IP \(bu 4
+Default: null
+.IP \(bu 4
+Type: null or Date
+.RE 0
+
+.P
+If passed to \fBnpm install\fR, will rebuild the npm tree such that only versions that were available \fBon or before\fR the given date are installed. If there are no versions available for the current set of dependencies, the command will error.
+.P
+If the requested version is a \fBdist-tag\fR and the given tag does not pass the \fB--before\fR filter, the most recent version less than or equal to that tag will be used. For example, \fBfoo@latest\fR might install \fBfoo@1.2\fR even though \fBlatest\fR is \fB2.0\fR.
.SS "\fBbin-links\fR"
.RS 0
.IP \(bu 4
diff --git a/deps/npm/man/man1/npm-install.1 b/deps/npm/man/man1/npm-install.1
index 6299fcf93dc..f21a7146ba0 100644
--- a/deps/npm/man/man1/npm-install.1
+++ b/deps/npm/man/man1/npm-install.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-INSTALL" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-install\fR - Install a package
.SS "Synopsis"
@@ -565,6 +565,18 @@ Type: Boolean
.P
When "true" submit audit reports alongside the current npm command to the default registry and all registries configured for scopes. See the documentation for npm help audit for details on what is submitted.
+.SS "\fBbefore\fR"
+.RS 0
+.IP \(bu 4
+Default: null
+.IP \(bu 4
+Type: null or Date
+.RE 0
+
+.P
+If passed to \fBnpm install\fR, will rebuild the npm tree such that only versions that were available \fBon or before\fR the given date are installed. If there are no versions available for the current set of dependencies, the command will error.
+.P
+If the requested version is a \fBdist-tag\fR and the given tag does not pass the \fB--before\fR filter, the most recent version less than or equal to that tag will be used. For example, \fBfoo@latest\fR might install \fBfoo@1.2\fR even though \fBlatest\fR is \fB2.0\fR.
.SS "\fBbin-links\fR"
.RS 0
.IP \(bu 4
diff --git a/deps/npm/man/man1/npm-link.1 b/deps/npm/man/man1/npm-link.1
index fac4e68ce41..328ab37d283 100644
--- a/deps/npm/man/man1/npm-link.1
+++ b/deps/npm/man/man1/npm-link.1
@@ -1,4 +1,4 @@
-.TH "NPM-LINK" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-LINK" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-link\fR - Symlink a package folder
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-login.1 b/deps/npm/man/man1/npm-login.1
index 86101d4bf51..fdf7dc536a5 100644
--- a/deps/npm/man/man1/npm-login.1
+++ b/deps/npm/man/man1/npm-login.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGIN" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-LOGIN" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-login\fR - Login to a registry user account
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-logout.1 b/deps/npm/man/man1/npm-logout.1
index 28ad2a71ad0..1fda83a77a0 100644
--- a/deps/npm/man/man1/npm-logout.1
+++ b/deps/npm/man/man1/npm-logout.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGOUT" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-LOGOUT" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-logout\fR - Log out of the registry
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ls.1 b/deps/npm/man/man1/npm-ls.1
index 354f8ab8d50..f917683046d 100644
--- a/deps/npm/man/man1/npm-ls.1
+++ b/deps/npm/man/man1/npm-ls.1
@@ -1,4 +1,4 @@
-.TH "NPM-LS" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-LS" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-ls\fR - List installed packages
.SS "Synopsis"
@@ -20,7 +20,7 @@ Positional arguments are \fBname@version-range\fR identifiers, which will limit
.P
.RS 2
.nf
-npm@11.4.2 /path/to/npm
+npm@11.5.1 /path/to/npm
└─┬ init-package-json@0.0.4
└── promzard@0.1.5
.fi
diff --git a/deps/npm/man/man1/npm-org.1 b/deps/npm/man/man1/npm-org.1
index 8e2346151fe..47eccc70240 100644
--- a/deps/npm/man/man1/npm-org.1
+++ b/deps/npm/man/man1/npm-org.1
@@ -1,4 +1,4 @@
-.TH "NPM-ORG" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-ORG" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-org\fR - Manage orgs
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-outdated.1 b/deps/npm/man/man1/npm-outdated.1
index f6bcf8f5b42..44109de6f34 100644
--- a/deps/npm/man/man1/npm-outdated.1
+++ b/deps/npm/man/man1/npm-outdated.1
@@ -1,4 +1,4 @@
-.TH "NPM-OUTDATED" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-OUTDATED" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-outdated\fR - Check for outdated packages
.SS "Synopsis"
@@ -167,6 +167,18 @@ Path to a parent workspace directory (will result in selecting all workspaces wi
When set for the \fBnpm init\fR command, this may be set to the folder of a workspace which does not yet exist, to create the folder and set it up as a brand new workspace within the project.
.P
This value is not exported to the environment for child processes.
+.SS "\fBbefore\fR"
+.RS 0
+.IP \(bu 4
+Default: null
+.IP \(bu 4
+Type: null or Date
+.RE 0
+
+.P
+If passed to \fBnpm install\fR, will rebuild the npm tree such that only versions that were available \fBon or before\fR the given date are installed. If there are no versions available for the current set of dependencies, the command will error.
+.P
+If the requested version is a \fBdist-tag\fR and the given tag does not pass the \fB--before\fR filter, the most recent version less than or equal to that tag will be used. For example, \fBfoo@latest\fR might install \fBfoo@1.2\fR even though \fBlatest\fR is \fB2.0\fR.
.SS "See Also"
.RS 0
.IP \(bu 4
diff --git a/deps/npm/man/man1/npm-owner.1 b/deps/npm/man/man1/npm-owner.1
index f99a4697545..81ef6cf66d9 100644
--- a/deps/npm/man/man1/npm-owner.1
+++ b/deps/npm/man/man1/npm-owner.1
@@ -1,4 +1,4 @@
-.TH "NPM-OWNER" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-OWNER" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-owner\fR - Manage package owners
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pack.1 b/deps/npm/man/man1/npm-pack.1
index 1783b0246c2..8709e59b7d1 100644
--- a/deps/npm/man/man1/npm-pack.1
+++ b/deps/npm/man/man1/npm-pack.1
@@ -1,4 +1,4 @@
-.TH "NPM-PACK" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-PACK" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-pack\fR - Create a tarball from a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ping.1 b/deps/npm/man/man1/npm-ping.1
index d70510141b7..d78ca556794 100644
--- a/deps/npm/man/man1/npm-ping.1
+++ b/deps/npm/man/man1/npm-ping.1
@@ -1,4 +1,4 @@
-.TH "NPM-PING" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-PING" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-ping\fR - Ping npm registry
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pkg.1 b/deps/npm/man/man1/npm-pkg.1
index 1dedbe37064..58ded5febd5 100644
--- a/deps/npm/man/man1/npm-pkg.1
+++ b/deps/npm/man/man1/npm-pkg.1
@@ -1,4 +1,4 @@
-.TH "NPM-PKG" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-PKG" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-pkg\fR - Manages your package.json
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prefix.1 b/deps/npm/man/man1/npm-prefix.1
index 88cb7e87aa8..7cd525b7618 100644
--- a/deps/npm/man/man1/npm-prefix.1
+++ b/deps/npm/man/man1/npm-prefix.1
@@ -1,4 +1,4 @@
-.TH "NPM-PREFIX" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-PREFIX" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-prefix\fR - Display prefix
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-profile.1 b/deps/npm/man/man1/npm-profile.1
index bd48bdec9ac..e79de330b16 100644
--- a/deps/npm/man/man1/npm-profile.1
+++ b/deps/npm/man/man1/npm-profile.1
@@ -1,4 +1,4 @@
-.TH "NPM-PROFILE" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-PROFILE" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-profile\fR - Change settings on your registry profile
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prune.1 b/deps/npm/man/man1/npm-prune.1
index 144b7e45ab3..9c86cc4c675 100644
--- a/deps/npm/man/man1/npm-prune.1
+++ b/deps/npm/man/man1/npm-prune.1
@@ -1,4 +1,4 @@
-.TH "NPM-PRUNE" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-PRUNE" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-prune\fR - Remove extraneous packages
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-publish.1 b/deps/npm/man/man1/npm-publish.1
index 43e63bb3f97..2b4323e35f0 100644
--- a/deps/npm/man/man1/npm-publish.1
+++ b/deps/npm/man/man1/npm-publish.1
@@ -1,4 +1,4 @@
-.TH "NPM-PUBLISH" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-PUBLISH" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-publish\fR - Publish a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-query.1 b/deps/npm/man/man1/npm-query.1
index ffe41e3f0cc..e0403860218 100644
--- a/deps/npm/man/man1/npm-query.1
+++ b/deps/npm/man/man1/npm-query.1
@@ -1,4 +1,4 @@
-.TH "NPM-QUERY" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-QUERY" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-query\fR - Dependency selector query
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-rebuild.1 b/deps/npm/man/man1/npm-rebuild.1
index 8d8d7c03200..31d59b66ab3 100644
--- a/deps/npm/man/man1/npm-rebuild.1
+++ b/deps/npm/man/man1/npm-rebuild.1
@@ -1,4 +1,4 @@
-.TH "NPM-REBUILD" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-REBUILD" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-rebuild\fR - Rebuild a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-repo.1 b/deps/npm/man/man1/npm-repo.1
index 1aa47f8cc4e..d2276b2038e 100644
--- a/deps/npm/man/man1/npm-repo.1
+++ b/deps/npm/man/man1/npm-repo.1
@@ -1,4 +1,4 @@
-.TH "NPM-REPO" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-REPO" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-repo\fR - Open package repository page in the browser
.SS "Synopsis"
@@ -15,7 +15,7 @@ This command tries to guess at the likely location of a package's repository URL
.SS "\fBbrowser\fR"
.RS 0
.IP \(bu 4
-Default: OS X: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
+Default: macOS: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
.IP \(bu 4
Type: null, Boolean, or String
.RE 0
diff --git a/deps/npm/man/man1/npm-restart.1 b/deps/npm/man/man1/npm-restart.1
index 359da936e50..c783c1efcd8 100644
--- a/deps/npm/man/man1/npm-restart.1
+++ b/deps/npm/man/man1/npm-restart.1
@@ -1,4 +1,4 @@
-.TH "NPM-RESTART" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-RESTART" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-restart\fR - Restart a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-root.1 b/deps/npm/man/man1/npm-root.1
index 42a79822391..870f1a3ac87 100644
--- a/deps/npm/man/man1/npm-root.1
+++ b/deps/npm/man/man1/npm-root.1
@@ -1,4 +1,4 @@
-.TH "NPM-ROOT" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-ROOT" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-root\fR - Display npm root
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-run.1 b/deps/npm/man/man1/npm-run.1
index bd51ce58af6..20a2d5396de 100644
--- a/deps/npm/man/man1/npm-run.1
+++ b/deps/npm/man/man1/npm-run.1
@@ -1,4 +1,4 @@
-.TH "NPM-RUN" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-RUN" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-run\fR - Run arbitrary package scripts
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-sbom.1 b/deps/npm/man/man1/npm-sbom.1
index 02133d34713..b78f930ef67 100644
--- a/deps/npm/man/man1/npm-sbom.1
+++ b/deps/npm/man/man1/npm-sbom.1
@@ -1,4 +1,4 @@
-.TH "NPM-SBOM" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-SBOM" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-sbom\fR - Generate a Software Bill of Materials (SBOM)
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-search.1 b/deps/npm/man/man1/npm-search.1
index 01f75efff06..71e1eb03da6 100644
--- a/deps/npm/man/man1/npm-search.1
+++ b/deps/npm/man/man1/npm-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-SEARCH" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-SEARCH" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-search\fR - Search for packages
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-shrinkwrap.1 b/deps/npm/man/man1/npm-shrinkwrap.1
index 077686855d4..c3db5d6b2b4 100644
--- a/deps/npm/man/man1/npm-shrinkwrap.1
+++ b/deps/npm/man/man1/npm-shrinkwrap.1
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-SHRINKWRAP" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-shrinkwrap\fR - Lock down dependency versions for publication
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-star.1 b/deps/npm/man/man1/npm-star.1
index d2f4f0bc8a9..039a9d77aee 100644
--- a/deps/npm/man/man1/npm-star.1
+++ b/deps/npm/man/man1/npm-star.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAR" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-STAR" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-star\fR - Mark your favorite packages
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stars.1 b/deps/npm/man/man1/npm-stars.1
index 683130aa570..3d01cceeb71 100644
--- a/deps/npm/man/man1/npm-stars.1
+++ b/deps/npm/man/man1/npm-stars.1
@@ -1,4 +1,4 @@
-.TH "NPM-STARS" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-STARS" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-stars\fR - View packages marked as favorites
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-start.1 b/deps/npm/man/man1/npm-start.1
index 4ca10bde324..b1c8d43f290 100644
--- a/deps/npm/man/man1/npm-start.1
+++ b/deps/npm/man/man1/npm-start.1
@@ -1,4 +1,4 @@
-.TH "NPM-START" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-START" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-start\fR - Start a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stop.1 b/deps/npm/man/man1/npm-stop.1
index 563e3547c5c..0ef270c5902 100644
--- a/deps/npm/man/man1/npm-stop.1
+++ b/deps/npm/man/man1/npm-stop.1
@@ -1,4 +1,4 @@
-.TH "NPM-STOP" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-STOP" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-stop\fR - Stop a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-team.1 b/deps/npm/man/man1/npm-team.1
index 6222cec0626..797e36745ba 100644
--- a/deps/npm/man/man1/npm-team.1
+++ b/deps/npm/man/man1/npm-team.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEAM" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-TEAM" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-team\fR - Manage organization teams and team memberships
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-test.1 b/deps/npm/man/man1/npm-test.1
index ab6daf44237..700ff4b7ead 100644
--- a/deps/npm/man/man1/npm-test.1
+++ b/deps/npm/man/man1/npm-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEST" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-TEST" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-test\fR - Test a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-token.1 b/deps/npm/man/man1/npm-token.1
index 141506c9865..8834947b79c 100644
--- a/deps/npm/man/man1/npm-token.1
+++ b/deps/npm/man/man1/npm-token.1
@@ -1,4 +1,4 @@
-.TH "NPM-TOKEN" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-TOKEN" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-token\fR - Manage your authentication tokens
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-undeprecate.1 b/deps/npm/man/man1/npm-undeprecate.1
index 6153acb8c43..f0be1531eff 100644
--- a/deps/npm/man/man1/npm-undeprecate.1
+++ b/deps/npm/man/man1/npm-undeprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNDEPRECATE" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-UNDEPRECATE" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-undeprecate\fR - Undeprecate a version of a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-uninstall.1 b/deps/npm/man/man1/npm-uninstall.1
index 4ad69524a96..3c6357d135a 100644
--- a/deps/npm/man/man1/npm-uninstall.1
+++ b/deps/npm/man/man1/npm-uninstall.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNINSTALL" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-UNINSTALL" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-uninstall\fR - Remove a package
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unpublish.1 b/deps/npm/man/man1/npm-unpublish.1
index e03dee6ad2f..cd56006c8ca 100644
--- a/deps/npm/man/man1/npm-unpublish.1
+++ b/deps/npm/man/man1/npm-unpublish.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNPUBLISH" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-UNPUBLISH" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-unpublish\fR - Remove a package from the registry
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unstar.1 b/deps/npm/man/man1/npm-unstar.1
index 67f52e7e462..7a6273221b1 100644
--- a/deps/npm/man/man1/npm-unstar.1
+++ b/deps/npm/man/man1/npm-unstar.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNSTAR" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-UNSTAR" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-unstar\fR - Remove an item from your favorite packages
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-update.1 b/deps/npm/man/man1/npm-update.1
index 5cdf466b131..e54e5c2c19a 100644
--- a/deps/npm/man/man1/npm-update.1
+++ b/deps/npm/man/man1/npm-update.1
@@ -1,4 +1,4 @@
-.TH "NPM-UPDATE" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-UPDATE" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-update\fR - Update packages
.SS "Synopsis"
@@ -287,6 +287,18 @@ Type: Boolean
.P
When "true" submit audit reports alongside the current npm command to the default registry and all registries configured for scopes. See the documentation for npm help audit for details on what is submitted.
+.SS "\fBbefore\fR"
+.RS 0
+.IP \(bu 4
+Default: null
+.IP \(bu 4
+Type: null or Date
+.RE 0
+
+.P
+If passed to \fBnpm install\fR, will rebuild the npm tree such that only versions that were available \fBon or before\fR the given date are installed. If there are no versions available for the current set of dependencies, the command will error.
+.P
+If the requested version is a \fBdist-tag\fR and the given tag does not pass the \fB--before\fR filter, the most recent version less than or equal to that tag will be used. For example, \fBfoo@latest\fR might install \fBfoo@1.2\fR even though \fBlatest\fR is \fB2.0\fR.
.SS "\fBbin-links\fR"
.RS 0
.IP \(bu 4
diff --git a/deps/npm/man/man1/npm-version.1 b/deps/npm/man/man1/npm-version.1
index 2e006982cb5..bc2a20603fc 100644
--- a/deps/npm/man/man1/npm-version.1
+++ b/deps/npm/man/man1/npm-version.1
@@ -1,4 +1,4 @@
-.TH "NPM-VERSION" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-VERSION" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-version\fR - Bump a package version
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-view.1 b/deps/npm/man/man1/npm-view.1
index e8a7c1bf483..d1e83d5f40c 100644
--- a/deps/npm/man/man1/npm-view.1
+++ b/deps/npm/man/man1/npm-view.1
@@ -1,4 +1,4 @@
-.TH "NPM-VIEW" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-VIEW" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-view\fR - View registry info
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-whoami.1 b/deps/npm/man/man1/npm-whoami.1
index 2f2c4b93b00..f748178998a 100644
--- a/deps/npm/man/man1/npm-whoami.1
+++ b/deps/npm/man/man1/npm-whoami.1
@@ -1,4 +1,4 @@
-.TH "NPM-WHOAMI" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-WHOAMI" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-whoami\fR - Display npm username
.SS "Synopsis"
diff --git a/deps/npm/man/man1/npm.1 b/deps/npm/man/man1/npm.1
index 7d7d210d8ce..0b3ebfd4ed7 100644
--- a/deps/npm/man/man1/npm.1
+++ b/deps/npm/man/man1/npm.1
@@ -1,4 +1,4 @@
-.TH "NPM" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPM" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm\fR - javascript package manager
.SS "Synopsis"
@@ -12,7 +12,7 @@ npm
Note: This command is unaware of workspaces.
.SS "Version"
.P
-11.4.2
+11.5.1
.SS "Description"
.P
npm is the package manager for the Node JavaScript platform. It puts modules in place so that node can find them, and manages dependency conflicts intelligently.
diff --git a/deps/npm/man/man1/npx.1 b/deps/npm/man/man1/npx.1
index 44421edce0d..7b86cacea20 100644
--- a/deps/npm/man/man1/npx.1
+++ b/deps/npm/man/man1/npx.1
@@ -1,4 +1,4 @@
-.TH "NPX" "1" "June 2025" "NPM@11.4.2" ""
+.TH "NPX" "1" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpx\fR - Run a command from a local or remote npm package
.SS "Synopsis"
diff --git a/deps/npm/man/man5/folders.5 b/deps/npm/man/man5/folders.5
index 18b42e450d5..35abf789046 100644
--- a/deps/npm/man/man5/folders.5
+++ b/deps/npm/man/man5/folders.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "June 2025" "NPM@11.4.2" ""
+.TH "FOLDERS" "5" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBfolders\fR - Folder Structures Used by npm
.SS "Description"
diff --git a/deps/npm/man/man5/install.5 b/deps/npm/man/man5/install.5
index 01addcf1284..dcc827ba961 100644
--- a/deps/npm/man/man5/install.5
+++ b/deps/npm/man/man5/install.5
@@ -1,4 +1,4 @@
-.TH "INSTALL" "5" "June 2025" "NPM@11.4.2" ""
+.TH "INSTALL" "5" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBinstall\fR - Download and install node and npm
.SS "Description"
@@ -37,9 +37,9 @@ If you are unable to use a Node version manager, you can use a Node installer to
\fBNodeSource installer\fR \fI\(lahttps://github.com/nodesource/distributions\(ra\fR. If you use Linux, we recommend that you use a NodeSource installer.
.RE 0
-.SS "OS X or Windows Node installers"
+.SS "macOS or Windows Node installers"
.P
-If you're using OS X or Windows, use one of the installers from the \fBNode.js download page\fR \fI\(lahttps://nodejs.org/en/download/\(ra\fR. Be sure to install the version labeled \fBLTS\fR. Other versions have not yet been tested with npm.
+If you're using macOS or Windows, use one of the installers from the \fBNode.js download page\fR \fI\(lahttps://nodejs.org/en/download/\(ra\fR. Be sure to install the version labeled \fBLTS\fR. Other versions have not yet been tested with npm.
.SS "Linux or other operating systems Node installers"
.P
If you're using Linux or another operating system, use one of the following installers:
@@ -52,6 +52,3 @@ One of the installers on the \fBNode.js download page\fR \fI\(lahttps://nodejs.o
.P
Or see \fBthis page\fR \fI\(lahttps://nodejs.org/en/download/package-manager/\(ra\fR to install npm for Linux in the way many Linux developers prefer.
-.SS "Less-common operating systems"
-.P
-For more information on installing Node.js on a variety of operating systems, see \fBthis page\fR \fI\(lahttps://nodejs.org/en/download/package-manager/\(ra\fR.
diff --git a/deps/npm/man/man5/npm-global.5 b/deps/npm/man/man5/npm-global.5
index 18b42e450d5..35abf789046 100644
--- a/deps/npm/man/man5/npm-global.5
+++ b/deps/npm/man/man5/npm-global.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "June 2025" "NPM@11.4.2" ""
+.TH "FOLDERS" "5" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBfolders\fR - Folder Structures Used by npm
.SS "Description"
diff --git a/deps/npm/man/man5/npm-json.5 b/deps/npm/man/man5/npm-json.5
index 1cc60d24b05..86974c10a31 100644
--- a/deps/npm/man/man5/npm-json.5
+++ b/deps/npm/man/man5/npm-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "June 2025" "NPM@11.4.2" ""
+.TH "PACKAGE.JSON" "5" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBpackage.json\fR - Specifics of npm's package.json handling
.SS "Description"
diff --git a/deps/npm/man/man5/npm-shrinkwrap-json.5 b/deps/npm/man/man5/npm-shrinkwrap-json.5
index 04c5b0ebc85..b52ced31894 100644
--- a/deps/npm/man/man5/npm-shrinkwrap-json.5
+++ b/deps/npm/man/man5/npm-shrinkwrap-json.5
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP.JSON" "5" "June 2025" "NPM@11.4.2" ""
+.TH "NPM-SHRINKWRAP.JSON" "5" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpm-shrinkwrap.json\fR - A publishable lockfile
.SS "Description"
diff --git a/deps/npm/man/man5/npmrc.5 b/deps/npm/man/man5/npmrc.5
index 6e041eae47f..bc9f9d48229 100644
--- a/deps/npm/man/man5/npmrc.5
+++ b/deps/npm/man/man5/npmrc.5
@@ -1,4 +1,4 @@
-.TH "NPMRC" "5" "June 2025" "NPM@11.4.2" ""
+.TH "NPMRC" "5" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBnpmrc\fR - The npm config files
.SS "Description"
diff --git a/deps/npm/man/man5/package-json.5 b/deps/npm/man/man5/package-json.5
index 1cc60d24b05..86974c10a31 100644
--- a/deps/npm/man/man5/package-json.5
+++ b/deps/npm/man/man5/package-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "June 2025" "NPM@11.4.2" ""
+.TH "PACKAGE.JSON" "5" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBpackage.json\fR - Specifics of npm's package.json handling
.SS "Description"
diff --git a/deps/npm/man/man5/package-lock-json.5 b/deps/npm/man/man5/package-lock-json.5
index 78e0bd267c9..0817708a68a 100644
--- a/deps/npm/man/man5/package-lock-json.5
+++ b/deps/npm/man/man5/package-lock-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE-LOCK.JSON" "5" "June 2025" "NPM@11.4.2" ""
+.TH "PACKAGE-LOCK.JSON" "5" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBpackage-lock.json\fR - A manifestation of the manifest
.SS "Description"
diff --git a/deps/npm/man/man7/config.7 b/deps/npm/man/man7/config.7
index 20f50ef8685..233ab61b966 100644
--- a/deps/npm/man/man7/config.7
+++ b/deps/npm/man/man7/config.7
@@ -1,4 +1,4 @@
-.TH "CONFIG" "7" "June 2025" "NPM@11.4.2" ""
+.TH "CONFIG" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBconfig\fR - More than you probably want to know about npm configuration
.SS "Description"
@@ -228,7 +228,7 @@ Type: null or Date
.RE 0
.P
-If passed to \fBnpm install\fR, will rebuild the npm tree such that only versions that were available \fBon or before\fR the \fB--before\fR time get installed. If there's no versions available for the current set of direct dependencies, the command will error.
+If passed to \fBnpm install\fR, will rebuild the npm tree such that only versions that were available \fBon or before\fR the given date are installed. If there are no versions available for the current set of dependencies, the command will error.
.P
If the requested version is a \fBdist-tag\fR and the given tag does not pass the \fB--before\fR filter, the most recent version less than or equal to that tag will be used. For example, \fBfoo@latest\fR might install \fBfoo@1.2\fR even though \fBlatest\fR is \fB2.0\fR.
.SS "\fBbin-links\fR"
@@ -246,7 +246,7 @@ Set to false to have it not do this. This can be used to work around the fact th
.SS "\fBbrowser\fR"
.RS 0
.IP \(bu 4
-Default: OS X: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
+Default: macOS: \fB"open"\fR, Windows: \fB"start"\fR, Others: \fB"xdg-open"\fR
.IP \(bu 4
Type: null, Boolean, or String
.RE 0
@@ -1245,7 +1245,7 @@ The "prerelease identifier" to use as a prefix for the "prerelease" part of a se
.SS "\fBprogress\fR"
.RS 0
.IP \(bu 4
-Default: \fBtrue\fR unless running in a known CI system
+Default: \fBtrue\fR when not in CI and both stderr and stdout are TTYs and not in a dumb terminal
.IP \(bu 4
Type: Boolean
.RE 0
diff --git a/deps/npm/man/man7/dependency-selectors.7 b/deps/npm/man/man7/dependency-selectors.7
index fe6a0cad7ae..b249ea851bc 100644
--- a/deps/npm/man/man7/dependency-selectors.7
+++ b/deps/npm/man/man7/dependency-selectors.7
@@ -1,4 +1,4 @@
-.TH "QUERYING" "7" "June 2025" "NPM@11.4.2" ""
+.TH "QUERYING" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBQuerying\fR - Dependency Selector Syntax & Querying
.SS "Description"
diff --git a/deps/npm/man/man7/developers.7 b/deps/npm/man/man7/developers.7
index e7c55251806..6961a751b7d 100644
--- a/deps/npm/man/man7/developers.7
+++ b/deps/npm/man/man7/developers.7
@@ -1,4 +1,4 @@
-.TH "DEVELOPERS" "7" "June 2025" "NPM@11.4.2" ""
+.TH "DEVELOPERS" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBdevelopers\fR - Developer Guide
.SS "Description"
diff --git a/deps/npm/man/man7/logging.7 b/deps/npm/man/man7/logging.7
index d0d90200ca1..fa6bcdb2d35 100644
--- a/deps/npm/man/man7/logging.7
+++ b/deps/npm/man/man7/logging.7
@@ -1,4 +1,4 @@
-.TH "LOGGING" "7" "June 2025" "NPM@11.4.2" ""
+.TH "LOGGING" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBLogging\fR - Why, What & How We Log
.SS "Description"
diff --git a/deps/npm/man/man7/orgs.7 b/deps/npm/man/man7/orgs.7
index ffcd881a5ed..38ddc1cbe05 100644
--- a/deps/npm/man/man7/orgs.7
+++ b/deps/npm/man/man7/orgs.7
@@ -1,4 +1,4 @@
-.TH "ORGS" "7" "June 2025" "NPM@11.4.2" ""
+.TH "ORGS" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBorgs\fR - Working with Teams & Orgs
.SS "Description"
diff --git a/deps/npm/man/man7/package-spec.7 b/deps/npm/man/man7/package-spec.7
index b174fbec828..a3bd8733cd8 100644
--- a/deps/npm/man/man7/package-spec.7
+++ b/deps/npm/man/man7/package-spec.7
@@ -1,4 +1,4 @@
-.TH "PACKAGE-SPEC" "7" "June 2025" "NPM@11.4.2" ""
+.TH "PACKAGE-SPEC" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBpackage-spec\fR - Package name specifier
.SS "Description"
diff --git a/deps/npm/man/man7/registry.7 b/deps/npm/man/man7/registry.7
index cab00cc9a6b..13ded7b2a54 100644
--- a/deps/npm/man/man7/registry.7
+++ b/deps/npm/man/man7/registry.7
@@ -1,4 +1,4 @@
-.TH "REGISTRY" "7" "June 2025" "NPM@11.4.2" ""
+.TH "REGISTRY" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBregistry\fR - The JavaScript Package Registry
.SS "Description"
diff --git a/deps/npm/man/man7/removal.7 b/deps/npm/man/man7/removal.7
index 5856a72ca22..2a5ca6b22f0 100644
--- a/deps/npm/man/man7/removal.7
+++ b/deps/npm/man/man7/removal.7
@@ -1,4 +1,4 @@
-.TH "REMOVAL" "7" "June 2025" "NPM@11.4.2" ""
+.TH "REMOVAL" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBremoval\fR - Cleaning the Slate
.SS "Synopsis"
diff --git a/deps/npm/man/man7/scope.7 b/deps/npm/man/man7/scope.7
index 7580ac785b4..949a1cc5cea 100644
--- a/deps/npm/man/man7/scope.7
+++ b/deps/npm/man/man7/scope.7
@@ -1,4 +1,4 @@
-.TH "SCOPE" "7" "June 2025" "NPM@11.4.2" ""
+.TH "SCOPE" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBscope\fR - Scoped packages
.SS "Description"
diff --git a/deps/npm/man/man7/scripts.7 b/deps/npm/man/man7/scripts.7
index 169287fadc9..7f530e4a5d3 100644
--- a/deps/npm/man/man7/scripts.7
+++ b/deps/npm/man/man7/scripts.7
@@ -1,9 +1,9 @@
-.TH "SCRIPTS" "7" "June 2025" "NPM@11.4.2" ""
+.TH "SCRIPTS" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBscripts\fR - How npm handles the "scripts" field
.SS "Description"
.P
-The \fB"scripts"\fR property of your \fBpackage.json\fR file supports a number of built-in scripts and their preset life cycle events as well as arbitrary scripts. These all can be executed by running \fBnpm run \fR or \fBnpm run \fR for short. \fIPre\fR and \fIpost\fR commands with matching names will be run for those as well (e.g. \fBpremyscript\fR, \fBmyscript\fR, \fBpostmyscript\fR). Scripts from dependencies can be run with \fBnpm explore -- npm run \fR.
+The \fB"scripts"\fR property of your \fBpackage.json\fR file supports a number of built-in scripts and their preset life cycle events as well as arbitrary scripts. These all can be executed by running \fBnpm run \fR. \fIPre\fR and \fIpost\fR commands with matching names will be run for those as well (e.g. \fBpremyscript\fR, \fBmyscript\fR, \fBpostmyscript\fR). Scripts from dependencies can be run with \fBnpm explore -- npm run \fR.
.SS "Pre & Post Scripts"
.P
To create "pre" or "post" scripts for any scripts defined in the \fB"scripts"\fR section of the \fBpackage.json\fR, simply create another script \fIwith a matching name\fR and add "pre" or "post" to the beginning of them.
diff --git a/deps/npm/man/man7/workspaces.7 b/deps/npm/man/man7/workspaces.7
index 5e2519612ad..2c1c874b6d4 100644
--- a/deps/npm/man/man7/workspaces.7
+++ b/deps/npm/man/man7/workspaces.7
@@ -1,4 +1,4 @@
-.TH "WORKSPACES" "7" "June 2025" "NPM@11.4.2" ""
+.TH "WORKSPACES" "7" "July 2025" "NPM@11.5.1" ""
.SH "NAME"
\fBworkspaces\fR - Working with workspaces
.SS "Description"
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
index a7e01fcf148..1edd0b643b6 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js
@@ -6,7 +6,7 @@ const pacote = require('pacote')
const cacache = require('cacache')
const { callLimit: promiseCallLimit } = require('promise-call-limit')
const realpath = require('../../lib/realpath.js')
-const { resolve, dirname } = require('node:path')
+const { resolve, dirname, sep } = require('node:path')
const treeCheck = require('../tree-check.js')
const { readdirScoped } = require('@npmcli/fs')
const { lstat, readlink } = require('node:fs/promises')
@@ -192,9 +192,11 @@ module.exports = cls => class IdealTreeBuilder extends cls {
}
async #checkEngineAndPlatform () {
- const { engineStrict, npmVersion, nodeVersion } = this.options
+ const { engineStrict, npmVersion, nodeVersion, omit = [] } = this.options
+ const omitSet = new Set(omit)
+
for (const node of this.idealTree.inventory.values()) {
- if (!node.optional) {
+ if (!node.optional && !node.shouldOmit(omitSet)) {
try {
// if devEngines is present in the root node we ignore the engines check
if (!(node.isRoot && node.package.devEngines)) {
@@ -1224,9 +1226,21 @@ This is a one-time fix-up, please be patient...
const { installLinks, legacyPeerDeps } = this
const isWorkspace = this.idealTree.workspaces && this.idealTree.workspaces.has(spec.name)
- // spec is a directory, link it unless installLinks is set or it's a workspace
+ // spec is a directory, link it if:
+ // - it's a workspace, OR
+ // - it's a project-internal file: dependency (always linked), OR
+ // - it's external and installLinks is false
// TODO post arborist refactor, will need to check for installStrategy=linked
- if (spec.type === 'directory' && (isWorkspace || !installLinks)) {
+ let isProjectInternalFileSpec = false
+ if (edge?.rawSpec.startsWith('file:../') || edge?.rawSpec.startsWith('file:./')) {
+ const targetPath = resolve(parent.realpath, edge.rawSpec.slice(5))
+ const resolvedProjectRoot = resolve(this.idealTree.realpath)
+ // Check if the target is within the project root
+ isProjectInternalFileSpec = targetPath.startsWith(resolvedProjectRoot + sep) || targetPath === resolvedProjectRoot
+ }
+ // Decide whether to link or copy the dependency
+ const shouldLink = isWorkspace || isProjectInternalFileSpec || !installLinks
+ if (spec.type === 'directory' && shouldLink) {
return this.#linkFromSpec(name, spec, parent, edge)
}
@@ -1476,11 +1490,6 @@ This is a one-time fix-up, please be patient...
const needPrune = metaFromDisk && (mutateTree || flagsSuspect)
if (this.#prune && needPrune) {
this.#idealTreePrune()
- for (const node of this.idealTree.inventory.values()) {
- if (node.extraneous) {
- node.parent = null
- }
- }
}
timeEnd()
@@ -1514,7 +1523,12 @@ This is a one-time fix-up, please be patient...
#idealTreePrune () {
for (const node of this.idealTree.inventory.values()) {
- if (node.extraneous) {
+ // optional peer dependencies are meant to be added to the tree
+ // through an explicit required dependency (most commonly in the
+ // root package.json), at which point they won't be optional so
+ // any dependencies still marked as both optional and peer at
+ // this point can be pruned as a special kind of extraneous
+ if (node.extraneous || (node.peer && node.optional)) {
node.parent = null
}
}
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js
index 796be4fa507..7f3fa461b06 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js
@@ -84,9 +84,7 @@ module.exports = cls => class Reifier extends cls {
#bundleUnpacked = new Set() // the nodes we unpack to read their bundles
#dryRun
#nmValidated = new Set()
- #omitDev
- #omitPeer
- #omitOptional
+ #omit
#retiredPaths = {}
#retiredUnchanged = {}
#savePrefix
@@ -110,10 +108,7 @@ module.exports = cls => class Reifier extends cls {
throw er
}
- const omit = new Set(options.omit || [])
- this.#omitDev = omit.has('dev')
- this.#omitOptional = omit.has('optional')
- this.#omitPeer = omit.has('peer')
+ this.#omit = new Set(options.omit)
// start tracker block
this.addTracker('reify')
@@ -562,12 +557,11 @@ module.exports = cls => class Reifier extends cls {
// adding to the trash list will skip reifying, and delete them
// if they are currently in the tree and otherwise untouched.
[_addOmitsToTrashList] () {
- if (!this.#omitDev && !this.#omitOptional && !this.#omitPeer) {
+ if (!this.#omit.size) {
return
}
const timeEnd = time.start('reify:trashOmits')
-
for (const node of this.idealTree.inventory.values()) {
const { top } = node
@@ -583,12 +577,7 @@ module.exports = cls => class Reifier extends cls {
}
// omit node if the dep type matches any omit flags that were set
- if (
- node.peer && this.#omitPeer ||
- node.dev && this.#omitDev ||
- node.optional && this.#omitOptional ||
- node.devOptional && this.#omitOptional && this.#omitDev
- ) {
+ if (node.shouldOmit(this.#omit)) {
this[_addNodeToTrashList](node)
}
}
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js b/deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js
index dbd9be8bd38..ce274635d3b 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js
@@ -1,5 +1,4 @@
// an object representing the set of vulnerabilities in a tree
-/* eslint camelcase: "off" */
const localeCompare = require('@isaacs/string-locale-compare')('en')
const npa = require('npm-package-arg')
@@ -8,16 +7,15 @@ const pickManifest = require('npm-pick-manifest')
const Vuln = require('./vuln.js')
const Calculator = require('@npmcli/metavuln-calculator')
-const _getReport = Symbol('getReport')
-const _fixAvailable = Symbol('fixAvailable')
-const _checkTopNode = Symbol('checkTopNode')
-const _init = Symbol('init')
-const _omit = Symbol('omit')
const { log, time } = require('proc-log')
const npmFetch = require('npm-registry-fetch')
class AuditReport extends Map {
+ #omit
+ error = null
+ topVulns = new Map()
+
static load (tree, opts) {
return new AuditReport(tree, opts).run()
}
@@ -91,22 +89,18 @@ class AuditReport extends Map {
constructor (tree, opts = {}) {
super()
- const { omit } = opts
- this[_omit] = new Set(omit || [])
- this.topVulns = new Map()
-
+ this.#omit = new Set(opts.omit || [])
this.calculator = new Calculator(opts)
- this.error = null
this.options = opts
this.tree = tree
this.filterSet = opts.filterSet
}
async run () {
- this.report = await this[_getReport]()
+ this.report = await this.#getReport()
log.silly('audit report', this.report)
if (this.report) {
- await this[_init]()
+ await this.#init()
}
return this
}
@@ -116,7 +110,7 @@ class AuditReport extends Map {
return !!(vuln && vuln.isVulnerable(node))
}
- async [_init] () {
+ async #init () {
const timeEnd = time.start('auditReport:init')
const promises = []
@@ -148,7 +142,7 @@ class AuditReport extends Map {
if (!seen.has(k)) {
const p = []
for (const node of this.tree.inventory.query('packageName', name)) {
- if (!shouldAudit(node, this[_omit], this.filterSet)) {
+ if (!this.shouldAudit(node)) {
continue
}
@@ -171,7 +165,15 @@ class AuditReport extends Map {
vuln.nodes.add(node)
for (const { from: dep, spec } of node.edgesIn) {
if (dep.isTop && !vuln.topNodes.has(dep)) {
- this[_checkTopNode](dep, vuln, spec)
+ vuln.fixAvailable = this.#fixAvailable(vuln, spec)
+ if (vuln.fixAvailable !== true) {
+ // now we know the top node is vulnerable, and cannot be
+ // upgraded out of the bad place without --force. But, there's
+ // no need to add it to the actual vulns list, because nothing
+ // depends on root.
+ this.topVulns.set(vuln.name, vuln)
+ vuln.topNodes.add(dep)
+ }
} else {
// calculate a metavuln, if necessary
const calc = this.calculator.calculate(dep.packageName, advisory)
@@ -214,33 +216,14 @@ class AuditReport extends Map {
timeEnd()
}
- [_checkTopNode] (topNode, vuln, spec) {
- vuln.fixAvailable = this[_fixAvailable](topNode, vuln, spec)
-
- if (vuln.fixAvailable !== true) {
- // now we know the top node is vulnerable, and cannot be
- // upgraded out of the bad place without --force. But, there's
- // no need to add it to the actual vulns list, because nothing
- // depends on root.
- this.topVulns.set(vuln.name, vuln)
- vuln.topNodes.add(topNode)
- }
- }
-
- // check whether the top node is vulnerable.
- // check whether we can get out of the bad place with --force, and if
- // so, whether that update is SemVer Major
- [_fixAvailable] (topNode, vuln, spec) {
- // this will always be set to at least {name, versions:{}}
- const paku = vuln.packument
-
+ // given the spec, see if there is a fix available at all, and note whether or not it's a semver major fix or not (i.e. will need --force)
+ #fixAvailable (vuln, spec) {
+ // TODO we return true, false, OR an object here. this is probably a bad pattern.
if (!vuln.testSpec(spec)) {
return true
}
- // similarly, even if we HAVE a packument, but we're looking for it
- // somewhere other than the registry, and we got something vulnerable,
- // then we're stuck with it.
+ // even if we HAVE a packument, if we're looking for it somewhere other than the registry and we have something vulnerable then we're stuck with it.
const specObj = npa(spec)
if (!specObj.registry) {
return false
@@ -250,15 +233,13 @@ class AuditReport extends Map {
spec = specObj.subSpec.rawSpec
}
- // We don't provide fixes for top nodes other than root, but we
- // still check to see if the node is fixable with a different version,
- // and if that is a semver major bump.
+ // we don't provide fixes for top nodes other than root, but we still check to see if the node is fixable with a different version, and note if that is a semver major bump.
try {
const {
_isSemVerMajor: isSemVerMajor,
version,
name,
- } = pickManifest(paku, spec, {
+ } = pickManifest(vuln.packument, spec, {
...this.options,
before: null,
avoid: vuln.range,
@@ -274,7 +255,7 @@ class AuditReport extends Map {
throw new Error('do not call AuditReport.set() directly')
}
- async [_getReport] () {
+ async #getReport () {
// if we're not auditing, just return false
if (this.options.audit === false || this.options.offline === true || this.tree.inventory.size === 1) {
return null
@@ -282,7 +263,7 @@ class AuditReport extends Map {
const timeEnd = time.start('auditReport:getReport')
try {
- const body = prepareBulkData(this.tree, this[_omit], this.filterSet)
+ const body = this.prepareBulkData()
log.silly('audit', 'bulk request', body)
// no sense asking if we don't have anything to audit,
@@ -309,37 +290,39 @@ class AuditReport extends Map {
timeEnd()
}
}
-}
-// return true if we should audit this one
-const shouldAudit = (node, omit, filterSet) =>
- !node.version ? false
- : node.isRoot ? false
- : filterSet && filterSet.size !== 0 && !filterSet.has(node) ? false
- : omit.size === 0 ? true
- : !( // otherwise, just ensure we're not omitting this one
- node.dev && omit.has('dev') ||
- node.optional && omit.has('optional') ||
- node.devOptional && omit.has('dev') && omit.has('optional') ||
- node.peer && omit.has('peer')
- )
-
-const prepareBulkData = (tree, omit, filterSet) => {
- const payload = {}
- for (const name of tree.inventory.query('packageName')) {
- const set = new Set()
- for (const node of tree.inventory.query('packageName', name)) {
- if (!shouldAudit(node, omit, filterSet)) {
- continue
- }
-
- set.add(node.version)
+ // return true if we should audit this one
+ shouldAudit (node) {
+ if (
+ !node.version ||
+ node.isRoot ||
+ (this.filterSet && this.filterSet?.size !== 0 && !this.filterSet?.has(node))
+ ) {
+ return false
}
- if (set.size) {
- payload[name] = [...set]
+ if (this.#omit.size === 0) {
+ return true
}
+ return !node.shouldOmit(this.#omit)
+ }
+
+ prepareBulkData () {
+ const payload = {}
+ for (const name of this.tree.inventory.query('packageName')) {
+ const set = new Set()
+ for (const node of this.tree.inventory.query('packageName', name)) {
+ if (!this.shouldAudit(node)) {
+ continue
+ }
+
+ set.add(node.version)
+ }
+ if (set.size) {
+ payload[name] = [...set]
+ }
+ }
+ return payload
}
- return payload
}
module.exports = AuditReport
diff --git a/deps/npm/node_modules/@npmcli/arborist/lib/node.js b/deps/npm/node_modules/@npmcli/arborist/lib/node.js
index d067fe393a3..91c61fa09b4 100644
--- a/deps/npm/node_modules/@npmcli/arborist/lib/node.js
+++ b/deps/npm/node_modules/@npmcli/arborist/lib/node.js
@@ -489,6 +489,15 @@ class Node {
return false
}
+ shouldOmit (omitSet) {
+ return (
+ this.peer && omitSet.has('peer') ||
+ this.dev && omitSet.has('dev') ||
+ this.optional && omitSet.has('optional') ||
+ this.devOptional && omitSet.has('optional') && omitSet.has('dev')
+ )
+ }
+
getBundler (path = []) {
// made a cycle, definitely not bundled!
if (path.includes(this)) {
diff --git a/deps/npm/node_modules/@npmcli/arborist/package.json b/deps/npm/node_modules/@npmcli/arborist/package.json
index 9d563593b40..3f9282e99a5 100644
--- a/deps/npm/node_modules/@npmcli/arborist/package.json
+++ b/deps/npm/node_modules/@npmcli/arborist/package.json
@@ -1,6 +1,6 @@
{
"name": "@npmcli/arborist",
- "version": "9.1.2",
+ "version": "9.1.3",
"description": "Manage node_modules trees",
"dependencies": {
"@isaacs/string-locale-compare": "^1.1.0",
@@ -41,7 +41,7 @@
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
"@npmcli/mock-registry": "^1.0.0",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"benchmark": "^2.1.4",
"minify-registry-metadata": "^4.0.0",
"nock": "^13.3.3",
@@ -93,7 +93,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
}
}
diff --git a/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js b/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
index e76c5a438d5..73f1c9d1006 100644
--- a/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
+++ b/deps/npm/node_modules/@npmcli/config/lib/definitions/definitions.js
@@ -230,12 +230,13 @@ const definitions = {
}),
before: new Definition('before', {
default: null,
+ hint: '',
type: [null, Date],
description: `
If passed to \`npm install\`, will rebuild the npm tree such that only
- versions that were available **on or before** the \`--before\` time get
- installed. If there's no versions available for the current set of
- direct dependencies, the command will error.
+ versions that were available **on or before** the given date are
+ installed. If there are no versions available for the current set of
+ dependencies, the command will error.
If the requested version is a \`dist-tag\` and the given tag does not
pass the \`--before\` filter, the most recent version less than or equal
@@ -260,7 +261,7 @@ const definitions = {
browser: new Definition('browser', {
default: null,
defaultDescription: `
- OS X: \`"open"\`, Windows: \`"start"\`, Others: \`"xdg-open"\`
+ macOS: \`"open"\`, Windows: \`"start"\`, Others: \`"xdg-open"\`
`,
type: [null, Boolean, String],
description: `
@@ -1571,9 +1572,9 @@ const definitions = {
},
}),
progress: new Definition('progress', {
- default: !ciInfo.isCI,
+ default: !(ciInfo.isCI || !process.stderr.isTTY || !process.stdout.isTTY || process.env.TERM === 'dumb'),
defaultDescription: `
- \`true\` unless running in a known CI system
+ \`true\` when not in CI and both stderr and stdout are TTYs and not in a dumb terminal
`,
type: Boolean,
description: `
@@ -1583,11 +1584,8 @@ const definitions = {
Set to \`false\` to suppress the progress bar.
`,
flatten (key, obj, flatOptions) {
- flatOptions.progress = !obj.progress ? false
- // progress is only written to stderr but we disable it unless stdout is a tty
- // also. This prevents the progress from appearing when piping output to another
- // command which doesn't break anything, but does look very odd to users.
- : !!process.stderr.isTTY && !!process.stdout.isTTY && process.env.TERM !== 'dumb'
+ // Only show progress if explicitly enabled AND we have proper TTY environment
+ flatOptions.progress = !!obj.progress && !!process.stderr.isTTY && !!process.stdout.isTTY && process.env.TERM !== 'dumb'
},
}),
provenance: new Definition('provenance', {
diff --git a/deps/npm/node_modules/@npmcli/config/package.json b/deps/npm/node_modules/@npmcli/config/package.json
index 69c19159185..fc6c9fd10ee 100644
--- a/deps/npm/node_modules/@npmcli/config/package.json
+++ b/deps/npm/node_modules/@npmcli/config/package.json
@@ -1,6 +1,6 @@
{
"name": "@npmcli/config",
- "version": "10.3.0",
+ "version": "10.3.1",
"files": [
"bin/",
"lib/"
@@ -33,7 +33,7 @@
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
"@npmcli/mock-globals": "^1.0.0",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"tap": "^16.3.8"
},
"dependencies": {
@@ -51,7 +51,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
}
}
diff --git a/deps/npm/node_modules/@npmcli/metavuln-calculator/lib/advisory.js b/deps/npm/node_modules/@npmcli/metavuln-calculator/lib/advisory.js
index 01f6a66fc2a..1f4554963d7 100644
--- a/deps/npm/node_modules/@npmcli/metavuln-calculator/lib/advisory.js
+++ b/deps/npm/node_modules/@npmcli/metavuln-calculator/lib/advisory.js
@@ -292,7 +292,7 @@ class Advisory {
[_testSpec] (spec) {
for (const v of this.versions) {
- const satisfies = semver.satisfies(v, spec)
+ const satisfies = semver.satisfies(v, spec, semverOpt)
if (!satisfies) {
continue
}
diff --git a/deps/npm/node_modules/@npmcli/metavuln-calculator/package.json b/deps/npm/node_modules/@npmcli/metavuln-calculator/package.json
index 1343b374273..fe39fcdf1fc 100644
--- a/deps/npm/node_modules/@npmcli/metavuln-calculator/package.json
+++ b/deps/npm/node_modules/@npmcli/metavuln-calculator/package.json
@@ -1,6 +1,6 @@
{
"name": "@npmcli/metavuln-calculator",
- "version": "9.0.0",
+ "version": "9.0.1",
"main": "lib/index.js",
"files": [
"bin/",
@@ -34,7 +34,7 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.0",
- "@npmcli/template-oss": "4.23.4",
+ "@npmcli/template-oss": "4.25.0",
"require-inject": "^1.4.4",
"tap": "^16.0.1"
},
@@ -50,7 +50,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.4",
+ "version": "4.25.0",
"publish": "true",
"ciVersions": [
"16.14.0",
diff --git a/deps/npm/node_modules/agent-base/dist/index.js b/deps/npm/node_modules/agent-base/dist/index.js
index c3c4099c73c..57ac85205e8 100644
--- a/deps/npm/node_modules/agent-base/dist/index.js
+++ b/deps/npm/node_modules/agent-base/dist/index.js
@@ -111,9 +111,7 @@ class Agent extends http.Agent {
// In order to properly update the socket pool, we need to call `getName()` on
// the core `https.Agent` if it is a secureEndpoint.
getName(options) {
- const secureEndpoint = typeof options.secureEndpoint === 'boolean'
- ? options.secureEndpoint
- : this.isSecureEndpoint(options);
+ const secureEndpoint = this.isSecureEndpoint(options);
if (secureEndpoint) {
// @ts-expect-error `getName()` isn't defined in `@types/node`
return https_1.Agent.prototype.getName.call(this, options);
diff --git a/deps/npm/node_modules/agent-base/package.json b/deps/npm/node_modules/agent-base/package.json
index 175ee71fb70..1b4964a83f6 100644
--- a/deps/npm/node_modules/agent-base/package.json
+++ b/deps/npm/node_modules/agent-base/package.json
@@ -1,6 +1,6 @@
{
"name": "agent-base",
- "version": "7.1.3",
+ "version": "7.1.4",
"description": "Turn a function into an `http.Agent` instance",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
diff --git a/deps/npm/node_modules/aproba/index.js b/deps/npm/node_modules/aproba/index.js
index fd947481ba5..5a58e812652 100644
--- a/deps/npm/node_modules/aproba/index.js
+++ b/deps/npm/node_modules/aproba/index.js
@@ -97,7 +97,7 @@ function moreThanOneError (schema) {
}
function newException (code, msg) {
- const err = new Error(msg)
+ const err = new TypeError(msg)
err.code = code
/* istanbul ignore else */
if (Error.captureStackTrace) Error.captureStackTrace(err, validate)
diff --git a/deps/npm/node_modules/aproba/package.json b/deps/npm/node_modules/aproba/package.json
index d2212d30d8e..71c7fca58d3 100644
--- a/deps/npm/node_modules/aproba/package.json
+++ b/deps/npm/node_modules/aproba/package.json
@@ -1,6 +1,6 @@
{
"name": "aproba",
- "version": "2.0.0",
+ "version": "2.1.0",
"description": "A ridiculously light-weight argument validator (now browser friendly)",
"main": "index.js",
"directories": {
diff --git a/deps/npm/node_modules/ci-info/index.js b/deps/npm/node_modules/ci-info/index.js
index 9cd162991a0..75695253adb 100644
--- a/deps/npm/node_modules/ci-info/index.js
+++ b/deps/npm/node_modules/ci-info/index.js
@@ -36,7 +36,7 @@ exports.isCI = !!(
env.CI !== 'false' && // Bypass all checks if CI env is explicitly set to 'false'
(env.BUILD_ID || // Jenkins, Cloudbees
env.BUILD_NUMBER || // Jenkins, TeamCity
- env.CI || // Travis CI, CircleCI, Cirrus CI, Gitlab CI, Appveyor, CodeShip, dsari, Cloudflare Pages
+ env.CI || // Travis CI, CircleCI, Cirrus CI, Gitlab CI, Appveyor, CodeShip, dsari, Cloudflare Pages/Workers
env.CI_APP_ID || // Appflow
env.CI_BUILD_ID || // Appflow
env.CI_BUILD_NUMBER || // Appflow
diff --git a/deps/npm/node_modules/ci-info/package.json b/deps/npm/node_modules/ci-info/package.json
index fc7e8999ea3..8ce80ae1ee8 100644
--- a/deps/npm/node_modules/ci-info/package.json
+++ b/deps/npm/node_modules/ci-info/package.json
@@ -1,6 +1,6 @@
{
"name": "ci-info",
- "version": "4.2.0",
+ "version": "4.3.0",
"description": "Get details about the current Continuous Integration environment",
"main": "index.js",
"typings": "index.d.ts",
@@ -36,6 +36,7 @@
"CHANGELOG.md"
],
"scripts": {
+ "build": "node sort-vendors.js && node create-typings.js",
"lint:fix": "standard --fix",
"test": "standard && node test.js",
"prepare": "husky install || true"
@@ -43,7 +44,7 @@
"devDependencies": {
"clear-module": "^4.1.2",
"husky": "^9.1.7",
- "publint": "^0.3.8",
+ "publint": "^0.3.12",
"standard": "^17.1.2",
"tape": "^5.9.0"
},
diff --git a/deps/npm/node_modules/ci-info/vendors.json b/deps/npm/node_modules/ci-info/vendors.json
index 0c47fa99cae..3505e1b533d 100644
--- a/deps/npm/node_modules/ci-info/vendors.json
+++ b/deps/npm/node_modules/ci-info/vendors.json
@@ -90,6 +90,11 @@
"constant": "CLOUDFLARE_PAGES",
"env": "CF_PAGES"
},
+ {
+ "name": "Cloudflare Workers",
+ "constant": "CLOUDFLARE_WORKERS",
+ "env": "WORKERS_CI"
+ },
{
"name": "Codefresh",
"constant": "CODEFRESH",
diff --git a/deps/npm/node_modules/libnpmaccess/package.json b/deps/npm/node_modules/libnpmaccess/package.json
index e5fac7f17de..d0e4e294022 100644
--- a/deps/npm/node_modules/libnpmaccess/package.json
+++ b/deps/npm/node_modules/libnpmaccess/package.json
@@ -18,7 +18,7 @@
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
"@npmcli/mock-registry": "^1.0.0",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"tap": "^16.3.8"
},
"repository": {
@@ -41,7 +41,7 @@
],
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
},
"tap": {
diff --git a/deps/npm/node_modules/libnpmdiff/package.json b/deps/npm/node_modules/libnpmdiff/package.json
index 8a96ff4c749..c89c809e456 100644
--- a/deps/npm/node_modules/libnpmdiff/package.json
+++ b/deps/npm/node_modules/libnpmdiff/package.json
@@ -1,6 +1,6 @@
{
"name": "libnpmdiff",
- "version": "8.0.5",
+ "version": "8.0.6",
"description": "The registry diff",
"repository": {
"type": "git",
@@ -43,11 +43,11 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"tap": "^16.3.8"
},
"dependencies": {
- "@npmcli/arborist": "^9.1.2",
+ "@npmcli/arborist": "^9.1.3",
"@npmcli/installed-package-contents": "^3.0.0",
"binary-extensions": "^3.0.0",
"diff": "^7.0.0",
@@ -58,7 +58,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
},
"tap": {
diff --git a/deps/npm/node_modules/libnpmexec/package.json b/deps/npm/node_modules/libnpmexec/package.json
index be3007ea7b9..49b188d9199 100644
--- a/deps/npm/node_modules/libnpmexec/package.json
+++ b/deps/npm/node_modules/libnpmexec/package.json
@@ -1,6 +1,6 @@
{
"name": "libnpmexec",
- "version": "10.1.4",
+ "version": "10.1.5",
"files": [
"bin/",
"lib/"
@@ -52,7 +52,7 @@
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
"@npmcli/mock-registry": "^1.0.0",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"bin-links": "^5.0.0",
"chalk": "^5.2.0",
"just-extend": "^6.2.0",
@@ -60,7 +60,7 @@
"tap": "^16.3.8"
},
"dependencies": {
- "@npmcli/arborist": "^9.1.2",
+ "@npmcli/arborist": "^9.1.3",
"@npmcli/package-json": "^6.1.1",
"@npmcli/run-script": "^9.0.1",
"ci-info": "^4.0.0",
@@ -74,7 +74,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
}
}
diff --git a/deps/npm/node_modules/libnpmfund/package.json b/deps/npm/node_modules/libnpmfund/package.json
index 7209005bb7b..d888665298a 100644
--- a/deps/npm/node_modules/libnpmfund/package.json
+++ b/deps/npm/node_modules/libnpmfund/package.json
@@ -1,6 +1,6 @@
{
"name": "libnpmfund",
- "version": "7.0.5",
+ "version": "7.0.6",
"main": "lib/index.js",
"files": [
"bin/",
@@ -42,18 +42,18 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"tap": "^16.3.8"
},
"dependencies": {
- "@npmcli/arborist": "^9.1.2"
+ "@npmcli/arborist": "^9.1.3"
},
"engines": {
"node": "^20.17.0 || >=22.9.0"
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
},
"tap": {
diff --git a/deps/npm/node_modules/libnpmorg/package.json b/deps/npm/node_modules/libnpmorg/package.json
index aec1ef79791..346a2f5fa82 100644
--- a/deps/npm/node_modules/libnpmorg/package.json
+++ b/deps/npm/node_modules/libnpmorg/package.json
@@ -29,7 +29,7 @@
],
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"minipass": "^7.1.1",
"nock": "^13.3.3",
"tap": "^16.3.8"
@@ -50,7 +50,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
},
"tap": {
diff --git a/deps/npm/node_modules/libnpmpack/package.json b/deps/npm/node_modules/libnpmpack/package.json
index 9bf4f14ce17..1aa091fbb5d 100644
--- a/deps/npm/node_modules/libnpmpack/package.json
+++ b/deps/npm/node_modules/libnpmpack/package.json
@@ -1,6 +1,6 @@
{
"name": "libnpmpack",
- "version": "9.0.5",
+ "version": "9.0.6",
"description": "Programmatic API for the bits behind npm pack",
"author": "GitHub Inc.",
"main": "lib/index.js",
@@ -24,7 +24,7 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"nock": "^13.3.3",
"spawk": "^1.7.1",
"tap": "^16.3.8"
@@ -37,7 +37,7 @@
"bugs": "https://github.com/npm/libnpmpack/issues",
"homepage": "https://npmjs.com/package/libnpmpack",
"dependencies": {
- "@npmcli/arborist": "^9.1.2",
+ "@npmcli/arborist": "^9.1.3",
"@npmcli/run-script": "^9.0.1",
"npm-package-arg": "^12.0.0",
"pacote": "^21.0.0"
@@ -47,7 +47,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
},
"tap": {
diff --git a/deps/npm/node_modules/libnpmpublish/lib/publish.js b/deps/npm/node_modules/libnpmpublish/lib/publish.js
index 001dff8de87..933e142422b 100644
--- a/deps/npm/node_modules/libnpmpublish/lib/publish.js
+++ b/deps/npm/node_modules/libnpmpublish/lib/publish.js
@@ -205,7 +205,7 @@ const ensureProvenanceGeneration = async (registry, spec, opts) => {
if (opts.access !== 'public') {
try {
const res = await npmFetch
- .json(`${registry}/-/package/${spec.escapedName}/visibility`, opts)
+ .json(`/-/package/${spec.escapedName}/visibility`, { ...opts, registry })
visibility = res
} catch (err) {
if (err.code !== 'E404') {
diff --git a/deps/npm/node_modules/libnpmpublish/package.json b/deps/npm/node_modules/libnpmpublish/package.json
index 9c7b7bdc3de..b6774b39afc 100644
--- a/deps/npm/node_modules/libnpmpublish/package.json
+++ b/deps/npm/node_modules/libnpmpublish/package.json
@@ -1,6 +1,6 @@
{
"name": "libnpmpublish",
- "version": "11.0.1",
+ "version": "11.1.0",
"description": "Programmatic API for the bits behind npm publish and unpublish",
"author": "GitHub Inc.",
"main": "lib/index.js",
@@ -27,7 +27,7 @@
"@npmcli/eslint-config": "^5.0.1",
"@npmcli/mock-globals": "^1.0.0",
"@npmcli/mock-registry": "^1.0.0",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"tap": "^16.3.8"
},
"repository": {
@@ -52,7 +52,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
},
"tap": {
diff --git a/deps/npm/node_modules/libnpmsearch/package.json b/deps/npm/node_modules/libnpmsearch/package.json
index ca021f24144..c2e1db68077 100644
--- a/deps/npm/node_modules/libnpmsearch/package.json
+++ b/deps/npm/node_modules/libnpmsearch/package.json
@@ -27,7 +27,7 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"nock": "^13.3.3",
"tap": "^16.3.8"
},
@@ -46,7 +46,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
},
"tap": {
diff --git a/deps/npm/node_modules/libnpmteam/package.json b/deps/npm/node_modules/libnpmteam/package.json
index 8ac2c30388f..04c3c4e6ddd 100644
--- a/deps/npm/node_modules/libnpmteam/package.json
+++ b/deps/npm/node_modules/libnpmteam/package.json
@@ -17,7 +17,7 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"nock": "^13.3.3",
"tap": "^16.3.8"
},
@@ -40,7 +40,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
},
"tap": {
diff --git a/deps/npm/node_modules/libnpmversion/package.json b/deps/npm/node_modules/libnpmversion/package.json
index 66ab2724777..2ceebf979aa 100644
--- a/deps/npm/node_modules/libnpmversion/package.json
+++ b/deps/npm/node_modules/libnpmversion/package.json
@@ -33,7 +33,7 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.1",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"require-inject": "^1.4.4",
"tap": "^16.3.8"
},
@@ -49,7 +49,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "../../scripts/template-oss/index.js"
}
}
diff --git a/deps/npm/node_modules/normalize-package-data/lib/fixer.js b/deps/npm/node_modules/normalize-package-data/lib/fixer.js
index 1c30cad65e6..49b97f5e322 100644
--- a/deps/npm/node_modules/normalize-package-data/lib/fixer.js
+++ b/deps/npm/node_modules/normalize-package-data/lib/fixer.js
@@ -1,11 +1,11 @@
+var { URL } = require('node:url')
var isValidSemver = require('semver/functions/valid')
var cleanSemver = require('semver/functions/clean')
var validateLicense = require('validate-npm-package-license')
var hostedGitInfo = require('hosted-git-info')
-var moduleBuiltin = require('node:module')
+var { isBuiltin } = require('node:module')
var depTypes = ['dependencies', 'devDependencies', 'optionalDependencies']
var extractDescription = require('./extract_description')
-var url = require('url')
var typos = require('./typos.json')
var isEmail = str => str.includes('@') && (str.indexOf('@') < str.lastIndexOf('.'))
@@ -231,7 +231,7 @@ module.exports = {
data.name = data.name.trim()
}
ensureValidName(data.name, strict, options.allowLegacyCase)
- if (moduleBuiltin.builtinModules.includes(data.name)) {
+ if (isBuiltin(data.name)) {
this.warn('conflictingName', data.name)
}
},
@@ -269,8 +269,7 @@ module.exports = {
if (typeof data.bugs === 'string') {
if (isEmail(data.bugs)) {
data.bugs = { email: data.bugs }
- /* eslint-disable-next-line node/no-deprecated-api */
- } else if (url.parse(data.bugs).protocol) {
+ } else if (URL.canParse(data.bugs)) {
data.bugs = { url: data.bugs }
} else {
this.warn('nonEmailUrlBugsString')
@@ -280,8 +279,7 @@ module.exports = {
var oldBugs = data.bugs
data.bugs = {}
if (oldBugs.url) {
- /* eslint-disable-next-line node/no-deprecated-api */
- if (typeof (oldBugs.url) === 'string' && url.parse(oldBugs.url).protocol) {
+ if (URL.canParse(oldBugs.url)) {
data.bugs.url = oldBugs.url
} else {
this.warn('nonUrlBugsUrlField')
@@ -317,8 +315,7 @@ module.exports = {
this.warn('nonUrlHomepage')
return delete data.homepage
}
- /* eslint-disable-next-line node/no-deprecated-api */
- if (!url.parse(data.homepage).protocol) {
+ if (!URL.canParse(data.homepage)) {
data.homepage = 'http://' + data.homepage
}
},
diff --git a/deps/npm/node_modules/normalize-package-data/package.json b/deps/npm/node_modules/normalize-package-data/package.json
index a849ea3a848..bf9b20f19d6 100644
--- a/deps/npm/node_modules/normalize-package-data/package.json
+++ b/deps/npm/node_modules/normalize-package-data/package.json
@@ -1,6 +1,6 @@
{
"name": "normalize-package-data",
- "version": "7.0.0",
+ "version": "7.0.1",
"author": "GitHub Inc.",
"description": "Normalizes data that can be found in package.json files.",
"license": "BSD-2-Clause",
@@ -28,7 +28,7 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.0",
- "@npmcli/template-oss": "4.23.3",
+ "@npmcli/template-oss": "4.25.0",
"tap": "^16.0.1"
},
"files": [
@@ -40,7 +40,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.3",
+ "version": "4.25.0",
"publish": "true"
},
"tap": {
diff --git a/deps/npm/node_modules/socks/build/common/helpers.js b/deps/npm/node_modules/socks/build/common/helpers.js
index 58331c8659d..f0fcaf043d6 100644
--- a/deps/npm/node_modules/socks/build/common/helpers.js
+++ b/deps/npm/node_modules/socks/build/common/helpers.js
@@ -104,6 +104,7 @@ function validateCustomProxyAuth(proxy, options) {
function isValidSocksRemoteHost(remoteHost) {
return (remoteHost &&
typeof remoteHost.host === 'string' &&
+ Buffer.byteLength(remoteHost.host) < 256 &&
typeof remoteHost.port === 'number' &&
remoteHost.port >= 0 &&
remoteHost.port <= 65535);
diff --git a/deps/npm/node_modules/socks/package.json b/deps/npm/node_modules/socks/package.json
index 02e4f14e00c..be8ee73ccbc 100644
--- a/deps/npm/node_modules/socks/package.json
+++ b/deps/npm/node_modules/socks/package.json
@@ -1,7 +1,7 @@
{
"name": "socks",
"private": false,
- "version": "2.8.5",
+ "version": "2.8.6",
"description": "Fully featured SOCKS proxy client supporting SOCKSv4, SOCKSv4a, and SOCKSv5. Includes Bind and Associate functionality.",
"main": "build/index.js",
"typings": "typings/index.d.ts",
diff --git a/deps/npm/node_modules/tinyglobby/node_modules/picomatch/lib/constants.js b/deps/npm/node_modules/tinyglobby/node_modules/picomatch/lib/constants.js
index 27b3e20fdfe..3f7ef7e53ad 100644
--- a/deps/npm/node_modules/tinyglobby/node_modules/picomatch/lib/constants.js
+++ b/deps/npm/node_modules/tinyglobby/node_modules/picomatch/lib/constants.js
@@ -99,6 +99,7 @@ module.exports = {
// Replace globs with equivalent patterns to reduce parsing time.
REPLACEMENTS: {
+ __proto__: null,
'***': '*',
'**/**': '**',
'**/**/**': '**'
diff --git a/deps/npm/node_modules/tinyglobby/node_modules/picomatch/package.json b/deps/npm/node_modules/tinyglobby/node_modules/picomatch/package.json
index 703a83dcd06..372e27e05f4 100644
--- a/deps/npm/node_modules/tinyglobby/node_modules/picomatch/package.json
+++ b/deps/npm/node_modules/tinyglobby/node_modules/picomatch/package.json
@@ -1,7 +1,7 @@
{
"name": "picomatch",
"description": "Blazing fast and accurate glob matcher written in JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions.",
- "version": "4.0.2",
+ "version": "4.0.3",
"homepage": "https://github.com/micromatch/picomatch",
"author": "Jon Schlinkert (https://github.com/jonschlinkert)",
"funding": "https://github.com/sponsors/jonschlinkert",
diff --git a/deps/npm/node_modules/tuf-js/dist/error.js b/deps/npm/node_modules/tuf-js/dist/error.js
index f4b10fa2028..3a3c26a068a 100644
--- a/deps/npm/node_modules/tuf-js/dist/error.js
+++ b/deps/npm/node_modules/tuf-js/dist/error.js
@@ -40,6 +40,7 @@ class DownloadLengthMismatchError extends DownloadError {
exports.DownloadLengthMismatchError = DownloadLengthMismatchError;
// Returned by FetcherInterface implementations for HTTP errors.
class DownloadHTTPError extends DownloadError {
+ statusCode;
constructor(message, statusCode) {
super(message);
this.statusCode = statusCode;
diff --git a/deps/npm/node_modules/tuf-js/dist/fetcher.js b/deps/npm/node_modules/tuf-js/dist/fetcher.js
index f966ce1bb0c..b964135c7b0 100644
--- a/deps/npm/node_modules/tuf-js/dist/fetcher.js
+++ b/deps/npm/node_modules/tuf-js/dist/fetcher.js
@@ -25,16 +25,16 @@ class BaseFetcher {
// the length of the file as we go
try {
for await (const chunk of reader) {
- const bufferChunk = Buffer.from(chunk);
- numberOfBytesReceived += bufferChunk.length;
+ numberOfBytesReceived += chunk.length;
if (numberOfBytesReceived > maxLength) {
throw new error_1.DownloadLengthMismatchError('Max length reached');
}
- await writeBufferToStream(fileStream, bufferChunk);
+ await writeBufferToStream(fileStream, chunk);
}
}
finally {
// Make sure we always close the stream
+ // eslint-disable-next-line @typescript-eslint/unbound-method
await util_1.default.promisify(fileStream.close).bind(fileStream)();
}
return handler(tmpFile);
@@ -54,6 +54,8 @@ class BaseFetcher {
}
exports.BaseFetcher = BaseFetcher;
class DefaultFetcher extends BaseFetcher {
+ timeout;
+ retry;
constructor(options = {}) {
super();
this.timeout = options.timeout;
diff --git a/deps/npm/node_modules/tuf-js/dist/store.js b/deps/npm/node_modules/tuf-js/dist/store.js
index 85673361087..1b1669029a8 100644
--- a/deps/npm/node_modules/tuf-js/dist/store.js
+++ b/deps/npm/node_modules/tuf-js/dist/store.js
@@ -4,8 +4,9 @@ exports.TrustedMetadataStore = void 0;
const models_1 = require("@tufjs/models");
const error_1 = require("./error");
class TrustedMetadataStore {
+ trustedSet = {};
+ referenceTime;
constructor(rootData) {
- this.trustedSet = {};
// Client workflow 5.1: record fixed update start time
this.referenceTime = new Date();
// Client workflow 5.2: load trusted root metadata
@@ -30,7 +31,9 @@ class TrustedMetadataStore {
return this.trustedSet[name];
}
updateRoot(bytesBuffer) {
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
const data = JSON.parse(bytesBuffer.toString('utf8'));
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
const newRoot = models_1.Metadata.fromJSON(models_1.MetadataKind.Root, data);
if (newRoot.signed.type != models_1.MetadataKind.Root) {
throw new error_1.RepositoryError(`Expected 'root', got ${newRoot.signed.type}`);
@@ -54,7 +57,9 @@ class TrustedMetadataStore {
if (this.root.signed.isExpired(this.referenceTime)) {
throw new error_1.ExpiredMetadataError('Final root.json is expired');
}
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
const data = JSON.parse(bytesBuffer.toString('utf8'));
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
const newTimestamp = models_1.Metadata.fromJSON(models_1.MetadataKind.Timestamp, data);
if (newTimestamp.signed.type != models_1.MetadataKind.Timestamp) {
throw new error_1.RepositoryError(`Expected 'timestamp', got ${newTimestamp.signed.type}`);
@@ -102,7 +107,9 @@ class TrustedMetadataStore {
if (!trusted) {
snapshotMeta.verify(bytesBuffer);
}
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
const data = JSON.parse(bytesBuffer.toString('utf8'));
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
const newSnapshot = models_1.Metadata.fromJSON(models_1.MetadataKind.Snapshot, data);
if (newSnapshot.signed.type != models_1.MetadataKind.Snapshot) {
throw new error_1.RepositoryError(`Expected 'snapshot', got ${newSnapshot.signed.type}`);
@@ -147,7 +154,9 @@ class TrustedMetadataStore {
}
// Client workflow 5.6.2: check against snapshot role's targets hash
meta.verify(bytesBuffer);
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
const data = JSON.parse(bytesBuffer.toString('utf8'));
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
const newDelegate = models_1.Metadata.fromJSON(models_1.MetadataKind.Targets, data);
if (newDelegate.signed.type != models_1.MetadataKind.Targets) {
throw new error_1.RepositoryError(`Expected 'targets', got ${newDelegate.signed.type}`);
@@ -168,7 +177,9 @@ class TrustedMetadataStore {
// Verifies and loads data as trusted root metadata.
// Note that an expired initial root is still considered valid.
loadTrustedRoot(bytesBuffer) {
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
const data = JSON.parse(bytesBuffer.toString('utf8'));
+ // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
const root = models_1.Metadata.fromJSON(models_1.MetadataKind.Root, data);
if (root.signed.type != models_1.MetadataKind.Root) {
throw new error_1.RepositoryError(`Expected 'root', got ${root.signed.type}`);
diff --git a/deps/npm/node_modules/tuf-js/dist/updater.js b/deps/npm/node_modules/tuf-js/dist/updater.js
index 8d5eb4428f0..32046e4bec4 100644
--- a/deps/npm/node_modules/tuf-js/dist/updater.js
+++ b/deps/npm/node_modules/tuf-js/dist/updater.js
@@ -15,13 +15,23 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
}) : function(o, v) {
o["default"] = v;
});
-var __importStar = (this && this.__importStar) || function (mod) {
- if (mod && mod.__esModule) return mod;
- var result = {};
- if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
- __setModuleDefault(result, mod);
- return result;
-};
+var __importStar = (this && this.__importStar) || (function () {
+ var ownKeys = function(o) {
+ ownKeys = Object.getOwnPropertyNames || function (o) {
+ var ar = [];
+ for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+ return ar;
+ };
+ return ownKeys(o);
+ };
+ return function (mod) {
+ if (mod && mod.__esModule) return mod;
+ var result = {};
+ if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+ __setModuleDefault(result, mod);
+ return result;
+ };
+})();
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
@@ -38,6 +48,14 @@ const store_1 = require("./store");
const url = __importStar(require("./utils/url"));
const log = (0, debug_1.default)('tuf:cache');
class Updater {
+ dir;
+ metadataBaseUrl;
+ targetDir;
+ targetBaseUrl;
+ forceCache;
+ trustedSet;
+ config;
+ fetcher;
constructor(options) {
const { metadataDir, metadataBaseUrl, targetDir, targetBaseUrl, fetcher, config, } = options;
this.dir = metadataDir;
diff --git a/deps/npm/node_modules/tuf-js/package.json b/deps/npm/node_modules/tuf-js/package.json
index e79a3d45f3f..8fc7f377794 100644
--- a/deps/npm/node_modules/tuf-js/package.json
+++ b/deps/npm/node_modules/tuf-js/package.json
@@ -1,12 +1,12 @@
{
"name": "tuf-js",
- "version": "3.0.1",
+ "version": "3.1.0",
"description": "JavaScript implementation of The Update Framework (TUF)",
"main": "dist/index.js",
"types": "dist/index.d.ts",
"scripts": {
- "build": "tsc --build",
- "clean": "rm -rf dist && rm tsconfig.tsbuildinfo",
+ "build": "tsc --build tsconfig.build.json",
+ "clean": "rm -rf dist && rm tsconfig.build.tsbuildinfo",
"test": "jest"
},
"repository": {
@@ -34,8 +34,8 @@
},
"dependencies": {
"@tufjs/models": "3.0.1",
- "debug": "^4.3.6",
- "make-fetch-happen": "^14.0.1"
+ "debug": "^4.4.1",
+ "make-fetch-happen": "^14.0.3"
},
"engines": {
"node": "^18.17.0 || >=20.5.0"
diff --git a/deps/npm/node_modules/validate-npm-package-name/lib/index.js b/deps/npm/node_modules/validate-npm-package-name/lib/index.js
index 1501796870f..db6e86b0dfc 100644
--- a/deps/npm/node_modules/validate-npm-package-name/lib/index.js
+++ b/deps/npm/node_modules/validate-npm-package-name/lib/index.js
@@ -2,7 +2,7 @@
const { builtinModules: builtins } = require('module')
var scopedPackagePattern = new RegExp('^(?:@([^/]+?)[/])?([^/]+?)$')
-var blacklist = [
+var exclusionList = [
'node_modules',
'favicon.ico',
]
@@ -43,9 +43,9 @@ function validate (name) {
}
// No funny business
- blacklist.forEach(function (blacklistedName) {
- if (name.toLowerCase() === blacklistedName) {
- errors.push(blacklistedName + ' is a blacklisted name')
+ exclusionList.forEach(function (excludedName) {
+ if (name.toLowerCase() === excludedName) {
+ errors.push(excludedName + ' is not a valid package name')
}
})
diff --git a/deps/npm/node_modules/validate-npm-package-name/package.json b/deps/npm/node_modules/validate-npm-package-name/package.json
index 18c1dddb3a7..e5162f847fe 100644
--- a/deps/npm/node_modules/validate-npm-package-name/package.json
+++ b/deps/npm/node_modules/validate-npm-package-name/package.json
@@ -1,6 +1,6 @@
{
"name": "validate-npm-package-name",
- "version": "6.0.1",
+ "version": "6.0.2",
"description": "Give me a string and I'll tell you if it's a valid npm package name",
"main": "lib/",
"directories": {
@@ -8,7 +8,7 @@
},
"devDependencies": {
"@npmcli/eslint-config": "^5.0.0",
- "@npmcli/template-oss": "4.24.3",
+ "@npmcli/template-oss": "4.25.0",
"tap": "^16.0.1"
},
"scripts": {
@@ -49,7 +49,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.24.3",
+ "version": "4.25.0",
"publish": true
},
"tap": {
diff --git a/deps/npm/package.json b/deps/npm/package.json
index 88a9f8ce305..ad5800a1058 100644
--- a/deps/npm/package.json
+++ b/deps/npm/package.json
@@ -1,5 +1,5 @@
{
- "version": "11.4.2",
+ "version": "11.5.1",
"name": "npm",
"description": "a package manager for JavaScript",
"workspaces": [
@@ -52,8 +52,8 @@
},
"dependencies": {
"@isaacs/string-locale-compare": "^1.1.0",
- "@npmcli/arborist": "^9.1.2",
- "@npmcli/config": "^10.3.0",
+ "@npmcli/arborist": "^9.1.3",
+ "@npmcli/config": "^10.3.1",
"@npmcli/fs": "^4.0.0",
"@npmcli/map-workspaces": "^4.0.2",
"@npmcli/package-json": "^6.2.0",
@@ -65,7 +65,7 @@
"archy": "~1.0.0",
"cacache": "^19.0.1",
"chalk": "^5.4.1",
- "ci-info": "^4.2.0",
+ "ci-info": "^4.3.0",
"cli-columns": "^4.0.0",
"fastest-levenshtein": "^1.0.16",
"fs-minipass": "^3.0.3",
@@ -77,12 +77,12 @@
"is-cidr": "^5.1.1",
"json-parse-even-better-errors": "^4.0.0",
"libnpmaccess": "^10.0.1",
- "libnpmdiff": "^8.0.5",
- "libnpmexec": "^10.1.4",
- "libnpmfund": "^7.0.5",
+ "libnpmdiff": "^8.0.6",
+ "libnpmexec": "^10.1.5",
+ "libnpmfund": "^7.0.6",
"libnpmorg": "^8.0.0",
- "libnpmpack": "^9.0.5",
- "libnpmpublish": "^11.0.1",
+ "libnpmpack": "^9.0.6",
+ "libnpmpublish": "^11.1.0",
"libnpmsearch": "^9.0.0",
"libnpmteam": "^8.0.1",
"libnpmversion": "^8.0.1",
@@ -93,7 +93,7 @@
"ms": "^2.1.2",
"node-gyp": "^11.2.0",
"nopt": "^8.1.0",
- "normalize-package-data": "^7.0.0",
+ "normalize-package-data": "^7.0.1",
"npm-audit-report": "^6.0.0",
"npm-install-checks": "^7.1.1",
"npm-package-arg": "^12.0.2",
@@ -115,7 +115,7 @@
"text-table": "~0.2.0",
"tiny-relative-date": "^1.3.0",
"treeverse": "^3.0.0",
- "validate-npm-package-name": "^6.0.1",
+ "validate-npm-package-name": "^6.0.2",
"which": "^5.0.0"
},
"bundleDependencies": [
@@ -192,7 +192,7 @@
"@npmcli/git": "^6.0.3",
"@npmcli/mock-globals": "^1.0.0",
"@npmcli/mock-registry": "^1.0.0",
- "@npmcli/template-oss": "4.23.6",
+ "@npmcli/template-oss": "4.24.4",
"@tufjs/repo-mock": "^3.0.1",
"ajv": "^8.12.0",
"ajv-formats": "^2.1.1",
@@ -214,13 +214,13 @@
"licenses": "npx licensee --production --errors-only",
"test": "tap",
"test:nocolor": "CI=true tap -Rclassic",
- "test-all": "node . run test -ws -iwr --if-present",
+ "test-all": "node . run test --workspaces --include-workspace-root --if-present",
"snap": "tap",
"prepack": "node . run build -w docs",
"posttest": "node . run lint",
"lint": "node . run eslint",
"lintfix": "node . run eslint -- --fix",
- "lint-all": "node . run lint -ws -iwr --if-present",
+ "lint-all": "node . run lint --workspaces --include-workspace-root --if-present",
"resetdeps": "node scripts/resetdeps.js",
"rp-pull-request": "node scripts/update-authors.js",
"postlint": "template-oss-check",
@@ -250,7 +250,7 @@
},
"templateOSS": {
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
- "version": "4.23.6",
+ "version": "4.24.4",
"content": "./scripts/template-oss/root.js"
},
"license": "Artistic-2.0",
diff --git a/deps/npm/tap-snapshots/test/lib/docs.js.test.cjs b/deps/npm/tap-snapshots/test/lib/docs.js.test.cjs
index fbdf9981d30..14bd0648073 100644
--- a/deps/npm/tap-snapshots/test/lib/docs.js.test.cjs
+++ b/deps/npm/tap-snapshots/test/lib/docs.js.test.cjs
@@ -263,9 +263,9 @@ config is given, this value will always be set to \`legacy\`.
* Type: null or Date
If passed to \`npm install\`, will rebuild the npm tree such that only
-versions that were available **on or before** the \`--before\` time get
-installed. If there's no versions available for the current set of direct
-dependencies, the command will error.
+versions that were available **on or before** the given date are installed.
+If there are no versions available for the current set of dependencies, the
+command will error.
If the requested version is a \`dist-tag\` and the given tag does not pass the
\`--before\` filter, the most recent version less than or equal to that tag
@@ -290,7 +290,7 @@ systems.
#### \`browser\`
-* Default: OS X: \`"open"\`, Windows: \`"start"\`, Others: \`"xdg-open"\`
+* Default: macOS: \`"open"\`, Windows: \`"start"\`, Others: \`"xdg-open"\`
* Type: null, Boolean, or String
The browser that is called by npm commands to open websites.
@@ -1290,7 +1290,8 @@ a semver. Like the \`rc\` in \`1.2.0-rc.8\`.
#### \`progress\`
-* Default: \`true\` unless running in a known CI system
+* Default: \`true\` when not in CI and both stderr and stdout are TTYs and not
+ in a dumb terminal
* Type: Boolean
When set to \`true\`, npm will display a progress bar during time intensive
@@ -3301,8 +3302,9 @@ Options:
[--global-style] [--omit [--omit ...]]
[--include [--include ...]]
[--strict-peer-deps] [--prefer-dedupe] [--no-package-lock] [--package-lock-only]
-[--foreground-scripts] [--ignore-scripts] [--no-audit] [--no-bin-links]
-[--no-fund] [--dry-run] [--cpu ] [--os ] [--libc ]
+[--foreground-scripts] [--ignore-scripts] [--no-audit] [--before ]
+[--no-bin-links] [--no-fund] [--dry-run] [--cpu ] [--os ]
+[--libc ]
[-w|--workspace [-w|--workspace ...]]
[--workspaces] [--include-workspace-root] [--install-links]
@@ -3331,6 +3333,7 @@ aliases: add, i, in, ins, inst, insta, instal, isnt, isnta, isntal, isntall
#### \`foreground-scripts\`
#### \`ignore-scripts\`
#### \`audit\`
+#### \`before\`
#### \`bin-links\`
#### \`fund\`
#### \`dry-run\`
@@ -3399,8 +3402,9 @@ Options:
[--global-style] [--omit [--omit ...]]
[--include [--include ...]]
[--strict-peer-deps] [--prefer-dedupe] [--no-package-lock] [--package-lock-only]
-[--foreground-scripts] [--ignore-scripts] [--no-audit] [--no-bin-links]
-[--no-fund] [--dry-run] [--cpu ] [--os ] [--libc ]
+[--foreground-scripts] [--ignore-scripts] [--no-audit] [--before ]
+[--no-bin-links] [--no-fund] [--dry-run] [--cpu ] [--os ]
+[--libc ]
[-w|--workspace [-w|--workspace ...]]
[--workspaces] [--include-workspace-root] [--install-links]
@@ -3429,6 +3433,7 @@ alias: it
#### \`foreground-scripts\`
#### \`ignore-scripts\`
#### \`audit\`
+#### \`before\`
#### \`bin-links\`
#### \`fund\`
#### \`dry-run\`
@@ -3675,6 +3680,7 @@ npm outdated [ ...]
Options:
[-a|--all] [--json] [-l|--long] [-p|--parseable] [-g|--global]
[-w|--workspace [-w|--workspace ...]]
+[--before ]
Run "npm help outdated" for more info
@@ -3688,6 +3694,7 @@ npm outdated [ ...]
#### \`parseable\`
#### \`global\`
#### \`workspace\`
+#### \`before\`
`
exports[`test/lib/docs.js TAP usage owner > must match snapshot 1`] = `
@@ -4433,7 +4440,8 @@ Options:
[--omit [--omit ...]]
[--include [--include ...]]
[--strict-peer-deps] [--no-package-lock] [--foreground-scripts]
-[--ignore-scripts] [--no-audit] [--no-bin-links] [--no-fund] [--dry-run]
+[--ignore-scripts] [--no-audit] [--before ] [--no-bin-links] [--no-fund]
+[--dry-run]
[-w|--workspace [-w|--workspace ...]]
[--workspaces] [--include-workspace-root] [--install-links]
@@ -4459,6 +4467,7 @@ aliases: up, upgrade, udpate
#### \`foreground-scripts\`
#### \`ignore-scripts\`
#### \`audit\`
+#### \`before\`
#### \`bin-links\`
#### \`fund\`
#### \`dry-run\`
diff --git a/deps/npm/tap-snapshots/test/lib/utils/error-message.js.test.cjs b/deps/npm/tap-snapshots/test/lib/utils/error-message.js.test.cjs
index 954e95e7180..732c0b9747b 100644
--- a/deps/npm/tap-snapshots/test/lib/utils/error-message.js.test.cjs
+++ b/deps/npm/tap-snapshots/test/lib/utils/error-message.js.test.cjs
@@ -15,7 +15,7 @@ Object {
Array [
"404",
"",
- "'http://evil:***@npmjs.org/not-found' is not in this registry.",
+ "The requested resource 'http://evil:***@npmjs.org/not-found' could not be found or you do not have permission to access it.",
],
Array [
"404",
@@ -58,7 +58,7 @@ Object {
Array [
"404",
"",
- "'node_modules' is not in this registry.",
+ "The requested resource 'node_modules' could not be found or you do not have permission to access it.",
],
Array [
"404",
@@ -67,7 +67,7 @@ Object {
],
Array [
"404",
- " 1. node_modules is a blacklisted name",
+ " 1. node_modules is not a valid package name",
],
Array [
"404",
@@ -101,7 +101,7 @@ Object {
Array [
"404",
"",
- "'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' is not in this registry.",
+ "The requested resource 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' could not be found or you do not have permission to access it.",
],
Array [
"404",
@@ -156,7 +156,7 @@ Object {
Array [
"404",
"",
- "'yolo' is not in this registry.",
+ "The requested resource 'yolo' could not be found or you do not have permission to access it.",
],
Array [
"404",
diff --git a/deps/npm/test/fixtures/mock-oidc.js b/deps/npm/test/fixtures/mock-oidc.js
new file mode 100644
index 00000000000..0d1726a2f91
--- /dev/null
+++ b/deps/npm/test/fixtures/mock-oidc.js
@@ -0,0 +1,154 @@
+const ciInfo = require('ci-info')
+const nock = require('nock')
+const mockGlobals = require('@npmcli/mock-globals')
+const { loadNpmWithRegistry } = require('./mock-npm')
+const { mockProvenance } = require('@npmcli/mock-registry/lib/provenance')
+
+// this is an effort to not add a dependency to the cli just for testing
+function makeJwt (payload) {
+ const header = { alg: 'none', typ: 'JWT' }
+ const headerB64 = Buffer.from(JSON.stringify(header)).toString('base64')
+ const payloadB64 = Buffer.from(JSON.stringify(payload)).toString('base64')
+ // empty signature section
+ return `${headerB64}.${payloadB64}.`
+}
+
+function gitlabIdToken ({ visibility = 'public' } = { visibility: 'public' }) {
+ const now = Math.floor(Date.now() / 1000)
+ const payload = {
+ project_visibility: visibility,
+ iat: now,
+ exp: now + 3600, // 1 hour expiration
+ }
+ return makeJwt(payload)
+}
+
+function githubIdToken ({ visibility = 'public' } = { visibility: 'public' }) {
+ const now = Math.floor(Date.now() / 1000)
+ const payload = {
+ repository_visibility: visibility,
+ iat: now,
+ exp: now + 3600, // 1 hour expiration
+ }
+ return makeJwt(payload)
+}
+
+const mockOidc = async (t, {
+ oidcOptions = {},
+ packageName = '@npmcli/test-package',
+ config = {},
+ packageJson = {},
+ load = {},
+ mockGithubOidcOptions = null,
+ mockOidcTokenExchangeOptions = null,
+ publishOptions = {},
+ provenance = false,
+}) => {
+ const github = oidcOptions.github ?? false
+ const gitlab = oidcOptions.gitlab ?? false
+
+ const ACTIONS_ID_TOKEN_REQUEST_URL = oidcOptions.ACTIONS_ID_TOKEN_REQUEST_URL ?? 'https://github.com/actions/id-token'
+ const ACTIONS_ID_TOKEN_REQUEST_TOKEN = oidcOptions.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? 'ACTIONS_ID_TOKEN_REQUEST_TOKEN'
+
+ mockGlobals(t, {
+ process: {
+ env: {
+ ACTIONS_ID_TOKEN_REQUEST_TOKEN: ACTIONS_ID_TOKEN_REQUEST_TOKEN,
+ ACTIONS_ID_TOKEN_REQUEST_URL: ACTIONS_ID_TOKEN_REQUEST_URL,
+ CI: github || gitlab ? 'true' : undefined,
+ ...(github ? { GITHUB_ACTIONS: 'true' } : {}),
+ ...(gitlab ? { GITLAB_CI: 'true' } : {}),
+ ...(oidcOptions.NPM_ID_TOKEN ? { NPM_ID_TOKEN: oidcOptions.NPM_ID_TOKEN } : {}),
+ /* eslint-disable-next-line max-len */
+ ...(oidcOptions.SIGSTORE_ID_TOKEN ? { SIGSTORE_ID_TOKEN: oidcOptions.SIGSTORE_ID_TOKEN } : {}),
+ },
+ },
+ })
+
+ const GITHUB_ACTIONS = ciInfo.GITHUB_ACTIONS
+ const GITLAB = ciInfo.GITLAB
+ delete ciInfo.GITHUB_ACTIONS
+ delete ciInfo.GITLAB
+ if (github) {
+ ciInfo.GITHUB_ACTIONS = 'true'
+ }
+ if (gitlab) {
+ ciInfo.GITLAB = 'true'
+ }
+ t.teardown(() => {
+ ciInfo.GITHUB_ACTIONS = GITHUB_ACTIONS
+ ciInfo.GITLAB = GITLAB
+ })
+
+ const { npm, registry, joinedOutput, logs } = await loadNpmWithRegistry(t, {
+ config: {
+ loglevel: 'silly',
+ ...config,
+ },
+ prefixDir: {
+ 'package.json': JSON.stringify({
+ name: packageName,
+ version: '1.0.0',
+ ...packageJson,
+ }, null, 2),
+ },
+ ...load,
+ })
+
+ if (mockGithubOidcOptions) {
+ const { idToken, audience, statusCode = 200 } = mockGithubOidcOptions
+ const url = new URL(ACTIONS_ID_TOKEN_REQUEST_URL)
+ nock(url.origin)
+ .get(url.pathname)
+ .query({ audience })
+ .matchHeader('authorization', `Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}`)
+ .matchHeader('accept', 'application/json')
+ .reply(statusCode, statusCode !== 500 ? { value: idToken } : { message: 'Internal Server Error' })
+ }
+
+ if (mockOidcTokenExchangeOptions) {
+ registry.mockOidcTokenExchange({
+ packageName,
+ ...mockOidcTokenExchangeOptions,
+ })
+ }
+
+ registry.publish(packageName, publishOptions)
+
+ if ((github || gitlab) && provenance) {
+ registry.getVisibility({ spec: packageName, visibility: { public: true } })
+ mockProvenance(t, {
+ oidcURL: ACTIONS_ID_TOKEN_REQUEST_URL,
+ requestToken: ACTIONS_ID_TOKEN_REQUEST_TOKEN,
+ workflowPath: '.github/workflows/publish.yml',
+ repository: 'github/foo',
+ serverUrl: 'https://github.com',
+ ref: 'refs/tags/pkg@1.0.0',
+ sha: 'deadbeef',
+ runID: '123456',
+ runAttempt: '1',
+ runnerEnv: 'github-hosted',
+ })
+ }
+
+ return { npm, joinedOutput, logs, ACTIONS_ID_TOKEN_REQUEST_URL }
+}
+
+const oidcPublishTest = (opts) => {
+ return async (t) => {
+ const { logsContain } = opts
+ const { npm, joinedOutput, logs } = await mockOidc(t, opts)
+ await npm.exec('publish', [])
+ logsContain?.forEach(item => {
+ t.ok(logs.includes(item), `Expected log to include: ${item}`)
+ })
+ t.match(joinedOutput(), '+ @npmcli/test-package@1.0.0')
+ }
+}
+
+module.exports = {
+ gitlabIdToken,
+ githubIdToken,
+ mockOidc,
+ oidcPublishTest,
+}
diff --git a/deps/npm/test/lib/cli/exit-handler.js b/deps/npm/test/lib/cli/exit-handler.js
index 484704c7352..f8b112beab0 100644
--- a/deps/npm/test/lib/cli/exit-handler.js
+++ b/deps/npm/test/lib/cli/exit-handler.js
@@ -4,7 +4,7 @@ const EventEmitter = require('node:events')
const os = require('node:os')
const t = require('tap')
const fsMiniPass = require('fs-minipass')
-const { output, time } = require('proc-log')
+const { output, time, log } = require('proc-log')
const errorMessage = require('../../../lib/utils/error-message.js')
const ExecCommand = require('../../../lib/commands/exec.js')
const { load: loadMockNpm } = require('../../fixtures/mock-npm')
@@ -707,3 +707,136 @@ t.test('do no fancy handling for shellouts', async t => {
})
})
})
+
+t.test('container scenarios that trigger exit handler bug', async t => {
+ t.test('process.exit() called before exit handler cleanup', async (t) => {
+ // Simulates when npm process exits directly without going through proper cleanup
+
+ let exitHandlerNeverCalledLogged = false
+ let npmBugReportLogged = false
+
+ await mockExitHandler(t, {
+ config: { loglevel: 'notice' },
+ })
+
+ // Override log.error to capture the specific error messages
+ const originalLogError = log.error
+ log.error = (prefix, msg) => {
+ if (msg === 'Exit handler never called!') {
+ exitHandlerNeverCalledLogged = true
+ }
+ if (msg === 'This is an error with npm itself. Please report this error at:') {
+ npmBugReportLogged = true
+ }
+ return originalLogError(prefix, msg)
+ }
+
+ t.teardown(() => {
+ log.error = originalLogError
+ })
+
+ // This happens when containers are stopped/killed before npm can clean up properly
+ process.emit('exit', 1)
+
+ // Verify the bug is detected and logged correctly
+ t.equal(exitHandlerNeverCalledLogged, true, 'should log "Exit handler never called!" error')
+ t.equal(npmBugReportLogged, true, 'should log npm bug report message')
+ })
+
+ t.test('SIGTERM signal is handled properly', (t) => {
+ // This test verifies that our fix handles SIGTERM signals
+
+ const ExitHandler = tmock(t, '{LIB}/cli/exit-handler.js')
+ const exitHandler = new ExitHandler({ process })
+
+ const initialSigtermCount = process.listeners('SIGTERM').length
+ const initialSigintCount = process.listeners('SIGINT').length
+ const initialSighupCount = process.listeners('SIGHUP').length
+
+ // Register signal handlers
+ exitHandler.registerUncaughtHandlers()
+
+ const finalSigtermCount = process.listeners('SIGTERM').length
+ const finalSigintCount = process.listeners('SIGINT').length
+ const finalSighupCount = process.listeners('SIGHUP').length
+
+ // Verify the fix: signal handlers should be registered
+ t.ok(finalSigtermCount > initialSigtermCount, 'SIGTERM handler should be registered')
+ t.ok(finalSigintCount > initialSigintCount, 'SIGINT handler should be registered')
+ t.ok(finalSighupCount > initialSighupCount, 'SIGHUP handler should be registered')
+
+ // Clean up listeners to avoid affecting other tests
+ const sigtermListeners = process.listeners('SIGTERM')
+ const sigintListeners = process.listeners('SIGINT')
+ const sighupListeners = process.listeners('SIGHUP')
+
+ for (const listener of sigtermListeners) {
+ process.removeListener('SIGTERM', listener)
+ }
+ for (const listener of sigintListeners) {
+ process.removeListener('SIGINT', listener)
+ }
+ for (const listener of sighupListeners) {
+ process.removeListener('SIGHUP', listener)
+ }
+
+ t.end()
+ })
+
+ t.test('signal handler execution', async (t) => {
+ const ExitHandler = tmock(t, '{LIB}/cli/exit-handler.js')
+ const exitHandler = new ExitHandler({ process })
+
+ // Register signal handlers
+ exitHandler.registerUncaughtHandlers()
+
+ process.emit('SIGTERM')
+ process.emit('SIGINT')
+ process.emit('SIGHUP')
+
+ // Clean up listeners
+ process.removeAllListeners('SIGTERM')
+ process.removeAllListeners('SIGINT')
+ process.removeAllListeners('SIGHUP')
+
+ t.pass('signal handlers executed successfully')
+ t.end()
+ })
+
+ t.test('hanging async operation interrupted by signal', async (t) => {
+ // This test simulates the scenario where npm hangs on a long operation and receives SIGTERM/SIGKILL before it can complete
+
+ let exitHandlerNeverCalledLogged = false
+
+ const { exitHandler } = await mockExitHandler(t, {
+ config: { loglevel: 'notice' },
+ })
+
+ // Override log.error to detect the bug message
+ const originalLogError = log.error
+ log.error = (prefix, msg) => {
+ if (msg === 'Exit handler never called!') {
+ exitHandlerNeverCalledLogged = true
+ }
+ return originalLogError(prefix, msg)
+ }
+
+ t.teardown(() => {
+ log.error = originalLogError
+ })
+
+ // Track if exit handler was called properly
+ let exitHandlerCalled = false
+ exitHandler.exit = () => {
+ exitHandlerCalled = true
+ }
+
+ // Simulate sending signal to the process without proper cleanup
+ // This mimics what happens when a container is terminated
+ process.emit('exit', 1)
+
+ // Verify the bug conditions
+ t.equal(exitHandlerCalled, false, 'exit handler should not be called in this scenario')
+ t.equal(exitHandlerNeverCalledLogged, true, 'should detect and log the exit handler bug')
+ })
+})
diff --git a/deps/npm/test/lib/commands/publish.js b/deps/npm/test/lib/commands/publish.js
index 3d1d629e31b..f228bfaa599 100644
--- a/deps/npm/test/lib/commands/publish.js
+++ b/deps/npm/test/lib/commands/publish.js
@@ -5,6 +5,9 @@ const pacote = require('pacote')
const Arborist = require('@npmcli/arborist')
const path = require('node:path')
const fs = require('node:fs')
+const { githubIdToken, gitlabIdToken, oidcPublishTest, mockOidc } = require('../../fixtures/mock-oidc')
+const { sigstoreIdToken } = require('@npmcli/mock-registry/lib/provenance')
+const mockGlobals = require('@npmcli/mock-globals')
const pkg = '@npmcli/test-package'
const token = 'test-auth-token'
@@ -988,3 +991,489 @@ t.test('semver highest dist tag', async t => {
await npm.exec('publish', [])
})
})
+
+t.test('oidc token exchange - no provenance', t => {
+ const githubPrivateIdToken = githubIdToken({ visibility: 'private' })
+ const gitlabPrivateIdToken = gitlabIdToken({ visibility: 'private' })
+
+ t.test('oidc token 500 with fallback', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ statusCode: 500,
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'verbose oidc Failed to fetch id_token from GitHub: received an invalid response',
+ ],
+ }))
+
+ t.test('oidc token invalid body with fallback', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: null,
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'verbose oidc Failed to fetch id_token from GitHub: missing value',
+ ],
+ }))
+
+ t.test('token exchange 500 with fallback', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPrivateIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ statusCode: 500,
+ idToken: githubPrivateIdToken,
+ body: {
+ message: 'oidc token exchange failed',
+ },
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'verbose oidc Failed token exchange request with body message: oidc token exchange failed',
+ ],
+ }))
+
+ t.test('token exchange 500 with no body message with fallback', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPrivateIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPrivateIdToken,
+ statusCode: 500,
+ body: undefined,
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'verbose oidc Failed token exchange request with body message: Unknown error',
+ ],
+ }))
+
+ t.test('token exchange invalid body with fallback', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPrivateIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPrivateIdToken,
+ body: {
+ token: null,
+ },
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'verbose oidc Failed because token exchange was missing the token in the response body',
+ ],
+ }))
+
+ t.test('github missing ACTIONS_ID_TOKEN_REQUEST_URL', oidcPublishTest({
+ oidcOptions: { github: true, ACTIONS_ID_TOKEN_REQUEST_URL: '' },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'silly oidc Skipped because incorrect permissions for id-token within GitHub workflow',
+ ],
+ }))
+
+ t.test('gitlab missing NPM_ID_TOKEN', oidcPublishTest({
+ oidcOptions: { gitlab: true, NPM_ID_TOKEN: '' },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'silly oidc Skipped because no id_token available',
+ ],
+ }))
+
+ t.test('no ci', oidcPublishTest({
+ oidcOptions: { github: false, gitlab: false },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ }))
+
+ // default registry success
+
+ t.test('default registry success github', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPrivateIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPrivateIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ }))
+
+ t.test('global try-catch failure via malformed url', oidcPublishTest({
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ oidcOptions: {
+ github: true,
+ // malformed url should trigger a global try-catch
+ ACTIONS_ID_TOKEN_REQUEST_URL: '//github.com',
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'verbose oidc Failure with message: Invalid URL',
+ ],
+ }))
+
+ t.test('global try-catch failure via throw non Error', async t => {
+ const { npm, logs, joinedOutput, ACTIONS_ID_TOKEN_REQUEST_URL } = await mockOidc(t, {
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ oidcOptions: {
+ github: true,
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ })
+
+ class URLOverride extends URL {
+ constructor (...args) {
+ const [url] = args
+ if (url === ACTIONS_ID_TOKEN_REQUEST_URL) {
+ throw 'Specifically throwing a non errror object to test global try-catch'
+ }
+ super(...args)
+ }
+ }
+
+ mockGlobals(t, {
+ URL: URLOverride,
+ })
+
+ await npm.exec('publish', [])
+ t.match(joinedOutput(), '+ @npmcli/test-package@1.0.0')
+ t.ok(logs.includes('verbose oidc Failure with message: Unknown error'))
+ })
+
+ t.test('default registry success gitlab', oidcPublishTest({
+ oidcOptions: { gitlab: true, NPM_ID_TOKEN: gitlabPrivateIdToken },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: gitlabPrivateIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ }))
+
+ // custom registry success
+
+ t.test('custom registry config success github', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ registry: 'https://registry.zzz.org',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.zzz.org',
+ idToken: githubPrivateIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPrivateIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ }))
+
+ t.test('custom registry scoped config success github', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '@npmcli:registry': 'https://registry.zzz.org',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.zzz.org',
+ idToken: githubPrivateIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPrivateIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ load: {
+ registry: 'https://registry.zzz.org',
+ },
+ }))
+
+ t.test('custom registry publishConfig success github', oidcPublishTest({
+ oidcOptions: { github: true },
+ packageJson: {
+ publishConfig: {
+ registry: 'https://registry.zzz.org',
+ },
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.zzz.org',
+ idToken: githubPrivateIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPrivateIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ load: {
+ registry: 'https://registry.zzz.org',
+ },
+ }))
+
+ t.test('dry-run can be used to check oidc config but not publish', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ 'dry-run': true,
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPrivateIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPrivateIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ noPut: true,
+ },
+ }))
+
+ t.end()
+})
+
+t.test('oidc token exchange - provenance', (t) => {
+ const githubPublicIdToken = githubIdToken({ visibility: 'public' })
+ const gitlabPublicIdToken = gitlabIdToken({ visibility: 'public' })
+ const SIGSTORE_ID_TOKEN = sigstoreIdToken()
+
+ t.test('default registry success github', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPublicIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPublicIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ provenance: true,
+ }))
+
+ t.test('default registry success gitlab', oidcPublishTest({
+ oidcOptions: { gitlab: true, NPM_ID_TOKEN: gitlabPublicIdToken, SIGSTORE_ID_TOKEN },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: gitlabPublicIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ provenance: true,
+ }))
+
+ t.test('default registry success gitlab without SIGSTORE_ID_TOKEN', oidcPublishTest({
+ oidcOptions: { gitlab: true, NPM_ID_TOKEN: gitlabPublicIdToken },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: gitlabPublicIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ provenance: false,
+ }))
+
+ t.test('setting provenance true in config should enable provenance', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ provenance: true,
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPublicIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPublicIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ provenance: true,
+ }))
+
+ t.test('setting provenance false in config should not use provenance', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ provenance: false,
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPublicIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: githubPublicIdToken,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ }))
+
+ const brokenJwts = [
+ 'x.invalid-jwt.x',
+ 'x.invalid-jwt.',
+ 'x.invalid-jwt',
+ 'x.',
+ 'x',
+ ]
+
+ brokenJwts.map((brokenJwt) => {
+ // windows does not like `.` in the filename
+ t.test(`broken jwt ${brokenJwt.replaceAll('.', '_')}`, oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: brokenJwt,
+ },
+ mockOidcTokenExchangeOptions: {
+ idToken: brokenJwt,
+ body: {
+ token: 'exchange-token',
+ },
+ },
+ publishOptions: {
+ token: 'exchange-token',
+ },
+ }))
+ })
+
+ t.test('token exchange 500 with fallback should not have provenance by default', oidcPublishTest({
+ oidcOptions: { github: true },
+ config: {
+ '//registry.npmjs.org/:_authToken': 'existing-fallback-token',
+ },
+ mockGithubOidcOptions: {
+ audience: 'npm:registry.npmjs.org',
+ idToken: githubPublicIdToken,
+ },
+ mockOidcTokenExchangeOptions: {
+ statusCode: 500,
+ idToken: githubPublicIdToken,
+ body: {
+ message: 'oidc token exchange failed',
+ },
+ },
+ publishOptions: {
+ token: 'existing-fallback-token',
+ },
+ logsContain: [
+ 'verbose oidc Failed token exchange request with body message: oidc token exchange failed',
+ ],
+ provenance: false,
+ }))
+
+ t.end()
+})
diff --git a/deps/npm/test/lib/commands/view.js b/deps/npm/test/lib/commands/view.js
index e2ef35a5fd5..5b63cecf7da 100644
--- a/deps/npm/test/lib/commands/view.js
+++ b/deps/npm/test/lib/commands/view.js
@@ -126,6 +126,34 @@ const packument = (nv, opts) => {
'1.0.1': {},
},
},
+ 'cyan-oidc': {
+ _npmUser: {
+ name: 'claudia',
+ email: 'claudia@cyan.com',
+ trustedPublisher: {
+ id: 'github',
+ oidcConfigId: 'oidc:a0e127d0-8d66-45d0-8264-e4f8372c7249',
+ },
+ },
+ name: 'cyan',
+ 'dist-tags': {
+ latest: '1.0.0',
+ },
+ versions: {
+ '1.0.0': {
+ version: '1.0.0',
+ name: 'cyan',
+ dist: {
+ shasum: '123',
+ tarball: 'http://hm.cyan.com/1.0.0.tgz',
+ integrity: '---',
+ fileCount: 1,
+ unpackedSize: 1000000,
+ },
+ },
+ '1.0.1': {},
+ },
+ },
brown: {
name: 'brown',
},
@@ -438,6 +466,12 @@ t.test('package with --json and semver range', async t => {
t.matchSnapshot(joinedOutput())
})
+t.test('package with _npmUser.trustedPublisher shows cleaned up property with --json', async t => {
+ const { view, joinedOutput } = await loadMockNpm(t, { config: { json: true } })
+ await view.exec(['cyan-oidc@^1.0.0'])
+ t.match(joinedOutput(), /claudia /, 'uses oidc trustedPublisher info for _npmUser')
+})
+
t.test('package with --json and no versions', async t => {
const { view, joinedOutput } = await loadMockNpm(t, { config: { json: true } })
await view.exec(['brown'])