FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade npm to 8.14.0 · nodejs/node@4096d81 · GitHub

deps: upgrade npm to 8.14.0 · nodejs/node@4096d81 · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit 4096d81

Browse files
npm-cli-bot
authored and
MylesBorins
committed
deps: upgrade npm to 8.14.0
PR-URL: #43826 Reviewed-By: Tobias Nießen <tniessen@tnie.de> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com> Reviewed-By: Darshan Sen <raisinten@gmail.com>
1 parent 581a84e commit 4096d81

133 files changed

Lines changed: 3787 additions & 511 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/npm/docs/content/commands/npm-adduser.md‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -93,13 +93,12 @@ npm init --scope=@foo --yes
9393
#### `auth-type`
9494

9595
* Default: "legacy"
96-
* Type: "legacy", "webauthn", "sso", "saml", or "oauth"
97-
* DEPRECATED: The SSO/SAML/OAuth methods are deprecated and will be removed in
98-
a future version of npm in favor of web-based login.
96+
* Type: "legacy", "web", "sso", "saml", "oauth", or "webauthn"
9997

100-
What authentication strategy to use with `adduser`/`login`.
98+
NOTE: auth-type values "sso", "saml", "oauth", and "webauthn" will be
99+
removed in a future version.
101100

102-
Pass `webauthn` to use a web-based login.
101+
What authentication strategy to use with `login`.
103102

104103
<!-- automatically generated, do not edit manually -->
105104
<!-- see lib/utils/config/definitions.js -->

‎deps/npm/docs/content/commands/npm-audit.md‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ description: Run a security audit
1111
<!-- see lib/commands/audit.js -->
1212

1313
```bash
14-
npm audit [fix]
14+
npm audit [fix|signatures]
1515
```
1616

1717
<!-- automatically generated, do not edit manually -->
@@ -41,6 +41,17 @@ vulnerability is found. It may be useful in CI environments to include the
4141
will cause the command to fail. This option does not filter the report
4242
output, it simply changes the command's failure threshold.
4343

44+
### Audit Signatures
45+
46+
This command can also audit the integrity values of the packages in your
47+
tree against any signatures present in the registry they were downloaded
48+
from. npm will attempt to download the keys from `/-/npm/v1/keys` on
49+
each the registry used to download any given package. It will then
50+
check the `dist.signatures` object in the package itself, and verify the
51+
`sig` present there using the `keyid` there, matching it with a key
52+
returned from the registry. The command for this is `npm audit
53+
signatures`
54+
4455
### Audit Endpoints
4556

4657
There are two audit endpoints that npm may use to fetch vulnerability

‎deps/npm/docs/content/commands/npm.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ following help topics:
102102
done via [`npm install`](/commands/npm-install)
103103
* adduser:
104104
Create an account or log in. When you do this, npm will store
105-
credentials in the user config file config file.
105+
credentials in the user config file.
106106
* publish:
107107
Use the [`npm publish`](/commands/npm-publish) command to upload your
108108
code to the registry.

‎deps/npm/docs/content/configuring-npm/package-json.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ IDs](https://spdx.org/licenses/). Ideally you should pick one that is
124124

125125
If your package is licensed under multiple common licenses, use an [SPDX
126126
license expression syntax version 2.0
127-
string](https://www.npmjs.com/package/spdx), like this:
127+
string](https://spdx.dev/specifications/), like this:
128128

129129
```json
130130
{

‎deps/npm/docs/content/using-npm/config.md‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -215,6 +215,19 @@ exit code.
215215
<!-- automatically generated, do not edit manually -->
216216
<!-- see lib/utils/config/definitions.js -->
217217

218+
#### `auth-type`
219+
220+
* Default: "legacy"
221+
* Type: "legacy", "web", "sso", "saml", "oauth", or "webauthn"
222+
223+
NOTE: auth-type values "sso", "saml", "oauth", and "webauthn" will be
224+
removed in a future version.
225+
226+
What authentication strategy to use with `login`.
227+
228+
<!-- automatically generated, do not edit manually -->
229+
<!-- see lib/utils/config/definitions.js -->
230+
218231
#### `before`
219232

220233
* Default: null
@@ -1905,20 +1918,6 @@ When set to `dev` or `development`, this is an alias for `--include=dev`.
19051918
<!-- automatically generated, do not edit manually -->
19061919
<!-- see lib/utils/config/definitions.js -->
19071920

1908-
#### `auth-type`
1909-
1910-
* Default: "legacy"
1911-
* Type: "legacy", "webauthn", "sso", "saml", or "oauth"
1912-
* DEPRECATED: The SSO/SAML/OAuth methods are deprecated and will be removed in
1913-
a future version of npm in favor of web-based login.
1914-
1915-
What authentication strategy to use with `adduser`/`login`.
1916-
1917-
Pass `webauthn` to use a web-based login.
1918-
1919-
<!-- automatically generated, do not edit manually -->
1920-
<!-- see lib/utils/config/definitions.js -->
1921-
19221921
#### `cache-max`
19231922

19241923
* Default: Infinity

‎deps/npm/docs/content/using-npm/scripts.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ There are some special life cycle scripts that happen only in certain
3939
situations. These scripts happen in addition to the `pre<event>`, `post<event>`, and
4040
`<event>` scripts.
4141

42-
* `prepare`, `prepublish`, `prepublishOnly`, `prepack`, `postpack`
42+
* `prepare`, `prepublish`, `prepublishOnly`, `prepack`, `postpack`, `dependencies`
4343

4444
**prepare** (since `npm@4.0.0`)
4545
* Runs any time before the package is packed, i.e. during `npm publish`
@@ -71,6 +71,10 @@ situations. These scripts happen in addition to the `pre<event>`, `post<event>`,
7171
**postpack**
7272
* Runs AFTER the tarball has been generated but before it is moved to its final destination (if at all, publish does not save the tarball locally)
7373

74+
**dependencies**
75+
* Runs AFTER any operations that modify the `node_modules` directory IF changes occurred.
76+
* Does NOT run in global mode
77+
7478
#### Prepare and Prepublish
7579

7680
**Deprecation Note: prepublish**
@@ -96,6 +100,10 @@ The advantage of doing these things at `prepublish` time is that they can be don
96100
* You don't need to rely on your users having `curl` or `wget` or
97101
other system tools on the target machines.
98102

103+
#### Dependencies
104+
105+
The `dependencies` script is run any time an `npm` command causes changes to the `node_modules` directory. It is run AFTER the changes have been applied and the `package.json` and `package-lock.json` files have been updated.
106+
99107
### Life Cycle Operation Order
100108

101109
#### [`npm cache add`](/commands/npm-cache)

‎deps/npm/docs/content/using-npm/workspaces.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ structure of files and folders:
5757
```
5858
.
5959
+-- node_modules
60-
| `-- packages/a -> ../packages/a
60+
| `-- a -> ../packages/a
6161
+-- package-lock.json
6262
+-- package.json
6363
`-- packages
@@ -112,15 +112,15 @@ respect the provided `workspace` configuration.
112112

113113
Given the [specifities of how Node.js handles module resolution](https://nodejs.org/dist/latest-v14.x/docs/api/modules.html#modules_all_together) it's possible to consume any defined workspace
114114
by its declared `package.json` `name`. Continuing from the example defined
115-
above, let's also create a Node.js script that will require the `workspace-a`
115+
above, let's also create a Node.js script that will require the workspace `a`
116116
example module, e.g:
117117

118118
```
119-
// ./workspace-a/index.js
119+
// ./packages/a/index.js
120120
module.exports = 'a'
121121
122122
// ./lib/index.js
123-
const moduleA = require('workspace-a')
123+
const moduleA = require('a')
124124
console.log(moduleA) // -> a
125125
```
126126

‎deps/npm/docs/output/commands/npm-adduser.html‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -207,12 +207,11 @@ <h4 id="scope"><code>scope</code></h4>
207207
<h4 id="auth-type"><code>auth-type</code></h4>
208208
<ul>
209209
<li>Default: "legacy"</li>
210-
<li>Type: "legacy", "webauthn", "sso", "saml", or "oauth"</li>
211-
<li>DEPRECATED: The SSO/SAML/OAuth methods are deprecated and will be removed in
212-
a future version of npm in favor of web-based login.</li>
210+
<li>Type: "legacy", "web", "sso", "saml", "oauth", or "webauthn"</li>
213211
</ul>
214-
<p>What authentication strategy to use with <code>adduser</code>/<code>login</code>.</p>
215-
<p>Pass <code>webauthn</code> to use a web-based login.</p>
212+
<p>NOTE: auth-type values "sso", "saml", "oauth", and "webauthn" will be
213+
removed in a future version.</p>
214+
<p>What authentication strategy to use with <code>login</code>.</p>
216215
<!-- raw HTML omitted -->
217216
<!-- raw HTML omitted -->
218217
<!-- raw HTML omitted -->

‎deps/npm/docs/output/commands/npm-audit.html‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -142,14 +142,14 @@ <h1 id="npm-audit">npm-audit</h1>
142142

143143
<section id="table_of_contents">
144144
<h2 id="table-of-contents">Table of contents</h2>
145-
<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#audit-endpoints">Audit Endpoints</a></li><ul><li><a href="#bulk-advisory-endpoint">Bulk Advisory Endpoint</a></li><li><a href="#quick-audit-endpoint">Quick Audit Endpoint</a></li><li><a href="#scrubbing">Scrubbing</a></li><li><a href="#calculating-meta-vulnerabilities-and-remediations">Calculating Meta-Vulnerabilities and Remediations</a></li></ul><li><a href="#exit-code">Exit Code</a></li><li><a href="#examples">Examples</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#audit-level"><code>audit-level</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#package-lock-only"><code>package-lock-only</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#foreground-scripts"><code>foreground-scripts</code></a></li><li><a href="#ignore-scripts"><code>ignore-scripts</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li><li><a href="#install-links"><code>install-links</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
145+
<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#audit-signatures">Audit Signatures</a></li><li><a href="#audit-endpoints">Audit Endpoints</a></li><ul><li><a href="#bulk-advisory-endpoint">Bulk Advisory Endpoint</a></li><li><a href="#quick-audit-endpoint">Quick Audit Endpoint</a></li><li><a href="#scrubbing">Scrubbing</a></li><li><a href="#calculating-meta-vulnerabilities-and-remediations">Calculating Meta-Vulnerabilities and Remediations</a></li></ul><li><a href="#exit-code">Exit Code</a></li><li><a href="#examples">Examples</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#audit-level"><code>audit-level</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#package-lock-only"><code>package-lock-only</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#foreground-scripts"><code>foreground-scripts</code></a></li><li><a href="#ignore-scripts"><code>ignore-scripts</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li><li><a href="#install-links"><code>install-links</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
146146
</section>
147147

148148
<div id="_content"><h3 id="synopsis">Synopsis</h3>
149149
<!-- raw HTML omitted -->
150150
<!-- raw HTML omitted -->
151151
<!-- raw HTML omitted -->
152-
<pre lang="bash"><code>npm audit [fix]
152+
<pre lang="bash"><code>npm audit [fix|signatures]
153153
</code></pre>
154154
<!-- raw HTML omitted -->
155155
<!-- raw HTML omitted -->
@@ -170,6 +170,14 @@ <h3 id="description">Description</h3>
170170
<code>--audit-level</code> parameter to specify the minimum vulnerability level that
171171
will cause the command to fail. This option does not filter the report
172172
output, it simply changes the command's failure threshold.</p>
173+
<h3 id="audit-signatures">Audit Signatures</h3>
174+
<p>This command can also audit the integrity values of the packages in your
175+
tree against any signatures present in the registry they were downloaded
176+
from. npm will attempt to download the keys from <code>/-/npm/v1/keys</code> on
177+
each the registry used to download any given package. It will then
178+
check the <code>dist.signatures</code> object in the package itself, and verify the
179+
<code>sig</code> present there using the <code>keyid</code> there, matching it with a key
180+
returned from the registry. The command for this is <code>npm audit signatures</code></p>
173181
<h3 id="audit-endpoints">Audit Endpoints</h3>
174182
<p>There are two audit endpoints that npm may use to fetch vulnerability
175183
information: the <code>Bulk Advisory</code> endpoint and the <code>Quick Audit</code> endpoint.</p>

‎deps/npm/docs/output/commands/npm-ls.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ <h3 id="description">Description</h3>
166166
the results to only the paths to the packages named. Note that nested
167167
packages will <em>also</em> show the paths to the specified packages. For
168168
example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
169-
<pre lang="bash"><code>npm@8.13.2 /path/to/npm
169+
<pre lang="bash"><code>npm@8.14.0 /path/to/npm
170170
└─┬ init-package-json@0.0.4
171171
└── promzard@0.1.5
172172
</code></pre>

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL