FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

deps: upgrade npm to 8.15.0 · nodejs/node@979f469 · GitHub

deps: upgrade npm to 8.15.0 · nodejs/node@979f469 · GitHub
Skip to content

Navigation Menu

Sign in
Sign in
Sign up

Commit 979f469

Browse files
npm-cli-bot
authored and
MylesBorins
committed
deps: upgrade npm to 8.15.0
PR-URL: #43917 Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Mestery <mestery@protonmail.com> Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent 4096d81 commit 979f469

48 files changed

Lines changed: 475 additions & 114 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎deps/npm/docs/content/commands/npm-audit.md‎

Lines changed: 49 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,55 @@ output, it simply changes the command's failure threshold.
4343

4444
### Audit Signatures
4545

46-
This command can also audit the integrity values of the packages in your
47-
tree against any signatures present in the registry they were downloaded
48-
from. npm will attempt to download the keys from `/-/npm/v1/keys` on
49-
each the registry used to download any given package. It will then
50-
check the `dist.signatures` object in the package itself, and verify the
51-
`sig` present there using the `keyid` there, matching it with a key
52-
returned from the registry. The command for this is `npm audit
53-
signatures`
46+
To ensure the integrity of packages you download from the public npm registry, or any registry that supports signatures, you can verify the registry signatures of downloaded packages using the npm CLI.
47+
48+
Registry signatures can be verified using the following `audit` command:
49+
50+
```bash
51+
$ npm audit signatures
52+
```
53+
54+
The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:
55+
56+
1. Signatures are provided in the package's `packument` in each published version within the `dist` object:
57+
58+
```json
59+
"dist":{
60+
"..omitted..": "..omitted..",
61+
"signatures": [{
62+
"keyid": "SHA256:{{SHA256_PUBLIC_KEY}}",
63+
"sig": "a312b9c3cb4a1b693e8ebac5ee1ca9cc01f2661c14391917dcb111517f72370809..."
64+
}]
65+
}
66+
```
67+
68+
See this [example](https://registry.npmjs.org/light-cycle/1.4.3) of a signed package from the public npm registry.
69+
70+
The `sig` is generated using the following template: `${package.name}@${package.version}:${package.dist.integrity}` and the `keyid` has to match one of the public signing keys below.
71+
72+
2. Public signing keys are provided at `registry-host.tld/-/npm/v1/keys` in the following format:
73+
74+
```
75+
{
76+
"keys": [{
77+
"expires": null,
78+
"keyid": "SHA256:{{SHA256_PUBLIC_KEY}}",
79+
"keytype": "ecdsa-sha2-nistp256",
80+
"scheme": "ecdsa-sha2-nistp256",
81+
"key": "{{B64_PUBLIC_KEY}}"
82+
}]
83+
}
84+
```
85+
86+
Keys response:
87+
88+
- `expires`: null or a simplified extended <a href="https://en.wikipedia.org/wiki/ISO_8601" target="_blank">ISO 8601 format</a>: `YYYY-MM-DDTHH:mm:ss.sssZ`
89+
- `keydid`: sha256 fingerprint of the public key
90+
- `keytype`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
91+
- `scheme`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
92+
- `key`: base64 encoded public key
93+
94+
See this <a href="https://registry.npmjs.org/-/npm/v1/keys" target="_blank">example key's response from the public npm registry</a>.
5495

5596
### Audit Endpoints
5697

‎deps/npm/docs/content/configuring-npm/folders.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,7 +202,7 @@ For a graphical breakdown of what is installed where, use `npm ls`.
202202
#### Publishing
203203
204204
Upon publishing, npm will look in the `node_modules` folder. If any of
205-
the items there are not in the `bundledDependencies` array, then they will
205+
the items there are not in the `bundleDependencies` array, then they will
206206
not be included in the package tarball.
207207
208208
This allows a package maintainer to install all of their dependencies

‎deps/npm/docs/content/configuring-npm/package-json.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -829,14 +829,14 @@ if the `soy-milk` package is not installed on the host. This allows you to
829829
integrate and interact with a variety of host packages without requiring
830830
all of them to be installed.
831831

832-
### bundledDependencies
832+
### bundleDependencies
833833

834834
This defines an array of package names that will be bundled when publishing
835835
the package.
836836

837837
In cases where you need to preserve npm packages locally or have them
838838
available through a single file download, you can bundle the packages in a
839-
tarball file by specifying the package names in the `bundledDependencies`
839+
tarball file by specifying the package names in the `bundleDependencies`
840840
array and executing `npm pack`.
841841

842842
For example:
@@ -847,7 +847,7 @@ If we define a package.json like this:
847847
{
848848
"name": "awesome-web-framework",
849849
"version": "1.0.0",
850-
"bundledDependencies": [
850+
"bundleDependencies": [
851851
"renderized",
852852
"super-streams"
853853
]
@@ -860,9 +860,9 @@ can be installed in a new project by executing `npm install
860860
awesome-web-framework-1.0.0.tgz`. Note that the package names do not
861861
include any versions, as that information is specified in `dependencies`.
862862

863-
If this is spelled `"bundleDependencies"`, then that is also honored.
863+
If this is spelled `"bundledDependencies"`, then that is also honored.
864864

865-
Alternatively, `"bundledDependencies"` can be defined as a boolean value. A
865+
Alternatively, `"bundleDependencies"` can be defined as a boolean value. A
866866
value of `true` will bundle all dependencies, a value of `false` will bundle
867867
none.
868868

‎deps/npm/docs/content/using-npm/config.md‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -357,8 +357,9 @@ newlines replaced by the string "\n". For example:
357357
cert="-----BEGIN CERTIFICATE-----\nXXXX\nXXXX\n-----END CERTIFICATE-----"
358358
```
359359

360-
It is _not_ the path to a certificate file (and there is no "certfile"
361-
option).
360+
It is _not_ the path to a certificate file, though you can set a
361+
registry-scoped "certfile" path like
362+
"//other-registry.tld/:certfile=/path/to/cert.pem".
362363

363364
<!-- automatically generated, do not edit manually -->
364365
<!-- see lib/utils/config/definitions.js -->
@@ -946,7 +947,8 @@ format with newlines replaced by the string "\n". For example:
946947
key="-----BEGIN PRIVATE KEY-----\nXXXX\nXXXX\n-----END PRIVATE KEY-----"
947948
```
948949

949-
It is _not_ the path to a key file (and there is no "keyfile" option).
950+
It is _not_ the path to a key file, though you can set a registry-scoped
951+
"keyfile" path like "//other-registry.tld/:keyfile=/path/to/key.pem".
950952

951953
<!-- automatically generated, do not edit manually -->
952954
<!-- see lib/utils/config/definitions.js -->

‎deps/npm/docs/output/commands/npm-audit.html‎

Lines changed: 40 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -171,13 +171,46 @@ <h3 id="description">Description</h3>
171171
will cause the command to fail. This option does not filter the report
172172
output, it simply changes the command's failure threshold.</p>
173173
<h3 id="audit-signatures">Audit Signatures</h3>
174-
<p>This command can also audit the integrity values of the packages in your
175-
tree against any signatures present in the registry they were downloaded
176-
from. npm will attempt to download the keys from <code>/-/npm/v1/keys</code> on
177-
each the registry used to download any given package. It will then
178-
check the <code>dist.signatures</code> object in the package itself, and verify the
179-
<code>sig</code> present there using the <code>keyid</code> there, matching it with a key
180-
returned from the registry. The command for this is <code>npm audit signatures</code></p>
174+
<p>To ensure the integrity of packages you download from the public npm registry, or any registry that supports signatures, you can verify the registry signatures of downloaded packages using the npm CLI.</p>
175+
<p>Registry signatures can be verified using the following <code>audit</code> command:</p>
176+
<pre lang="bash"><code>$ npm audit signatures
177+
</code></pre>
178+
<p>The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:</p>
179+
<ol>
180+
<li>Signatures are provided in the package's <code>packument</code> in each published version within the <code>dist</code> object:</li>
181+
</ol>
182+
<pre lang="json"><code>"dist":{
183+
"..omitted..": "..omitted..",
184+
"signatures": [{
185+
"keyid": "SHA256:{{SHA256_PUBLIC_KEY}}",
186+
"sig": "a312b9c3cb4a1b693e8ebac5ee1ca9cc01f2661c14391917dcb111517f72370809..."
187+
}]
188+
}
189+
</code></pre>
190+
<p>See this <a href="https://registry.npmjs.org/light-cycle/1.4.3">example</a> of a signed package from the public npm registry.</p>
191+
<p>The <code>sig</code> is generated using the following template: <code>${package.name}@${package.version}:${package.dist.integrity}</code> and the <code>keyid</code> has to match one of the public signing keys below.</p>
192+
<ol start="2">
193+
<li>Public signing keys are provided at <code>registry-host.tld/-/npm/v1/keys</code> in the following format:</li>
194+
</ol>
195+
<pre><code>{
196+
"keys": [{
197+
"expires": null,
198+
"keyid": "SHA256:{{SHA256_PUBLIC_KEY}}",
199+
"keytype": "ecdsa-sha2-nistp256",
200+
"scheme": "ecdsa-sha2-nistp256",
201+
"key": "{{B64_PUBLIC_KEY}}"
202+
}]
203+
}
204+
</code></pre>
205+
<p>Keys response:</p>
206+
<ul>
207+
<li><code>expires</code>: null or a simplified extended <!-- raw HTML omitted -->ISO 8601 format<!-- raw HTML omitted -->: <code>YYYY-MM-DDTHH:mm:ss.sssZ</code></li>
208+
<li><code>keydid</code>: sha256 fingerprint of the public key</li>
209+
<li><code>keytype</code>: only <code>ecdsa-sha2-nistp256</code> is currently supported by the npm CLI</li>
210+
<li><code>scheme</code>: only <code>ecdsa-sha2-nistp256</code> is currently supported by the npm CLI</li>
211+
<li><code>key</code>: base64 encoded public key</li>
212+
</ul>
213+
<p>See this <!-- raw HTML omitted -->example key's response from the public npm registry<!-- raw HTML omitted -->.</p>
181214
<h3 id="audit-endpoints">Audit Endpoints</h3>
182215
<p>There are two audit endpoints that npm may use to fetch vulnerability
183216
information: the <code>Bulk Advisory</code> endpoint and the <code>Quick Audit</code> endpoint.</p>

‎deps/npm/docs/output/commands/npm-ls.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ <h3 id="description">Description</h3>
166166
the results to only the paths to the packages named. Note that nested
167167
packages will <em>also</em> show the paths to the specified packages. For
168168
example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
169-
<pre lang="bash"><code>npm@8.14.0 /path/to/npm
169+
<pre lang="bash"><code>npm@8.15.0 /path/to/npm
170170
└─┬ init-package-json@0.0.4
171171
└── promzard@0.1.5
172172
</code></pre>

‎deps/npm/docs/output/commands/npm.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ <h2 id="table-of-contents">Table of contents</h2>
149149
<!-- raw HTML omitted -->
150150
<!-- raw HTML omitted -->
151151
<h3 id="version">Version</h3>
152-
<p>8.14.0</p>
152+
<p>8.15.0</p>
153153
<h3 id="description">Description</h3>
154154
<p>npm is the package manager for the Node JavaScript platform. It puts
155155
modules in place so that node can find them, and manages dependency

‎deps/npm/docs/output/configuring-npm/folders.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -291,7 +291,7 @@ <h4 id="example">Example</h4>
291291
<p>For a graphical breakdown of what is installed where, use <code>npm ls</code>.</p>
292292
<h4 id="publishing">Publishing</h4>
293293
<p>Upon publishing, npm will look in the <code>node_modules</code> folder. If any of
294-
the items there are not in the <code>bundledDependencies</code> array, then they will
294+
the items there are not in the <code>bundleDependencies</code> array, then they will
295295
not be included in the package tarball.</p>
296296
<p>This allows a package maintainer to install all of their dependencies
297297
(and dev dependencies) locally, but only re-publish those items that

‎deps/npm/docs/output/configuring-npm/package-json.html‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ <h1 id="packagejson">package.json</h1>
142142

143143
<section id="table_of_contents">
144144
<h2 id="table-of-contents">Table of contents</h2>
145-
<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><li><a href="#name">name</a></li><li><a href="#version">version</a></li><li><a href="#description2">description</a></li><li><a href="#keywords">keywords</a></li><li><a href="#homepage">homepage</a></li><li><a href="#bugs">bugs</a></li><li><a href="#license">license</a></li><li><a href="#people-fields-author-contributors">people fields: author, contributors</a></li><li><a href="#funding">funding</a></li><li><a href="#files">files</a></li><li><a href="#main">main</a></li><li><a href="#browser">browser</a></li><li><a href="#bin">bin</a></li><li><a href="#man">man</a></li><li><a href="#directories">directories</a></li><ul><li><a href="#directoriesbin">directories.bin</a></li><li><a href="#directoriesman">directories.man</a></li></ul><li><a href="#repository">repository</a></li><li><a href="#scripts">scripts</a></li><li><a href="#config">config</a></li><li><a href="#dependencies">dependencies</a></li><ul><li><a href="#urls-as-dependencies">URLs as Dependencies</a></li><li><a href="#git-urls-as-dependencies">Git URLs as Dependencies</a></li><li><a href="#github-urls">GitHub URLs</a></li><li><a href="#local-paths">Local Paths</a></li></ul><li><a href="#devdependencies">devDependencies</a></li><li><a href="#peerdependencies">peerDependencies</a></li><li><a href="#peerdependenciesmeta">peerDependenciesMeta</a></li><li><a href="#bundleddependencies">bundledDependencies</a></li><li><a href="#optionaldependencies">optionalDependencies</a></li><li><a href="#overrides">overrides</a></li><li><a href="#engines">engines</a></li><li><a href="#os">os</a></li><li><a href="#cpu">cpu</a></li><li><a href="#private">private</a></li><li><a href="#publishconfig">publishConfig</a></li><li><a href="#workspaces">workspaces</a></li><li><a href="#default-values">DEFAULT VALUES</a></li><li><a href="#see-also">SEE ALSO</a></li></ul></div>
145+
<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><li><a href="#name">name</a></li><li><a href="#version">version</a></li><li><a href="#description2">description</a></li><li><a href="#keywords">keywords</a></li><li><a href="#homepage">homepage</a></li><li><a href="#bugs">bugs</a></li><li><a href="#license">license</a></li><li><a href="#people-fields-author-contributors">people fields: author, contributors</a></li><li><a href="#funding">funding</a></li><li><a href="#files">files</a></li><li><a href="#main">main</a></li><li><a href="#browser">browser</a></li><li><a href="#bin">bin</a></li><li><a href="#man">man</a></li><li><a href="#directories">directories</a></li><ul><li><a href="#directoriesbin">directories.bin</a></li><li><a href="#directoriesman">directories.man</a></li></ul><li><a href="#repository">repository</a></li><li><a href="#scripts">scripts</a></li><li><a href="#config">config</a></li><li><a href="#dependencies">dependencies</a></li><ul><li><a href="#urls-as-dependencies">URLs as Dependencies</a></li><li><a href="#git-urls-as-dependencies">Git URLs as Dependencies</a></li><li><a href="#github-urls">GitHub URLs</a></li><li><a href="#local-paths">Local Paths</a></li></ul><li><a href="#devdependencies">devDependencies</a></li><li><a href="#peerdependencies">peerDependencies</a></li><li><a href="#peerdependenciesmeta">peerDependenciesMeta</a></li><li><a href="#bundledependencies">bundleDependencies</a></li><li><a href="#optionaldependencies">optionalDependencies</a></li><li><a href="#overrides">overrides</a></li><li><a href="#engines">engines</a></li><li><a href="#os">os</a></li><li><a href="#cpu">cpu</a></li><li><a href="#private">private</a></li><li><a href="#publishconfig">publishConfig</a></li><li><a href="#workspaces">workspaces</a></li><li><a href="#default-values">DEFAULT VALUES</a></li><li><a href="#see-also">SEE ALSO</a></li></ul></div>
146146
</section>
147147

148148
<div id="_content"><h3 id="description">Description</h3>
@@ -772,19 +772,19 @@ <h3 id="peerdependenciesmeta">peerDependenciesMeta</h3>
772772
if the <code>soy-milk</code> package is not installed on the host. This allows you to
773773
integrate and interact with a variety of host packages without requiring
774774
all of them to be installed.</p>
775-
<h3 id="bundleddependencies">bundledDependencies</h3>
775+
<h3 id="bundledependencies">bundleDependencies</h3>
776776
<p>This defines an array of package names that will be bundled when publishing
777777
the package.</p>
778778
<p>In cases where you need to preserve npm packages locally or have them
779779
available through a single file download, you can bundle the packages in a
780-
tarball file by specifying the package names in the <code>bundledDependencies</code>
780+
tarball file by specifying the package names in the <code>bundleDependencies</code>
781781
array and executing <code>npm pack</code>.</p>
782782
<p>For example:</p>
783783
<p>If we define a package.json like this:</p>
784784
<pre lang="json"><code>{
785785
"name": "awesome-web-framework",
786786
"version": "1.0.0",
787-
"bundledDependencies": [
787+
"bundleDependencies": [
788788
"renderized",
789789
"super-streams"
790790
]
@@ -794,8 +794,8 @@ <h3 id="bundleddependencies">bundledDependencies</h3>
794794
This file contains the dependencies <code>renderized</code> and <code>super-streams</code> which
795795
can be installed in a new project by executing <code>npm install awesome-web-framework-1.0.0.tgz</code>. Note that the package names do not
796796
include any versions, as that information is specified in <code>dependencies</code>.</p>
797-
<p>If this is spelled <code>"bundleDependencies"</code>, then that is also honored.</p>
798-
<p>Alternatively, <code>"bundledDependencies"</code> can be defined as a boolean value. A
797+
<p>If this is spelled <code>"bundledDependencies"</code>, then that is also honored.</p>
798+
<p>Alternatively, <code>"bundleDependencies"</code> can be defined as a boolean value. A
799799
value of <code>true</code> will bundle all dependencies, a value of <code>false</code> will bundle
800800
none.</p>
801801
<h3 id="optionaldependencies">optionalDependencies</h3>

‎deps/npm/docs/output/using-npm/config.html‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -428,8 +428,9 @@ <h4 id="cert"><code>cert</code></h4>
428428
newlines replaced by the string "\n". For example:</p>
429429
<pre lang="ini"><code>cert="-----BEGIN CERTIFICATE-----\nXXXX\nXXXX\n-----END CERTIFICATE-----"
430430
</code></pre>
431-
<p>It is <em>not</em> the path to a certificate file (and there is no "certfile"
432-
option).</p>
431+
<p>It is <em>not</em> the path to a certificate file, though you can set a
432+
registry-scoped "certfile" path like
433+
"//other-registry.tld/:certfile=/path/to/cert.pem".</p>
433434
<!-- raw HTML omitted -->
434435
<!-- raw HTML omitted -->
435436
<h4 id="ci-name"><code>ci-name</code></h4>
@@ -907,7 +908,8 @@ <h4 id="key"><code>key</code></h4>
907908
format with newlines replaced by the string "\n". For example:</p>
908909
<pre lang="ini"><code>key="-----BEGIN PRIVATE KEY-----\nXXXX\nXXXX\n-----END PRIVATE KEY-----"
909910
</code></pre>
910-
<p>It is <em>not</em> the path to a key file (and there is no "keyfile" option).</p>
911+
<p>It is <em>not</em> the path to a key file, though you can set a registry-scoped
912+
"keyfile" path like "//other-registry.tld/:keyfile=/path/to/key.pem".</p>
911913
<!-- raw HTML omitted -->
912914
<!-- raw HTML omitted -->
913915
<h4 id="legacy-bundling"><code>legacy-bundling</code></h4>

0 commit comments

Comments
 (0)

Footer

© 2026 GitHub, Inc.
Back | FazBrowse Home | New Git URL