Release: [email protected]

.licensee.json

@@ -1,5 +1,6 @@
 {
   "license": "(MIT OR BSD-2-Clause OR BSD-3-Clause OR Apache-2.0 OR ISC OR Unlicense OR CC-BY-3.0 OR CC0-1.0 OR Artistic-2.0)",
+  "corrections": true,
   "whitelist": {
     "config-chain": "1.1.12",
     "cyclist": "0.2.2",

AUTHORS

@@ -623,3 +623,10 @@ Eli Doran <[email protected]>
 Tobias Koppers <[email protected]>
 Grey Baker <[email protected]>
 JT Turner <[email protected]>
+Audrey Eschright <[email protected]>
+Alexander Gudulin <[email protected]>
+Philipp Hagemeister <[email protected]>
+Amadou Sall <[email protected]>
+Chris Manson <[email protected]>
+vlasy <[email protected]>
+Emilis Dambauskas (Tokenmill) <[email protected]>

CHANGELOG.md

@@ -1,6 +1,100 @@
+## v6.9.0 (2018-02-20):
+
+### FEATURES
+
+* [`2ba3a0f67`](https://github.com/npm/cli/commit/2ba3a0f6721f6d5a16775aebce6012965634fc7c)
+  [#90](https://github.com/npm/cli/pull/90)
+  Time traveling installs using the `--before` flag.
+  ([@zkat](https://github.com/zkat))
+* [`b7b54f2d1`](https://github.com/npm/cli/commit/b7b54f2d18e2d8d65ec67c850b21ae9f01c60e7e)
+  [#3](https://github.com/npm/cli/pull/3)
+  Add support for package aliases. This allows packages to be installed under a
+  different directory than the package name listed in `package.json`, and adds a
+  new dependency type to allow this to be done for registry dependencies.
+  ([@zkat](https://github.com/zkat))
+* [`684bccf06`](https://github.com/npm/cli/commit/684bccf061dfc97bb759121bc0ad635e01c65868)
+  [#146](https://github.com/npm/cli/pull/146)
+  Always save `package-lock.json` when using `--package-lock-only`.
+  ([@aeschright](https://github.com/aeschright))
+* [`b8b8afd40`](https://github.com/npm/cli/commit/b8b8afd4048b4ba1181e00ba2ac49ced43936ce0)
+  [#139](https://github.com/npm/cli/pull/139)
+  Make empty-string run-scripts run successfully as a no-op.
+  ([@vlasy](https://github.com/vlasy))
+* [`8047b19b1`](https://github.com/npm/cli/commit/8047b19b1b994fd4b4e7b5c91d7cc4e0384bd5e4)
+  [npm.community#3784](https://npm.community/t/3784)
+  Match git semver ranges when flattening the tree.
+  ([@larsgw](https://github.com/larsgw))
+* [`e135c2bb3`](https://github.com/npm/cli/commit/e135c2bb360dcf00ecee34a95985afec21ba3655)
+  [npm.community#1725](https://npm.community/t/1725?u=larsgw)
+  Re-enable updating local packages.
+  ([@larsgw](https://github.com/larsgw))
+
+### BUGFIXES
+
+* [`cf09fbaed`](https://github.com/npm/cli/commit/cf09fbaed489d908e9b551382cc5f61bdabe99a9)
+  [#153](https://github.com/npm/cli/pull/153)
+  Set modified to undefined in `npm view` when `time` is not available. This
+  fixes a bug where `npm view` would crash on certain third-party registries.
+  ([@simonua](https://github.com/simonua))
+* [`774fc26ee`](https://github.com/npm/cli/commit/774fc26eeb01345c11bd8c97e2c4f328d419d9b5)
+  [#154](https://github.com/npm/cli/pull/154)
+  Print out tar version in `install.sh` only when the flag is supported not all
+  the tar implementations support --version flag. This allows the install script
+  to work in OpenBSD, for example.
+  ([@agudulin](https://github.com/agudulin))
+* [`863baff11`](https://github.com/npm/cli/commit/863baff11d8c870f1a0d9619bb5133c67d71e407)
+  [#158](https://github.com/npm/cli/pull/158)
+  Fix typo in error message for `npm stars`.
+  ([@phihag](https://github.com/phihag))
+* [`a805a95ad`](https://github.com/npm/cli/commit/a805a95ad8832ef5008671f4bd4c11b83e32e0f2)
+  [npm.community#4227](https://npm.community/t/4227)
+  Strip version info from pkg on E404. This improves the error messaging format.
+  ([@larsgw](https://github.com/larsgw))
+
+### DOCS
+
+* [`5d7633833`](https://github.com/npm/cli/commit/5d76338338621fd0b3d4f7914a51726d27569ee1)
+  [#160](https://github.com/npm/cli/pull/160)
+  Add `npm add` as alias to npm install in docs.
+  ([@ahasall](https://github.com/ahasall))
+* [`489c2211c`](https://github.com/npm/cli/commit/489c2211c96a01d65df50fd57346c785bcc3efe6)
+  [#162](https://github.com/npm/cli/pull/162)
+  Fix link to RFC #10 in the changelog.
+  ([@mansona](https://github.com/mansona))
+* [`433020ead`](https://github.com/npm/cli/commit/433020ead5251b562bc3b0f5f55341a5b8cc9023)
+  [#135](https://github.com/npm/cli/pull/135)
+  Describe exit codes in npm-audit docs.
+  ([@emilis-tm](https://github.com/emilis-tm))
+
+### DEPENDENCIES
+
+* [`ee6b6746b`](https://github.com/npm/cli/commit/ee6b6746b04f145dfe489af2d26667ac32ba0cef)
+  [zkat/make-fetch-happen#29](https://github.com/zkat/make-fetch-happen/issues/29)
+  `[email protected]`
+  ([@TooTallNate](https://github.com/TooTallNate))
+* [`2ce23baf5`](https://github.com/npm/cli/commit/2ce23baf53b1ce7d11b8efb80c598ddaf9cef9e7)
+  `[email protected]`:
+  Adds support for package aliases
+  ([@zkat](https://github.com/zkat))
+* [`baaedbc6e`](https://github.com/npm/cli/commit/baaedbc6e2fc370d73b35e7721794719115507cc)
+  `[email protected]`:
+  Adds opts.before support
+  ([@zkat](https://github.com/zkat))
+* [`57e771a03`](https://github.com/npm/cli/commit/57e771a032165d1e31e71d0ff7530442139c21a6)
+  [#164](https://github.com/npm/cli/pull/164)
+  `[email protected]`
+  ([@kemitchell](https://github.com/kemitchell))
+* [`2b78288d4`](https://github.com/npm/cli/commit/2b78288d4accd10c1b7cc6c36bc28045f5634d91)
+  add core to default inclusion tests in pack
+  ([@Kat Marchán](https://github.com/Kat Marchán))
+* [`9b8b6513f`](https://github.com/npm/cli/commit/9b8b6513fbce92764b32a067322984985ff683fe)
+  [npm.community#5382](https://npm.community/t/npm-pack-leaving-out-files-6-8-0-only/5382)
+  `[email protected]`: Fixes bug where `core/` directories were being suddenly excluded.
+  ([@zkat](https://github.com/zkat))
+
 ## v6.8.0 (2019-02-07):
 
-This release includes an implementation of [RFC #10](https://github.com/npm/rfcs/blob/latest/accepted/0010-monorepo-subdirectory-declaration.md), documenting an optional field that can be used to specify
+This release includes an implementation of [RFC #10](https://github.com/npm/rfcs/blob/latest/implemented/0010-monorepo-subdirectory-declaration.md), documenting an optional field that can be used to specify
 the directory path for a package within a monorepo.
 
 ### NEW FEATURES
@@ -17,7 +111,7 @@ the directory path for a package within a monorepo.
   ([@zkat](https://github.com/zkat))
 * [`cdb059293`](https://github.com/npm/cli/commit/cdb0592939d6256c80f7ec5a2b6251131a512a2a)
   [#144](https://github.com/npm/cli/pull/144)
-  Fix common.npm callback arguments. 
+  Fix common.npm callback arguments.
   ([@larsgw](https://github.com/larsgw))
 * [`25573e9b9`](https://github.com/npm/cli/commit/25573e9b9d5d26261c68d453f06db5b3b1cd6789)
   [npm.community#4770](https://npm.community/t/https://npm.community/t/4770)

doc/cli/npm-audit.md

@@ -65,7 +65,8 @@ $ npm audit --parseable | awk -F $'\t' '{print $1,$4}'
 The audit command submits a description of the dependencies configured in
 your project to your default registry and asks for a report of known
 vulnerabilities. The report returned includes instructions on how to act on
-this information.
+this information. The command will exit with a 0 exit code if no
+vulnerabilities were found.
 
 You can also have npm automatically fix the vulnerabilities by running `npm
 audit fix`. Note that some vulnerabilities cannot be fixed automatically and
@@ -99,6 +100,13 @@ The non-reversible identifiers are a sha256 of a session-specific UUID and the
 value being replaced, ensuring a consistent value within the payload that is
 different between runs.
 
+## EXIT CODE
+
+The `npm audit` command will exit with a 0 exit code if no vulnerabilities were found.
+
+If vulnerabilities were found the exit code will depend on the `audit-level`
+configuration setting.
+
 ## SEE ALSO
 
 * npm-install(1)

doc/cli/npm-install.md

@@ -14,7 +14,7 @@ npm-install(1) -- Install a package
     npm install <tarball url>
     npm install <folder>
 
-    alias: npm i
+    aliases: npm i, npm add
     common options: [-P|--save-prod|-D|--save-dev|-O|--save-optional] [-E|--save-exact] [-B|--save-bundle] [--no-save] [--dry-run]
 
 ## DESCRIPTION

doc/misc/npm-config.md

@@ -179,6 +179,22 @@ a non-zero exit code.
 
 What authentication strategy to use with `adduser`/`login`.
 
+### before
+
+* Alias: enjoy-by
+* Default: null
+* Type: Date
+
+If passed to `npm install`, will rebuild the npm tree such that only versions
+that were available **on or before** the `--before` time get installed.
+If there's no versions available for the current set of direct dependencies, the
+command will error.
+
+If the requested version is a `dist-tag` and the given tag does not pass the
+`--before` filter, the most recent version less than or equal to that tag will
+be used. For example, `foo@latest` might install `[email protected]` even though `latest`
+is `2.0`.
+
 ### bin-links
 
 * Default: `true`

lib/config/defaults.js

@@ -113,6 +113,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
     'audit-level': 'low',
     'auth-type': 'legacy',
 
+    'before': null,
     'bin-links': true,
     browser: null,
 
@@ -260,6 +261,7 @@ exports.types = {
   audit: Boolean,
   'audit-level': ['low', 'moderate', 'high', 'critical'],
   'auth-type': ['legacy', 'sso', 'saml', 'oauth'],
+  'before': [null, Date],
   'bin-links': Boolean,
   browser: [null, String],
   ca: [null, String, Array],
@@ -394,6 +396,7 @@ function getLocalAddresses () {
 }
 
 exports.shorthands = {
+  before: ['--enjoy-by'],
   s: ['--loglevel', 'silent'],
   d: ['--loglevel', 'info'],
   dd: ['--loglevel', 'verbose'],

lib/install.js

@@ -401,7 +401,7 @@ Installer.prototype.normalizeCurrentTree = function (cb) {
   if (this.currentTree.error) {
     for (let child of this.currentTree.children) {
       if (!child.fakeChild && isExtraneous(child)) {
-        this.currentTree.package.dependencies[child.package.name] = computeVersionSpec(this.currentTree, child)
+        this.currentTree.package.dependencies[moduleName(child)] = computeVersionSpec(this.currentTree, child)
       }
     }
   }
@@ -703,8 +703,25 @@ Installer.prototype.cloneCurrentTreeToIdealTree = function (cb) {
   validate('F', arguments)
   log.silly('install', 'cloneCurrentTreeToIdealTree')
 
-  this.idealTree = copyTree(this.currentTree)
-  this.idealTree.warnings = []
+  if (npm.config.get('before')) {
+    this.idealTree = {
+      package: this.currentTree.package,
+      path: this.currentTree.path,
+      realpath: this.currentTree.realpath,
+      children: [],
+      requires: [],
+      missingDeps: {},
+      missingDevDeps: {},
+      requiredBy: [],
+      error: this.currentTree.error,
+      warnings: [],
+      isTop: true
+    }
+  } else {
+    this.idealTree = copyTree(this.currentTree)
+    this.idealTree.warnings = []
+  }
+
   cb()
 }
 
@@ -825,7 +842,11 @@ Installer.prototype.printInstalledForHuman = function (diffs, auditResult) {
   var report = ''
   if (this.args.length && (added || updated)) {
     report += this.args.map((p) => {
-      return `+ ${p.name}@${p.version}`
+      return `+ ${p.name}@${p.version}${
+        !p._requested.name || p._requested.name === p.name
+          ? ''
+          : ` (as ${p._requested.name})`
+      }`
     }).join('\n') + '\n'
   }
   var actions = []
@@ -922,10 +943,14 @@ Installer.prototype.printInstalledForJSON = function (diffs, auditResult) {
   function recordAction (action) {
     var mutation = action[0]
     var child = action[1]
+    const isAlias = child.package && child.package._requested && child.package._requested.type === 'alias'
+    const name = isAlias
+      ? child.package._requested.name
+      : child.package && child.package.name
     var result = {
       action: mutation,
-      name: moduleName(child),
-      version: child.package && child.package.version,
+      name,
+      version: child.package && `${isAlias ? `npm:${child.package.name}@` : ''}${child.package.version}`,
       path: child.path
     }
     if (mutation === 'move') {
@@ -947,10 +972,16 @@ Installer.prototype.printInstalledForParseable = function (diffs) {
     } else if (mutation === 'update') {
       var previousVersion = child.oldPkg.package && child.oldPkg.package.version
     }
+    const isAlias = child.package._requested && child.package._requested.type === 'alias'
+    const version = child.package && isAlias
+      ? `npm:${child.package.name}@${child.package.version}`
+      : child.package
+        ? child.package.version
+        : ''
     output(
       mutation + '\t' +
       moduleName(child) + '\t' +
-      (child.package ? child.package.version : '') + '\t' +
+      version + '\t' +
       (child.path ? path.relative(self.where, child.path) : '') + '\t' +
       (previousVersion || '') + '\t' +
       (previousPath || ''))

lib/install/action/extract.js

@@ -6,6 +6,7 @@ const figgyPudding = require('figgy-pudding')
 const stat = BB.promisify(require('graceful-fs').stat)
 const gentlyRm = BB.promisify(require('../../utils/gently-rm.js'))
 const mkdirp = BB.promisify(require('mkdirp'))
+const moduleName = require('../../utils/module-name.js')
 const moduleStagingPath = require('../module-staging-path.js')
 const move = require('../../utils/move.js')
 const npa = require('npm-package-arg')
@@ -113,7 +114,7 @@ function readBundled (pkg, staging, extractTo) {
 }
 
 function stageBundledModule (bundler, child, staging, parentPath) {
-  const stageFrom = path.join(parentPath, 'node_modules', child.package.name)
+  const stageFrom = path.join(parentPath, 'node_modules', moduleName(child))
   const stageTo = moduleStagingPath(staging, child)
 
   return BB.map(child.children, (child) => {

lib/install/action/global-install.js

@@ -3,12 +3,13 @@ var path = require('path')
 var npm = require('../../npm.js')
 var Installer = require('../../install.js').Installer
 var packageId = require('../../utils/package-id.js')
+var moduleName = require('../../utils/module-name.js')
 
 module.exports = function (staging, pkg, log, next) {
   log.silly('global-install', packageId(pkg))
   var globalRoot = path.resolve(npm.globalDir, '..')
   npm.config.set('global', true)
-  var install = new Installer(globalRoot, false, [pkg.package.name + '@' + pkg.package._requested.fetchSpec])
+  var install = new Installer(globalRoot, false, [moduleName(pkg) + '@' + pkg.package._requested.rawSpec])
   install.link = false
   install.run(function () {
     npm.config.set('global', false)

lib/install/action/global-link.js

@@ -1,8 +1,9 @@
 'use strict'
+var moduleName = require('../../utils/module-name.js')
 var npm = require('../../npm.js')
 var packageId = require('../../utils/package-id.js')
 
 module.exports = function (staging, pkg, log, next) {
   log.silly('global-link', packageId(pkg))
-  npm.link(pkg.package.name, next)
+  npm.link(moduleName(pkg), next)
 }

lib/install/and-add-parent-to-errors.js

@@ -1,12 +1,13 @@
 'use strict'
+var moduleName = require('../utils/module-name.js')
 var validate = require('aproba')
 
 module.exports = function (parent, cb) {
   validate('F', [cb])
   return function (er) {
     if (!er) return cb.apply(null, arguments)
     if (er instanceof Error && parent && parent.package && parent.package.name) {
-      er.parent = parent.package.name
+      er.parent = moduleName(parent)
     }
     cb(er)
   }