diff options
Diffstat (limited to 'deps/node/deps/npm/changelogs/CHANGELOG-3.md')
| -rw-r--r-- | deps/node/deps/npm/changelogs/CHANGELOG-3.md | 5245 |
1 files changed, 0 insertions, 5245 deletions
diff --git a/deps/node/deps/npm/changelogs/CHANGELOG-3.md b/deps/node/deps/npm/changelogs/CHANGELOG-3.md deleted file mode 100644 index a652eb37..00000000 --- a/deps/node/deps/npm/changelogs/CHANGELOG-3.md +++ /dev/null @@ -1,5245 +0,0 @@ -### v3.10.10 (2016-11-04) - -See the discussion on [#14042](https://github.com/npm/npm/issues/14042) for -more context on this release, which is intended to address a serious regression -in shrinkwrap behavior in the version of the CLI currently bundled with Node.js -6 LTS "Boron". You should never install this version directly; instead update -to `npm@4`, which has everything in this release and more. - -#### REGRESSION FIX - -* [`9aebe98`](https://github.com/npm/npm/commit/9aebe982114ea2107f46baa1dcb11713b4aaad04) - [#14117](https://github.com/npm/npm/pull/14117) - Fixes a bug where installing a shrinkwrapped package would fail if the - platform failed to install an optional dependency included in the shrinkwrap. - ([@watilde](https://github.com/watilde)) - -#### UPDATE SUPPORT MATRIX - -With the advent of the second official Node.js LTS release, Node 6.x -'Boron', the Node.js project has now officially dropped versions 0.10 -and 0.12 out of the maintenance phase of LTS. (Also, Node 5 was never -part of LTS, and will see no further support now that Node 7 has been -released.) As a small team with limited resources, the npm CLI team is -following suit and dropping those versions of Node from its CI test -matrix. - -* [`c82ecfd`](https://github.com/npm/npm/commit/c82ecfdbe0b5f318a175714a8753efe4dfd3e4b3) - [#14503](https://github.com/npm/npm/pull/14503) - Node 6 is LTS; 5.x, 0.10, and 0.12 are unsupported. - ([@othiym23](https://github.com/othiym23)) - -### v3.10.9 (2016-10-06) - -Hi everyone! This is the last of our monthly releases. We're going to give -an every-two-weeks schedule a try starting with our next release. We'll -reevaluate in a quarter, but we suspect that will be what we'll stick with. -You might be wondering _why_ we've been fiddling with the release cadence? Well, -we've been trying to tune it to to minimize the overhead for our little team. - -This is ALSO the ULTIMATE release of `npm` version 3. That's right, in -just two weeks' time (October 20th for you fans of calendar time), our dear -`npm` will be hitting the big 4.0. - -**DON'T PANIC** - -This is gonna be a much, MUCH smaller major version than 3.x was. Maybe even -smaller than 2.x was. I can't tell you everything that'll be in there just -yet, but at the very least it's going to have what's in our -[4.x milestone](https://github.com/npm/npm/pulls?q=is%3Aopen+is%3Apr+milestone%3A4.x), -PLUS, the first steps in -[making `prepublish` work](https://github.com/npm/npm/issues/10074) the way -people expect it to. - -**NOW ABOUT THIS RELEASE** - -This release sees a whole slew of bug fixes. Notably a bunch of lifecycle -fixes and a really important shrinkwrap fix. - -#### LIFECYCLE FIXES - -* [`d388f90`](https://github.com/npm/npm/commit/d388f90732981633b3cdb4fc7fb0fababd4e64ab) - [#13942](https://github.com/npm/npm/pull/13942) - Fix current working directory while running shrinkwrap lifecycle scripts. - Previously if you ran a shrinkwrap from another lifecycle script AND - `node_modules` existed (and if you're running `npm shrinkwrap` it probably - should) then `npm` would run the shrinkwrap lifecycle from the - `node_modules` folder instead of the package folder. - ([@evocateur](https://github.com/evocateur)) - ([@iarna](https://github.com/iarna)) -* [`c3b6cdf`](https://github.com/npm/npm/commit/c3b6cdfedcdb4d9e7712be5245d9b274828d88d1) - [#13964](https://github.com/npm/npm/pull/13964) - Fix bug where the `uninstall` lifecycles weren't being run when you - reinstalled/updated an existing module. - ([@iarna](https://github.com/iarna)) -* [`72bb89c`](https://github.com/npm/npm/commit/72bb89c1aa9811a18cbd766f3da73da76eb920c6) - [#13344](https://github.com/npm/npm/pull/13344) - When running lifecycles use `TMPDIR` if it's writable and fall back to the - current working directory if not. Previously we just assumed `TMPDIR` - wouldn't be writable (as we might have been running as `nobody` and - `nobody` on some systems can't write to `TMPDIR`). - ([@aaronjensen](https://github.com/aaronjensen)) - -#### SHRINKWRAP GIT & TAGGED DEPENDENCY FIX - -* [`3b5eee0`](https://github.com/npm/npm/commit/3b5eee0d31737d1c2518ed95dcc7aaaaa93c253c) - [#13941](https://github.com/npm/npm/pull/13941) - Fix git and tagged dependency matching with shrinkwraps. Previously git - and tag (ie `foo@latest`) dependencies installed from a shrinkwrap would - always be flagged as invalid. - ([@iarna](https://github.com/iarna)) - -#### BUG FIXES - -* [`bf3bd1e`](https://github.com/npm/npm/commit/bf3bd1e4347ee2c5de08d23558c4444749178c8b) - [#14143](https://github.com/npm/npm/pull/14143) - Fix bug in `npm version` where `npm-shrinkwrap.json` wouldn't be updated - if you ran `npm version` from outside of your project root. - ([@lholmquist](https://github.com/lholmquist)) -* [`1089878`](https://github.com/npm/npm/commit/1089878f58977559414c8a9addfc69a9c68905b0) - [#13613](https://github.com/npm/npm/pull/13613) - Log 'skipping action' as 'verbose' instead of 'warn'. This removes a lot of - clutter when there are links in your `node_modules`. The long term plan is - to entirely blind `npm` to what's inside links, which will make this code - go away entirely. - ([@timoxley](https://github.com/timoxley)) -* [`952f1e1`](https://github.com/npm/npm/commit/952f1e109a070ab4066179f6104ba9394300e342) - [#13999](https://github.com/npm/npm/pull/13999) - Fix a bug where setting `bin` to `null` in your `package.json` would result - in `npm` crashing. - ([@IonicaBizau](https://github.com/IonicaBizau)) -* [`fcf8b11`](https://github.com/npm/npm/commit/fcf8b11fb7fcf8902f6a887c3d5f0aef2897dde0) - [#14032](https://github.com/npm/npm/pull/14032) - When using `npm view`, if you specified a version that didn't exist it - would previously print `undefined` (even if you asked for JSON output). It - now prints nothing in this situation. This brings `npm@3`'s behavior in - line with `npm@2`. - ([@roblg](https://github.com/roblg)) -* [`93c689f`](https://github.com/npm/npm/commit/93c689ff44c6042a2dcde7fe0d74d2264237d666) - [#14032](https://github.com/npm/npm/pull/14032) - When using `npm view --json` with a version range that matches multiple - versions we now return a list of all of the metadata for all of those - versions. Previously we picked one and only returned that. This brings - `npm@3`'s behavior in line with `npm@2`. - ([@roblg](https://github.com/roblg)) -* [`2411728`](https://github.com/npm/npm/commit/24117289e09c373b845150c45e4793d98fe7cf4b) - [#14045](https://github.com/npm/npm/pull/14045) - Fix a Windows-only bug in the `git` tests. The tests had rather particular - ideas about what arguments would be passed to `git` and on Windows they - got this wrong. - ([@watilde](https://github.com/watilde)) - -#### DOCUMENTATION & MISC - -* [`30772cc`](https://github.com/npm/npm/commit/30772cc5f80923bf21c003fbe53e5fed9d3a5d97) - [#13904](https://github.com/npm/npm/pull/13904) - Update `package.json` example to include GitHub branches. - ([@stevokk](https://github.com/stevokk)) -* [`f66876f`](https://github.com/npm/npm/commit/f66876f75c204fb78028cf2ff7979f80355bd06c) - [#14010](https://github.com/npm/npm/pull/14010) - Update the GitHub issue template to reflect Apple's change in name of its - desktop operating system. - ([@AlexChesters](https://github.com/AlexChesters)) - -#### DEPENDENCY UPDATES - -* [`b3f9bf1`](https://github.com/npm/npm/commit/b3f9bf1ada3f93e6775f5c232350030db6635d0c) - [#13918](https://github.com/npm/npm/issues/13918) - `graceful-fs@4.1.9`: - Fix the _uid must be an unsigned int_ bug that's been around forever but that - `npm` started tickling in v3.10.8. - ([@addaleax](https://github.com/addaleax)) - Also fixes wrapper to `fs.readdir` to actually pass through (rather than - drop) optional arguments. - ([@isaacs](https://github.com/isaacs)) -* [`9402ead`](https://github.com/npm/npm/commit/9402ead67e3be9b431ade637fbfac86204ee96fe) - [isaacs/node-glob#293](https://github.com/isaacs/node-glob/pull/293) - `glob@7.1.0`: - Add `absolute` option for `match` event. - ([@phated](https://github.com/phated)) -* [`58b83db`](https://github.com/npm/npm/commit/58b83db327dd87bf7cb5a7d503303537718f2f30) - `asap@2.0.5` - ([@kriskowal](https://github.com/kriskowal)) -* [`5707e6e`](https://github.com/npm/npm/commit/5707e6e55b220439c3f83e77daf4c70d72eb46f0) - `sorted-object@2.0.1` - ([@domenic](https://github.com/domenic)) -* [`9d20910`](https://github.com/npm/npm/commit/9d209107ce49a7424c50459284280cd2e6e215d1) - `request@2.75.0` - ([@simov](https://github.com/simov)) -* [`dea4848`](https://github.com/npm/npm/commit/dea48487a9d03492edc68670d05776d32d9ee8cf) - `path-is-inside@1.0.2` - ([@domenic](https://github.com/domenic)) -* [`b3f3db5`](https://github.com/npm/npm/commit/b3f3db52e864d607b6d9b18920e2f58acc4b1616) - `opener@1.4.2` - ([@dominic](https://github.com/dominic)) -* [`6bb5f95`](https://github.com/npm/npm/commit/6bb5f953888bbaaeeb624d623c2a9746d1c243a0) - `lockfile@1.0.2` - ([@isaacs](https://github.com/isaacs)) -* [`13f7c0a`](https://github.com/npm/npm/commit/13f7c0a73212284b53a2d96882fc298afbf9609c) - `config-chain@1.1.11` - ([@dominictarr](https://github.com/dominictarr)) - -### v3.10.8 (2016-09-08) - -Monthly releases are so big! Just look at all this stuff! - -Our quarter of monthly releases is almost over. The next one, in October, might -very well be our last one as we move to trying something different and learning -lessons from our little experiment. - -You may also want to keep an eye our for `npm@4` next month, since we're -planning on finally releasing it then and including a (small) number of breaking -changes we've been meaning to do for a long time. Don't worry, though: `npm@3` -will still be around for a bit and will keep getting better and better, and is -most likely going to be the version that `node@6` uses once it goes to LTS. - -As some of us have mentioned before, npm is likely to start doing more regular -semver-major bumps, while keeping those bumps significantly smaller than the -huge effort that was `npm@3` -- we're not very likely to do a world-shaking -thing like that for a while, if ever. - -All that said, let's move on to the patches included in v3.10.8! - -#### SHRINKWRAP LEVEL UP - -The most notable part of this release is a series of commits meant to make `npm -shrinkwrap` more consistent. By itself, shrinkwrap seems like a fairly -straightforward thing to implement, but things get complicated when it starts -interacting with `devDependencies`, `optionalDependencies`, and -`bundledDependencies`. These commits address some corner cases related to these. - -* [`a7eca32`](https://github.com/npm/npm/commit/a7eca3246fbbcbb05434cb6677f65d14c945d74f) - [#10073](https://github.com/npm/npm/pull/10073) - Record if a dependency is only used as a devDependency and exclude it from the - shrinkwrap file. - ([@bengl](https://github.com/bengl)) -* [`1eabcd1`](https://github.com/npm/npm/commit/1eabcd16bf2590364ca20831096350073539bf3a) - [#10073](https://github.com/npm/npm/pull/10073) - Record if a dependency is optional to shrinkwrap. - ([@bengl](https://github.com/bengl)) -* [`03efc89`](https://github.com/npm/npm/commit/03efc89522c99ee0fa37d8f4a99bc3b44255ef98) - [#13692](https://github.com/npm/npm/pull/13692/) - We were doing a weird thing where we used a `package.json` field `installable` - to check to see if we'd checked for platform compatibility, and if not did - so. But this was the only place that was ever done so there was no reason to - implement it in such an obfuscated manner. - Instead it now just directly checks and then records that its done so on the - node object with `knownInstallable`. This is useful to know because modules - expanded via shrinkwrap don't go through this– `inflateShrinkwrap` does not - currently have any rollback semantics and so checking this sort of thing there - is unhelpful. - ([@iarna](https://github.com/iarna)) -* [`ff87938`](https://github.com/npm/npm/commit/ff879382fda21dac7216a5f666287b3a7e74a947) - [#11735](https://github.com/npm/npm/issues/11735) - Running `npm install --save-dev` will now update shrinkwrap file, but only - if there already are devDependencies in it. - ([@szimek](https://github.com/szimek)) -* [`c00ca3a`](https://github.com/npm/npm/commit/c00ca3aef836709eeaeade91c5305bc2fbda2e8a) - [#13394](https://github.com/npm/npm/issues/13394) - Check installability of modules from shrinkwrap, since modules that came into - the tree vie shrinkwrap won't already have this information recorded in - advance. - ([@iarna](https://github.com/iarna)) - -#### INSTALLER ERROR REPORTING LEVEL UP - -As part of the shrinkwrap push, there were also a lot of error-reporting -improvements. Some to add more detail to error objects, others to fix bugs and -inconsistencies. - -* [`2cdd713`](https://github.com/npm/npm/commit/2cdd7132abddcc7f826a355c14348ce9a5897ffe) - Consistently set code on `ETARGET` when fetching package metadata if no - compatible version is found. - ([@iarna](https://github.com/iarna)) -* [`cabcd17`](https://github.com/npm/npm/commit/cabcd173f2923cb5b77e7be0e42eea2339a24727) - [#13692](https://github.com/npm/npm/pull/13692/) - Include installer warning details at the `verbose` log level. - ([@iarna](https://github.com/iarna)) -* [`95a4044`](https://github.com/npm/npm/commit/95a4044cbae93d19d0da0f3cd04ea8fa620295d9) - [`dbb14c2`](https://github.com/npm/npm/commit/dbb14c241d982596f1cdaee251658f5716989fd2) - [`9994383`](https://github.com/npm/npm/commit/9994383959798f80749093301ec43a8403566bb6) - [`7417000`](https://github.com/npm/npm/commit/74170003db0c53def9b798cb6fe3fe7fc3e06482) - [`f45f85d`](https://github.com/npm/npm/commit/f45f85dac800372d63dfa8653afccbf5bcae7295) - [`e79cc1b`](https://github.com/npm/npm/commit/e79cc1b11440f0d122c4744d5eff98def9553f4a) - [`146ee39`](https://github.com/npm/npm/commit/146ee394b1f7a33cf409a30b835a85d939acb438) - [#13692](https://github.com/npm/npm/pull/13692/) - Improve various bits of error reporting, adding more error information and - some related refactoring. - ([@iarna](https://github.com/iarna)) - -#### MISCELLANEOUS BUGS LEVEL UP - -* [`116b6c6`](https://github.com/npm/npm/commit/116b6c60a174ea0cc49e4d62717e4e26175b6534) - [#13456](https://github.com/npm/npm/issues/13456) - In lifecycle scripts, any `node_modules/.bin` existing in the hierarchy - should be turned into an entry in the PATH environment variable. - However, prior to this commit, it was splitting based on the string - `node_modules`, rather than restricting it to only path portions like - `/node_modules/` or `\node_modules\`. So, a path containing an entry - like `my_node_modules` would be improperly split. - ([@isaacs](https://github.com/isaacs)) -* [`0a28dd0`](https://github.com/npm/npm/commit/0a28dd0104e5b4a8cc0cb038bd213e6a50827fe8) - [npm/fstream-npm#23](https://github.com/npm/fstream-npm/pull/23) - `fstream-npm@1.2.0`: - Always ignore `*.orig` files, which are generated by git when using `git - mergetool`, by default. - ([@zkat](https://github.com/zkat)) -* [`a3a2fb9`](https://github.com/npm/npm/commit/a3a2fb97adc87c2aa9b2b8957861b30efafc7ad0) - [#13708](https://github.com/npm/npm/pull/13708) - Always ignore `*.orig` files, which are generated by git when using `git - mergetool`, by default. - ([@boneskull](https://github.com/boneskull)) - -#### TOOLING LEVEL UP - -* [`e1d7e6c`](https://github.com/npm/npm/commit/e1d7e6ce551cbc42026cdcadcb37ea515059c972) - Add helper for generating test skeletons. - ([@iarna](https://github.com/iarna)) -* [`4400b35`](https://github.com/npm/npm/commit/4400b356bca9175935edad1469c608c909bc01bf) - Fix fixture creation and cleanup in `maketest`. - ([@iarna](https://github.com/iarna)) - -#### DOCUMENTATION LEVEL UP - -* [`8eb9460`](https://github.com/npm/npm/commit/8eb94601fe895b97cbcf8c6134e6b371c5371a1e) - [#13717](https://github.com/npm/npm/pull/13717) - Document that `npm link` will link the files specified in the `bin` field of - `package.json` to `{prefix}/bin/{name}`. - ([@legodude17](https://github.com/legodude17)) -* [`a66e5e9`](https://github.com/npm/npm/commit/a66e5e9c388878fe03fb29014c3b95d28bedd3c1) - [#13682](https://github.com/npm/npm/pull/13682) - Minor grammar fix in documentation for `npm scripts`. - ([@Ajedi32](https://github.com/Ajedi32)) -* [`74b8043`](https://github.com/npm/npm/commit/74b80437ffdfcf8172f6ed4f39bfb021608dd9dd) - [#13655](https://github.com/npm/npm/pull/13655) - Document line comment syntax for `.npmrc`. - ([@mdjasper](https://github.com/mdjasper)) -* [`b352a84`](https://github.com/npm/npm/commit/b352a84c2c7ad15e9c669af75f65cdaa964f86c0) - [#12438](https://github.com/npm/npm/issues/12438) - Remind folks to use `#!/usr/bin/env node` in their `bin` scripts to make files - executable directly. - ([@mxstbr](https://github.com/mxstbr)) -* [`b82fd83`](https://github.com/npm/npm/commit/b82fd838edbfff5d2833a62f6d8ae8ea2df5a1f2) - [#13493](https://github.com/npm/npm/pull/13493) - Document that the user config file can itself be configured either through the - `$NPM_CONFIG_USERCONFIG` environment variable, or `--userconfig` command line - flag. - ([@jasonkarns](https://github.com/jasonkarns)) -* [`8a02699`](https://github.com/npm/npm/commit/8a026992a03d90e563a97c70e90926862120693b) - [#13911](https://github.com/npm/npm/pull/13911) - Minor documentation reword and cleanup. - ([@othiym23](https://github.com/othiym23)) - -#### DEPENDENCY LEVEL UP - -* [`2818fb0`](https://github.com/npm/npm/commit/2818fb0f6081d68a91f0905945ad102f26c6cf85) - `glob@7.0.6` - ([@isaacs](https://github.com/isaacs)) -* [`d88ec81`](https://github.com/npm/npm/commit/d88ec81ad33eb2268fcd517d35346a561bc59aff) - `graceful-fs@4.1.6` - ([@francescoinfante](https://github.com/francescoinfante)) -* [`4727f86`](https://github.com/npm/npm/commit/4727f8646daca7b3e3c1c95860e02acf583b9dae) - `lodash.clonedeep@4.5.0` - ([@jdalton](https://github.com/jdalton)) -* [`c347678`](https://github.com/npm/npm/commit/c3476780ef4483425e4ae1d095a5884b46b8db86) - `lodash.union@4.6.0` - ([@jdalton](https://github.com/jdalton)) -* [`530bd4d`](https://github.com/npm/npm/commit/530bd4d2ae6f704f624e4f7bf64f911f37e2b7f8) - `lodash.uniq@4.5.0` - ([@jdalton](https://github.com/jdalton)) -* [`483d56a`](https://github.com/npm/npm/commit/483d56ae8137eca0c0f7acd5d1c88ca6d5118a6a) - `lodash.without@4.4.0` - ([@jdalton](https://github.com/jdalton)) -* [`6c934df`](https://github.com/npm/npm/commit/6c934df6e74bacd0ed40767b319936837a43b586) - `inherits@2.0.3` - ([@isaacs](https://github.com/isaacs)) -* [`a65ed7c`](https://github.com/npm/npm/commit/a65ed7cbd3c950383a14461a4b2c87b67ef773b9) - `npm-registry-client@7.2.1`: - * [npm/npm-registry-client#142](https://github.com/npm/npm-registry-client/pull/142) Fix `EventEmitter` warning spam from error handlers on socket. ([@addaleax](https://github.com/addaleax)) - * [npm/npm-registry-client#131](https://github.com/npm/npm-registry-client/pull/131) Adds support for streaming request bodies. ([@aredridel](https://github.com/aredridel)) - * Fixes [#13656](https://github.com/npm/npm/issues/13656). - * Dependency updates. - * Documentation improvements. - ([@othiym23](https://github.com/othiym23)) -* [`2b88d62`](https://github.com/npm/npm/commit/2b88d62e6a730716b27052c0911c094d01830a60) - [npm/npmlog#34](https://github.com/npm/npmlog/pull/34) - `npmlog@4.0.0`: - Allows creating log levels that are empty strings or 0 - ([@rwaldron](https://github.com/rwaldron)) -* [`242babb`](https://github.com/npm/npm/commit/242babbd02274ee2d212ae143992c20f47ef0066) - `once@1.4.0` - ([@zkochan](https://github.com/zkochan)) -* [`6d8ba2b`](https://github.com/npm/npm/commit/6d8ba2b4918e2295211130af68ee8a67099139e0) - `readable-stream@2.1.5` - ([@calvinmetcalf](https://github.com/calvinmetcalf)) -* [`855c099`](https://github.com/npm/npm/commit/855c099482a8d93b7f0646bd7bcf8a31f81868e0) - `retry@0.10.0` - ([@tim-kos](https://github.com/tim-kos)) -* [`80540c5`](https://github.com/npm/npm/commit/80540c52b252615ae8a6271b3df870eabfea935e) - `semver@5.3.0`: - * Add `minSatisfying` - * Add `prerelease(v)` - ([@isaacs](https://github.com/isaacs)) -* [`8aaac52`](https://github.com/npm/npm/commit/8aaac52ffae8e689fae265712913b1e2a36b1aa6) - `which@1.2.1` - ([@isaacs](https://github.com/isaacs)) -* [`85108a2`](https://github.com/npm/npm/commit/85108a29108ab0a57997572dc14f87eb706890ba) - `write-file-atomic@1.2.0`: - Preserve chmod and chown from the overwritten file - ([@iarna](https://github.com/iarna)) -* [`291a377`](https://github.com/npm/npm/commit/291a377f32f5073102a8ede61a27e6a9b37154c2) - Update npm documentation to reflect documentation for `semver@5.3.0`. - ([@zkat](https://github.com/zkat)) - -### v3.10.7 (2016-08-11) - -Hi all, today's our first release coming out of the new monthly release -cadence. See below for details. We're all recovered from conferences now -and raring to go! We've got some pretty keen bug fixes and a bunch of -documentation and dependency updates. It's hard to narrow it down to just a -few, but of note are scoped packages in bundled dependencies, the -`preinstall` lifecycle fix, the shrinkwrap and Git dependencies fix and the -fix to a crasher involving cycles in development dependencies. - -#### NEW RELEASE CADENCE - -Releasing npm has been, for the most part, a very prominent part of our -weekly process process. As part of our efforts to find the most effective -ways to allocate our team's resources, we decided last month that we would -try and slow our releases down to a monthly cadence, and see if we found -ourselves with as much extra time and attention as we expected to have. -Process experiments are useful for finding more effective ways to do our -work, and we're at least going to keep doing this for a whole quarter, and -then measure how well it worked out. It's entirely likely that we'll switch -back to a more frequent cadence, specially if we find that the value that -weekly cadence was providing the community is not worth sacrificing for a -bit of extra time. Does this affect you significantly? Let us know! - -#### SCOPED PACKAGES IN BUNDLED DEPENDENCIES - -Prior to this release and -[v2.15.10](https://github.com/npm/npm/releases/v2.15.10), npm had ignored -scoped modules found in `bundleDependencies`. - -* [`29cf56d`](https://github.com/npm/npm/commit/29cf56dbae8e3dd16c24876f998051623842116a) - [#8614](https://github.com/npm/npm/issues/8614) - Include scoped packages in bundled dependencies. - ([@forivall](https://github.com/forivall)) - -#### `preinstall` LIFECYCLE IN CURRENT PROJECT - -* [`b7f13bc`](https://github.com/npm/npm/commit/b7f13bc80b89b025be0c53d81b90ec8f2cebfab7) - [#13259](https://github.com/npm/npm/pull/13259) - Run top level preinstall before installing dependencies - ([@palmerj3](https://github.com/palmerj3)) - -#### BETTER SHRINKWRAP WITH GIT DEPENDENCIES - -* [`0f7e319`](https://github.com/npm/npm/commit/0f7e3197bcec7a328b603efdffd3681bbc40f585) - [#12718](https://github.com/npm/npm/issues/12718.) - Update outdated git dependencies found in shrinkwraps. Previously, if the - module version was the same then no update would be completed even if the - committish had changed. - ([@kossnocorp](https://github.com/kossnocorp)) - - -#### CYCLES IN DEVELOPMENT DEPENDENCIES NO LONGER CRASH - -* [`1691de6`](https://github.com/npm/npm/commit/1691de668d34cd92ab3de08bf3a06085388f2f07) - [#13327](https://github.com/npm/npm/issues/13327) - Fix bug where cycles found in development dependencies could result in - infinite recursion that resulted in crashes. - ([@iarna](https://github.com/iarna)) - -#### IMPROVE "NOT UPDATING LINKED MODULE" WARNINGS - -* [`1619871`](https://github.com/npm/npm/commit/1619871ac0cc8839dc9962c78e736095976c1eb4) - [#12893](https://github.com/npm/npm/pull/12893) - Only warn about symlink update if version number differs - The update-linked action outputs a warning that it needs to update the - linked package, but can't, There is no need for the package to be updated if - it is already at the correct version. This change does a check before - logging the warning. - ([@DaveEmmerson](https://github.com/DaveEmmerson)) - -#### MORE BUG FIXES - -* [`8f8d1b3`](https://github.com/npm/npm/commit/8f8d1b33a78c79aff9de73df362abaa7f05751d2) - [#11398](https://github.com/npm/npm/issues/11398) - Fix bug where `package.json` files that contained a `type` property could - cause crashes. `type` is not a `package.json` property that npm makes use - of and having it should be (and now is) harmless. - ([@zkat](https://github.com/zkat)) -* [`e7fa6c6`](https://github.com/npm/npm/commit/e7fa6c6a2c1de2a214479daa8c6901eebb350381) - [#13353](https://github.com/npm/npm/issues/13353) - Add GIT_EXEC_PATH to Git environment whitelist. - ([@mhart](https://github.com/mhart)) -* [`c23af21`](https://github.com/npm/npm/commit/c23af21d4cedd7fedcb4168672044db76ad054a8) - [#13626](https://github.com/npm/npm/pull/13626) - Use HTTPS issues URL in the error message for type validation errors. - ([@watilde](https://github.com/watilde)) - -#### INCLUDE `npm login` IN COMMAND SUMMARY - -* [`ab0c4b1`](https://github.com/npm/npm/commit/ab0c4b137b05762e75e0913038b606f087b58aa0) - [#13581](https://github.com/npm/npm/issues/13581) - The `login` command has long been an alias for `adduser`. - At the same time, there is an expectation not just of that - particular word being something to look for, but of there being - clear symmetry with `logout`. - So it was a bit confusing when `login` didn't show up in - `npm help` on a technicality. This seems like an acceptable - exception to the rule that says "no aliases in `npm help`". - ([@zkat](https://github.com/zkat)) - -#### DOCUMENTATION - -* [`e2d7e78`](https://github.com/npm/npm/commit/e2d7e7820a7875ed96e0382dc1e91b8df4e83746) - [#13319](https://github.com/npm/npm/pull/13319) - As Node.js 0.8 is no longer supported, remove mention of it from the README. - ([@watilde](https://github.com/watilde)) -* [`c565d89`](https://github.com/npm/npm/commit/c565d893a38efb6006e841450503329c9e58f100) - [#13349](https://github.com/npm/npm/pull/13349) - Updated the scripts documentation to explain the different between `version` and `preversion`. - ([@christophehurpeau](https://github.com/christophehurpeau)) -* [`fa8f87f`](https://github.com/npm/npm/commit/fa8f87f1ec92e543dd975156c4b184eb3e0b80cb) - [#10167](https://github.com/npm/npm/pull/10167) - Clarify in scope documentation that npm@2 is required for scoped packages. - ([@danpaz](https://github.com/danpaz)) - -#### DEPENDENCIES - -* [`124427e`](https://github.com/npm/npm/commit/124427eabbfd200aa145114e389e19692559ff1e) - [#8614](https://github.com/npm/npm/issues/8614) - `fstream-npm@1.1.1`: - Fixes bug with inclusion of scoped bundled dependencies. - ([@forivall](https://github.com/forivall)) -* [`7e0cdff`](https://github.com/npm/npm/commit/7e0cdff04714709f6dc056b19422d3f937502f1c) - [#13497](https://github.com/npm/npm/pull/13497) - `graceful-fs@4.1.5`: - `graceful-fs` had a [bug fix](https://github.com/isaacs/node-graceful-fs/pull/71) which - fixes a problem ([nodejs/node#7846](https://github.com/nodejs/node/pull/7846)) exposed - by recent changes to Node.js. - ([@thefourtheye](https://github.com/thefourtheye)) -* [`9b88cb8`](https://github.com/npm/npm/commit/9b88cb89f138443f324094685f4de073f33ecef0) - [#9984](https://github.com/npm/npm/issues/9984) - `request@2.74.0`: - Update request library to at least 2.73 to fix a bug where `npm install` would crash with - _Cannot read property 'emit' of null._ - - Update `request` dependency `tough-cookie` to `2.3.0` to - to address [https://nodesecurity.io/advisories/130](https://nodesecurity.io/advisories/130). - Versions 0.9.7 through 2.2.2 contain a vulnerable regular expression that, - under certain conditions involving long strings of semicolons in the - "Set-Cookie" header, causes the event loop to block for excessive amounts of - time. - ([@zarenner](https://github.com/zarenner)) - ([@stash-sfdc](https://github.com/stash-sfdc)) -* [`bf78ce5`](https://github.com/npm/npm/commit/bf78ce5ef5d2d6e95177193cca5362dd27bff968) - [#13387](https://github.com/npm/npm/issues/13387) - `minimatch@3.0.3`: - Handle extremely long and terrible patterns more gracefully. - There were some magic numbers that assumed that every extglob pattern starts - and ends with a specific number of characters in the regular expression. - Since !(||) patterns are a little bit more complicated, this led to creating - an invalid regular expression and throwing. - ([@isaacs](https://github.com/isaacs)) -* [`803e538`](https://github.com/npm/npm/commit/803e538efaae4b56a764029742adcf6761e8398b) - [isaacs/rimraf#111](https://github.com/isaacs/rimraf/issues/111) - `rimraf@2.5.4`: Clarify assertions: cb is required, options are not. - ([@isaacs](https://github.com/isaacs)) -* [`a9f84ef`](https://github.com/npm/npm/commit/a9f84ef61b4c719b646bf9cda00577ef16e3a113) - `lodash.without@4.2.0` - ([@jdalton](https://github.com/jdalton)) -* [`f59ff1c`](https://github.com/npm/npm/commit/f59ff1c2701f1bfd21bfdb97b4571823b614f694) - `lodash.uniq@4.4.0` - ([@jdalton](https://github.com/jdalton)) -* [`8cc027e`](https://github.com/npm/npm/commit/8cc027e5e81623260a49b31fe406ce483258b203) - `lodash.union@4.5.0` - ([@jdalton](https://github.com/jdalton)) -* [`0a6c1e4`](https://github.com/npm/npm/commit/0a6c1e4302a153fb055f495043ed33afd8324193) - `lodash.without@4.3.0` - ([@jdalton](https://github.com/jdalton)) -* [`4ab0181`](https://github.com/npm/npm/commit/4ab0181fca2eda18888b865ef691b83d30fb0c33) - `lodash.clonedeep@4.4.1` - ([@jdalton](https://github.com/jdalton)) - -### v3.10.6 (2016-07-07) - -This week we have a bunch of bug fixes for ya! A shrinkwrap regression -introduced in 3.10.0, better lifecycle `PATH` behavior, improvements when -working with registries other than `registry.npmjs.org` and a fix for -hopefully the last _don't print a progress bar over my interactive thingy_ -bug. - -#### SHRINKWRAP AND DEV DEPENDENCIES - -The rewrite in 3.10.0 triggered a bug where dependencies of devDependencies -would be included in your shrinkwrap even if you didn't request -devDependencies. - -* [`2484529`](https://github.com/npm/npm/commit/2484529ab56a42e5d6f13c48006f39a596d9e327) - [#13308](https://github.com/npm/npm/pull/13308) - Fix bug where deps of devDependencies would be incorrectly included in - shrinkwraps. - ([@iarna](https://github.com/iarna)) - -#### BETTER PATH LIFECYCLE BEHAVIOR - -We've been around the details on this one a few times in recent months and -hopefully this will bring is to where we want to be. - -* [`81051a9`](https://github.com/npm/npm/commit/81051a90eee66a843f76eb8cccedbb1d0a5c1f47) - [#12968](https://github.com/npm/npm/pull/12968) - When running lifecycle scripts, only prepend directory containing the node - binary to PATH if not already in PATH. - ([@segrey](https://github.com/segrey)) - -#### BETTER INTERACTIONS WITH THIRD PARTY REGISTRIES - -* [`071193c`](https://github.com/npm/npm/commit/071193c8e193767dd1656cb27556cb3751d77a3b) - [#10869](https://github.com/npm/npm/pull/10869) - If the registry returns a list of versions some of which are invalid, skip - those when picking a version to install. This can't happen with - registry.npmjs.org as it will normalize versions published with it, but it - can happen with other registries. - ([@gregersrygg](https://github.com/gregersrygg)) - -#### ONE LAST TOO-MUCH-PROGRESS CORNER - -* [`1244cc1`](https://github.com/npm/npm/commit/1244cc16dc5a0536acf26816a1deeb8e221d67eb) - [#13305](https://github.com/npm/npm/pull/13305) - Disable progress bar in `npm edit` and `npm config edit`. - ([@watilde](https://github.com/watilde)) - -#### HTML DOCS IMPROVEMENTS - -* [`58da923`](https://github.com/npm/npm/commit/58da9234ae72a5474b997f890a1155ee9785e6f1) - [#13225](https://github.com/npm/npm/issues/13225) - Fix HTML character set declaration in generated HTML documentation. - ([@KenanY](https://github.com/KenanY)) -* [`d1f0bf4`](https://github.com/npm/npm/commit/d1f0bf4303566f8690502034f82bbb449850958d) - [#13250](https://github.com/npm/npm/pull/13250) - Optimize png images using zopflipng. - ([@PeterDaveHello](https://github.com/PeterDaveHello)) - -#### DEPENDENCY UPDATES (THAT MATTER) - -* [`c7567e5`](https://github.com/npm/npm/commit/c7567e58618b63f97884afa104d2f560c9272dd5) - [npm/npm-user-validate#9](https://github.com/npm/npm-user-validate/pull/9) - `npm-user-validate@0.1.5`: - Lower the username length limits to 214 from 576 to match `registry.npmjs.org`'s limits. - ([@aredridel](https://github.com/aredridel)) -* [`22802c9`](https://github.com/npm/npm/commit/22802c9db3cf990c905e8f61304db9b5571d7964) - [#isaacs/rimraf](https://github.com/npm/npm/issues/isaacs/rimraf) - `rimraf@2.5.3`: - Fixes EPERM errors when running `lstat` on read-only directories. - ([@isaacs](https://github.com/isaacs)) -* [`ce6406f`](https://github.com/npm/npm/commit/ce6406f4b6c4dffbb5cd8a3c049f6663a5665522) - `glob@7.0.5`: - Forces the use of `minimatch` to 3.0.2, which improved handling of long and - complicated patterns. - ([@isaacs](https://github.com/isaacs)) - - -### v3.10.5 (2016-07-05) - -This is a fix to this week's testing release to correct the update of -`node-gyp` which somehow got mangled. - -* [`ca97ce2`](https://github.com/npm/npm/commit/ca97ce2e8d8ba44c445b39ffa40daf397d5601b3) - [#13256](https://github.com/npm/npm/issues/13256) - Fresh reinstall of `node-gyp@3.4.0`. - ([@zkat](https://github.com/zkat)) - -### v3.10.4 (2016-06-30) - -Hey y'all! This release includes a bunch of fixes we've been working on as we -continue on our `big-bug` push. There's still [a lot of it left to -do](https://github.com/npm/npm/labels/big-bug), but once this is done, things -should just generally be more stable, installs should be more reliable and -correct, and we'll be able to move on to more future work. We'll keep doing our -best! 🙌 - -#### RACES AS WACKY AS [REDLINE](https://en.wikipedia.org/wiki/Redline_\(2009_film\)) - -Races are notoriously hard to squash, and tend to be some of the more common -recurring bugs we see on the CLI. [@julianduque](https://github.com/julianduque) -did some pretty awesome [sleuthing -work](https://github.com/npm/npm/issues/12669) to track down a cache race and -helpfully submitted a patch. There were some related races in the same area that -also got fixed at around the same time, mostly affecting Windows users. - -* [`2a37c97`](https://github.com/npm/npm/commit/2a37c97121483db2b6f817fe85c2a5a77b76080e) - [#12669](https://github.com/npm/npm/issues/12669) - [#13023](https://github.com/npm/npm/pull/13023) - The CLI is pretty aggressive about correcting permissions across the cache - whenever it writes to it. This aggressiveness caused a couple of races where - temporary cache files would get picked up by `fs.readdir`, and removed before - `chownr` was called on them, causing `ENOENT` errors. While the solution might - seem a bit hamfisted, it's actually perfectly safe and appropriate in this - case to just ignore those resulting `ENOENT` errors. - ([@julianduque](https://github.com/julianduque)) -* [`ea018b9`](https://github.com/npm/npm/commit/ea018b9e3856d1798d199ae3ebce4ed07eea511b) - [#13023](https://github.com/npm/npm/pull/13023) - If a user were to have SUDO_UID and SUDO_GID, they'd be able to get into a - pretty weird state. This fixes that corner case. - ([@zkat](https://github.com/zkat)) -* [`703ca3a`](https://github.com/npm/npm/commit/703ca3abbf4f1cb4dff08be32acd2142d5493482) - [#13023](https://github.com/npm/npm/pull/13023) - A missing `return` was causing `chownr` to be called on Windows, even though - that's literally pointless, and causing crashes in the process, instead of - short-circuiting. This was entirely dependent on which callback happened to be - called first, and in some cases, the failing one would win the race. This - should prevent this from happening in the future. - ([@zkat](https://github.com/zkat)) -* [`69267f4`](https://github.com/npm/npm/commit/69267f4fbd1467ce576f173909ced361f8fe2a9d) - [#13023](https://github.com/npm/npm/pull/13023) - Added tests to verify `correct-mkdir` race patch. - ([@zkat](https://github.com/zkat)) -* [`e5f50ea`](https://github.com/npm/npm/commit/e5f50ea9f84fe8cac6978d18f7efdf43834928e7) - [#13023](https://github.com/npm/npm/pull/13023) - Added tests to verify `addLocal` race patch. - ([@zkat](https://github.com/zkat)) - -#### SHRINKWRAP IS COMPLICATED BUT IT'S BETTER NOW - -[@iarna](https://github.com/iarna) did some heroic hacking to refactor a bunch -of `shrinkwrap`-related bits and fixed some resolution and pathing issues that -were biting users. The code around that stuff got more readable/maintainable in -the process, too! - -* [`346bba1`](https://github.com/npm/npm/commit/346bba1e1fee9cc814b07c56f598a73be5c21686) - [#13214](https://github.com/npm/npm/pull/13214) - Resolve local dependencies in `npm-shrinkwrap.json` relative to the top of the - tree. - ([@iarna](https://github.com/iarna)) -* [`4a67fdb`](https://github.com/npm/npm/commit/4a67fdbd0f160deb6644a9c4c5b587357db04d2d) - [#13213](https://github.com/npm/npm/pull/13213) - If you run `npm install modulename` it should, if a `npm-shrinkwrap.json` is - present, use the version found there. If not, it'll use the version found in - your `package.json`, and failing *that*, use `latest`. - This fixes a case where the first check was being bypassed because version - resolution was being done prior to loading the shrinkwrap, and so checks to - match the shrinkwrap version couldn't succeed. - ([@iarna](https://github.com/iarna)) -* [`afa2133`](https://github.com/npm/npm/commit/afa2133a5d8ac4f6f44cdc6083d89ad7f946f5bb) - [#13214](https://github.com/npm/npm/pull/13214) - Refactor shrinkwrap specifier lookup into shared function. - ([@iarna](https://github.com/iarna)) -* [`2820b56`](https://github.com/npm/npm/commit/2820b56a43e1cc1e12079a4c886f6c14fe8c4f10) - [#13214](https://github.com/npm/npm/pull/13214) - Refactor operations in `inflate-shrinkwrap.js` into separate functions for - added clarity. - ([@iarna](https://github.com/iarna)) -* [`ee5bfb3`](https://github.com/npm/npm/commit/ee5bfb3e56ee7ae582bec9f741f32b224c279947) - Fix Windows path issue in a shrinkwrap test. - ([@zkat](https://github.com/zkat)) - -#### OTHER BUGFIXES - -* [`a11a7b2`](https://github.com/npm/npm/commit/a11a7b2e7df9478ac9101b06eead4a74c41a648d) - [#13212](https://github.com/npm/npm/pull/13212) - Resolve local paths passed in through the command line relative to current - directory, instead of relative to the `package.json`. - ([@iarna](https://github.com/iarna)) - -#### DEPENDENCY UPDATES - -* [`900a5b7`](https://github.com/npm/npm/commit/900a5b7f18b277786397faac05853c030263feb8) - [#13199](https://github.com/npm/npm/pull/13199) - [`node-gyp@3.4.0`](https://github.com/nodejs/node-gyp/blob/master/CHANGELOG.md): - AIX, Visual Studio 2015, and logging improvements. Oh my~! - ([@rvagg](https://github.com/rvagg)) - -#### DOCUMENTATION FIXES - -* [`c6942a7`](https://github.com/npm/npm/commit/c6942a7d6acb2b8c73206353bbec03380a056af4) - [#13134](https://github.com/npm/npm/pull/13134) - Fixed a few typos in `CHANGELOG.md`. - ([@watilde](https://github.com/watilde)) -* [`e63d913`](https://github.com/npm/npm/commit/e63d913127731ece56dcd69c7c0182af21be58f8) - [#13156](https://github.com/npm/npm/pull/13156) - Fix old reference to `doc/install` in a source comment. - ([@sheerun](https://github.com/sheerun)) -* [`099d23c`](https://github.com/npm/npm/commit/099d23cc8f38b524dc19a25857b2ebeca13c49d6) - [#13113](https://github.com/npm/npm/issues/13113) - [#13189](https://github.com/npm/npm/pull/13189) - Fixes a link to `npm-tag(3)` that was breaking to instead point to - `npm-dist-tag(1)`, as reported by [@SimenB](https://github.com/SimenB) - ([@macdonst](https://github.com/macdonst)) - -### v3.10.3 (2016-06-23) - -Given that we had not one, but two updates to our RC this past week, it -should come as no surprise that this week's full release is a bit -lighter. We have some documentation patches and a couple of bug fixes via -dependency updates. - -If you haven't yet checked out last week's release, -[v3.10.0](https://github.com/npm/npm/releases/tag/v3.10.0) -and the two follow up releases -[v3.10.1](https://github.com/npm/npm/releases/tag/v3.10.1) -and -[v3.10.2](https://github.com/npm/npm/releases/tag/v3.10.2), -you really should do so. They're the most important releases we've had in -quite a while, fixing a bunch of critical bugs (including an issue -impacting publishing with Node.js 6.x) and of course, bringing in the new -and improved progress bar. - -#### BUM SYMLINKS BURN NO MORE - -There's been a bug lurking where broken symlinks in your `node_modules` -folder could cause all manner of mischief, from crashes to empty `npm ls` -results. The intrepid [@watilde](https://github.com/watilde) tracked this -down for us. - -This addresses the root cause of the outdated crasher we protected -against earlier this week in -[#13115](https://github.com/npm/npm/issues/13115). - -This also fixes [#9564](https://github.com/npm/npm/issues/9564), the -problem where a bad symlink in your global modules would result in an -empty result when you ran `npm ls -g`. - -This ALSO likely fixes numerous "Missing argument #1" errors. (But surely -not all of them as that's actually just a generic arity and -type-validation failure.) - -* [`ca92ac4`](https://github.com/npm/npm/commit/ca92ac455b841a708dd89262ff88d503b125d717) - [npm/read-package-tree#6](https://github.com/npm/read-package-tree/pull/6) - `read-package-tree@5.1.5`: - Make bad symlinks be non-fatal errors when reading the tree off disk. - ([@watilde](https://github.com/watilde)) - -#### BETTER UNICODE DETECTION - -* [`6c3f7f0`](https://github.com/npm/npm/commit/6c3f7f043f09fc2aa19ffd3f956787635fa6f4d0) - `has-unicode@2.0.1`: - Fix unicode detection on a number of Linux distributions. - ([@Darkhogg](https://github.com/Darkhogg)) ([@gagern](https://github.com/gagern)) - - -#### DOCUMENTATION FIXES - -* [`b9243ee`](https://github.com/npm/npm/commit/b9243ee60a3d60505c2502dc8633811b42c8aaea) - [#13127](https://github.com/npm/npm/pull/13127) - Remove extra backtick from `npm ls` documentation. - ([@shvaikalesh](https://github.com/shvaikalesh)) -* [`e05c0c2`](https://github.com/npm/npm/commit/e05c0c243cc702f9c392c001f668a90b57eaeb0e) - [iarna/has-unicode#3](https://github.com/iarna/has-unicode/pull/3) - [iarna/has-unicode#4](https://github.com/iarna/has-unicode/pull/4) - [#13084](https://github.com/npm/npm/pull/13084) - Correct changelog entry for shrinkwrap lifecycle order. - ([@SimenB](https://github.com/SimenB)) -* [`823994f`](https://github.com/npm/npm/commit/823994f100a0e59e1dd109e312811f971968ec75) - [#13080](https://github.com/npm/npm/pull/13080) - Describe using `npm pack` to see a dry run of publication results in - the `npm publish` documentation. - ([@laughinghan](https://github.com/laughinghan)) - -#### DEPENDENCY UPDATES - -* [`e44d2db`](https://github.com/npm/npm/commit/e44d2db1ad0d860ca08e99c81135bd399fb733b1) - `aproba@1.0.4`: Documentation updates and minor refactoring. - ([@iarna](https://github.com/iarna)) - -### v3.10.2 (2016-06-17): - -This is a quick hotfix release with two small bug fixes. First, there was -an issue where the new progress bar would overwrite interactive prompts, -that is, those found in `npm login` and `npm init`. Second, if the -directory you were running `npm outdated` on was a bad link or otherwise had -unrecoverable errors then npm would crash instead of printing the error. - -* [`fbefb86`](https://github.com/npm/npm/commit/fbefb8675b26320b295f481b4872ce99f0180807) - [`7779e9f`](https://github.com/npm/npm/commit/7779e9fb9430f6547532c67f2471864d62bbd5bc) - [#13105](https://github.com/npm/npm/issues/13105) - Disable progress bar in `adduser` and `init`. -* [`6a33b2c`](https://github.com/npm/npm/commit/6a33b2c13f637a41e25cd0339925bc430b50358a) - [#13115](https://github.com/npm/npm/issues/13115) - Ensure that errors reading the package tree for `outdated` does not result - in crashes. - ([@iarna](https://github.com/iarna)) - -### v3.10.1 (2016-06-17): - -There are two very important bug fixes and one long-awaited (and significant!) -deprecation in this hotfix release. [Hold on.](http://butt.holdings/) - -#### *WHOA* - -When Node.js 6.0.0 was released, the CLI team noticed an alarming upsurge in -bugs related to important files (like `README.md`) not being included in -published packages. The new bugs looked much like -[#5082](https://github.com/npm/npm/issues/5082), which had been around in one -form or another since April, 2014. #5082 used to be a very rare (and obnoxious) -bug that the CLI team hadn't had much luck reproducing, and we'd basically -marked it down as a race condition that arose on machines using slow and / or -rotating-media-based hard drives. - -Under 6.0.0, the behavior was reliable enough to be nearly deterministic, and -made it very difficult for publishers using `.npmignore` files in combination -with `"files"` stanzas in `package.json` to get their packages onto the -registry without one or more files missing from the packed tarball. The entire -saga is contained within [the issue](https://github.com/npm/npm/issues/5082), -but the summary is that an improvement to the performance of -[`fs.realpath()`](https://nodejs.org/api/fs.html#fs_fs_realpath_path_options_callback) -made it much more likely that the packing code would lose the race. - -Fixing this has proven to be very difficult, in part because the code used by -npm to produce package tarballs is more complicated than, strictly speaking, it -needs to be. [**@evanlucas**](https://github.com/evanlucas) contributed [a -patch](https://github.com/npm/fstream/pull/50) that passed the tests in a -[special test suite](https://github.com/othiym23/eliminate-5082) that I -([**@othiym23**](https://github.com/othiym23)) created (with help from -[**@addaleax**](https://github.com/addaleax)), but only _after_ we'd released -the fixed version of that package did we learn that it actually made the -problem _worse_ in other situations in npm proper. Eventually, -[**@rvagg**](https://github.com/rvagg) put together a more durable fix that -appears to completely address the errant behavior under Node.js 6.0.0. That's -the patch included in this release. Everybody should chip in for redback -insurance for Rod and his family; he's done the community a huge favor. - -Does this mean the long (2+ year) saga of #5082 is now over? At this point, I'm -going to quote from my latest summary on the issue: - -> The CLI team (mostly me, with input from the rest of the team) has decided that -> the overall complexity of the interaction between `fstream`, `fstream-ignore`, -> `fstream-npm`, and `node-tar` has grown more convoluted than the team is -> comfortable (maybe even capable of) supporting. -> -> - While I believe that @rvagg's (very targeted) fix addresses _this_ issue, I -> would be shocked if there aren't other race conditions in npm's packing -> logic. I've already identified a couple other places in the code that are -> most likely race conditions, even if they're harder to trigger than the -> current one. -> - The way that dependency bundling is integrated leads to a situation in -> which a bunch of logic is duplicated between `fstream-npm` and -> `lib/utils/tar.js` in npm itself, and the way `fstream`'s extension -> mechanism works makes this difficult to clean up. This caused a nasty -> regression ([#13088](https://github.com/npm/fstream/pull/50), see below) as -> of ~`npm@3.8.7` where the dependencies of `bundledDependencies` were no -> longer being included in the built package tarballs. -> - The interaction between `.npmignore`, `.gitignore`, and `files` is hopelessly -> complicated, scattered in many places throughout the code. We've been -> discussing [making the ignores and includes logic clearer and more -> predictable](https://github.com/npm/npm/wiki/Files-and-Ignores), and the -> current code fights our efforts to clean that up. -> -> So, our intention is still to replace `fstream`, `fstream-ignore`, and -> `fstream-npm` with something much simpler and purpose-built. There's no real -> reason to have a stream abstraction here when a simple recursive-descent -> filesystem visitor and a synchronous function that can answer whether a given -> path should be included in the packed tarball would do the job adequately. -> -> What's not yet clear is whether we'll need to replace `node-tar` in the -> process. `node-tar` is a very robust implementation of tar (it handles, like, -> everything), and it also includes some very important tweaks to prevent several -> classes of security exploits involving maliciously crafted packages. However, -> its packing API involves passing in an `fstream` instance, so we'd either need -> to produce something that follows enough of `fstream`'s contract for `node-tar` -> to keep working, or swap `node-tar` out for something like `tar-stream` (and -> then ensuring that our use of `tar-stream` is secure, which could involve -> security patches for either npm or `tar-stream`). - -The testing and review of `fstream@1.0.10` that the team has done leads us to -believe that this bug is fixed, but I'm feeling more than a little paranoid -about fstream now, so it's important that people keep a close eye on their -publishes for a while and let us know immediately if they notice any -irregularities. - -* [`8802f6c`](https://github.com/npm/npm/commit/8802f6c152ea35cb9e5269c077c3a2f9df411afc) - [#5082](https://github.com/npm/npm/issues/5082) `fstream@1.0.10`: Ensure that - entries are collected after a paused stream resumes. - ([@rvagg](https://github.com/rvagg)) -* [`c189723`](https://github.com/npm/npm/commit/c189723110497a17dac3b0596f2916deeed93ee7) - [#5082](https://github.com/npm/npm/issues/5082) Remove the warning introduced - in `npm@3.10.0`, because it should no longer be necessary. - ([@othiym23](https://github.com/othiym23)) - -#### *ERK* - -Because the interaction between `fstream`, `fstream-ignore`, `fsream-npm`, and -`node-tar` is so complex, it's proven difficult to add support for npm features -like `bundledDependencies` without duplicating some logic within npm's code -base. While [fixing a completely unrelated -bug](https://github.com/npm/npm/issues/9642), we "cleaned up" some of this -seemingly duplicated code, and in the process removed the code that ensured -that the dependencies of `bundledDependencies` are themselves bundled. We've -brought that code back into the code base (without reopening #9642), and added -a test to ensure that this regression can't recur. - -* [`1b6ceca`](https://github.com/npm/npm/commit/1b6ceca32fc81ca7cc7ac2eb7d11f687e6f87f26) - [#13088](https://github.com/npm/npm/issues/13088) Partially restore npm's own - version of the `fstream-npm` function `applyIgnores` to ensure that the - dependencies of `bundledDependencies` are included in published packages. - ([@iarna](https://github.com/iarna)) - -#### GOODBYE, FAITHFUL FRIEND - -At NodeConf Adventure 2016 (RIP in peace, Mikeal Rogers's NodeConf!), the CLI -team had an opportunity to talk to representatives from some of the larger -companies that we knew were still using Node.js 0.8 in production. After asking -them whether they were still using 0.8, we got back blank stares and questions -like, "0.8? You mean, from four years ago?" After establishing that being able -to run npm in their legacy environments was no longer necessary, the CLI team -made the decision to drop support for 0.8. (Faithful observers of our [team -meetings](https://github.com/npm/npm/issues?utf8=%E2%9C%93&q=is%3Aissue+npm+cli+team+meeting+) -will have known this was the plan for NodeConf since the beginning of 2016.) - -In practice, this means only what's in the commit below: we've removed 0.8 from -our continuous integration test matrix below, and will no longer be habitually -testing changes under Node 0.8. We may also give ourselves permission to use -`setImmediate()` in test code. However, since the project still supports -Node.js 0.10 and 0.12, it's unlikely that patches that rely on ES 2015 -functionality will land anytime soon. - -Looking forward, the team's current plan is to drop support for Node.js 0.10 -when its LTS maintenance window expires in October, 2016, and 0.12 when its -maintenance / LTS window ends at the end of 2016. We will also drop support for -Node.js 5.x when Node.js 6 becomes LTS and Node.js 7 is released, also in the -October-December 2016 timeframe. - -(Confused about Node.js's LTS policy? [Don't -be!](https://github.com/nodejs/LTS) If you look at [this -diagram](https://github.com/nodejs/LTS/blob/ce364a94b0e0619eba570cd57be396573e1ef889/schedule.png), -it should make all of the preceding clear.) - -If, in practice, this doesn't work with distribution packagers or other -community stakeholders responsible for packaging and distributing Node.js and -npm, please reach out to us. Aligning the npm CLI's LTS policy with Node's -helps everybody minimize the amount of work they need to do, and since all of -our teams are small and very busy, this is somewhere between a necessity and -non-negotiable. - -* [`d6afd5f`](https://github.com/npm/npm/commit/d6afd5ffb1b19e5d94aeee666afcb8adaced58db) - Remove 0.8 from the Node.js testing matrix, and reorder to match real-world - priority, with comments. ([@othiym23](https://github.com/othiym23)) - -### v3.10.0 (2016-06-16): - -Do we have a release for you! We have our first new lifecycle since -`version`, a new progress bar and a bunch of bug fixes. -[I'm](https://github.com/iarna) really excited about this release, let me -tell you!! - -#### DANGER: PUBLISHING ON NODE 6.0.0 - -Publishing and packing are buggy under Node versions greater than 6.0.0. -Please use Node.js LTS (4.4.x) to publish packages. See -[#5082](https://github.com/npm/npm/issues/5082) for details and current -status. - -* [`4e52cef`](https://github.com/npm/npm/commit/4e52cef3d4170c8abab98149666ec599f8363233) - [#13077](https://github.com/npm/npm/pull/13077) - Warn when using Node 6+. - ([@othiym23](https://github.com/othiym23)) - -#### NEW LIFECYCLE SCRIPT: `shrinkwrap` - -* [`e8c80f2`](https://github.com/npm/npm/commit/e8c80f20bfd5d1618e85dbab41660d6f3e5ce405) - [#10744](https://github.com/npm/npm/issues/10744) - You can now add `preshrinkwrap`, `shrinkwrap` and `postshrinkwrap` to your `package.json` - scripts section. They are run when you run `npm shrinkwrap` or `npm install --save` with - an `npm-shrinkwrap.json` present in your module directory. - - `preshrinkwrap` and `shrinkwrap` is run prior to generating the new `npm-shrinkwrap.json` - and `postshrinkwrap` is run after. - ([@SimenB](https://github.com/SimenB)) - -#### NEW PROGRESS BAR - - - -We have a new progress bar and a bunch of related improvements! - -##### BLOCKING BLOCKING - -**!!WARNING!!** As a part of this change we now explicitly set -`process.stdout` and `process.stderr` to be _blocking_ if they are ttys, -using [set-blocking](https://www.npmjs.com/package/set-blocking). This is -necessary to ensure that we can fully erase the progress bar before we start -writing other things out to the console. - -Prior to Node.js 6.0.0, they were already blocking on Windows, and MacOS. -Meanwhile, on Linux they were always non-blocking but had large (64kb) -buffers, which largely made this a non-issue there. Starting with Node.js -6.0.0 they became non-blocking on MacOS and that caused some unexpected -issues (see [nodejs/node#6456](https://github.com/nodejs/node/issues/6456)). - -If you are a Linux user, it's plausible that this might have a performance -impact if your terminal can't keep up with output rate. If you experience -this, we want to know! Please [file an -issue](https://github.com/npm/npm/issues/new) at our issue tracker. - -##### BETTER LAYOUT - -Let's start by talking about what goes into the new progress bar: - -``` -⸨░░░░░░░░░░⠂⠂⠂⠂⠂⠂⠂⠂⸩ ⠹ loadExtraneous: verb afterAdd /Users/rebecca/.npm/null/0.0.0/package/package.json written - ↑‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ ↑ ‾‾‾‾‾‾‾‾‾↑‾‾‾‾ ‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾↑‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾ - percent complete spinner current thing we're doing most recent log line -``` - -The _spinner_ is intended as an activity indicator–it moves whenever -npm sends something to its logs. It also spins at a constant speed while -waiting on the network. - -The _current thing we're doing_ relates to how we track how much work has -been done. It's the name of the unit of work we most recently started or -completed some of. Sometimes these names are more obvious than others and -that's something we'll look at improving over time. - -And finally, the _most recent log line_ is exactly that, it's the most -recent line that you would have seen if you were running with -`--loglevel=silly` or were watching the `npm-debug.log`. These are written -to be useful to the npm developers above all else, so they may sometimes be -a little cryptic. - -* [`6789978`](https://github.com/npm/npm/commit/6789978ab0713f67928177a9109fed43953ccbda) - [#13075](https://github.com/npm/npm/pull/13075) - `npmlog@3.1.2`: Update to the latest npmlog, which includes the new and - improved progress bar layout. - ([@iarna](https://github.com/iarna)) - -##### MORE PERFORMANT - -The underlying code for the progress bar was rewritten, in part with -performance in mind. Previously whenever you updated the progress bar it -would check an internal variable for how long it had been since the last -update and if it had been long enough, it would print out what you gave it. -With the new progress bar we do updates at a fixed interval (with -`setInterval`) and "updating" the progress bar just updates some variables -that will be used when the next tick of the progress bar happens. Currently -progress bar updates happen every 50ms, although that's open to tuning. - -##### WIDE(R) COMPATIBILITY - -I spent a lot of time working our Unicode support. There were a few issues -that plagued us: - -Previously one of the characters we used was _ambiguous width_ which means -that it was possible to configure your terminal to display it as _full -width_. If you did this, the output would be broken because we assumed it -was a _half width_ character. We no longer use any of these characters. - -Previously, we defaulted to using Unicode on Windows. This isn't a safe -assumption, however, as folks in non-US locales often use other code pages -for their terminals. Windows doesn't provide* any facility available to -Node.js for determining the current code page, so we no longer try to use -Unicode on Windows. - -_\* The facilities it does provide are a command line tool and a windows -system call. The former isn't satisfactory for speed reasons and the latter -can't be accessed from a JS-only Node.js program._ - -##### FOR THE FUTURE: THEMES - -The new version of the progress bar library supports plugable themes. Adding -support to npm shouldn't be too difficult. The built in themes are: - -* `ASCII` – The fallback theme which is always available. -* `colorASCII` – Inverts the color of the completed portion of the progress - bar. The default on Windows and usually on Linux. (Color support is - determined by looking at the `TERM` environment variable.) -* `brailleSpinner` – A braille based spinner and other unicode enhancements. MacOS only. -* `colorBrailleSpinner` – The default on MacOS, a combination of the above two. - -##### LESS GARBLED OUTPUT - -As a part of landing this I've also taken the opportunity to more -systematically disable the progress bar prior to printing to `stdout` or -running external commands (in particular: git). This should ensure that the -progress bar doesn't get left on screen after something else prints -something. We also are now much more zealous about erasing the progress bar -on exit, so if you `Ctrl-C` out of an install we'll still cleanup the -progress bar. - -* [`63f153c`](https://github.com/npm/npm/commit/63f153c743f9354376bfb9dad42bd028a320fd1f) - [#13075](https://github.com/npm/npm/pull/13075) - Consistently make sure that the progress bar is hidden before we try to - write to stdout. - ([@iarna](https://github.com/iarna)) -* [`8da79fa`](https://github.com/npm/npm/commit/8da79fa60de4972dca406887623d4e430d1609a1) - [#13075](https://github.com/npm/npm/pull/13075) - Be more methodical about disabling progress bars before running external - commands. - ([@iarna](https://github.com/iarna)) - -#### REPLACE `process.nextTick` WITH `asap` ASAP - -* [`5873b56`](https://github.com/npm/npm/commit/5873b56cb315437dfe97e747811c0b9c297bfd38) - [`254ad7e`](https://github.com/npm/npm/commit/254ad7e38f978b81046d242297fe8b122bfb5852) - [#12754](https://github.com/npm/npm/issues/12754) - Use `asap` in preference over `process.nextTick` to avoid recursion warnings. - Under the hood `asap` uses `setImmediate` when available and falls back to - `process.nextTick` when it's not. Versions of node that don't support - `setImmediate` have a version of `process.nextTick` that actually behaves - like the current `setImmediate`. - ([@lxe](https://github.com/lxe)) - -#### FIXES AND REFACTORING - -Sometimes the installer would get it into its head that it could move or -remove things that it really shouldn't have. While the reproducers for this were -often a bit complicated (the core reproducer involved five symlinks(!)), it turns -out this is an easy scenario to end up in if your project has a bunch of small -modules and you're linking them while developing them. - -Fixing this ended up involving doing an important and overdue rewrite of how -the installer keeps track of (and interrogates) the relationships between -modules. This likely fixes other related bugs, and in the coming weeks -we'll verify and close them as we find them. There are a whole slew of -commits related to this rewrite, and if you'd like to learn more check -out the PR where I describe what I did in detail: [#12775](https://github.com/npm/npm/pull/12775) - -* [`8f3e111`](https://github.com/npm/npm/commit/8f3e111fdd2ce7824864f77b04e5206bdaf961a1) - [`c0b0ed1`](https://github.com/npm/npm/commit/c0b0ed1e9945c01b2e68bf22af3fe4005aa4bcd4) - [#10800](https://github.com/npm/npm/issues/10800) - Remove install pruning stage–this was obsoleted by making the installer keep - itself up to date as it goes along. This is NOT related to `npm prune`. - ([@iarna](https://github.com/iarna)) - -#### MAKE OUTDATED MORE WIDELY LEGIBLE - -* [`21c60e9`](https://github.com/npm/npm/commit/21c60e9bb56d47da17b79681f2142b3dcf4c804b) - [#12843](https://github.com/npm/npm/pull/12843) - In `npm outdated, stop coloring the _Location_ and _Package Type_ columns. - Previously they were colored dark gray, which was hard to read for some - users. - ([@tribou](https://github.com/tribou)) - -#### DOCUMENTATION UPDATE - -* [`eb0a72e`](https://github.com/npm/npm/commit/eb0a72eb95862c1d0d41a259d138ab601d538793) - [#12983](https://github.com/npm/npm/pull/12983) - Describe how to run the lifecycle scripts of dependencies. How you do - this changed with `npm` v2. - ([@Tapppi](https://github.com/Tapppi)) - -### DEPENDENCY UPDATES - -* [`da743dc`](https://github.com/npm/npm/commit/da743dc2153fed8baca3dada611b188f53ab5931) - `which@1.2.10`: - Fix bug where unnecessary special case path handling for Windows could - produce unexpected results on Unix systems. - ([@isaacs](https://github.com/isaacs)) -* [`4533bd5`](https://github.com/npm/npm/commit/4533bd501d54aeedfec3884f4fd54e8c2edd6020) - `npm-user-validate@0.1.4`: - Validate the length of usernames. - ([@aredridel](https://github.com/aredridel)) -* [`4a18922`](https://github.com/npm/npm/commit/4a18922e56f9dc902fbb4daa8f5fafa4a1b89376) - `glob@7.0.4`: - Fixes issues with Node 6 and "long or excessively symlink-looping paths". - ([@isaacs](https://github.com/isaacs)) -* [`257fe11`](https://github.com/npm/npm/commit/257fe11052987e5cfec2abdf52392dd95a6c6ef3) - `npm-package-arg@4.2.0`: - Add `escapedName` to the result. It is suitable for passing through to a - registry without further processing. - ([@nexdrew](https://github.com/nexdrew)) -* [`dda3ca7`](https://github.com/npm/npm/commit/dda3ca70f74879106589ef29e167c8b91ef5aa4c) - `wrappy@1.0.2` - ([@zkat](https://github.com/zkat)) -* [`25f1db5`](https://github.com/npm/npm/commit/25f1db504d0fd8c97211835f0027027fe95e0ef3) - `readable-stream@2.1.4` - ([@calvinmetcalf](https://github.com/calvinmetcalf)) -* [`9d64fe6`](https://github.com/npm/npm/commit/9d64fe676ebc6949c687ffb85bd93eca3137fc0d) - `abbrev@1.0.9` - ([@isaacs](https://github.com/isaacs)) - -### v3.9.6 (2016-06-02): - -#### SMALL OUTPUT TWEAK - -* [`0bdc9d1`](https://github.com/npm/npm/commit/0bdc9d13b73df07e63a58470ea001fda490e5869) - [#12879](https://github.com/npm/npm/pull/12879) - The usage output for npm commands was somehow under the impression that - the singular form of `aliases` is `aliase`. This has been corrected to show - `alias` instead. - ([@intelliot](https://github.com/intelliot)) - -#### DOC UPDATES - -* [`f771b49`](https://github.com/npm/npm/commit/f771b49f5d65bbef540c231fbfcca71cacdce4db) - [#12933](https://github.com/npm/npm/pull/12933) - Add `config.gypi` to list of files that are always ignored in the - `package.json` manpage. - ([@Jokero](https://github.com/Jokero)) - -#### DEPENDENCY UPDATES - -* [`61c1d9c`](https://github.com/npm/npm/commit/61c1d9cd4b2296bd41d55a5c58e35ca5f028b9bc) - [#12926](https://github.com/npm/npm/pull/12926) - Removed unused dependency `lodash.isarray`. - ([@mmalecki](https://github.com/mmalecki)) -* [`168ed28`](https://github.com/npm/npm/commit/168ed2834b2c6db8bb39f81baadc0bf275807328) - [#12926](https://github.com/npm/npm/pull/12926) - Removed unused dependency `lodash.keys`. - ([@mmalecki](https://github.com/mmalecki)) - -### v3.9.5 (2016-05-27): - -Just a quick point release. We had an issue where I (Kat) included the -`.nyc_output/` directory in `npm@3.9.3` and `npm@3.9.4`. The issue got reported -right after that second release -([`#12873`](https://github.com/npm/npm/issues/12873)), and now there's this -small point release that's there to fix the issue sooner. - -* [`f96aea0`](https://github.com/npm/npm/commit/f96aea085be981cdb59bd09f16da40717426f981) - [#12878](https://github.com/npm/npm/pull/12878) - Ignore `.nyc_output` to avoid an accidental publish or commit filled with - code coverage data. - ([@TheAlphaNerd](https://github.com/TheAlphaNerd)) - -### v3.9.4 (2016-05-26): - -Hey all! It's that time again! - -This week continues our current `big-bug` squashing push, although there's none -that are ready to release quite yet -- we're working on it! - -It's also worth noting that we're entering the main part of conference season, -so you can probably expect a bit of a dev slowdown as a lot of us wombats attend -or speak at the various conferences. Remember [npm.camp](npm.camp) is happening -in 2 months and the lineup is looking pretty great! Tickets are still on sale. -Come hang out with us! WOO FUN! 🎉😸 - -#### BUGFIX - -* [`cac0038`](https://github.com/npm/npm/commit/cac0038868b18295f9f299e762e20034f32a3e11) - [#12845](https://github.com/npm/npm/pull/12845) - Progress bar during tarball packing now prints `pack:packagename` instead of - `pack:[object Object]`. - ([@iarna](https://github.com/iarna)) - -#### DOC UPDATES - -* [`0b81622`](https://github.com/npm/npm/commit/0b816225c743c9203db5d92fb4dd3a9293833298) - [#12840](https://github.com/npm/npm/pull/12840) - Remove sexualized language from comment in code. - ([@geek](https://github.com/geek)) -* [`d6dff24`](https://github.com/npm/npm/commit/d6dff2481cb587c392f22afb893ac3136371a64c) - [#12802](https://github.com/npm/npm/pull/12802) - Small grammar fix in `cli/npm.md`. - ([@andresilveira](https://github.com/andresilveira)) -* [`cb38e0f`](https://github.com/npm/npm/commit/cb38e0fff82a6c1c110026b95b07a8c32e27ec01) - [#12782](https://github.com/npm/npm/pull/12782) - Documents that `NOTICE` files started getting included after - [npm/fstream-npm#17](https://github.com/npm/fstream-npm/pull/17). - ([@SimenB](https://github.com/SimenB)) -* [`70a3ae4`](https://github.com/npm/npm/commit/70a3ae4d4ec76b3ec51f00bf5261f1147829f9fe) - [#12776](https://github.com/npm/npm/pull/12776) - `npm run-script` used to have a `<pkg>` argument that allowed you to target - specific packages' scripts. This was removed as one of the breaking changes - for `npm@2`. - This patch removes a mention of that argument, which really doesn't exist - anymore. - ([@fibo](https://github.com/fibo)) - -#### DEP UPDATES - -* [`4a4470d`](https://github.com/npm/npm/commit/4a4470ddd1d9b0b62cb94f3bff5ab6b8e6db527a) - `aproba@1.0.3` - ([@iarna](https://github.com/iarna)) - -#### TEST IMPROVEMENTS - -So it turns out, `t.comment` in `tap` is actually pretty nice! -There's also a couple other test improvements by Rebecca landing here. - -* [`9fd04dd`](https://github.com/npm/npm/commit/9fd04dd6be493465d7ac5f14dd9328e66069c1bf) - [#12851](https://github.com/npm/npm/pull/12851) - Rewrite `shrinkwrap-prod-dependency-also` test to use `common.npm` - ([@iarna](https://github.com/iarna)) -* [`3bc4a8e`](https://github.com/npm/npm/commit/3bc4a8ee58cb0e0adc84b4f135330f2b1e20d992) - [#12851](https://github.com/npm/npm/pull/12851) - Clean up `rm-linked` test. - ([@iarna](https://github.com/iarna)) -* [`bf7f7f2`](https://github.com/npm/npm/commit/bf7f7f273a794f7573bbbc84b1c216fdcd9e0ef9) - [#12851](https://github.com/npm/npm/pull/12851) - Clean up `outdated-symlink` test. - ([@iarna](https://github.com/iarna)) -* [`ca0baa4`](https://github.com/npm/npm/commit/ca0baa4dac85b1df4e26ef0c73d39314ca6858ca) - [#12851](https://github.com/npm/npm/pull/12851) - Improve diagnostics for `shrinkwrap-scoped-auth` test. - ([@iarna](https://github.com/iarna)) -* [`fbec9fd`](https://github.com/npm/npm/commit/fbec9fd5bb0abce589120d14c1f2b03b58cecce1) - [#12851](https://github.com/npm/npm/pull/12851) - Rewrite `shrinkwrap-dev-dependency` test to use `common.npm`. - ([@iarna](https://github.com/iarna)) - -### v3.9.3 (2016-05-19): - -This week continues our `big-bug` squashing adventure! Things are churning along -nicely, and we've gotten a lot of fantastic contributions from the community. -Please keep it up! - -A quick note on last week's release: We had a small `npm shrinkwrap`-related -crasher in `npm@3.9.1`, so once this release goes out, `v3.9.2` is going to be -`npm@latest`. Please update if you ended up in with that previous version! - -Remember we have a weekly team meeting, and you can [suggest agenda items in the -GitHub issue](https://github.com/npm/npm/issues/12761). Keep an eye out for the -`#npmweekly` tag on Twitter, too, and join the conversation! We'll do our best -to address questions y'all send us. ✌ - -#### FIXES - -* [`42d71be`](https://github.com/npm/npm/commit/42d71be2cec674dd9e860ad414f53184f667620d) - [#12685](https://github.com/npm/npm/pull/12685) - When using `npm ls <pkg>` without a semver specifier, `npm ls` would skip - any packages in your tree that matched by name, but had a prerelease version - in their `package.json`. This patch fixes it so `npm ls` does a simple name - match unless you use the `npm ls <pkg>@<version>` format. - ([@zkat](https://github.com/zkat)) -* [`c698ae6`](https://github.com/npm/npm/commit/c698ae666afc92fbc0fcba3c082cfa9b34a4420d) - [#12685](https://github.com/npm/npm/pull/12685) - Added some tests for more basic `npm ls` functionality. - ([@zkat](https://github.com/zkat)) - -### NOTABLE DEPENDENCY UPDATES - -* [`3a6fe23`](https://github.com/npm/npm/commit/3a6fe2373c45e80a1f28aaf176d552f6f97cf131) - [npm/fstream-npm#17](https://github.com/npm/fstream-npm/pull/17) - `fstream-npm@1.1.0`: - `fstream-npm` always includes NOTICE files now. - ([@kemitchell](https://github.com/kemitchell)) -* [`df04e05`](https://github.com/npm/npm/commit/df04e05af1f257a1903372e1baf334c0969fbdbd) - [#10013](https://github.com/npm/npm/issues/10013) - `read-package-tree@5.1.4`: - Fixes an issue where `npm install` would fail if your `node_modules` was - symlinked. - ([@iarna](https://github.com/iarna)) -* [`584676f`](https://github.com/npm/npm/commit/584676f85eaebcb9d6c4d70d2ad320be8a8d6a74) - [npm/init-package-json#62](https://github.com/npm/init-package-json/pull/62) - `init-package-json@1.9.4`: - Stop using `package` for a variable, which defeats some bundlers and linters. - ([@adius](https://github.com/adius)) -* [`935a7e3`](https://github.com/npm/npm/commit/935a7e359535e13924934811b77924cbad82619a) - `readable-stream@2.1.3`: - Node 6 build and buffer-related updates. - ([@calvinmetcalf](https://github.com/calvinmetcalf)) - -#### OTHER DEPENDENCY UPDATES - -* [`4c4609e`](https://github.com/npm/npm/commit/4c4609ea49e77303f9d72af6757620e6b3a9a6a9) - `inflight@1.0.5` - ([@zkat](https://github.com/zkat)) -* [`7a3030d`](https://github.com/npm/npm/commit/7a3030d3d44ea2136425f72950ba22e6efd441d9) - `hosted-git-info@2.1.5` - ([@zkat](https://github.com/zkat)) -* [`5ed4b58`](https://github.com/npm/npm/commit/5ed4b58409eeb134bca1c96252682fd7600d9906) - `which@1.2.9` - ([@isaacs](https://github.com/isaacs)) - -### v3.9.2 (2016-05-17) - -This is a quick patch release. The previous release, 3.9.1, introduced a -bug where npm would crash given a combination of specific package tree on -disk and a shrinkwrap. - -* [`cde367f`](https://github.com/npm/npm/commit/cde367fbb6eebc5db68a44b12a5c7bea158d70db) - [#12724](https://github.com/npm/npm/issues/12724) - Fix crasher when inflating shrinkwraps with packages on disk that were - installed by older npm versions. - ([@iarna](https://github.com/iarna)) - -### v3.9.1 (2016-05-12) - -HI all! We have bug fixes to a couple of the hairy corners of `npm`, in the -form of shrinkwraps and bundled dependencies. Plus some documentation improvements -and our lodash deps bot a bump. - -This is our first week really focused on getting the -[big bugs](https://github.com/npm/npm/issues?q=is%3Aopen+is%3Aissue+label:big-bug) -list down. Our work from this week will be landing next week, and I can't -wait to tell you about that! (It's about symlinks!) - -#### SHRINKWRAP FIX - -* [`b894413`](https://github.com/npm/npm/commit/b8944139a935680c4a267468bb2d3c3082b5609f) - [#12372](https://github.com/npm/npm/issues/12372) - Changing a nested dependency in an `npm-shrinkwrap.json` and then running `npm install` - would not get up the updated package. This corrects that. - ([@misterbyrne](https://github.com/misterbyrne)) - -#### BUNDLED DEPENDENCIES FIX - -* [`d0c6d19`](https://github.com/npm/npm/commit/d0c6d194471be8ce3e7b41b744b24f63dd1a3f6f) - [#12476](https://github.com/npm/npm/pull/12476) - Protects against a crasher when a bundled dep is missing a package.json. - ([@dflupu](https://github.com/dflupu)) - -#### DOCS IMPROVEMENTS - -* [`6699aa5`](https://github.com/npm/npm/commit/6699aa53c0a729cfc921ac1d8107c320e5a5ac95) - [#12585](https://github.com/npm/npm/pull/12585) - Document that engineStrict is quite gone. Not "deprecated" so much as "extirpated". - ([@othiym23](https://github.com/othiym23)) -* [`7a41a84`](https://github.com/npm/npm/commit/7a41a84b655be3204d2e80848278a510e42c80e7) - [#12636](https://github.com/npm/npm/pull/12636) - Improve `npm-scripts` documentation regarding when `node-gyp` is used. - ([@reconbot](https://github.com/reconbot)) -* [`4c4b4ba`](https://github.com/npm/npm/commit/4c4b4badf09b9b50cdca85314429a0111bb35cb1) - [#12586](https://github.com/npm/npm/pull/12586) - Correct `package.json` documentation as to when `node-gyp rebuild` called. - This now matches https://docs.npmjs.com/misc/scripts#default-values - ([@reconbot](https://github.com/reconbot)) - -#### DEPENDENCY UPDATES - -* [`cfa797f`](https://github.com/npm/npm/commit/cfa797fedd34696d45b61e3ae0398407afece880) - `lodash._baseuniq@4.6.0` - ([@jdalton](https://github.com/jdalton)) -* [`ab6f180`](https://github.com/npm/npm/commit/ab6f1801971b513f9294b4b8902034ab402af02d) - `lodash.keys@4.0.7` - ([@jdalton](https://github.com/jdalton)) -* [`4b8d8b6`](https://github.com/npm/npm/commit/4b8d8b63e760a8aa03e8bffa974495dfafbfcb06) - `lodash.union@4.4.0` - ([@jdalton](https://github.com/jdalton)) -* [`46099d3`](https://github.com/npm/npm/commit/46099d34542760098e5d13c7468a405a724ca407) - `lodash.uniq@4.3.0` - ([@jdalton](https://github.com/jdalton)) -* [`fff89c6`](https://github.com/npm/npm/commit/fff89c6826c86e9e789adcc9c398385539306042) - `lodash.without@4.2.0` - ([@jdalton](https://github.com/jdalton)) - -### v3.9.0 (2016-05-05) - -Wow! This is a big release week! We've completed the fixes that let the -test suite pass on Windows, plus more general bug fixes we found while -fixing things on Windows. Plus a warning to help folks work around a common -footgun. PLUS an improvement to how npm works with long cache timeouts. - -#### INFINITE CACHE A LITTLE BETTER - -* [`111ae3e`](https://github.com/npm/npm/commit/111ae3ec366ece7ebcf5988f5bc2a7cd70737dfe) - [#8581](https://github.com/npm/npm/issues/8581) - When a package is fetched from the cache which cannot satisfy the version - requirements, an attempt to fetch it from the network is made. This is - helpful for folks using high values for `--cache-min` who are willing to - accept possibly not-the-most-recent modules in return for less network - traffic. - ([@Zirak](https://github.com/Zirak)) - -#### WARNING: FOOTGUN - -* [`60b9a05`](https://github.com/npm/npm/commit/60b9a051aa46b8892fe63b3681839a6fd6642bfd) - [#12475](https://github.com/npm/npm/pull/12475) - Options can only start with ASCII dashes. Ordinarily this isn't a problem - but many web documentation tools "helpfully" convert `--` into an emdash - (–), or `-` into an endash (–). If you copy and paste from this documentation - your commands won't work the way you expect. This adds a warning that tries - to be a little more descriptive about why your command is failing. - ([@iarna](https://github.com/iarna)) - -#### WINDOWS CI - -We have [Windows CI](https://ci.appveyor.com/project/npm/npm) setup now! We still have to -tweak it a little bit around paths to the git binaries, but it's otherwise ready! - -* [`bb5d6cb`](https://github.com/npm/npm/commit/bb5d6cbf46b2609243d3b384caadd196e665a797) - [#11444](https://github.com/npm/npm/pull/11444) - Add AppVeyor to CI matrix. - ([@othiym23](https://github.com/othiym23)) - -#### COVERAGE DATA - -Not only do our tests produce coverage reports after they run now, we also -automatically [update Coveralls](https://coveralls.io/github/npm/npm) with -results from [Travis CI](travis-ci.org/npm/npm) runs. - -* [`044cbab`](https://github.com/npm/npm/commit/044cbab0d49adeeb0d9310c64fee6c9759cc7428) - [#11444](https://github.com/npm/npm/pull/11444) - Enable coverage reporting for every test run. - ([@othiym23](https://github.com/othiym23)) - -#### EVERYONE BUGS - -* [`37c6a51`](https://github.com/npm/npm/commit/37c6a51c71b0feec8f639b3199a8a9172e58deec) - [#12150](https://github.com/npm/npm/pull/12150) - Ensure that 'npm cache ls' outputs real filenames. Previously it would - sometimes double up the package name in the path it printed. - ([@isaacs](https://github.com/isaacs)) -* [`d3ce0b2`](https://github.com/npm/npm/commit/d3ce0b253eb519375071aee29db4ee129dbcdf5c) - [#11444](https://github.com/npm/npm/pull/11444) - Fix unbuilding bins for scoped modules. - ([@iarna](https://github.com/iarna)) -* [`e928a30`](https://github.com/npm/npm/commit/e928a30947477a09245f54e9381f46b97bee32d5) - [#11444](https://github.com/npm/npm/pull/11444) - Make handling of local modules (eg `npm install /path/to/my/module`) more - consistent when saved to a `package.json`. There were bugs previously where - it wouldn't consistently resolve relative paths in the same way. - ([@iarna](https://github.com/iarna)) -* [`b820ed4`](https://github.com/npm/npm/commit/b820ed4fc04e21577fa66f7c9482b5ab002e7985) - [#11444](https://github.com/npm/npm/pull/11444) - Under certain circumstances the paths produced for linking, either - relative or absolute, would end up basing off the wrong virtual cwd. - This resulted in failures for `npm link` in this situations. - ([@iarna](https://github.com/iarna)) - -#### WINDOWS BUGS - -* [`7380425`](https://github.com/npm/npm/commit/7380425d810fb8bfc69405a9cbbdec19978a7bee) - [#11444](https://github.com/npm/npm/pull/11444) - Scoped module names were not being correctly inferred from the path on Windows. - ([@zkat](https://github.com/zkat)) -* [`91fc24f`](https://github.com/npm/npm/commit/91fc24f2763c2e0591093099ffc866c735f27fde) - [#11444](https://github.com/npm/npm/pull/11444) - Explore with a command to run didn't work properly in Windows– it would pop open a new - cmd window and leave it there. - ([@iarna](https://github.com/iarna)) - -#### WINDOWS REFACTORING - -* [`f07e643`](https://github.com/npm/npm/commit/f07e6430d4ca02f811138f6140a8bad927607a1f) - [#11444](https://github.com/npm/npm/pull/11444) - Move exec path escaping out to its own function. This turns out to be - tricky to get right because how you escape commands to run on Windows via - cmd is different then how you escape them at other times. Specifically, - you HAVE to quote each directory segment that has a quote in it, that is: - `C:\"Program Files"\MyApp\MyApp.exe` By contrast, if that were an argument - to a command being run, you CAN'T DO quote it that way, instead you have - to wrap the entire path in quotes, like so: `"C:\Program - Files\MyApp\MyApp.exe"`. - ([@iarna](https://github.com/iarna)) -* [`2e01d29`](https://github.com/npm/npm/commit/2e01d299f8244134b1aa040cab1b59c72c9df4da) - [#11444](https://github.com/npm/npm/pull/11444) - Create a single function for detecting if we're running on Windows (and - using a Windows shell like cmd) and use this instead of doing it one-off - all over the place. - ([@iarna](https://github.com/iarna)) - -#### FIX WINDOWS TESTS - -As I said before, our tests are passing on Windows! 🎉 - -* [`ef0dd74`](https://github.com/npm/npm/commit/ef0dd74583be25c72343ed07d1127e4d0cc02df9) - [#11444](https://github.com/npm/npm/pull/11444) - The fruits of many weeks of labor, fix our tests to pass on Windows. - ([@zkat](https://github.com/zkat)) - ([@iarna](https://github.com/iarna)) - -#### DEPENDENCY UPDATES - -* [`8fccda8`](https://github.com/npm/npm/commit/8fccda8587209659c469ab55c608b0e2d7533530) - [#11444](https://github.com/npm/npm/pull/11444) - `normalize-git-url@3.0.2`: - Fix file URLs on Windows. - ([@zkat](https://github.com/zkat)) -* [`f53a154`](https://github.com/npm/npm/commit/f53a154df8e0696623e6a71f33e0a7c11a7555aa) - `readable-stream@2.1.2`: - When readable-stream is disabled, reuse result of `require('stream')` - instead of calling it every time. - ([@calvinmetcalf](https://github.com/calvinmetcalf)) -* [`02841cf`](https://github.com/npm/npm/commit/02841cfb81d6ba86f691ab43d9bbdac29aec27e7) - [#11444](https://github.com/npm/npm/pull/11444) - `realize-package-specifier@3.0.2`: - Resolve local package paths relative to package root, not cwd. - ([@zkat](https://github.com/zkat)) - ([@iarna](https://github.com/iarna)) -* [`247c1c5`](https://github.com/npm/npm/commit/247c1c5ae08c882c9232ca605731039168bae6ed) - [#11444](https://github.com/npm/npm/pull/11444) - `npm-package-arg@4.1.1`: - Fix Windows file URIs with leading slashes. - ([@zkat](https://github.com/zkat)) -* [`365c72b`](https://github.com/npm/npm/commit/365c72bc3ecd9e45f9649725dd635d5625219d8c) - `which@1.2.8` - ([@isaacs](https://github.com/isaacs)) -* [`e568caa`](https://github.com/npm/npm/commit/e568caabb8390a924ce1cfa51fc914ee6c1637a2) - `graceful-fs@4.1.4` - ([@isaacs](https://github.com/isaacs)) -* [`304b974`](https://github.com/npm/npm/commit/304b97434959a58f84383bcccc0357c51a4eb39a) - [#11444](https://github.com/npm/npm/pull/11444) - `standard@6.0.8` - ([@feross](https://github.com/feross)) - -### v3.8.9 (2016-04-28) - -Our biggest news this week is that we got the -[Windows test suite passing](https://github.com/npm/npm/pull/11444)! -It'll take a little longer to get it passing in our -[Windows CI](https://ci.appveyor.com/project/npm/npm/) but that's coming -soon too. - -That means we'll be shifting gears away from tests to fixing -[Big Bugs™](https://github.com/npm/npm/issues?q=is%3Aopen+is%3Aissue+label%3Abig-bug) again. -Join us at our [team meeting](https://github.com/npm/npm/issues/12517) next -Tuesday to learn more about that. - -#### BUG FIXES AND REFACTORING - -* [`60da618`](https://github.com/npm/npm/commit/60da61862885fa904afba7d121860b4282a5b0df) - [#12347](https://github.com/npm/npm/issues/12347) - Fix a bug that could result in shrinkwraps missing the `resolved` field, which is - necessary in producing a fully reproducible build. - ([@sminnee](https://github.com/sminnee)) -* [`8597ba4`](https://github.com/npm/npm/commit/8597ba432e91245a1000953b612eb01308178bad) - [#12009](https://github.com/npm/npm/issues/12009) - Fix a bug in `npm view <packagename> versions` that resulted in bad output if you - didn't also pass in `--json`. - ([@watilde](https://github.com/watilde)) -* [`20125f1`](https://github.com/npm/npm/commit/20125f19b96fd05af63f8c0bd243ffb25780279a) - [`a53feac`](https://github.com/npm/npm/commit/a53feac2647f7dc4245f1700dfbdd1aba8745672) - [`6cfbae4`](https://github.com/npm/npm/commit/6cfbae403abc3cf690565b09569f71cdd41a8372) - [#12485](https://github.com/npm/npm/pull/12485) - Refactor how the help summaries for commands are produced, such that we only have - one list of command aliases. - ([@watilde](https://github.com/watilde)) -* [`2ae210c`](https://github.com/npm/npm/commit/2ae210c76ab6fd15fcf15dc1808b01ca0b94fc9e) - `read-package-json@2.0.4`: - Fix a crash we discovered while fixing up the Windows test suite where if - you had a file in your `node_modules` it would cause a crash on Windows - (but not MacOS/Linux). - - This makes the error code you get on Windows match that from MacOS/Linux - if you try to read a `package.json` from a path that includes a file, not - a folder. - ([@zkat](https://github.com/zkat)) - -### v3.8.8 (2016-04-21) - -Hi all! Long time no see! We've been heads-down working through getting -[our test suite passing on Windows](https://github.com/npm/npm/pull/11444). -Did you know that we have -[Windows CI](https://ci.appveyor.com/project/npm/npm) now running over at -Appveyor? In the meantime, we've got a bunch of dependency updates, some -nice documentation improvements and error messages when your `package.json` -contains invalid JSON. (Yeah, I thought we did that last one before too!) - -#### BAD JSON IS BAD - -* [`769e620`](https://github.com/npm/npm/commit/769e6200722d8060b6769e47354032c51cfa85a1) - [#12406](https://github.com/npm/npm/pull/12406) - Failing to parse the top level `package.json` should be an error. - ([@watilde](https://github.com/watilde)) - -#### DOCUMENTATION - -* [`7d64301`](https://github.com/npm/npm/commit/7d643018af5051c920cc73f17bfe32b7ff86e108) - [#12415](https://github.com/npm/npm/pull/12415) - Clarify that when configuring client-side certificates for authenticating - to non-npm registries that `cert` and `key` are not filesystem paths and should - actually include the certificate and key data. - ([@rvedotrc](https://github.com/rvedotrc)) -* [`f8539b8`](https://github.com/npm/npm/commit/f8539b8c986e81771ccc8ced7e716718423d3187) - [#12324](https://github.com/npm/npm/pull/12324) - Describe how `npm run` sets `NODE` and `PATH` in more detail. - Note that `npm run` changes `PATH` to include the current node - interpreter’s directory. - ([@addaleax](https://github.com/addaleax)) -* [`2b57606`](https://github.com/npm/npm/commit/2b57606852a2c2a03e4c4b7dcda85b807619c2cf) - [#11461](https://github.com/npm/npm/pull/11461) - Clarify the documentation for the package.json homepage field. - ([@stevemao](https://github.com/stevemao)) - -#### TESTS - -* [`b5a0fbb`](https://github.com/npm/npm/commit/b5a0fbb9e1a2c4fb003dd748264571aa6e3c9e70) - [#12329](https://github.com/npm/npm/pull/12329) - Fix progress config testing to ignore local user configs. - Previously, _any_ local setting would cause the tests to fail as - they were trying to test what the default values for the progress - bar would be in different environments and any explicit setting - overrides those defaults. - ([@iarna](https://github.com/iarna)) -* [`3d195bc`](https://github.com/npm/npm/commit/3d195bc0a72b40df02a5c56e4f3be44152e8222b) - The lifecycle-signal test could crash on v0.8 due to its use of `Number.parseInt`, which - isn't available in that version of node. Fortunately `global.parseInt` _is_, so - we just use that instead. - ([@iarna](https://github.com/iarna)) - -#### DEPENDENCY UPDATES - -* [`05a28e3`](https://github.com/npm/npm/commit/05a28e38586082ac4bbf26ee6f863cc8d07054d6) - `npm-package-arg@4.1.1`: - Under some circumstances `file://` URLs on Windows were not handled correctly. - - Also, stop converting local module/tarballs into full paths in this - module. We do already do that in `realize-package-specifier`, which is - more appropriate as it knows what package we're installing relative to. - ([@zkat](https://github.com/zkat)) -* [`ada2e93`](https://github.com/npm/npm/commit/ada2e93e8b276000150a9aa93fff69ec366e03d6) - `realize-package-specifier@3.0.3`: - Require the new `npm-package-arg`, plus fix a case where specifiers that were - maybe a tag, maybe a local filename were resolved differently than those that were - definitely a local filename. - ([@zkat](https://github.com/zkat)) ([@iarna](https://github.com/iarna)) -* [`adc515b`](https://github.com/npm/npm/commit/adc515b22775871386cd62390079fb4bf8e1714a) - `fs-vacuum@1.2.9`: - A fix for AIX where a non-empty directory can cause `fs.rmDir` to fail with `EEXIST` instead of `ENOTEMPTY` - and three new tests - ([@richardlau](https://github.com/richardlau)) - - Code cleanup, CI & dependency updates. - ([@othiym23](https://github.com/othiym23)) -* [`ef53a46`](https://github.com/npm/npm/commit/ef53a46906ce872a4541b605dd42a563cc26e614) - `tap@5.7.1` - ([@isaacs](https://github.com/isaacs)) -* [`df1f2e4`](https://github.com/npm/npm/commit/df1f2e4838b4d7ea2ea2321a95ae868c0ec0a520) - `request@2.72.0`: - Fix crashes when response headers indicate gzipped content but the body is - empty. - Add support for the deflate content encoding. - ([@simov](https://github.com/simov)) -* [`776c599`](https://github.com/npm/npm/commit/776c599b204632aca9d29fd92ea5c4f099fdea9f) - `readable-stream@2.1.0`: - Adds READABLE_STREAM env var that, if set to `disable`, will make - `readable-stream` use the local native node streams instead. - ([@calvinmetcalf](https://github.com/calvinmetcalf)) -* [`10d6d55`](https://github.com/npm/npm/commit/10d6d5547354fcf50e930c7932ba4d63c0b6009c) - `normalize-git-url@3.0.2`: - Add support `git+file://` type URLs. - ([@zkat](https://github.com/zkat)) -* [`75017ae`](https://github.com/npm/npm/commit/75017aeecec69a1efd546df908aa5befc4467f36) - `lodash.union@4.3.0` - ([@jdalton](https://github.com/jdalton)) - -### v3.8.7 (2016-04-07) - -#### IMPROVED DIAGNOSTICS - -* [`38cf79f`](https://github.com/npm/npm/commit/38cf79ffa564ef5cb6677b476e06d0e45351592a) - [#12083](https://github.com/npm/npm/pull/12083) - If you `ignore-scripts` to disable lifecycles, this makes npm report when it skips running - a script. - ([@bfred-it](https://github.com/bfred-it)) - -#### IMPROVE AUTO-INCLUDES - -* [`c615182`](https://github.com/npm/npm/commit/c615182c8b47e418338eb1317b99bb66987cda54) - [#11995](https://github.com/npm/npm/pull/11995) - There were bugs where modules whose names matched the special files that npm always - includes would be included, for example, the `history` package was always included. - - With `npm@3` such extraneously bundled modules would not be ordinarily - used, as things in `node_modules` in packages are ignored entirely if the - package isn't marked as bundling modules. - - Because of this `npm@3` behavior, the `files-and-ignores` test failed to catch this as - it was testing _install output_ not what got packed. That has also been fixed. - ([@glenjamin](https://github.com/glenjamin)) - -#### DOCUMENTATION UPDATES - -* [`823d9df`](https://github.com/npm/npm/commit/823d9dfa91d7086a26620f007aee4e3cd77b6153) - [#12107](https://github.com/npm/npm/pull/12107) - In the command summary for `adduser` mention that `login` is an alias. - ([@gnerkus](https://github.com/gnerkus)) -* [`7aaf47e`](https://github.com/npm/npm/commit/7aaf47e124c45dde72c961638b770ee535fb2776) - [#12244](https://github.com/npm/npm/pull/12244) - Update the README to suggest npm@3 for Windows users. Also add a reference to - [Microsoft's npm upgrade tool](https://github.com/felixrieseberg/npm-windows-upgrade). - ([@felixrieseberg](https://github.com/felixrieseberg)) - -#### DEPENDENCY UPDATES - -* [`486bbc0`](https://github.com/npm/npm/commit/486bbc0e1b101f847e890e6f1925dc8cb253cf3e) - `request@2.70.0` - ([@simov](https://github.com/simov)) -* [`b1aff34`](https://github.com/npm/npm/commit/b1aff346fc41f13e3306b437e1831942aacf2f54) - `lodash.keys@4.0.6` - ([@jdalton](https://github.com/jdalton)) - -### v3.8.6 (2016-03-31) - -Heeeeeey y'all. - -Kat here! Rebecca's been schmoozing with folks at [Microsoft -Build](https://build.microsoft.com/), so I'm doing the `npm@3` release this -week. - -Speaking of Build, it looks like Microsoft is doing some bash thing. This might -be really good news for our Windows users once it rolls around. We're keeping an -eye out and feeling hopeful. 🙆 - -As far as the release goes: We're really happy to be getting more and more -community contributions! Keep it up! We really appreciate folks trying to help -us, and we'll do our best to help point you in the right direction. Even things -like documentation are a huge help. And remember -- you get socks for it, too! - -#### FIXES - -* [`f8fb4d8`](https://github.com/npm/npm/commit/f8fb4d83923810eb78d075bd200a9376c64c3e3a) - [#12079](https://github.com/npm/npm/pull/12079) - Back in `npm@3.2.2` we included [a patch that made it so `npm install pkg` was - basically `npm install pkg@latest` instead of - `pkg@*`](https://github.com/npm/npm/pull/9170) - This is probably what most users expected, but it also ended up [breaking `npm - deprecate`](https://github.com/npm/npm/pull/9170) when no version was provided - for a package. In that case, we were using `*` to mean "deprecate all - versions" and relying on the `pkg` -> `pkg@*` conversion. - This patch fixes `npm deprecate pkg` to work as it used to by special casing - that particular command's behavior. - ([@polm](https://github.com/polm)) -* [`458f773`](https://github.com/npm/npm/commit/458f7734f3376aba0b6ff16d34a25892f7717e40) - [#12146](https://github.com/npm/npm/pull/12146) - Adds `make doc-clean` to `prepublish` script, to clear out previously built - docs before publishing a new npm version - ([@watilde](https://github.com/watilde)) -* [`f0d1521`](https://github.com/npm/npm/commit/f0d1521038e956b2197673f36c464684293ce99d) - [#12146](https://github.com/npm/npm/pull/12146) - Adds `doc-clean` phony target to `make publish`. - ([@watilde](https://github.com/watilde)) - -#### DOC UPDATES - -* [`ea92ffc`](https://github.com/npm/npm/commit/ea92ffc9dd2a063896353fc52c104e85ec061360) - [#12147](https://github.com/npm/npm/pull/12147) - Document that the current behavior of `engines` is just to warn if the node - platform is incompatible. - ([@reconbot](https://github.com/reconbot)) -* [`cd1ba44`](https://github.com/npm/npm/commit/cd1ba4423b3ca889c741141b95b0d9472b9f71ea) - [#12143](https://github.com/npm/npm/pull/12143) - Remove `npm faq` command, since the [FAQ was - removed](https://github.com/npm/npm/pull/10547). - ([@watilde](https://github.com/watilde)) -* [`50a12cb`](https://github.com/npm/npm/commit/50a12cb1f5f158af78d6962ad20ff0a98bc18f18) - [#12143](https://github.com/npm/npm/pull/12143) - Remove references to the FAQ from the docs, since [it was - removed](https://github.com/npm/npm/pull/10547). - ([@watilde](https://github.com/watilde)) -* [`60051c2`](https://github.com/npm/npm/commit/60051c25e2ab80c667137dfcd04b242eea25980e) - [#12093](https://github.com/npm/npm/pull/12093) - Update `bugs` url in `package.json` to use the `https` URL for Github. - ([@watilde](https://github.com/watilde)) -* [`af30c37`](https://github.com/npm/npm/commit/af30c374ef22ed1a1c71b14fced7c4b8350e4e82) - [#12075](https://github.com/npm/npm/pull/12075) - Add the `--ignore-scripts` flag to the `npm install` docs. - ([@paulirish](https://github.com/paulirish)) -* [`632b214`](https://github.com/npm/npm/commit/632b214b2f2450e844410792e5947e46844612ff) - [#12063](https://github.com/npm/npm/pull/12063) - Various minor fixes to the html docs homepage. - ([@watilde](https://github.com/watilde)) - -#### DEP BUMPS - -* [`3da0171`](https://github.com/npm/npm/commit/3da01716a0e41d6b5adee2b4fc70fcaf08c0eb24) - `lodash.without@4.1.2` - ([@jdalton](https://github.com/jdalton)) -* [`69ccf6d`](https://github.com/npm/npm/commit/69ccf6dd4caf95cd0628054307487cae1885acd0) - `lodash.uniq@4.2.1` - ([@jdalton](https://github.com/jdalton)) -* [`b50c41a`](https://github.com/npm/npm/commit/b50c41a9930dc5353a23c5ae2ff87bb99e11d482) - `lodash.union@4.2.1` - ([@jdalton](https://github.com/jdalton)) -* [`59c1ad7`](https://github.com/npm/npm/commit/59c1ad7b6f243d07618ed5703bd11d787732fc57) - `lodash.clonedeep@4.3.2` - ([@jdalton](https://github.com/jdalton)) -* [`2b4f797`](https://github.com/npm/npm/commit/2b4f797dba8e7a1376c8335b7223e82d02cd8243) - `lodash._baseuniq@4.5.1` - ([@jdalton](https://github.com/jdalton)) - -### v3.8.5 (2016-03-24) - -Like my esteemed colleague [@zkat](https://github.com/zkat) said in this -week's [LTS release notes](https://github.com/npm/npm/releases/tag/v2.15.2), -this week is another small release but we are continuing to work on our -[Windows efforts](https://github.com/npm/npm/pull/11444). - -You may also be interested in reading the [LTS process and -policy](https://github.com/npm/npm/wiki/LTS) that -[@othiym23](https://github.com/othiym23) put together recently. If you have any -feedback, we would love to hear. - -#### DOCTOR IT HURTS WHEN LINK TO MY LINK - -Well then, don't do that. - -* [`0d4a0b1`](https://github.com/npm/npm/commit/0d4a0b1) - [#11442](https://github.com/npm/npm/pull/11442) - Fail if the user asks us to make a link from a module back on to itself. - ([@antialias](https://github.com/antialias)) - -#### ERR MODULE LIST TOO LONG - -* [`b271ed2`](https://github.com/npm/npm/commit/b271ed2) - [#11983](https://github.com/npm/npm/issues/11983) - Exit early if no arguments were provided to search instead of trying to display all the modules, - running out of memory, and then crashing. - ([@SimenB](https://github.com/SimenB)) - -#### ELIMINATE UNUSED MODULE - -* [`b8c7cd7`](https://github.com/npm/npm/commit/b8c7cd7) - [#12000](https://github.com/npm/npm/pull/12000) - Stop depending on [`async-some`](https://npmjs.com/package/async-some) as it's no - longer used in npm. - ([@watilde](https://github.com/watilde)) - -#### DOCUMENTATION IMPROVEMENTS - -* [`fdd6b28`](https://github.com/npm/npm/commit/fdd6b28) - [#11884](https://github.com/npm/npm/pull/11884) - Include `node_modules` in the list of files and directories that npm won't - include in packages ordinarily. (Modules listed in `bundledDependencies` and things - that those modules rely on, ARE included of course.) - ([@Jameskmonger](https://github.com/Jameskmonger)) -* [`aac15eb`](https://github.com/npm/npm/commit/aac15eb) - [#12006](https://github.com/npm/npm/pull/12006) - Fix typo in npm-orgs documentation, where teams docs went to access docs and vice versa. - ([@yaelz](https://github.com/yaelz)) - -#### FEWER NETWORK TESTS - -* [`3e41360`](https://github.com/npm/npm/commit/3e41360) - [#11987](https://github.com/npm/npm/pull/11987) - Fix test that was inappropriately hitting the network - ([@yodeyer](https://github.com/yodeyer)) - -### v3.8.4 (2016-03-24) - -Was erroneously released with just a changelog typo correction and was -otherwise the same as 3.8.3. - -### v3.8.3 (2016-03-17): - -#### SECURITY ADVISORY: BEARER TOKEN DISCLOSURE - -This release includes [the fix for a -vulnerability](https://github.com/npm/npm/commit/f67ecad59e99a03e5aad8e93cd1a086ae087cb29) -that could cause the unintentional leakage of bearer tokens. - -Here are details on this vulnerability and how it affects you. - -##### DETAILS - -Since 2014, npm’s registry has used HTTP bearer tokens to authenticate requests -from the npm’s command-line interface. A design flaw meant that the CLI was -sending these bearer tokens with _every_ request made by logged-in users, -regardless of the destination of their request. (The bearers only should have -been included for requests made against a registry or registries used for the -current install.) - -An attacker could exploit this flaw by setting up an HTTP server that could -collect authentication information, then use this authentication information to -impersonate the users whose tokens they collected. This impersonation would -allow them to do anything the compromised users could do, including publishing -new versions of packages. - -With the fixes we’ve released, the CLI will only send bearer tokens with -requests made against a registry. - -##### THINK YOU'RE AT RISK? REGENERATE YOUR TOKENS - -If you believe that your bearer token may have been leaked, [invalidate your -current npm bearer tokens](https://www.npmjs.com/settings/tokens) and rerun -`npm login` to generate new tokens. Keep in mind that this may cause continuous -integration builds in services like Travis to break, in which case you’ll need -to update the tokens in your CI server’s configuration. - -##### WILL THIS BREAK MY CURRENT SETUP? - -Maybe. - -npm’s CLI team believes that the fix won’t break any existing registry setups. -Due to the large number of registry software suites out in the wild, though, -it’s possible our change will be breaking in some cases. - -If so, please [file an issue](https://github.com/npm/npm/issues/new) describing -the software you’re using and how it broke. Our team will work with you to -mitigate the breakage. - -##### CREDIT & THANKS - -Thanks to Mitar, Will White & the team at Mapbox, Max Motovilov, and James -Taylor for reporting this vulnerability to npm. - -#### PERFORMANCE IMPROVEMENTS - -The updated [`are-we-there-yet`](https://npmjs.com/package/are-we-there-yet) -changes how it tracks how complete things are to be much more efficient. -The summary is that `are-we-there-yet` was refactored to remove an expensive -tree walk. - -The result for you should be faster installs when working with very large trees. - -Previously `are-we-there-yet` computed this when you asked by passing the request down -its tree of progress indicators, totaling up the results. In doing so, it had to walk the -entire tree of progress indicators. - -By contrast, `are-we-there-yet` now updates a running total when a change -is made, bubbling that up the tree from whatever branch made progress. This -bubbling was already going on so there was nearly no cost associated with taking advantage of it. - -* [`32f2bd0`](https://github.com/npm/npm/commit/32f2bd0e26116db253e619d67c4feae1de3ad2c2) - `npmlog@2.0.3`: - Bring in substantial performance improvements from `are-we-there-yet`. - ([@iarna](https://github.com/iarna)) - -#### DUCT TAPE FOR BUGS - -* [`473d324`](https://github.com/npm/npm/commit/473d3244a8ddfd6b260d0aa0d395b119d595bf97) - [#11947](https://github.com/npm/npm/pull/11947) - Guard against bugs that could cause the installer to crash with errors like: - - ``` - TypeError: Cannot read property 'target' of null - ``` - - This doesn't fix the bugs, but it does at least make the installer less - likely to explode. - ([@thefourtheye](https://github.com/thefourtheye)) - -#### DOC FIXES - -* [`ffa428a`](https://github.com/npm/npm/commit/ffa428a4eee482aa620819bc8df994a76fad7b0c) - [#11880](https://github.com/npm/npm/pull/11880) - Fix typo in `npm install` documentation. - ([@watilde](https://github.com/watilde)) - -#### DEPENDENCY UPDATES - -* [`7537fe1`](https://github.com/npm/npm/commit/7537fe1748c27e6f1144b279b256cd3376d5c41c) - `sorted-object@2.0.0`: - Create objects with `{}` instead of `Object.create(null)` to make the results - strictly equal to what, say, parsed JSON would provide. - ([@domenic](https://github.com/domenic)) -* [`8defb0f`](https://github.com/npm/npm/commit/8defb0f7b3ebdbe15c9ef5036052c10eda7e3161) - `readable-stream@2.0.6`: - Fix sync write issue on 0.10. - ([@calvinmetcalf](https://github.com/calvinmetcalf)) - -#### TEST FIXES FOR THE SELF TESTS - -* [`c3edeab`](https://github.com/npm/npm/commit/c3edeabece4400308264e7cf4bc4448bd2729f55) - [#11912](https://github.com/npm/npm/pull/11912) - Change the self installation test to do its work in `/tmp`. - Previously this was installing into a temp subdir in `test/tap`, which - wouldn't catch the case where a module was installed in the local - `node_modules` folder but not in dependencies, as node would look up - the tree and use the copy from the version of npm being tested. - ([@iarna](https://github.com/iarna)) - -### v3.8.2 (2016-03-10): - -#### HAVING TROUBLE INSTALLING C MODULES ON ANDROID? - -This release includes an updated `node-gyp` with fixes for Android. - -* [`634ecba`](https://github.com/npm/npm/commit/634ecba320fb5a3287e8b7debfd8b931827b9e19) - `node-gyp@3.3.1`: - Fix bug in builds for Android. - ([@bnoordhuis](https://github.com/bnoordhuis)) - -#### NPM LOGOUT CLEANS UP BETTER - -* [`460ed21`](https://github.com/npm/npm/commit/460ed217876ac78d21477c288f1c06563fb770b4) - [#10529](https://github.com/npm/npm/issues/10529) - If you ran `npm logout` with a scope, while we did invalidate your auth - token, we weren't removing the auth token from your config file. This patch causes - the auth token to be removed. - ([@wyze](https://github.com/wyze)) - -#### HELP MORE HELPFUL - -* [`d1d0233`](https://github.com/npm/npm/commit/d1d02335d297da2734b538de44d8967bdcd354cf) - [#11003](https://github.com/npm/npm/issues/11003) - Update help to only show command names and their shortcuts. Previously - some typo corrections were shown, along with various alternate - spellings. - ([@watilde](https://github.com/watilde)) -* [`47928cd`](https://github.com/npm/npm/commit/47928cd6264e1d6d0ef67435b71c66d01bea664a) - [#11003](https://github.com/npm/npm/issues/11003) - Remove "version" typo from the help listing. - ([@doug-wade](https://github.com/doug-wade)) - -#### MORE COMPLETE CONFIG LISTINGS - -* [`cf5fd40`](https://github.com/npm/npm/commit/cf5fd401494d96325d74a8bb8c326aa0045a714c) - [#11472](https://github.com/npm/npm/issues/11472) - Make `npm config list` include the per-project `.npmrc` in the output. - ([@mjomble](https://github.com/mjomble)) - -#### DEPTH LIMITED PARSEABLE DEP LISTINGS - -* [`611070f`](https://github.com/npm/npm/commit/611070f0f7a1e185c75cadae46179194084b398f) - [#11495](https://github.com/npm/npm/issues/11495) - Made `npm ls --parseable` honor the `--depth=#` option. - ([@zacdoe](https://github.com/zacdoe)) - -#### PROGRESS FOR THE (NON) UNICODE REVOLUTION - -* [`ff90382`](https://github.com/npm/npm/commit/ff9038227a1976b5e936442716d9877f43c6c9b4) - [#11781](https://github.com/npm/npm/issues/11781) - Make the progress bars honor the unicode option. - ([@watilde](https://github.com/watilde)) - -#### `npm view --json`, NOW ACTUALLY JSON - -* [`24ab70a`](https://github.com/npm/npm/commit/24ab70a4ccfeaa005b80252da313bb589510668e) - [#11808](https://github.com/npm/npm/issues/11808) - Make `npm view` produce valid JSON when requested with `--json`. - Previously `npm view` produced some sort of weird hybrid output, with multiple - JSON docs. - ([@doug-wade](https://github.com/doug-wade)) - -#### DOCUMENTATION CHANGES - -* [`6fb0499`](https://github.com/npm/npm/commit/6fb0499bea868fdc637656d210c94f051481ecd4) - [#11726](https://github.com/npm/npm/issues/11726) - Previously we patched the `npm update` docs to suggest using `--depth - Infinity` instead of `--depth 9999`, but that was a mistake. We forgot - that `npm outdated` (on which `npm update` is built) has a special - case where it treats `Infinity` as `0`. This reverts that patch. - ([@GriffinSchneider](https://github.com/GriffinSchneider)) -* [`f0bf684`](https://github.com/npm/npm/commit/f0bf684a87ea5eea03432a17f38678fed4960d43) - [#11748](https://github.com/npm/npm/pull/11748) - Document all of the various aliases for commands in the documentation - for those commands. - ([@watilde](https://github.com/watilde)) -* [`fe04443`](https://github.com/npm/npm/commit/fe04443d8988e2e41bd4047078e06a26d05d380d) - [#10968](https://github.com/npm/npm/issues/10968) - The `npm-scope` document notes that scopes have been available on the - public registry for a while. This adds that you'll need `npm@2` or later - to use them. - ([@doug-wade](https://github.com/doug-wade)) -* [`3db37a5`](https://github.com/npm/npm/commit/3db37a52b2b2e3193ef250ad2cf96dfd2def2777) - [#11820](https://github.com/npm/npm/pull/11820) - The command `npm link` should be linking package from local folder to - global, and `npm link package-name` should be from global to local. The - description in the documentation was reversed and this fixes that. - ([@rhgb](https://github.com/rhgb)) - -#### GLOB FOR THE GLOB THRONE - -* [`be55882`](https://github.com/npm/npm/commit/be55882dc4ee5ce0777b4badc9141dab5bf5be4d) - `glob@7.0.3`: - Fix a race condition and some windows edge cases. - ([@isaacs](https://github.com/isaacs)) - -### v3.8.1 (2016-03-03): - -This week the install summary got better, killing your npm process now -also kills the scripts it was running and a rarely used search flag got -documented. - -Our improvements on the test suite on Windows are beginning to pick up -steam, you can follow along by -[watching the PR](https://github.com/npm/npm/pull/11444). - -#### BETTER INSTALL SUMMARIES - -* [`e40d457`](https://github.com/npm/npm/commit/e40d4572cc98db06757df5b8bb6b7dbd0546d3d7) - [#11699](https://github.com/npm/npm/issues/11699) - Ensure that flags like `--production` passed to install don't result in - the summary at the end being incorrectly filtered. That summary is - produced by the same code as `npm ls` and therefore responds to flags - the same way it does. This is undesirable when it's an install summary, - however, as we don't want it to filter anything. - - This fixes an issue where `npm install --production <module>` would - result in npm exiting with an error code. The `--production` flag would - make `npm ls` filter out `<module>` as it wasn't saved to the - `package.json` and thus wasn't a production dependency. The install - report is limited to show just the modules installed, so with that - filtered out nothing is available. With nothing available `npm ls` - would set `npm` to exit with an error code. - ([@ixalon](https://github.com/ixalon)) -* [`99337b4`](https://github.com/npm/npm/commit/99337b469163a4b211b9c6ff1aa9712ae0d601d2) - [#11600](https://github.com/npm/npm/pull/11600) - Make the report of installed modules really only show those modules - that were installed. Previously it selected which modules from your - tree to display based on `name@version` which worked great when your - tree was deduped but would list things it hadn't touched when there - were duplicates. - ([@iarna](https://github.com/iarna)) - -#### SCRIPTS BETTER FOLLOW THE LEADER - -* [`5454347`](https://github.com/npm/npm/commit/545434766eb3681d3f40b745f9f3187ed63f310a) - [#10868](https://github.com/npm/npm/pull/10868) - When running a lifecycle script, say through `npm start`, killing npm - wouldn't forward that on to the children. It does now. - ([@daniel-pedersen](https://github.com/daniel-pedersen)) - -#### SEARCHING SPECIFIC REGISTRIES - -* [`6020447`](https://github.com/npm/npm/commit/60204479f76458a9864aa530cda2b3333f95c2b0) - [#11490](https://github.com/npm/npm/pull/11490) - Add docs for using the `--registry` flag with search. - ([@plumlee](https://github.com/plumlee)) - -#### LODASH UPDATES - -* [`bb14204`](https://github.com/npm/npm/commit/bb14204183dad620a6650452a26cdc64111f8136) - `lodash.without@4.1.1` - ([@jdalton](https://github.com/jdalton)) -* [`0089059`](https://github.com/npm/npm/commit/0089059c562aee9ad0398e55d2c12c68a6150e79) - `lodash.keys@4.0.5` - ([@jdalton](https://github.com/jdalton)) -* [`6ee1de4`](https://github.com/npm/npm/commit/6ee1de4474d9683a1f7023067d440780eeb10311) - `lodash.clonedeep@4.3.1` - ([@jdalton](https://github.com/jdalton)) - -### v3.8.0 (2016-02-25): - -This week brings a quality of life improvement for some Windows users, and -an important knob to be tuned for folks experiencing network problems. - -#### LIMIT CONCURRENT REQUESTS - -We've long known that `npm`'s tendency to try to request all your -dependencies simultaneously upset some network hardware (particular, -consumer grade routers & proxies of all sorts). One of the reasons that we're -planning to write our own npm specific version of `request` is to be able to -more easily control this sort of thing. - -But fortunately, you don't have to wait for that. -[@misterbyrne](https://github.com/misterbyrne) took a look at our existing -code and realized it could be added painlessly TODAY. The new default -maximum is `50`, instead of `Infinity`. If you're having network issues you -can try setting that value down to something lower (if you do, please let us -know... the default is subject to tuning). - -* [`910f9ac`](https://github.com/npm/npm/commit/910f9accf398466b8497952bee9f566ab50ade8c) - [`f7be667`](https://github.com/npm/npm/commit/f7be667548a132ec190ac9d60a31885a7b4fe2b3) - Add a new config option, `maxsockets` and `npm-registry-client@7.1.0` to - take advantage of it. - ([@misterbyrne](https://github.com/misterbyrne)) - -#### WINDOWS GIT BASH - -We think it's pretty keen too, we were making it really hard to actually -upgrade if you were using it. NO MORE! - -* [`d60351c`](https://github.com/npm/npm/commit/d60351ccae87d71a5f5eac73e3085c6290b52a69) - [#11524](https://github.com/npm/npm/issues/11524) - Prefer locally installed npm in Git Bash -- previous behavior was to use - the global one. This was done previously for other shells, but not for Git - Bash. - ([@destroyerofbuilds](https://github.com/destroyerofbuilds)) - -#### DOCUMENTATION IMPROVEMENTS - -* [`b63de3c`](https://github.com/npm/npm/commit/b63de3c97c4c27078944249a4d5bbe1c502c23bc) - [#11636](https://github.com/npm/npm/issues/11636) - Document `--save-bundle` option in main install page. - ([@datyayu](https://github.com/datyayu)) -* [`3d26453`](https://github.com/npm/npm/commit/3d264532d6d9df60420e985334aebb53c668d32b) - [#11644](https://github.com/npm/npm/pull/11644) - Add `directories.test` to the `package.json` documentation. - ([@lewiscowper](https://github.com/lewiscowper)) -* [`b64d124`](https://github.com/npm/npm/commit/b64d12432fdad344199b678d700306340d3607eb) - [#11441](https://github.com/npm/npm/pull/11441) - Add a link in documentation to the contribution guidelines. - ([@watilde](https://github.com/watilde)) -* [`82fc548`](https://github.com/npm/npm/commit/82fc548b0e2abbdc4f7968c20b118c30cca79a24) - [#11441](https://github.com/npm/npm/pull/11441/commits) - Remove mentions of the long defunct Google group. - ([@watilde](https://github.com/watilde)) -* [`c6ad091`](https://github.com/npm/npm/commit/c6ad09131af2e2766d6034257a8fcaa294184121) - [#11474](https://github.com/npm/npm/pull/11474) - Correct invalid JSON in npm-update docs. - ([@robludwig](https://github.com/robludwig)) -* [`4906c90`](https://github.com/npm/npm/commit/4906c90ed2668adf59ebee759c7ebb811aa46e57) - Expand on the documentation for `bundlededDependencies`, explaining what they are - and when you might want to use them. - ([@gnerkus](https://github.com/gnerkus)) - -#### DEPENDENCY UPDATES - -* [`93cdc25`](https://github.com/npm/npm/commit/93cdc25432b71cbc9c25c54ae316770e18f4b01e) - `strip-ansi@3.0.1`: - Non-user visible tests & maintainer doc updates. - ([@jbnicolai](https://github.com/jbnicolai)) -* [`3b2ccef`](https://github.com/npm/npm/commit/3b2ccef30dc2038b99ba93cd1404a1d01dac8790) - `lodash.keys@4.0.4` - ([@jdalton](https://github.com/jdalton)) -* [`30e9eb9`](https://github.com/npm/npm/commit/30e9eb97397a8f85081d328ea9aa54c2a7852613) - `lodash._baseuniq@4.5.0` - ([@jdalton](https://github.com/jdalton)) - - -### v3.7.5 (2016-02-22): - -A quick fixup release because when I updated glob, I missed the subdep copies of itself -that it installed deeper in the tree. =/ - -This only effected people trying to update to `3.7.4` from `npm@2` or `npm@1`. Updates from -`npm@3` worked fine (as it fixes up the missing subdeps during installation). - -#### OH MY GLOB - -* [`63fa704`](https://github.com/npm/npm/commit/63fa7044569127e6e29510dc499a865189806076) - [#11633](https://github.com/npm/npm/issues/11633) - When updating the top level `npm` to `glob@7`, the subdeps that - still depended on `glob@6` got new versions installed but they - weren't added to the commit. This adds them back in. - ([@iarna](https://github.com/iarna)) - -### v3.7.4 (2016-02-18): - -I'm ([@iarna](https://github.com/iarna)) back from vacation in the frozen -wastes of Maine! This release sees a couple of bug fixes, some -documentation updates, a bunch of dependency updates and improvements to our -test suite. - -#### FIXES FOR `update`, FIXES FOR `ls` - -* [`53cdb96`](https://github.com/npm/npm/commit/53cdb96634fc329378b4ea4e767ba9987986a76e) - [#11362](https://github.com/npm/npm/issues/11362) - Make `npm update` stop trying to update linked packages. - ([@rhendric](https://github.com/rhendric)) -* [`8d90d25`](https://github.com/npm/npm/commit/8d90d25b3da086843ce43911329c9572bd109078) - [#11559](https://github.com/npm/npm/issues/11559) - Only list runtime dependencies when doing `npm ls --production`. - ([@yibn2008](https://github.com/yibn2008)) - -#### @wyze, DOCUMENTATION HERO OF THE PEOPLE, GETS THEIR OWN HEADER - -* [`b78b301`](https://github.com/npm/npm/commit/b78b30171038ab737eff0b070281277e35af25b4) - [#11416](https://github.com/npm/npm/pull/11416) - Logout docs were using a section copy-pasted from the adduser docs. - ([@wyze](https://github.com/wyze)) -* [`649e28f`](https://github.com/npm/npm/commit/649e28f50aa323e75202eeedb824434535a0a4a0) - [#11414](https://github.com/npm/npm/pull/11414) - Add colon for consistency. - ([@wyze](https://github.com/wyze)) - -#### WHITTLING AWAY AT PATH LENGTHS - -So for all of you who don't know -- Node.js does, in fact, support long Windows -paths. Unfortunately, depending on the tool and the Windows version, a lot of -external tooling does not. This means, for example, that some (all?) versions of -Windows Explorer *can literally never delete npm from their system entirely -because of deeply-nested npm dependencies*. Which is pretty gnarly. - -Incidentally, if you run into that in particularly, you can use -[rimraf](npm.im/rimraf) to remove such files 💁. - -The latest victim of this issue was the Node.js CI setup for testing on Windows, -which uses some tooling or another that croaks on the usual path length limit -for that OS: 255 characters. - -This isn't ordinarily an issue with `npm@3` as it produces mostly flat -trees, but you may be surprised to learn that `npm`'s own distribution isn't -flat, due to needing to be compatible with `npm@1.2`, which ships with -`node@0.8`! - -We've taken another baby step towards alleviating this in this release by -updating a couple of dependencies that were preventing `npmlog` from deduping, -and then doing a dedupe on that and `gauge`. Hopefully it helps. - -* [`f3c32bc`](https://github.com/npm/npm/commit/f3c32bc3127301741d2fa3a26be6f5f127a35908) - [#11528](https://github.com/npm/npm/pull/11528) - `node-gyp@3.3.0`: - Update to a more recent version that uses a version of npmlog compatible - with npm itself. Also adds: AIX support, new `gyp`, `--cafile` command - line option, and allows configuration of Node.js and io.js mirrors. - ([@rvagg](https://github.com/rvagg)) - -#### INTERNAL TEST IMPROVEMENTS - -The `npm` core team's time recently has been sunk into `npm`'s many years of -tech debt. Specifically, we've been working on improving the test suite. -This isn't user visible, but in future should mean a more stable, easier to -contribute to `npm`. Ordinarily we don't report these kinds of changes in -the change log, but I thought I might share this week as this chunk is -bigger than usual. - -* [`07f020a`](https://github.com/npm/npm/commit/07f020a09e94ae393c67526985444e128ef6f83c) - [#11292](https://github.com/npm/npm/pull/11292) - `tacks@1.0.9`: - Add a package that provides a tool to generate fixtures from folders and, relatedly, - a module that an create and tear down filesystem fixtures easily. - ([@iarna](https://github.com/iarna)) -* [`0837346`](https://github.com/npm/npm/commit/083734631f9b11b17c08bca8ba8cb736a7b1e3fb) - [#11292](https://github.com/npm/npm/pull/11292) - Remove all the relatively cryptic legacy tests and creates new tap tests - that check the same functionality. The *legacy* tests were tests that - were originally a shell script that was ported to javascript early in - `npm`'s history. - ([@iarna](https://github.com/iarna)) - ([@zkat](https://github.com/zkat)) -* [`5a701e7`](https://github.com/npm/npm/commit/5a701e71a0130787fb98450f9de92117b4ef88e1) - [#11292](https://github.com/npm/npm/pull/11292) - Test that we don't leak auth info into the environment. - ([@zkat](https://github.com/zkat)) -* [`502d7d0`](https://github.com/npm/npm/commit/502d7d0628f08b09d8d13538ebccc63de8b3edf5) - [#11292](https://github.com/npm/npm/pull/11292) - Test that env vars properly passed into scripts. - ([@zkat](https://github.com/zkat)) -* [`420f267`](https://github.com/npm/npm/commit/420f2672ee8c909f18bee10b1fc7d4ad91cf328b) - [#11292](https://github.com/npm/npm/pull/11292) - Test that npm's distribution binary is complete and can be installed and used. - ([@iarna](https://github.com/iarna)) -* [`b7e99be`](https://github.com/npm/npm/commit/b7e99be1b1086f2d6098c653c1e20791269c9177) - [#11292](https://github.com/npm/npm/pull/11292) - Test that the `package.json` `files` section and `.npmignore` do what - they're supposed to. - ([@zkat](https://github.com/zkat)) - -#### DEPENDENCY UPDATES - -* [`4611098`](https://github.com/npm/npm/commit/4611098fd8c65d61a0645deb05bf38c81300ffca) - `rimraf@2.5.2`: - Use `glob@7.0.0`. - ([@isaacs](https://github.com/isaacs)) -* [`41b2772`](https://github.com/npm/npm/commit/41b2772cb83627f3b5b926cf81e150e7148cb124) - `glob@7.0.0`: - Raise error if `options.cwd` is specified, and not a directory. - ([@isaacs](https://github.com/isaacs)) -* [`c14e74a`](https://github.com/npm/npm/commit/c14e74ab5d17c764f3aa37123a9632fa965f8760) - `gauge@1.2.7`: Update to newer lodash versions, for a smaller tree. - ([@iarna](https://github.com/iarna)) -* [`d629363`](https://github.com/npm/npm/commit/d6293630ddc25bfa26d19b6be4fd2685976d7358) - `lodash.without@4.1.0` - ([@jdalton](https://github.com/jdalton)) -* [`3ea4c80`](https://github.com/npm/npm/commit/3ea4c8049ca8df9f64426b1db8a29b9579950134) - `lodash.uniq@4.2.0` - ([@jdalton](https://github.com/jdalton)) -* [`8ddcc8d`](https://github.com/npm/npm/commit/8ddcc8deb554660a3f7f474fae9758c967d94552) - `lodash.union@4.2.0` - ([@jdalton](https://github.com/jdalton)) -* [`2b656a6`](https://github.com/npm/npm/commit/2b656a672d351f32ee2af24dcee528356dcd64f4) - `lodash.keys@4.0.3` - ([@jdalton](https://github.com/jdalton)) -* [`ac171f8`](https://github.com/npm/npm/commit/ac171f8f0318a7dd3c515f3b83502dfa9e87adb8) - `lodash.isarguments@3.0.7` - ([@jdalton](https://github.com/jdalton)) -* [`bcccd90`](https://github.com/npm/npm/commit/bcccd9057b75d800c799ab15f00924f700415d3e) - `lodash.clonedeep@4.3.0` - ([@jdalton](https://github.com/jdalton)) -* [`8165bca`](https://github.com/npm/npm/commit/8165bca537d86305a3d08f080f86223a26615aa8) - `lodash._baseuniq@4.4.0` - ([@jdalton](https://github.com/jdalton)) - -### v3.7.3 (2016-02-11): - -Hey all! We've got a pretty small release this week -- just documentation -updates and a couple of dependencies. This release also includes a particular -dependency upgrade that makes it so we're exclusively using the latest version -of `graceful-fs`, which'll make it so things keep working with future Node.js -releases. - -A certain internal Node.js API was deprecated and slated for future removal from -Node Core. This API was critical for versions of `graceful-fs@<4`, before a -different approach was used to achieve similar ends. By upgrading this library, -and making sure all our dependencies are also updated, we've ensured npm will -continue to work once the API is finally removed. Older versions of npm, on the -other hand, will simply not work on future versions of Node.js. - -#### DEPENDENCY UPGRADES - -* [`29536f4`](https://github.com/npm/npm/commit/29536f42da6c06091c9acbc8952f72daa8a9412c) - `cmd-shim@2.0.2`: - Final straggler using `graceful-fs@<4`. - ([@ForbesLindesay](https://github.com/ForbesLindesay)) -* [`5f59e74`](https://github.com/npm/npm/commit/5f59e748ef4c066756bb204a452cecd0543c7a2f) - `lodash.uniq@4.1.0` - ([@jdalton](https://github.com/jdalton)) -* [`987cabe`](https://github.com/npm/npm/commit/987cabe8a18abcb5a685685958bf74c7258a979c) - `lodash.union@4.1.0` - ([@jdalton](https://github.com/jdalton)) -* [`5c641f0`](https://github.com/npm/npm/commit/5c641f05fdc153c6bb06a89c46fe2a345ce413db) - `lodash.clonedeep@4.1.0` - ([@jdalton](https://github.com/jdalton)) - -#### EVERYONE GETTING SOCKS LIKE IT'S OPRAH'S SHOW - -* [`9ea5658`](https://github.com/npm/npm/commit/9ea56582ca4d0991dbed44f992c88f08a643cb4b) - [#11410](https://github.com/npm/npm/pull/11410) - Fixed a small spelling error in `npm-config.md`. - ([@pra85](https://github.com/pra85)) -* [`2a11e56`](https://github.com/npm/npm/commit/2a11e562a14bce18b6ddca6c20d17f97b6a8ec2f) - [#11403](https://github.com/npm/npm/pull/11403) - Removes `--depth Infinity` warning from documentation -- this operation should - actually be totally safe as of `npm@3`. (The warning remains for `npm@2`.) - ([@Aourin](https://github.com/Aourin)) -* [`42a4727`](https://github.com/npm/npm/commit/42a4727bfb1e21c890b8e2babda55e06ac2bda29) - [#11391](https://github.com/npm/npm/pull/11391) - Fixed versions of `shrinkwrap.json` in examples in documentation for `npm - shrinkwrap`, which did not quite match up. - ([@xcatliu](https://github.com/xcatliu)) - -### v3.7.2 (2016-02-04): - -This week, the CLI team has been busy working on rewriting tests to support -getting coverage reports going and running all of our tests on Windows. -Meanwhile, we've got a bunch of dependency updates and one or two other -things. - -#### TESTS WENT INTO HIDING - -Last week we took a patch from [@substack](https://github.com/substack) to -stop the installer from reordering arrays in an installed module's -`package.json`... but somehow I dropped the test when I was rebasing. - -* [`21b9271`](https://github.com/npm/npm/commit/21b927182514a0ff6d9f34480bfc39f72e3e9f8c) - [#10063](https://github.com/npm/npm/issues/10063) - Restore test that verifies that we don't re-order arrays in a module's - `package.json` on install. - ([@substack](https://github.com/substack)) - -#### DOCUMENTATION FIXES - -* [`c67521d`](https://github.com/npm/npm/commit/c67521dc6c1e41d39d02c74105e41442851d23bb) - [#11348](https://github.com/npm/npm/pull/11348) - Improve the documentation around which files are ALWAYS included in published packages - and which are ALWAYS excluded. - ([@jscissr](https://github.com/jscissr)) -* [`7ef6793`](https://github.com/npm/npm/commit/7ef6793cd191cc8d88340f7e1ce9c9e3d6f0b2f4) - [#11348](https://github.com/npm/npm/pull/11348) - The release date on the 3.7.0 changelog entry was wrong. I honestly don't - know how I keep doing this. =D - ([@rafek](https://github.com/rafek)) - -#### DEPENDENCY UPDATES - -* [`8a3c80c`](https://github.com/npm/npm/commit/8a3c80c4fd3d82fe937f30bc7cbd3dee51a8a893) - `graceful-fs@4.1.3`: - Fix a bug where close wasn't getting made graceful. - ([@isaacs](https://github.com/isaacs)) - -`lodash` saw updates across most of its modules this week with browser -campatibility fixes that don't really impact us. - -* [`2df342b`](https://github.com/npm/npm/commit/2df342bf30efa99b98016acc8a5dc03e00b58b9c) - `lodash.without@4.0.2` - ([@jdalton](https://github.com/jdalton)) -* [`86aa91d`](https://github.com/npm/npm/commit/86aa91dce60f6b6a92bb3ba2bf6e6be1f6afc750) - `lodash.uniq@4.0.2` - ([@jdalton](https://github.com/jdalton)) -* [`0a94bf6`](https://github.com/npm/npm/commit/0a94bf6af0ebd38d080f92257e0cd9bae40b31ff) - `lodash.union@4.0.2` - ([@jdalton](https://github.com/jdalton)) -* [`b4c9582`](https://github.com/npm/npm/commit/b4c9582b4ef5991f3d155e0c6142ed1c631860af) - `lodash.isarguments@3.0.6` - ([@jdalton](https://github.com/jdalton)) -* [`efe766c`](https://github.com/npm/npm/commit/efe766c63c0948a4ae4c0d12f2b834629ab86e92) - `lodash.keys@4.0.2`: Minor code cleanup and the above. - ([@jdalton](https://github.com/jdalton)) -* [`36abb24`](https://github.com/npm/npm/commit/36abb24ef31017adbf325e7f833d5d4b0f03f5d4) - `lodash.clonedeep@4.0.4`: - Add support for cloning prototype objects and the above. - ([@jdalton](https://github.com/jdalton)) - -### v3.7.1 (2016-02-01): - -Super quick Monday patch on last week's release. - -If you ever wondered why we release things to the `npm@next` tag for a week -before promoting them to `npm@latest`, this is it! - -#### RELEASE TRAIN VINDICATED (again) - -* [`adcaf04`](adcaf047811dcc475ab1984fc93fe34540fc03d7) - [#11349](https://github.com/npm/npm/issues/11349) - Revert last weeks change to use JSON clone instead of `lodash.cloneDeep`. - ([@iarna](https://github.com/iarna)) - -### v3.7.0 (2016-01-29): - -Hi all! This week brings us some important performance improvements, -support for git submodules(!) and a bunch of bug fixes. - -#### PERFORMANCE - -`gauge`, the module responsible for drawing `npm`'s progress bars, had an -embarrassing bug in its debounce implementation that resulted in it, on many -systems, actually being _slower_ than if it hadn't been debouncing. This was -due to it destroying and then creating a timer object any time it got an -update while waiting on its minimum update period to elapse. This only was -a measurable slowdown when sending thousands of updates a second, but -unfortunately parts of `npm`'s logging do exactly that. This has been patched -to eliminate that churn, and our testing shows the progress bar as being -eliminated as a source of slow down. - -Meanwhile, `are-we-there-yet` is the module that tracks just how complete -our big asynchronous install process is. [@STRML](https://github.com/STRML) -spent some time auditing its source and made a few smaller performance -improvements to it. Most impactful was eliminating a bizarre bit of code -that was both binding to AND closing over the current object. I don't have -any explanation for how that crept in. =D - -* [`c680fa9`](https://github.com/npm/npm/commit/c680fa9f8135759eb5512f4b86e47fa265733f79) - `npmlog@2.0.2`: New `are-we-there-yet` with performance patches from - [@STRML](https://github.com/STRML). New `gauge` with timer churn - performance patch. - ([@iarna](https://github.com/iarna)) - -We were also using `lodash`'s `cloneDeep` on `package.json` data which is -definitely overkill, seeing as `package.json` data has all the restrictions -of being `json`. The fix for this is just swapping that out for something -that does a pair of `JSON.stringify`/`JSON.parse`, which is distinctly more -speedy. - -* [`1d1ea7e`](https://github.com/npm/npm/commit/1d1ea7eeb958034878eb6573149aeecc686888d3) - [#11306](https://github.com/npm/npm/pull/11306) - Use JSON clone instead of `lodash.cloneDeep`. - ([@STRML](https://github.com/STRML)) - -#### NEW FEATURE: GIT SUBMODULE SUPPORT - -Long, long requested– the referenced issue is from 2011– we're finally -getting rudimentary git submodule support. - -* [`39dea9c`](https://github.com/npm/npm/commit/39dea9ca4216c6ea628f5ca47d2b34a4b251a1ed) - [#1876](https://github.com/npm/npm/issues/1876) - Add support for git submodules in git remotes. This is a fairly simple - approach, which does not leverage the git caching mechanism to cache - submodules. It also doesn't provide a means to disable automatic - initialization, e.g. via a setting in the `.gitmodules` file. - ([@gagern](https://github.com/gagern)) - -#### ROBUSTNESS - -* [`5dec02a`](https://github.com/npm/npm/commit/5dec02a3d0e82202c021e27aff9d006283fdc25a) - [#10347](https://github.com/npm/npm/issues/10347) - There is an obscure feature that lets you monkey-patch npm when it starts - up. If the module being required with this feature failed, it would - previously just make `npm` error out– this reduces that to a warning. - ([@evanlucas](https://github.com/evanlucas)) - -#### BUG FIXES - -* [`9ab8b8d`](https://github.com/npm/npm/commit/9ab8b8d047792612ae7f9a6079745d51d5283a53) - [#10820](https://github.com/npm/npm/issues/10820) - Fix a bug with `npm ls` where if you asked for ONLY production dependencies in output - it would exclude dependencies that were BOTH production AND development dependencies. - ([@davidvgalbraith](https://github.com/davidvgalbraith)) -* [`6803fed`](https://github.com/npm/npm/commit/6803fedadb8f9b36cd85f7338ecf75d1d183c833) - [#8982](https://github.com/npm/npm/issues/8982) - Fix a bug where, under some circumstances, if you had a path that - contained the name of a package being installed somewhere in it, `npm` - would incorrectly refuse to run lifecycle scripts. - ([@elvanja](https://github.com/elvanja)) -* [`3eae40b`](https://github.com/npm/npm/commit/3eae40b7a681aa067dfe4fea8c9a76da5b508b48) - [#9253](https://github.com/npm/npm/issues/9253) - Fix a bug where, when running lifecycle scripts, if the Node.js binary you ran - `npm` with wasn't in your `PATH`, `npm` wouldn't use it to run your scripts. - ([@segrey](https://github.com/segrey)) -* [`61daa6a`](https://github.com/npm/npm/commit/61daa6ae8cbc041d3a0d8a6f8f268b47dd8176eb) - [#11014](https://github.com/npm/npm/issues/11014) - Fix a bug where running `rimraf node_modules/<package>` followed by `npm - rm --save <package>` would fail. `npm` now correctly removes the module - from your `package.json` even though it doesn't exist on disk. - ([@davidvgalbraith](https://github.com/davidvgalbraith)) -* [`a605586`](https://github.com/npm/npm/commit/a605586df134ee97c95f89c4b4bd6bc73f7aa439) - [#9679](https://github.com/npm/npm/issues/9679) - Fix a bug where `npm install --save git+https://…` would save a `https://` - url to your `package.json` which was a problem because `npm` wouldn't then - know that it was a git repo. - ([@gagern](https://github.com/gagern)) -* [`bbdc700`](https://github.com/npm/npm/commit/bbdc70024467c365cc4e06b8410947c04b6f145b) - [#10063](https://github.com/npm/npm/issues/10063) - Fix a bug where `npm` would change the order of array properties in the - `package.json` files of dependencies. `npm` adds a bunch of stuff to - `package.json` files in your `node_modules` folder for debugging and - bookkeeping purposes. As a part of this process it sorts the object to - reduce file churn when it does updates. This fixes a bug where the arrays - in the object were also getting sorted. This wasn't a problem for - properties that `npm` itself maintains, but _is_ a problem for properties - used by other packages. - ([@substack](https://github.com/substack)) - -#### DOCS IMPROVEMENTS - -* [`2609a29`](https://github.com/npm/npm/commit/2609a2950704f577ac888668e81ba514568fab44) - [#11273](https://github.com/npm/npm/pull/11273) - Include an example of viewing package version history in the `npm view` documentation. - ([@vedatmahir](https://github.com/vedatmahir)) -* [`719ea9c`](https://github.com/npm/npm/commit/719ea9c45a5c3233f3afde043b89824aad2df0a7) - [#11272](https://github.com/npm/npm/pull/11272) - Fix typographical issue in `npm update` documentation. - ([@jonathanp](https://github.com/jonathanp)) -* [`cb9df5a`](https://github.com/npm/npm/commit/cb9df5a37091e06071d8704b629e7ebaa41c37fe) - [#11215](https://github.com/npm/npm/pull/11215) - Do not call `SEE LICENSE IN <filename>` an _SPDX expression_, as it's not. - ([@kemitchell](https://github.com/kemitchell)) -* [`f427934`](https://github.com/npm/npm/commit/f4279346c368da4bca09385f773e8eed1d389e5e) - [#11196](https://github.com/npm/npm/pull/11196) - Correct the `package.json` examples in the `npm update` documentation to actually be - valid JSON and not just JavaScript object literals. - ([@s100](https://github.com/s100)) - -#### DEPENDENCY UPDATES - -* [`a7b2407`](https://github.com/npm/npm/commit/a7b24074cb59a1ab17c0d8eff1498047e6a123e5) - `retry@0.9.0`: New features and interface agnostic refactoring. - ([@tim-kos](https://github.com/tim-kos)) -* [`220fc77`](https://github.com/npm/npm/commit/220fc7702ae3e5d601dfefd3e95c14e9b32327de) - `request@2.69.0`: - A bunch of small bug fixes and module updates. - ([@simov](https://github.com/simov)) -* [`9e5c84f`](https://github.com/npm/npm/commit/9e5c84f1903748897e54f8ff099729ff744eab0f) - `which@1.2.4`: - Update `isexe` and fix bug in `pathExt`, in which files without extensions - would sometimes be preferred to files with extensions on Windows, even though - those without extensions aren't executable. - `pathExt` is a list of extensions that are considered executable (exe, cmd, - bat, com on Windows). - ([@isaacs](https://github.com/isaacs)) -* [`375b9c4`](https://github.com/npm/npm/commit/375b9c42fe0c6de47ac2f92527354b2ea79b7968) - `rimraf@2.5.1`: Minor doc formatting fixes. - ([@isaacs](https://github.com/isaacs)) -* [`ef1971e`](https://github.com/npm/npm/commit/ef1971e6270c2bc72e6392b51a8b84f52708f7e7) - `lodash.clonedeep@4.0.2`: - Misc minor code cleanup. No functional changes. - ([@jdalton](https://github.com/jdalton)) - -### v3.6.0 (2016-01-20): - -Hi all! This is a bigger release, in part 'cause we didn't have one last -week. The most important thing you need to know is that when `npm@3.6.0` replaces -`npm@3.5.4` as `next`, `npm@3.5.4` WILL NOT be moved on to `latest`. This is due to -a packaging error that tickles bugs in some earlier releases and makes upgrades to it -from those versions break the install. - -#### NEW FEATURES‼ - -* [`ff504d4`](https://github.com/npm/npm/commit/ff504d449ea1fa996cbb02c8078964643c51e5f6) - [#8752](https://github.com/npm/npm/issues/8752) - In `npm outdated`, report symlinked packages as having a wanted & latest - version of `linked`. - ([@halhenke](https://github.com/halhenke)) -* [`f44d8c9`](https://github.com/npm/npm/commit/f44d8c9a3940f7041f8136f8754a54b13f1f9d60) - [#10775](https://github.com/npm/npm/issues/10775) - Add a success message to `adduser` / `login`. - ([@ekmartin](https://github.com/ekmartin)) -* [`3109303`](https://github.com/npm/npm/commit/310930395c9bf1577cf085b9742210bfc71bb019) - [#10043](https://github.com/npm/npm/pull/10043) - Warn if you try to use `npm run x` if you don't have a `node_modules` folder, since - whatever you're trying to do _probably_ won't work. - ([@timkrins](https://github.com/timkrins)) - -* [`9ed2849`](https://github.com/npm/npm/commit/9ed2849cd7e8cc97111dca42a940905284afe55d) - [`e9f1ad8`](https://github.com/npm/npm/commit/e9f1ad88ce58ecd111811e11afa52ac19fc8696e) - [`f10d300`](https://github.com/npm/npm/commit/f10d300e5effa7a5756c8d461eef284c283a41d1) - [`8b593d8`](https://github.com/npm/npm/commit/8b593d8d187d6ac85d2a59cbe647afb5516c1b94) - [#10717](https://github.com/npm/npm/pull/10717) - `npm version` can now take a `from-git` argument, which instructs `npm` to read the - version from git and update your `package.json` to what it finds. This is in contrast - to its normal use where `npm` _tells_ git about your new version. - ([@ekmartin](https://github.com/ekmartin)) - -#### 3.5.4 WAS NOT SO GREAT - -The `npm@3.5.4` package was missing some dependencies. Specifically, `glob` -and `has-unicode` had major release updates which meant that subdeps that -relied on older major versions couldn't use the npm supplied versions any -more, and so they needed their own copies. - -This went undetected because the actions necessary to run the tests (which -check for this sort of thing) resolved the missing modules. - -Further, it didn't have symptoms when upgrading from _most_ versions of npm. -Unfortunately, some versions had bugs that were tickled by this and resulted -in broken upgrades, most notably, `npm@3.3.12`, the version that's been in -Node.js 5. - -* [`1d3325c`](https://github.com/npm/npm/commit/1d3325c040621a4792db80fb232f4994b9d5c5f2) - [`02611c6`](https://github.com/npm/npm/commit/02611c673a4d2bbe8fcef8d48407768da31c90d2) - [`39d5fea`](https://github.com/npm/npm/commit/39d5feadefdde38d75a18f23343bc6ec37153638) - [`7d0e830`](https://github.com/npm/npm/commit/7d0e830f26c73b9d9277b29949227ba9cca27fd9) - [#11129](https://github.com/npm/npm/pull/11129) - Update the underlying dependencies to allow use for the new versions of - `glob` and `has-unicode`. - ([@iarna](https://github.com/iarna)) - -#### WHEN MISSING PATHS ARE OK - -* [`bb638fa`](https://github.com/npm/npm/commit/bb638fa4f48d24d2c9935861d5d751c5621eea49) - [#11212](https://github.com/npm/npm/pull/11212) - When trying to determine if a file was controlled by npm before going to - remove it, we check to see if it is inside any of a list of paths that npm - considers to be under its control. Not all of those paths always exist - (and that's ok!) Previously we were calling it a failure to match if ANY - of them didn't exist. We now only do so if NONE of them exist. If some - do, then we do our usual checks on them. - - This showed up as an error where you would see something like: - ``` - npm warn gentlyRm not removing /path/to/thing as it wasn't installed by /path/to/other/thing - ``` - But it totally was installed by it. - ([@iarna](https://github.com/iarna)) - -#### BETTER NODE PRE-RELEASE SUPPORT - -Historically, if you used a pre-release version of Node.js, you would get -dozens and dozens of warnings when EVERY engine check failed across all of -your modules, because `>= 0.10.0` doesn't match prereleases. - -You might find this stream of redundent warnings undesirable. I do. - -We've moved this into a SINGLE warning you'll get about using a pre-release -version of Node.js and now suppress those other warnings. - -* [`6952f79`](https://github.com/npm/npm/commit/6952f7981e451a2d599a4f513573af208bdfe103) - [#11212](https://github.com/npm/npm/pull/11212) - Engine check warnings are now issued along with any other warnings about - your tree, instead of emitting in the middle of your install (and then - disappearing behind the giant tree of stuff installed). - ([@iarna](https://github.com/iarna)) -* [`ee2ebe9`](https://github.com/npm/npm/commit/ee2ebe96fb3d105787835b72085bbd2eee66a629) - [#11212](https://github.com/npm/npm/pull/11212) - Suppress engine verification warnings about pre-release versions of Node.js. - ([@iarna](https://github.com/iarna)) -* [`135b7e0`](https://github.com/npm/npm/commit/135b7e078311e8b4e2c8e2b662eed9ba6c2e2537) - [#11212](https://github.com/npm/npm/pull/11212) - Explicitly warn, in only one place, if you are using a pre-release version - of Node.js. - ([@iarna](https://github.com/iarna)) - -#### BUG FIXES - -* [`ea331c8`](https://github.com/npm/npm/commit/ea331c82157c65f7643cd4b49fd24031c84bf601) - [#10938](https://github.com/npm/npm/issues/10938) - When removing a package, sometimes the `node_modules/.bin` wouldn't be - cleaned up entirely. This would result in package folders that contained - only a `node_modules/.bin` directory. In turn, this would result in `npm - ls` and other tools complaining about these broken directories. - To fix this, the `unbuild` step now explicitly deletes the - `node_modules/.bin` folder as its final step. - ([@chrisirhc](https://github.com/chrisirhc)) -* [`00720db`](https://github.com/npm/npm/commit/00720db2c326cf8f968c662444a4575ae8c3020a) - [#11158](https://github.com/npm/npm/pull/11158) - On Windows, the `node-gyp` wrapper would fail if your path to `node-gyp` - contained spaces. This fixes that problem by quoting use of that path. - ([@orangemocha](https://github.com/orangemocha)) -* [`69ac933`](https://github.com/npm/npm/commit/69ac9333506752bf2e5af70b3b3e03c6181de3e7) - [#11142](https://github.com/npm/npm/pull/11142) - Fix a race condition when making directories in the cache, which could - lead to `ENOENT` failures. - ([@Jimbly](https://github.com/Jimbly)) -* [`e982858`](https://github.com/npm/npm/commit/e982858d9bed65cede9cbb12df9216a4bb9e6fc9) - [#9696](https://github.com/npm/npm/issues/9696) - When replacing the `package.json` in the cache you sometimes see `EPERM` errors on - Windows that you wouldn't on Unix-like operating systems. This ignores those errors - and allows Windows to continue. Longer term, we'll be adding something to retry - these errors, but ultimately fail if there really is an ongoing permissions issue. - ([@orangemocha](https://github.com/orangemocha)) - -#### DOC CHANGES - -* [`3666081`](https://github.com/npm/npm/commit/3666081abd02184ba97a7cdb6ae238085d640b4b) - [#11188](https://github.com/npm/npm/pull/11188) - Add brief description to publish documentation of what's included in - published tarballs. - ([@beaugunderson](https://github.com/beaugunderson)) -* [`b463e34`](https://github.com/npm/npm/commit/b463e3424b296cfc4bd384fc8bfe0e2329649164) - [#11150](https://github.com/npm/npm/pull/11150) - In npm update docs, advise use of `--depth Infinity` instead of `--depth - 9999`. - ([@halhenke](https://github.com/halhenke)) -* [`382e71a`](https://github.com/npm/npm/commit/382e71a7ee5d1ca3dba55c1e753d529eb8ae6895) - [#11128](https://github.com/npm/npm/pull/11128) - In the `package.json` docs, make the reference to the "Local Paths" section - a link to it as well. - ([@orangejulius](https://github.com/orangejulius)) -* [`5277e7f`](https://github.com/npm/npm/commit/5277e7f236e8cb40d7f4a1054506f2d3d159716e) - [#11090](https://github.com/npm/npm/pull/11090) - Fix the 3.5.4 release date in CHANGELOG.md. - ([@ashleygwilliams](https://github.com/ashleygwilliams)) -* [`e6d238a`](https://github.com/npm/npm/commit/e6d238a3d90beeb0af23fa75a9b5e50671d6e4c5) - [#11130](https://github.com/npm/npm/pull/11130) - Eliminate the "using npm programmatically" section from the README. The - documentation for this was removed a while ago and is unsupported. - ([@ljharb](https://github.com/ljharb)) - -#### DEPENDENCY UPDATES - -* [`b0dde5c`](https://github.com/npm/npm/commit/b0dde5c3407b58d78969d3da01af2629fcba1c73) - `config-chain@1.1.10`: Update tests for most recent version of `ini`. - ([@dominictarr](https://github.com/dominictarr)) -* [`c62f414`](https://github.com/npm/npm/commit/c62f414534971761a48ce3cbc3e25214fb09e494) - `glob@6.0.4`: Eliminated use of `util._extend`. - ([@isaacs](https://github.com/isaacs)) -* [`98a6779`](https://github.com/npm/npm/commit/98a67797978ed7ce534e16b705d3a2a9ca0e6cc1) - `lodash.clonedeep@4.0.1`: Bug fixes, including the non-linear performance - that was biting npm a while back. - ([@jdalton](https://github.com/jdalton)) -* [`0e8c4ce`](https://github.com/npm/npm/commit/0e8c4cebddaefbf5eca0abaad512db266c6722c9) - `lodash.without@4.0.1` - ([@jdalton](https://github.com/jdalton)) -* [`1fd19f5`](https://github.com/npm/npm/commit/1fd19f57a3551d7d30a6b8a9ce967ef50e0ff0ba) - `lodash.uniq@4.0.1` - ([@jdalton](https://github.com/jdalton)) -* [`b7486c5`](https://github.com/npm/npm/commit/b7486c550f3391f733d1e1907652be95fddf4368) - `lodash.union@4.0.1` - ([@jdalton](https://github.com/jdalton)) -* [`54bb591`](https://github.com/npm/npm/commit/54bb5911e18f8fb86eb94159f34b13f0c0aa2e30) - `lodash.keys@4.0.0` - ([@jdalton](https://github.com/jdalton)) -* [`26f7a7a`](https://github.com/npm/npm/commit/26f7a7aaae0575a85deba2241ee69b433dd1ba98) - `lodash.isarray@4.0.0` - ([@jdalton](https://github.com/jdalton)) -* [`ed38bd3`](https://github.com/npm/npm/commit/ed38bd3baf544dfc0630fd321d279f137700bd4d) - `lodash.isarguments@3.0.5` - ([@jdalton](https://github.com/jdalton)) - -### v3.5.4 (2016-01-07): - -I hope you all had fantastic winter holidays, if it's winter where you are -and if there are holidays‼ We went a few weeks without releases because -staff was taking time away from work here and there. A new year has come -and we're back now, and refreshed and ready to dig in! - -This week brings us a bunch of documentation improvements and some module -updates. The core team's focus continues to be on improving tests, -particularly with Windows, so there's not too much to call out here. - -#### DOCUMENTATION IMPROVEMENTS - -* [`6b0031e`](https://github.com/npm/npm/commit/6b0031e28c0b10fb2622fdadde41f5cd294348e8) - [#11044](https://github.com/npm/npm/pull/11044) - Correct documentation regarding the defaults for the `color` config option. - ([@scottaddie](https://github.com/scottaddie)) -* [`c6ce69e`](https://github.com/npm/npm/commit/c6ce69eaed7f17b5f1876ac13ecfae3d14a72f24) - [#10990](https://github.com/npm/npm/pull/10990) - Drop mentions in documentation of `process.installPrefix`, as it hasn't - been a thing since Node.js 0.6 and we don't support that. - ([@jeffmcmahan](https://github.com/jeffmcmahan)) -* [`dee92d1`](https://github.com/npm/npm/commit/dee92d1f78608a10becf57aae86d5d495f2272bd) - [#11037](https://github.com/npm/npm/pull/11037) - Clarify the documentation on the max length of the `name` property in - `package.json` files. - ([@scottaddie](https://github.com/scottaddie)) -* [`4b9d7bb`](https://github.com/npm/npm/commit/4b9d7bb1a4fc3f1edcf563379abfd2273af10881) - [#10787](https://github.com/npm/npm/pull/10787) - Make the formatting in the documentation for `npm dist-tag` more - consistent with other docs. - ([@cvrebert](https://github.com/cvrebert)) -* [`7f77a80`](https://github.com/npm/npm/commit/7f77a80d561ee4b2b8c0aba1226fe89dfe339bcd) - [#10787](https://github.com/npm/npm/pull/10787) - Add documentation to the `npm dist-tag` docs that explains in greater - detail how `latest` is different than other tags. Further, improve the - documentation with better examples. Add a discussion of common practice - for using dist tags to manage alpha's and beta's. - ([@cvrebert](https://github.com/cvrebert)) -* [`6db58dd`](https://github.com/npm/npm/commit/6db58dd0d7719c4675a239d43164edc066842b14) - [`2ee6371`](https://github.com/npm/npm/commit/2ee6371911bd3a4d566c5d7bc8734facc60cb27c) - [#10788](https://github.com/npm/npm/pull/10788) - [#10789](https://github.com/npm/npm/pull/10789) - Improve documentation cross referencing. - ([@cvrebert](https://github.com/cvrebert)) -* [`7ba629a`](https://github.com/npm/npm/commit/7ba629a2ad3eaf736529e053b533cabe3a0d7123) - [#10790](https://github.com/npm/npm/pull/10790) - Document more clearly that `npm install foo` means `npm install - foo@latest`. - ([@cvrebert](https://github.com/cvrebert)) - -#### A FEW MODULE UPDATES - -* [`fc2e8d5`](https://github.com/npm/npm/commit/fc2e8d58a91728cb06936eea686efaa4fdec3f06) - `glob@6.0.3`: Remove deprecated features and fix a bunch of bugs. - ([@isaacs](https://github.com/isaacs)) -* [`5b820c4`](https://github.com/npm/npm/commit/5b820c4e17c907fa8c23771c0cd8e74dd5fdaa51) - `has-unicode@2.0.0`: Change the default on Windows to be false, as - international Windows installs often install to non-unicode codepages and - there's no way to detect this short of a system call or a call to a - command line program. - ([@iarna](https://github.com/iarna)) -* [`238fe84`](https://github.com/npm/npm/commit/238fe84ac61297f1d71701d80368afaa40463305) - `which@1.2.1`: Fixed bugs with uid/gid checks and with quoted Windows PATH - parts. - ([@isaacs](https://github.com/isaacs)) -* [`5e510e1`](https://github.com/npm/npm/commit/5e510e13d022a22d58742b126482d3b38a14cc83) - `rimraf@2.5.0`: Add ability to disable glob support / pass in options. - ([@isaacs](https://github.com/isaacs)) -* [`7558215`](https://github.com/npm/npm/commit/755821569466b7be0883f4b0573eeb83c24109eb) - `readable-stream@2.0.5`: Minor performance improvements. - ([@calvinmetcalf](https://github.com/calvinmetcalf)) -* [`64e8499`](https://github.com/npm/npm/commit/64e84992c812a73d590be443c09a6977d0ae9040) - `fs-write-stream-atomic@1.0.8`: Rewrite to use modern streams even on 0.8 - plus a bunch of tests. - ([@iarna](https://github.com/iarna)) -* [`74d92a0`](https://github.com/npm/npm/commit/74d92a08d72ce3603244de4bb3e3706d2b928cef) - `columnify@1.5.4`: Some bug fixes around large inputs. - ([@timoxley](https://github.com/timoxley)) - -#### FIX NPM'S TESTS ON 0.8 - -This doesn't impact you as a user of npm, and ordinarily that means we -wouldn't call it out here, but if you've ever wanted to contribute, having -that green travis badge makes it a lot easier to do so with confidence! - -* [`b14cdbb`](https://github.com/npm/npm/commit/b14cdbb6002b04bfbefaff70cc45810c20d5a366) - [#10872](https://github.com/npm/npm/pull/10872) - Rewrite tests using nock to use other alternatives. - ([@zkat](https://github.com/zkat)) -* [`59ed01a`](https://github.com/npm/npm/commit/59ed01a8ea7960b1467aed52164fc36a03c77770) - [#10872](https://github.com/npm/npm/pull/10872) - Work around Node.js 0.8 http back-pressure bug. - - 0.8 http streams have a bug, where if they're paused with data in their - buffers when the socket closes, they call `end` before emptying those - buffers, which results in the entire pipeline ending and thus the point - that applied backpressure never being able to trigger a `resume`. - - We work around this by piping into a pass through stream that has - unlimited buffering. The pass through stream is from readable-stream and - is thus a current streams3 implementation that is free of these bugs even - on 0.8. - ([@iarna](https://github.com/iarna)) - -### v3.5.3 (2015-12-10): - -Did you know that Bob Ross reached the rank of master sergeant in the US Air -Force before becoming perhaps the most soothing painter of all time? - -#### TWO HAPPY LITTLE BUG FIXES - -* [`71c9590`](https://github.com/npm/npm/commit/71c9590be61b6a7b7fa8b6dc19baa588cda26a27) - [#10505](https://github.com/npm/npm/issues/10505) `npm ls --json --depth=0` - now respects the depth parameter, when it is zero and when it is not zero. - ([@MarkReeder](https://github.com/MarkReeder)) -* [`954fa67`](https://github.com/npm/npm/commit/954fa67f1ca3739992abd244e217a0aaf8465660) - [#9099](https://github.com/npm/npm/issues/9099) I had always thought you - could run `npm version` from subdirectories in your project, which is great, - because now you can. I guess I was just ahead of my time. - ([@ekmartin](https://github.com/ekmartin)) - -#### NOW PAINT IN SOME NICE DOCS CHANGES - -* [`b88c37c`](https://github.com/npm/npm/commit/b88c37c1cced40e9e41402cc54a5efc3c33cd13e) - [#10546](https://github.com/npm/npm/issues/10546) Goodbye, FAQ! You were - cheeky and fun until you weren't! Don't worry: npm still loves everyone, - especially you! ([@ashleygwilliams](https://github.com/ashleygwilliams)) -* [`2d3afe9`](https://github.com/npm/npm/commit/2d3afe9644ba69681a36721e79c45d27def71939) - [#10570](https://github.com/npm/npm/issues/10570) Update documentation URLs - to be HTTPS everywhere sensible. No HTTP shall be spared! - ([@rsp](https://github.com/rsp)) -* [`6abd0e0`](https://github.com/npm/npm/commit/6abd0e0626d0f642ce0dae0e128ced80433f15a1) - [#10650](https://github.com/npm/npm/issues/10650) Correctly note that there - are two lifecycle scripts run by an install phase in an example, instead of - three. ([@eymengunay](https://github.com/eymengunay)) -* [`a5e8df5`](https://github.com/npm/npm/commit/a5e8df53b8d6d75398cb6a55a44dcf374b0f1661) - [#10687](https://github.com/npm/npm/issues/10687) `npm outdated`'s output can - be a little puzzling sometimes. I've attempted to make it clearer, with some - examples, of what's going on with "wanted" and "latest" in more cases. - ([@othiym23](https://github.com/othiym23)) -* [`8f52833`](https://github.com/npm/npm/commit/8f52833f5d15c4f94467234607d40e75198af1aa) - [#10700](https://github.com/npm/npm/issues/10700) Hey, do you remember when - `search.npmjs.org` was a thing? I think I do? The last time I used it was in - like 2012, and it's gone now, so remove it from the docs. - ([@gagern](https://github.com/gagern)) -* [`b6a53b8`](https://github.com/npm/npm/commit/b6a53b889c948053dcbf6d7aab9ad1cd4226dc32) - [npm/docs#477](https://github.com/npm/docs/issues/477) Continue to airbrush - the CLI API docs out of history. ([@verpixelt](https://github.com/verpixelt)) -* [`b835b72`](https://github.com/npm/npm/commit/b835b72d1dd23b0a17321a85d8d395322d18005d) - `semver@5.1.0`: Include BNF for SemVer expression grammar (which is also now - included in `npm help semver`). ([@isaacs](https://github.com/isaacs)) - -#### LAND YOUR DEPENDENCY UPGRADES IN PAIRS SO EVERYONE HAS A FRIEND - -* [`95e99fa`](https://github.com/npm/npm/commit/95e99faadcdc85a16210dd79c0e7d83add1b9f3e) - `request@2.67.0` ([@simov](https://github.com/simov)) -* [`b49199a`](https://github.com/npm/npm/commit/b49199ac96dfb1afe5719286621a318576dd69ae) - [isaacs/rimraf#89](https://github.com/isaacs/rimraf/pull/89) `rimraf@2.4.4` - ([@zerok](https://github.com/zerok)) -* [`6632418`](https://github.com/npm/npm/commit/66324189a734a1665e1b78a06ba44089d9c3a11c) - [npm/nopt#51](https://github.com/npm/nopt/pull/51) `nopt@3.0.6` - ([@wbecker](https://github.com/wbecker)) -* [`f0a3b3e`](https://github.com/npm/npm/commit/f0a3b3e0dbbdaf11ec55dccd59cc21bfa05f9240) - [isaacs/once#7](https://github.com/isaacs/once/pull/7) `once@1.3.3` - ([@floatdrop](https://github.com/floatdrop)) - -### v3.5.2 (2015-12-03): - -Weeeelcome to another npm release! The short version is that we fixed -some `ENOENT` and some modules that resulted in modules going missing. We -also eliminated the use of MD5 in our code base to help folks using -Node.js in FIPS mode. And we fixed a bad URL in our license file. - -#### FIX URL IN LICENSE - -The license incorrectly identified the registry URL as -`registry.npmjs.com` and this has been corrected to `registry.npmjs.org`. - -* [`cb6d81b`](https://github.com/npm/npm/commit/cb6d81bd611f68c6126a90127a9dfe5604d46c8c) - [#10685](https://github.com/npm/npm/pull/10685) - Fix npm public registry URL in notices. - ([@kemitchell](https://github.com/kemitchell)) - -#### ENOENT? MORE LIKE ENOMOREBUGS - -The headliner this week was uncovered by the fixes to bundled dependency -handling over the past few releases. What had been a frustratingly -intermittent and hard to reproduce bug became something that happened -every time in Travis. This fixes another whole bunch of errors where you -would, while running an install have it crash with an `ENOENT` on -`rename`, or the install would finish but some modules would be -mysteriously missing and you'd have to install a second time. - -What's going on was a bit involved, so bear with me: - -`npm@3` generates a list of actions to take against the tree on disk. -With the exception of lifecycle scripts, it expects these all to be able -to act independently without interfering with each other. - -This means, for instance, that one should be able to upgrade `b` in -`a→b→c` without having npm reinstall `c`. - -That works fine by the way. - -But it also means that the move action should be able to move `b` in -`a→b→c@1.0.1` to `a→d→b→c@1.0.2` without moving or removing `c@1.0.1` and -while leaving `c@1.0.2` in place if it was already installed. - -That is, the `move` action moves an individual node, replacing itself -with an empty spot if it had children. This is not, as it might first -appear, something where you move an entire branch to another location on -the tree. - -When moving `b` we already took care to leave `c@1.0.1` in place so that -other moves (or removes) could handle it, but we were stomping on the -destination and so `c@1.0.2` was being removed. - -* [`f4385d8`](https://github.com/npm/npm/commit/f4385d8e7678349e75c80fae8a1f8f366f197937) - [#10655](https://github.com/npm/npm/pull/10655) - Preserve destination `node_modules` when moving. - ([@iarna](https://github.com/iarna)) - -There was also a bug with `remove` where it was pruning the entire tree -at the remove point, prior to running moves and adds. - -This was fine most of the time, but if we were moving one of the deps out -from inside it, kaboom. - -* [`19c626d`](https://github.com/npm/npm/commit/19c626d69888f0cdc6e960254b3fdf523ec4b52c) - [#10655](https://github.com/npm/npm/pull/10655) - Get rid of the remove commit phase– we could have it prune _just_ the - module being removed, but that isn't gaining us anything. - ([@iarna](https://github.com/iarna)) - -After all that, we shouldn't be upgrading the `add` of a bundled package -to a `move`. Moves save us from having to extract the package, but with a -bundled dependency it's included in another package already so that -doesn't gain us anything. - -* [`641a93b`](https://github.com/npm/npm/commit/641a93bd66a6aa4edf2d6167344b50d1a2afb593) - [#10655](https://github.com/npm/npm/pull/10655) - Don't convert adds to moves with bundled deps. - ([@iarna](https://github.com/iarna)) - -While I was in there, I also took some time to improve diagnostics to -make this sort of thing easier to track down in the future: - -* [`a04ec04`](https://github.com/npm/npm/commit/a04ec04804e562b511cd31afe89c8ba94aa37ff2) - [#10655](https://github.com/npm/ npm/pull/10655) - Wrap rename so errors have stack traces. - ([@iarna](https://github.com/iarna)) -* [`8ea142f`](https://github.com/npm/npm/commit/8ea142f896a2764290ca5472442b27b047ab7a1a) - [#10655](https://github.com/npm/npm/pull/10655) - Add silly logging so function is debuggable - ([@iarna](https://github.com/iarna)) - -#### NO MORE MD5 - -We updated modules that had been using MD5 for non-security purposes. -While this is perfectly safe, if you compile Node in FIPS-compliance mode -it will explode if you try to use MD5. We've replaced MD5 with Murmur, -which conveys our intent better and is faster to boot. - -* [`f068b26`](https://github.com/npm/npm/commit/f068b2661a8d0269c184867e003cd08cb6c56cf2) - [#10629](https://github.com/npm/npm/issues/10629) - `unique-filename@1.1.0` - ([@iarna](https://github.com/iarna)) -* [`dba1b24`](https://github.com/npm/npm/commit/dba1b2402aaa2beceec798d3bd22d00650e01069) - [#10629](https://github.com/npm/npm/issues/10629) - `write-file-atomic@1.1.4` - ([@othiym23](https://github.com/othiym23)) -* [`8347a30`](https://github.com/npm/npm/commit/8347a308ef0d2cf0f58f96bba3635af642ec611f) - [#10629](https://github.com/npm/npm/issues/10629) - `fs-write-stream-atomic@1.0.5` - ([@othiym23](https://github.com/othiym23)) - -#### DEPENDENCY UPDATES - -* [`9e2a2bb`](https://github.com/npm/npm/commit/9e2a2bb5bc71a0ab3b3637e8eec212aa22d5c99f) - [nodejs/node-gyp#831](https://github.com/nodejs/node-gyp/pull/831) - `node-gyp@3.2.1`: - Improved \*BSD support. - ([@bnoordhuis](https://github.com/bnoordhuis)) - -### v3.5.1 (2015-11-25): - -#### THE npm CLI !== THE npm REGISTRY !== npm, INC. - -npm-the-CLI is licensed under the terms of the [Artistic License -2.0](https://github.com/npm/npm/blob/8d79c1a39dae908f27eaa37ff6b23515d505ef29/LICENSE), -which is a liberal open-source license that allows you to take this code and do -pretty much whatever you like with it (that is, of course, not legal language, -and if you're doing anything with npm that leaves you in doubt about your legal -rights, please seek the review of qualified counsel, which is to say, not -members of the CLI team, none of whom have passed the bar, to my knowledge). At -the same time the primary registry the CLI uses when looking up and downloading -packages is a commercial service run by npm, Inc., and it has its own [Terms of -Use](https://www.npmjs.com/policies/terms). - -Aside from clarifying the terms of use (and trying to make sure they're more -widely known), the only recent changes to npm's licenses have been making the -split between the CLI and registry clearer. You are still free to do whatever -you like with the CLI's source, and you are free to view, download, and publish -packages to and from `registry.npmjs.org`, but now the existing terms under -which you can do so are more clearly documented. Aside from the two commits -below, see also [the release notes for -`npm@3.4.1`](https://github.com/npm/npm/releases/tag/v3.4.1), which is where -the split between the CLI's code and the terms of use for the registry was -first made more clear. - -* [`35a5dd5`](https://github.com/npm/npm/commit/35a5dd5abbfeec4f98a2b4534ec4ef5d16760581) - [#10532](https://github.com/npm/npm/issues/10532) Clarify that - `registry.npmjs.org` is the default, but that you're free to use the npm CLI - with whatever registry you wish. ([@kemitchell](https://github.com/kemitchell)) -* [`fa6b013`](https://github.com/npm/npm/commit/fa6b0136a0e4a19d8979b2013622e5ff3f0446f8) - [#10532](https://github.com/npm/npm/issues/10532) Having semi-duplicate - release information in `README.md` was confusing and potentially inaccurate, - so remove it. ([@kemitchell](https://github.com/kemitchell)) - -#### EASE UP ON WINDOWS BASH USERS - -It turns out that a fair number of us use bash on Windows (through MINGW or -bundled with Git, plz – Cygwin is still a bridge too far, for both npm and -Node.js). [@jakub-g](https://github.com/jakub-g) did us all a favor and relaxed -the check for npm completion to support MINGW bash. Thanks, Jakub! - -* [`09498e4`](https://github.com/npm/npm/commit/09498e45c5c9e683f092ab1372670f81db4762b6) - [#10156](https://github.com/npm/npm/issues/10156) completion: enable on - Windows in git bash ([@jakub-g](https://github.com/jakub-g)) - -#### THE ONGOING SAGA OF BUNDLED DEPENDENCIES - -`npm@3.5.0` fixed up a serious issue with how `npm@3.4.1` (and potentially -`npm@3.4.0` and `npm@3.3.12`) handled the case in which dependencies bundled -into a package tarball are handled improperly when one or more of their own -dependencies are older than what's latest on the registry. Unfortunately, in -fixing that (quite severe) regression (see [`npm@3.5.0`'s release notes' for -details](https://github.com/npm/npm/releases/tag/v3.5.0)), we introduced a new -(small, and fortunately cosmetic) issue where npm superfluously warns you about -bundled dependencies being stale. We have now fixed that, and hope that we -haven't introduced any _other_ regressions in the process. :D - -* [`20824a7`](https://github.com/npm/npm/commit/20824a75bf7639fb0951a588e3c017a370ae6ec2) - [#10501](https://github.com/npm/npm/issues/10501) Only warn about replacing - bundled dependencies when actually doing so. ([@iarna](https://github.com/iarna)) - -#### MAKE NODE-GYP A LITTLE BLUER - -* [`1d14d88`](https://github.com/npm/npm/commit/1d14d882c3b5af0a7fee46e8e0e343d07e4c38cb) - `node-gyp@3.2.0`: Support AIX, use `which` to find Python, updated to a newer - version of `gyp`, and more! ([@bnoordhuis](https://github.com/bnoordhuis)) - -#### A BOUNTEOUS THANKSGIVING CORNUCOPIA OF DOC TWEAKS - -These are great! Keep them coming! Sorry for letting them pile up so deep, -everybody. Also, a belated Thanksgiving to our Canadian friends, and a happy -Thanksgiving to all our friends in the USA. - -* [`4659f1c`](https://github.com/npm/npm/commit/4659f1c5ad617c46a5e89b48abf0b1c4e6f04307) - [#10244](https://github.com/npm/npm/issues/10244) In `npm@3`, `npm dedupe` - doesn't take any arguments, so update documentation to reflect that. - ([@bengotow](https://github.com/bengotow)) -* [`625a7ee`](https://github.com/npm/npm/commit/625a7ee6b4391e90cb28a95f20a73fd794e1eebe) - [#10250](https://github.com/npm/npm/issues/10250) Correct order of `org:team` - in `npm team` documentation. ([@louislarry](https://github.com/louislarry)) -* [`bea7f87`](https://github.com/npm/npm/commit/bea7f87399d784e3a6d3393afcca658a61a40d77) - [#10371](https://github.com/npm/npm/issues/10371) Remove broken / duplicate - link to tag. ([@WickyNilliams](https://github.com/WickyNilliams)) -* [`0a25e29`](https://github.com/npm/npm/commit/0a25e2956e9ddd4065d6bd929559321afc512fde) - [#10419](https://github.com/npm/npm/issues/10419) Remove references to - nonexistent `npm-rm(1)` documentation. ([@KenanY](https://github.com/KenanY)) -* [`19b94e1`](https://github.com/npm/npm/commit/19b94e1e6781fe2f98ada0a3f49a1bda25e3e32d) - [#10474](https://github.com/npm/npm/issues/10474) Clarify that install finds - dependencies in `package.json`. ([@sleekweasel](https://github.com/sleekweasel)) -* [`b25efc8`](https://github.com/npm/npm/commit/b25efc88067c843ffdda86ea0f50f95d136a638e) - [#9948](https://github.com/npm/npm/issues/9948) Encourage users to file an - issue, rather than emailing authors. ([@trodrigues](https://github.com/trodrigues)) -* [`24f4ced`](https://github.com/npm/npm/commit/24f4cedc83b10061f26362bf2f005ab935e0cbfe) - [#10497](https://github.com/npm/npm/issues/10497) Clarify what a package is - slightly. ([@aredridel](https://github.com/aredridel)) -* [`e8168d4`](https://github.com/npm/npm/commit/e8168d40caae00b2914ea09dbe4bd1b09ba3dcd5) - [#10539](https://github.com/npm/npm/issues/10539) Remove an extra, spuriously - capitalized letter. ([@alexlukin-softgrad](https://github.com/alexlukin-softgrad)) - -### v3.5.0 (2015-11-19): - -#### TEEN ORCS AT THE GATES - -This week heralds the general release of the primary npm registry's [new -support for private packages for -organizations](http://blog.npmjs.org/post/133542170540/private-packages-for-organizations). -For many potential users, it's the missing piece needed to make it easy for you -to move your organization's private work onto npm. And now it's here! The -functionality to support it has been in place in the CLI for a while now, -thanks to [@zkat](https://github.com/zkat)'s hard work. - -During our final testing before the release, our ace support team member -[@snopeks](https://github.com/snopeks) noticed that there had been some drift -between the CLI team's implementation and what npm was actually preparing to -ship. In the interests of everyone having a smooth experience with this -_extremely useful_ new feature, we quickly made a few changes to square up the -CLI and the web site experiences. - -* [`d7fb92d`](https://github.com/npm/npm/commit/d7fb92d1c53ba5196ad6dd2101a06792a4c0412b) - [#9327](https://github.com/npm/npm/issues/9327) `npm access` no longer has - problems when run in a directory that doesn't contain a `package.json`. - ([@othiym23](https://github.com/othiym23)) -* [`17df3b5`](https://github.com/npm/npm/commit/17df3b5d5dffb2e9c223b9cfa2d5fd78c39492a4) - [npm/npm-registry-client#126](https://github.com/npm/npm-registry-client/issues/126) - `npm-registry-client@7.0.8`: Allow the CLI to grant, revoke, and list - permissions on unscoped (public) packages on the primary registry. - ([@othiym23](https://github.com/othiym23)) - -#### NON-OPTIONAL INSTALLS, DEFINITELY NON-OPTIONAL - -* [`180263b`](https://github.com/npm/npm/commit/180263b) - [#10465](https://github.com/npm/npm/pull/10465) - When a non-optional dep fails, we check to see if it's only required by - ONLY optional dependencies. If it is, we make it fail all the deps in - that chain (and roll them back). If it isn't then we give an error. - - We do this by walking up through all of our ancestors until we either hit an - optional dependency or the top of the tree. If we hit the top, we know to - give the error. - - If you installed a module by hand but didn't `--save` it, your module - won't have the top of the tree as an anscestor and so this code was - failing to abort the install with an error - - This updates the logic so that hitting the top OR a module that was - requested by the user will trigger the error message. - ([@iarna](https://github.com/iarna)) - -* [`b726a0e`](https://github.com/npm/npm/commit/b726a0e) - [#9204](https://github.com/npm/npm/issues/9204) - Ideally we would like warnings about your install to come AFTER the - output from your compile steps or the giant tree of installed modules. - - To that end, we've moved warnings about failed optional deps to the show - after your install completes. - ([@iarna](https://github.com/iarna)) - -#### OVERRIDING BUNDLING - -* [`aed71fb`](https://github.com/npm/npm/commit/aed71fb) - [#10482](https://github.com/npm/npm/issues/10482) - We've been in our bundled modules code a lot lately, and our last go at - this introduced a new bug, where if you had a module `a` that bundled - a module `b`, which in turn required `c`, and the version of `c` that - got bundled wasn't compatible with `b`'s `package.json`, we would then - install a compatible version of `c`, but also erase `b` at the same time. - - This fixes that. It also reworks our bundled module support to be much - closer to being in line with how we handle non-bundled modules and we're - hopeful this will reduce any future errors around them. The new structure - is hopefully much easier to reason about anyway. - ([@iarna](https://github.com/iarna)) - -#### A BRIEF NOTE ON NPM'S BACKWARDS COMPATIBILITY - -We don't often have much to say about the changes we make to our internal -testing and tooling, but I'm going to take this opportunity to reiterate that -npm tries hard to maintain compatibility with a wide variety of Node versions. -As this change shows, we want to ensure that npm works the same across: - -* Node.js 0.8 -* Node.js 0.10 -* Node.js 0.12 -* the latest io.js release -* Node.js 4 LTS -* Node.js 5 - -Contributors who send us pull requests often notice that it's very rare that -our tests pass across all of those versions (ironically, almost entirely due to -the packages we use for testing instead of any issues within npm itself). We're -currently beginning an effort, lasting the rest of 2015, to clean up our test -suite, and not only get it passing on all of the above versions of Node.js, but -working solidly on Windows as well. This is a compounding form of technical -debt that we're finally paying down, and our hope is that cleaning up the tests -will produce a more robust CLI that's a lot easier to write patches for. - -* [`791ec6b`](https://github.com/npm/npm/commit/791ec6b1bac0d1df59f5ebb4ccd16a29a5dc73f0) - [#10233](https://github.com/npm/npm/issues/10233) Update Node.js versions - that Travis uses to test npm. ([@iarna](https://github.com/iarna)) - -#### 0.8 + npm <1.4 COMPATIBLE? SURE WHY NOT - -Hey, you found the feature we added! - -* [`231c58a`](https://github.com/npm/npm/commit/231c58a) - [#10337](https://github.com/npm/npm/pull/10337) - Add two new flags, first `--legacy-bundling` which installs your - dependencies such that if you bundle those dependencies, npm versions - prior to `1.4` can still install them. This eliminates all automatic - deduping. - - Second, `--global-style` which will install modules in your `node_modules` - folder with the same layout as global modules. Only your direct - dependencies will show in `node_modules` and everything they depend on - will be flattened in their `node_modules` folders. This obviously will - eliminate some deduping. - ([@iarna](https://github.com/iarna)) - -#### TYPOS IN THE LICENSE, OH MY - -* [`8d79c1a`](https://github.com/npm/npm/commit/8d79c1a39dae908f27eaa37ff6b23515d505ef29) - [#10478](https://github.com/npm/npm/issues/10478) Correct two typos in npm's - LICENSE. ([@jorrit](https://github.com/jorrit)) - -### v3.4.1 (2015-11-12): - -#### ASK FOR NOTHING, GET LATEST - -When you run `npm install foo`, you probably expect that you'll get the -`latest` version of `foo`, whatever that is. And good news! That's what -this change makes it do. - -We _think_ this is what everyone wants, but if this causes problems for -you, we want to know! If it proves problematic for people we will consider -reverting it (preferably before this becomes `npm@latest`). - -Previously, when you ran `npm install foo` we would act as if you typed -`npm install foo@*`. Now, like any range-type specifier, in addition to -matching the range, it would also have to be `<=` the value of the -`latest` dist-tag. Further, it would exclude prerelease versions from the -list of versions considered for a match. - -This worked as expected most of the time, unless your `latest` was a -prerelease version, in which case that version wouldn't be used, to -everyone's surprise. Worse, if all your versions were prerelease versions -it would just refuse to install anything. (We fixed that in -[`npm@3.2.2`](https://github.com/npm/npm/releases/tag/v3.2.2) with -[`e4a38080`](https://github.com/npm/npm/commit/e4a38080).) - -* [`1e834c2`](https://github.com/npm/npm/commit/1e834c2) - [#10189](https://github.com/npm/npm/issues/10189) - `npm-package-arg@4.1.0` Change the default version from `*` to `latest`. - ([@zkat](https://github.com/zkat)) - -#### BUGS - -* [`bec4a84`](https://github.com/npm/npm/commit/bec4a84) - [#10338](https://github.com/npm/npm/pull/10338) - Failed installs could result in more rollback (removal of just installed - packages) than we intended. This bug was first introduced by - [`83975520`](https://github.com/npm/npm/commit/83975520). - ([@iarna](https://github.com/iarna)) -* [`06c732f`](https://github.com/npm/npm/commit/06c732f) - [#10338](https://github.com/npm/npm/pull/10338) - Updating a module could result in the module stealing some of its - dependencies from the top level, potentially breaking other modules or - resulting in many redundent installations. This bug was first introduced - by [`971fd47a`](https://github.com/npm/npm/commit/971fd47a). - ([@iarna](https://github.com/iarna)) -* [`5653366`](https://github.com/npm/npm/commit/5653366) - [#9980](https://github.com/npm/npm/issues/9980) - npm, when removing a module, would refuse to remove the symlinked - binaries if the module itself was symlinked as well. npm goes to some - effort to ensure that it doesn't remove things that aren't is, and this - code was being too conservative. This code has been rewritten to be - easier to follow and to be unit-testable. - ([@iarna](https://github.com/iarna)) - -#### LICENSE CLARIFICATION - -* [`80acf20`](https://github.com/npm/npm/commit/80acf20) - [#10326](https://github.com/npm/npm/pull/10326) - Update npm's licensing to more completely cover all of the various - things that are npm. - ([@kemitchell](https://github.com/kemitchell)) - -#### CLOSER TO GREEN TRAVIS - -* [`fc12da9`](https://github.com/npm/npm/commit/fc12da9) - [#10232](https://github.com/npm/npm/pull/10232) - `nock@1.9.0` - Downgrade nock to a version that doesn't depend on streams2 in core so - that more of our tests can pass in 0.8. - ([@iarna](https://github.com/iarna)) - -### v3.4.0 (2015-11-05): - -#### A NEW FEATURE - -This was a group effort, with [@isaacs](https://github.com/isaacs) -dropping the implementation in back in August. Then, a few days ago, -[@ashleygwilliams](https://github.com/ashleygwilliams) wrote up docs and -just today [@othiym23](https://github.com/othiym23) wrote a test. - -It's a handy shortcut to update a dependency and then make sure tests -still pass. - -This new command: - -``` -npm install-test x -``` - -is the equivalent of running: - -``` -npm install x && npm test -``` - -* [`1ac3e08`](https://github.com/npm/npm/commit/1ac3e08) - [`bcb04f6`](https://github.com/npm/npm/commit/bcb04f6) - [`b6c17dd`](https://github.com/npm/npm/commit/b6c17dd) - [#9443](https://github.com/npm/npm/pull/9443) - Add `npm install-test` command, alias `npm it`. - ([@isaacs](https://github.com/isaacs), - [@ashleygwilliams](https://github.com/ashleygwilliams), - [@othiym23](https://github.com/othiym23)) - -#### BUG FIXES VIA DEPENDENCY UPDATES - -* [`31c0080`](https://github.com/npm/npm/commit/31c0080) - [#8640](https://github.com/npm/npm/issues/8640) - [npm/normalize-package-data#69](https://github.com/npm/normalize-package-data/pull/69) - `normalize-package-data@2.3.5`: - Fix a bug where if you didn't specify the name of a scoped module's - binary, it would install it such that it was impossible to call it. - ([@iarna](https://github.com/iarna)) -* [`02b37bc`](https://github.com/npm/npm/commit/02b37bc) - [npm/fstream-npm#14](https://github.com/npm/fstream-npm/pull/14) - `fstream-npm@1.0.7`: - Only filter `config.gypi` when it's in the build directory. - ([@mscdex](https://github.com/mscdex)) -* [`accb9d2`](https://github.com/npm/npm/commit/accb9d2) - [npm/fstream-npm#15](https://github.com/npm/fstream-npm/pull/15) - `fstream-npm@1.0.6`: - Stop including directories that happened to have names matching whitelisted - npm files in npm module tarballs. The most common cause was that if you had - a README directory then everything in it would be included if wanted it - or not. - ([@taion](https://github.com/taion)) - -#### DOCUMENTATION FIXES - -* [`7cf6366`](https://github.com/npm/npm/commit/7cf6366) - [#10036](https://github.com/npm/npm/pull/10036) - Fix typo / over-abbreviation. - ([@ifdattic](https://github.com/ifdattic)) -* [`d0ad8f4`](https://github.com/npm/npm/commit/d0ad8f4) - [#10176](https://github.com/npm/npm/pull/10176) - Fix broken link, scopes => scope. - ([@ashleygwilliams](https://github.com/ashleygwilliams)) -* [`d623783`](https://github.com/npm/npm/commit/d623783) - [#9460](https://github.com/npm/npm/issue/9460) - Specifying the default command run by "npm start" and the - fact that you can pass it arguments. - ([@JuanCaicedo](https://github.com/JuanCaicedo)) - -#### DEPENDENCY UPDATES FOR THEIR OWN SAKE - -* [`0a4c29e`](https://github.com/npm/npm/commit/0a4c29e) - [npm/npmlog#19](https://github.com/npm/npmlog/pull/19) - `npmlog@2.0.0`: Make it possible to emit log messages with `error` as the - prefix. - ([@bengl](https://github.com/bengl)) -* [`9463ce9`](https://github.com/npm/npm/commit/9463ce9) - `read-package-json@2.0.2`: - Minor cleanups. - ([@KenanY](https://github.com/KenanY)) - -### v3.3.12 (2015-11-02): - -Hi, a little hot-fix release for a bug introduced in 3.3.11. The ENOENT fix -last week ([`f0e2088`](https://github.com/npm/npm/commit/f0e2088)) broke -upgrades of modules that have bundled dependencies (like `npm`, augh!) - -* [`aedf7cf`](https://github.com/npm/npm/commit/aedf7cf) - [#10192](//github.com/npm/npm/pull/10192) - If a bundled module is going to be replacing a module that's currently on - disk (for instance, when you upgrade a module that includes bundled - dependencies) we want to select the version from the bundle in preference - over the one that was there previously. - ([@iarna](https://github.com/iarna)) - -### v3.3.11 (2015-10-29): - -This is a dependency update week, so that means no PRs from our lovely -users. Look for those next week. As it happens, the dependencies updated -were just devdeps, so nothing for you all to worry about. - -But the bug fixes, oh geez, I tracked down some really long standing stuff -this week!! The headliner is those intermittent `ENOENT` errors that no one -could reproduce consistently? I think they're nailed! But also pretty -important, the bug where `hapi` would install w/ a dep missing? Squashed! - -#### EEEEEEENOENT - -* [`f0e2088`](https://github.com/npm/npm/commit/f0e2088) - [#10026](https://github.com/npm/npm/issues/10026) - Eliminate some, if not many, of the `ENOENT` errors `npm@3` has seen over - the past few months. This was happening when npm would, in its own mind, - correct a bundled dependency, due to a `package.json` specifying an - incompatible version. Then, when npm extracted the bundled version, what - was on disk didn't match its mind and… well, when it tried to act on what - was in its mind, we got an `ENOENT` because it didn't actually exist on - disk. - ([@iarna](https://github.com/iarna)) - -#### PARTIAL SHRINKWRAPS, NO LONGER A BAD DAY - -* [`712fd9c`](https://github.com/npm/npm/commit/712fd9c) - [#10153](https://github.com/npm/npm/pull/10153) - Imagine that you have a module, let's call it `fun-time`, and it depends - on two dependencies, `need-fun@1` and `need-time`. Further, `need-time` - requires `need-fun@2`. So after install the logical tree will look like - this: - - ``` - fun-time - ├── need-fun@1 - └── need-time - └── need-fun@2 - ``` - - Now, the `fun-time` author also distributes a shrinkwrap, but it only includes - the `need-fun@1` in it. - - Resolving dependencies would look something like this: - - 1. Require `need-fun@1`: Use version from shrinkwrap (ignoring version) - 2. Require `need-time`: User version in package.json - 1. Require `need-fun@2`: Use version from shrinkwrap, which oh hey, is - already installed at the top level, so no further action is needed. - - Which results in this tree: - - ``` - fun-time - ├── need-fun@1 - └── need-time - ``` - - We're ignoring the version check on things specified in the shrinkwrap - so that you can override the version that will be installed. This is - because you may want to use a different version than is specified - by your dependencies' dependencies' `package.json` files. - - To fix this, we now only allow overrides of a dependency version when - that dependency is a child (in the tree) of the thing that requires it. - This means that when we're looking for `need-fun@2` we'll see `need-fun@1` - and reject it because, although it's from a shrinkwrap, it's parent is - `fun-time` and the package doing the requiring is `need-time`. - - ([@iarna](https://github.com/iarna)) - -#### STRING `package.bin` AND NON-NPMJS REGISTRIES - -* [`3de1463`](https://github.com/npm/npm/commit/3de1463) - [#9187](https://github.com/npm/npm/issues/9187) - If you were using a module with the `bin` field in your `package.json` set - to a string on a non-npmjs registry then npm would crash, due to the our - expectation that the `bin` field would be an object. We now pass all - `package.json` data through a routine that normalizes the format, - including the `bin` field. (This is the same routine that your - `package.json` is passed through when read off of disk or sent to the - registry for publication.) Doing this also ensures that older modules on - npm's own registry will be treated exactly the same as new ones. (In the - past we weren't always super careful about scrubbing `package.json` data - on publish. And even when we were, those rules have subtly changed over - time.) - ([@iarna](https://github.com/iarna)) - -### v3.3.10 (2015-10-22): - -Hey you all! Welcome to a busy bug fix and PR week. We've got changes -to how `npm install` replaces dependencies during updates, improvements -to shrinkwrap behavior, and all sorts of doc updates. - -In other news, `npm@3` landed in node master in preparation for `node@5` -with [`41923c0`](https://github.com/nodejs/node/commit/41923c0). - -#### UPDATED DEPS NOW MAKE MORE SENSE - -* [`971fd47`](https://github.com/npm/npm/commit/971fd47) - [#9929](https://github.com/npm/npm/pull/9929) - Make the tree more consistent by doing updates in place. This means - that trees after a dependency version update will more often look - the same as after a fresh install. - ([@iarna](https://github.com/iarna)) - -#### SHRINKWRAP + DEV DEPS NOW RESPECTED - -* [`eb28a8c`](https://github.com/npm/npm/commit/eb28a8c) - [#9647](https://github.com/npm/npm/issues/9647) - If a shrinkwrap already has dev deps, don't throw them away when - someone later runs `npm install --save`. - ([@iarna](https://github.com/iarna)) - -#### FANTASTIC DOCUMENTATION UPDATES - -* [`291162c`](https://github.com/npm/npm/commit/291162c) - [#10021](https://github.com/npm/npm/pull/10021) - Improve wording in the FAQ to be more empathetic and less jokey. - ([@TaMe3971](https://github.com/TaMe3971)) -* [`9a28c54`](https://github.com/npm/npm/commit/9a28c54) - [#10020](https://github.com/npm/npm/pull/10020) - Document the command to see the list of config defaults in the section - on config defaults. - ([@lady3bean](https://github.com/lady3bean)) -* [`8770b0a`](https://github.com/npm/npm/commit/8770b0a) - [#7600](https://github.com/npm/npm/issues/7600) - Add shortcuts to all command documentation. - ([@RichardLitt](https://github.com/RichardLitt)) -* [`e9b7d0d`](https://github.com/npm/npm/commit/e9b7d0d) - [#9950](https://github.com/npm/npm/pull/9950) - On errors that can be caused by outdated node & npm, suggest updating - as a part of the error message. - ([@ForbesLindesay](https://github.com/ForbesLindesay)) - -#### NEW STANDARD HAS ALWAYS BEEN STANDARD - -* [`40c1b0f`](https://github.com/npm/npm/commit/40c1b0f) - [#9954](https://github.com/npm/npm/pull/9954) - Update to `standard@5` and reformat the source to work with it. - ([@cbas](https://github.com/cbas)) - -### v3.3.9 (2015-10-15): - -This week sees a few small changes ready to land: - -#### TRAVIS NODE 0.8 BUILDS REJOICE - -* [`25a234b`](https://github.com/npm/npm/commit/25a234b) - [#9668](https://github.com/npm/npm/issues/9668) - Install `npm@3`'s bundled dependencies with `npm@2`, so that the ancient npm - that ships with node 0.8 can install `npm@3` directly. - ([@othiym23](https://github.com/othiym23)) - -#### SMALL ERROR MESSAGE IMPROVEMENT - -* [`a332f61`](https://github.com/npm/npm/commit/a332f61) - [#9927](https://github.com/npm/npm/pull/9927) - Update error messages where we report a list of versions that you could - have installed to show this as a comma separated list instead of as JSON. - ([@iarna](https://github.com/iarna)) - -#### DEPENDENCY UPDATES - -* [`4cd74b0`](https://github.com/npm/npm/commit/4cd74b0) - `nock@2.15.0` - ([@pgte](https://github.com/pgte)) -* [`9360976`](https://github.com/npm/npm/commit/9360976) - `tap@2.1.1` - ([@isaacs](https://github.com/isaacs)) -* [`1ead0a4`](https://github.com/npm/npm/commit/1ead0a4) - `which@1.2.0` - ([@isaacs](https://github.com/isaacs)) -* [`759f88a`](https://github.com/npm/npm/commit/759f88a) - `has-unicode@1.0.1` - ([@iarna](https://github.com/iarna)) - -### v3.3.8 (2015-10-12): - -This is a small update release, we're reverting -[`22a3af0`](https://github.com/npm/npm/commit/22a3af0) from last week's -release, as it is resulting in crashes. We'll revisit this PR during this -week. - -* [`ddde1d5`](https://github.com/npm/npm/commit/ddde1d5) - Revert "lifecycle: Swap out custom logic with add-to-path module" - ([@iarna](https://github.com/iarna)) - -### v3.3.7 (2015-10-08): - -So, as Kat mentioned in last week's 2.x release, we're now swapping weeks -between accepting PRs and doing dependency updates, in an effort to keep -release management work from taking over our lives. This week is a PR week, -so we've got a bunch of goodies for you. - -Relatedly, this week means 3.3.6 is now `latest` and it is WAY faster than -previous 3.x releases. Give it or this a look! - -#### OPTIONAL DEPS, MORE OPTIONAL - -* [`2289234`](https://github.com/npm/npm/commit/2289234) - [#9643](https://github.com/npm/npm/issues/9643) - [#9664](https://github.com/npm/npm/issues/9664) - `npm@3` was triggering `npm@2`'s build mechanics when it was linking bin files - into the tree. This was originally intended to trigger rebuilds of - bundled modules, but `npm@3`'s flat module structure confused it. This - caused two seemingly unrelated issues. First, failing optional - dependencies could under some circumstances (if they were built during - this phase) trigger a full build failure. And second, rebuilds were being - triggered of already installed modules, again, in some circumstances. - Both of these are fixed by disabling the `npm@2` mechanics and adding a - special rebuild phase for the initial installation of bundled modules. - ([@iarna](https://github.com/iarna)) - -#### BAD NAME, NO CRASH - -* [`b78fec9`](https://github.com/npm/npm/commit/b78fec9) - [#9766](https://github.com/npm/npm/issues/9766) - Refactor all attempts to read the module name or package name to go via a - single function, with appropriate guards unusual circumstances where they - aren't where we expect them. This ultimately will ensure we don't see any - more recurrences of the `localeCompare` error and related crashers. - ([@iarna](https://github.com/iarna)) - -#### MISCELLANEOUS BUG FIXES - -* [`22a3af0`](https://github.com/npm/npm/commit/22a3af0) - [#9553](https://github.com/npm/npm/pull/9553) - Factor the lifecycle code to manage paths out into its own module and use that. - ([@kentcdodds](https://github.com/kentcdodds)) -* [`6a29fe3`](https://github.com/npm/npm/commit/6a29fe3) - [#9677](https://github.com/npm/npm/pull/9677) - Start testing our stuff in node 4 on travis - ([@fscherwi](https://github.com/fscherwi)) -* [`508c6a4`](https://github.com/npm/npm/commit/508c6a4) - [#9669](https://github.com/npm/npm/issues/9669) - Make `recalculateMetadata` more resilient to unexpectedly bogus dependency specifiers. - ([@tmct](https://github.com/tmct)) -* [`3c44763`](https://github.com/npm/npm/commit/3c44763) - [#9643](https://github.com/npm/npm/issues/9463) - Update `install --only` to ignore the `NODE_ENV` var and _just_ use the only - value, if specified. - ([@watilde](https://github.com/watilde)) -* [`87336c3`](https://github.com/npm/npm/commit/87336c3) - [#9879](https://github.com/npm/npm/pull/9879) - `npm@3`'s shrinkwrap was refusing to shrinkwrap if an optional dependency - was missing– patch it to allow this. - ([@mantoni](https://github.com/mantoni)) - -#### DOCUMENTATION UPDATES - -* [`82659fd`](https://github.com/npm/npm/commit/82659fd) - [#9208](https://github.com/npm/npm/issues/9208) - Correct the npm style guide around quote usage - ([@aaroncrows](https://github.com/aaroncrows)) -* [`a69c83a`](https://github.com/npm/npm/commit/a69c83a) - [#9645](https://github.com/npm/npm/pull/9645) - Fix spelling error in README - ([@dkoleary88](https://github.com/dkoleary88)) -* [`f2cf054`](https://github.com/npm/npm/commit/f2cf054) - [#9714](https://github.com/npm/npm/pull/9714) - Fix typos in our documentation - ([@reggi](https://github.com/reggi)) -* [`7224bef`](https://github.com/npm/npm/commit/7224bef) - [#9759](https://github.com/npm/npm/pull/9759) - Fix typo in npm-team docs - ([@zkat](https://github.com/zkat)) -* [`7e6e007`](https://github.com/npm/npm/commit/7e6e007) - [#9820](https://github.com/npm/npm/pull/9820) - Correct documentation as to `binding.gyp` - ([@KenanY](https://github.com/KenanY)) - -### v3.3.6 (2015-09-30): - -I have the most exciting news for you this week. YOU HAVE NO IDEA. Well, -ok, maybe you do if you follow my twitter. - -Performance just got 5 bazillion times better (under some circumstances, -ymmv, etc). So– my test scenario is our very own website. In `npm@2`, on my -macbook running `npm ls` takes about 5 seconds. Personally it's more than -I'd like, but it's entire workable. In `npm@3` it has been taking _50_ seconds, -which is appalling. But after doing some work on Monday isolating the performance -issues I've been able to reduce `npm@3`'s run time back down to 5 seconds. - -Other scenarios were even worse, there was one that until now in `npm@3` that -took almost 6 minutes, and has been reduced to 14 seconds. - -* [`7bc0d4c`](https://github.com/npm/npm/commit/7bc0d4c) - [`cf42217`](https://github.com/npm/npm/commit/cf42217) - [#8826](https://github.com/npm/npm/issues/8826) - Stop using deepclone on super big datastructures. Avoid cloning - all-together even when that means mutating things, when possible. - Otherwise use a custom written tree-copying function that understands - the underlying datastructure well enough to only copy what we absolutely - need to. - ([@iarna](https://github.com/iarna)) - -In other news, look for us this Friday and Saturday at the amazing -[Open Source and Feelings](https://osfeels.com) conference, where something like a -third of the company will be attending. - -#### And finally a dependency update - -* [`a6a4437`](https://github.com/npm/npm/commit/a6a4437) - `glob@5.0.15` - ([@isaacs](https://github.com/isaacs)) - -#### And some subdep updates - -* [`cc5e6a0`](https://github.com/npm/npm/commit/cc5e6a0) - `hoek@2.16.3` - ([@nlf](https://github.com/nlf)) -* [`912a516`](https://github.com/npm/npm/commit/912a516) - `boom@2.9.0` - ([@arb](https://github.com/arb)) -* [`63944e9`](https://github.com/npm/npm/commit/63944e9) - `bluebird@2.10.1` - ([@petkaantonov](https://github.com/petkaantonov)) -* [`ef16003`](https://github.com/npm/npm/commit/ef16003) - `mime-types@2.1.7` & `mime-db@1.19.0` - ([@dougwilson](https://github.com/dougwilson)) -* [`2b8c0dd`](https://github.com/npm/npm/commit/2b8c0dd) - `request@2.64.0` - ([@simov](https://github.com/simov)) -* [`8139124`](https://github.com/npm/npm/commit/8139124) - `brace-expansion@1.1.1` - ([@juliangruber](https://github.com/juliangruber)) - -### v3.3.5 (2015-09-24): - -Some of you all may not be aware, but npm is ALSO a company. I tell you this -'cause npm-the-company had an all-staff get together this week, flying in -our remote folks from around the world. That was great, but it also -basically eliminated normal work on Monday and Tuesday. - -Still, we've got a couple of really important bug fixes this week. Plus a -lil bit from the [now LTS 2.x branch](https://github.com/npm/npm/releases/tag/v2.14.6). - -#### ATTENTION WINDOWS USERS - -If you previously updated to npm 3 and you try to update again, you may get -an error messaging telling you that npm won't install npm into itself. Until you -are at 3.3.5 or greater, you can get around this with `npm install -f -g npm`. - -* [`bef06f5`](https://github.com/npm/npm/commit/bef06f5) - [#9741](https://github.com/npm/npm/pull/9741) Uh... so... er... it - seems that since `npm@3.2.0` on Windows with a default configuration, it's - been impossible to update npm. Well, that's not actually true, there's a - work around (see above), but it shouldn't be complaining in the first - place. - ([@iarna](https://github.com/iarna)) - -#### STACK OVERFLOWS ON PUBLISH - -* [`330b496`](https://github.com/npm/npm/commit/330b496) - [#9667](https://github.com/npm/npm/pull/9667) - We were keeping track of metadata about your project while packing the - tree in a way that resulted in this data being written to packed tar files - headers. When this metadata included cycles, it resulted in the the tar - file entering an infinite recursive loop and eventually crashing with a - stack overflow. - - I've patched this by keeping track of your metadata by closing over the - variables in question instead, and I've further restricted gathering and - tracking the metadata to times when it's actually needed. (Which is only - if you need bundled modules.) - ([@iarna](https://github.com/iarna)) - -#### LESS CRASHY ERROR MESSAGES ON BAD PACKAGES - -* [`829921f`](https://github.com/npm/npm/commit/829921f) - [#9741](https://github.com/npm/npm/pull/9741) - Packages with invalid names or versions were crashing the installer. These - are now captured and warned as was originally intended. - ([@iarna](https://github.com/iarna)) - -#### ONE DEPENDENCY UPDATE - -* [`963295c`](https://github.com/npm/npm/commit/963295c) - `npm-install-checks@2.0.1` - ([@iarna](https://github.com/iarna)) - -#### AND ONE SUBDEPENDENCY - -* [`448737d`](https://github.com/npm/npm/commit/448737d) - `request@2.63.0` - ([@simov](https://github.com/simov)) - -### v3.3.4 (2015-09-17): - -This is a relatively quiet release, bringing a few bug fixes and -some module updates, plus via the -[2.14.5 release](https://github.com/npm/npm/releases/tag/v2.14.5) -some forward compatibility fixes with versions of Node that -aren't yet released. - -#### NO BETA NOTICE THIS TIME!! - -But, EXCITING NEWS FRIENDS, this week marks the exit of `npm@3` -from beta. This means that the week of this release, -[v3.3.3](https://github.com/npm/npm/releases/tag/v3.3.3) will -become `latest` and this version (v3.3.4) will become `next`!! - -#### CRUFT FOR THE CRUFT GODS - -What I call "cruft", by which I mean, files sitting around in -your `node_modules` folder, will no longer produce warnings in -`npm ls` nor during `npm install`. This brings `npm@3`'s behavior -in line with `npm@2`. - -* [`a127801`](https://github.com/npm/npm/commit/a127801) - [#9285](https://github.com/npm/npm/pull/9586) - Stop warning about cruft in module directories. - ([@iarna](https://github.com/iarna)) - -#### BETTER ERROR MESSAGE - -* [`95ee92c`](https://github.com/npm/npm/commit/95ee92c) - [#9433](https://github.com/npm/npm/issues/9433) - Give better error messages for invalid URLs in the dependency - list. - ([@jamietre](https://github.com/jamietre)) - -#### MODULE UPDATES - -* [`ebb92ca`](https://github.com/npm/npm/commit/ebb92ca) - `retry@0.8.0` ([@tim-kos](https://github.com/tim-kos)) -* [`55f1285`](https://github.com/npm/npm/commit/55f1285) - `normalize-package-data@2.3.4` ([@zkat](https://github.com/zkat)) -* [`6d4ebff`](https://github.com/npm/npm/commit/6d4ebff) - `sha@2.0.1` ([@ForbesLindesay](https://github.com/ForbesLindesay)) -* [`09a9c7a`](https://github.com/npm/npm/commit/09a9c7a) - `semver@5.0.3` ([@isaacs](https://github.com/isaacs)) -* [`745000f`](https://github.com/npm/npm/commit/745000f) - `node-gyp@3.0.3` ([@rvagg](https://github.com/rvagg)) - -#### SUB DEP MODULE UPDATES - -* [`578ca25`](https://github.com/npm/npm/commit/578ca25) - `request@2.62.0` ([@simov](https://github.com/simov)) -* [`1d8996e`](https://github.com/npm/npm/commit/1d8996e) - `jju@1.2.1` ([@rlidwka](https://github.com/rlidwka)) -* [`6da1ba4`](https://github.com/npm/npm/commit/6da1ba4) - `hoek@2.16.2` ([@nlf](https://github.com/nlf)) - -### v3.3.3 (2015-09-10): - -This short week brought us brings us a few small bug fixes, a -doc change and a whole lotta dependency updates. - -Plus, as usual, this includes a forward port of everything in -[`npm@2.14.4`](https://github.com/npm/npm/releases/tag/v2.14.4). - -#### BETA BUT NOT FOREVER - -**_THIS IS BETA SOFTWARE_**. `npm@3` will remain in beta until -we're confident that it's stable and have assessed the effect of -the breaking changes on the community. During that time we will -still be doing `npm@2` releases, with `npm@2` tagged as `latest` -and `next`. We'll _also_ be publishing new releases of `npm@3` -as `npm@v3.x-next` and `npm@v3.x-latest` alongside those -versions until we're ready to switch everyone over to `npm@3`. -We need your help to find and fix its remaining bugs. It's a -significant rewrite, so we are _sure_ there still significant -bugs remaining. So do us a solid and deploy it in non-critical -CI environments and for day-to-day use, but maybe don't use it -for production maintenance or frontline continuous deployment -just yet. - -#### REMOVE INSTALLED BINARIES ON WINDOWS - -So waaaay back at the start of August, I fixed a bug with -[#9198](https://github.com/npm/npm/pull/9198). That fix made it -so that if you had two modules installed that both installed the -same binary (eg `gulp` & `gulp-cli`), that removing one wouldn't -remove the binary if it was owned by the other. - -It did this by doing some hocus-pocus that, turns out, was -Unix-specific, so on Windows it just threw up its hands and -stopped removing installed binaries at all. Not great. - -So today we're fixing that– it let us maintain the same safety -that we added in #9198, but ALSO works with Windows. - -* [`25fbaed`](https://github.com/npm/npm/commit/25fbaed) - [#9394](https://github.com/npm/npm/issues/9394) - Treat cmd-shims the same way we treat symlinks - ([@iarna](https://github.com/iarna)) - -#### API DOCUMENTATION HAS BEEN SACRIFICED THE API GOD - -The documentation of the internal APIs of npm is going away, -because it would lead people into thinking they should integrate -with npm by using it. Please don't do that! In the future, we'd -like to give you a suite of stand alone modules that provide -better, more stand alone APIs for your applications to build on. -But for now, call the npm binary with `process.exec` or -`process.spawn` instead. - -* [`2fb60bf`](https://github.com/npm/npm/commit/2fb60bf) - Remove misleading API documentation - ([@othiym23](https://github.com/othiym23)) - -#### ALLOW `npm link` ON WINDOWS W/ PRERELEASE VERSIONS OF NODE - -We never meant to have this be a restriction in the first place -and it was only just discovered with the recent node 4.0.0 -release candidate. - -* [`6665e54`](https://github.com/npm/npm/commit/6665e54) - [#9505](https://github.com/npm/npm/pull/9505) - Allow npm link to run on Windows with prerelease versions of - node - ([@jon-hall](https://github.com/jon-hall)) - -#### graceful-fs update - -We're updating all of npm's deps to use the most recent -`graceful-fs`. This turns out to be important for future not yet -released versions of node, because older versions monkey-patch -`fs` in ways that will break in the future. Plus it ALSO makes -use of `process.binding` which is an internal API that npm -definitely shouldn't have been using. We're not done yet, but -this is the bulk of them. - -* [`e7bc98e`](https://github.com/npm/npm/commit/e7bc98e) - `write-file-atomic@1.1.3` - ([@iarna](https://github.com/iarna)) -* [`7417600`](https://github.com/npm/npm/commit/7417600) - `tar@2.2.1` - ([@zkat](https://github.com/zkat)) -* [`e4e9d40`](https://github.com/npm/npm/commit/e4e9d40) - `read-package-json@2.0.1` - ([@zkat](https://github.com/zkat)) -* [`481611d`](https://github.com/npm/npm/commit/481611d) - `read-installed@4.0.3` - ([@zkat](https://github.com/zkat)) -* [`0dabbda`](https://github.com/npm/npm/commit/0dabbda) - `npm-registry-client@7.0.4` - ([@zkat](https://github.com/zkat)) -* [`c075a91`](https://github.com/npm/npm/commit/c075a91) - `fstream@1.0.8` - ([@zkat](https://github.com/zkat)) -* [`2e4341a`](https://github.com/npm/npm/commit/2e4341a) - `fs-write-stream-atomic@1.0.4` - ([@zkat](https://github.com/zkat)) -* [`18ad16e`](https://github.com/npm/npm/commit/18ad16e) - `fs-vacuum@1.2.7` - ([@zkat](https://github.com/zkat)) - -#### DEPENDENCY UPDATES - -* [`9d6666b`](https://github.com/npm/npm/commit/9d6666b) - `node-gyp@3.0.1` - ([@rvagg](https://github.com/rvagg)) -* [`349c4df`](https://github.com/npm/npm/commit/349c4df) - `retry@0.7.0` - ([@tim-kos](https://github.com/tim-kos)) -* [`f507551`](https://github.com/npm/npm/commit/f507551) - `which@1.1.2` - ([@isaacs](https://github.com/isaacs)) -* [`e5b6743`](https://github.com/npm/npm/commit/e5b6743) - `nopt@3.0.4` - ([@zkat](https://github.com/zkat)) - -#### THE DEPENDENCIES OF OUR DEPENDENCIES ARE OUR DEPENDENCIES UPDATES - -* [`316382d`](https://github.com/npm/npm/commit/316382d) - `mime-types@2.1.6` & `mime-db@1.18.0` -* [`64b741e`](https://github.com/npm/npm/commit/64b741e) - `spdx-correct@1.0.1` -* [`fff62ac`](https://github.com/npm/npm/commit/fff62ac) - `process-nextick-args@1.0.3` -* [`9d6488c`](https://github.com/npm/npm/commit/9d6488c) - `cryptiles@2.0.5` -* [`1912012`](https://github.com/npm/npm/commit/1912012) - `bluebird@2.10.0` -* [`4d09402`](https://github.com/npm/npm/commit/4d09402) - `readdir-scoped-modules@1.0.2` - -### v3.3.2 (2015-09-04): - -#### PLEASE HOLD FOR THE NEXT AVAILABLE MAINTAINER - -This is a tiny little maintenance release, both to update dependencies and to -keep `npm@3` up to date with changes made to `npm@2`. -[@othiym23](https://github.com/othiym23) is putting out this release (again) as -his esteemed colleague [@iarna](https://github.com/iarna) finishes relocating -herself, her family, and her sizable anime collection all the way across North -America. It contains [all the goodies in -`npm@2.14.3`](https://github.com/npm/npm/releases/tag/v2.14.3) and one other -dependency update. - -#### BETA WARNINGS FOR FUN AND PROFIT - -**_THIS IS BETA SOFTWARE_**. `npm@3` will remain in beta until we're -confident that it's stable and have assessed the effect of the breaking -changes on the community. During that time we will still be doing `npm@2` -releases, with `npm@2` tagged as `latest` and `next`. We'll _also_ be -publishing new releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` -alongside those versions until we're ready to switch everyone over to -`npm@3`. We need your help to find and fix its remaining bugs. It's a -significant rewrite, so we are _sure_ there still significant bugs -remaining. So do us a solid and deploy it in non-critical CI environments -and for day-to-day use, but maybe don't use it for production maintenance or -frontline continuous deployment just yet. - -That said, it's getting there! It will be leaving beta very soon! - -#### ONE OTHER DEPENDENCY UPDATE - -* [`bb5de34`](https://github.com/npm/npm/commit/bb5de3493531228df0bd3f0742d5493c826be6dd) - `is-my-json-valid@2.12.2`: Upgrade to a new, modernized version of - `json-pointer`. ([@mafintosh](https://github.com/mafintosh)) - -### v3.3.1 (2015-08-27): - -Hi all, this `npm@3` update brings you another round of bug fixes. The -headliner here is that `npm update` works again. We're running down the -clock on blocker 3.x issues! Shortly after that hits zero we'll be -promoting 3.x to latest!! - -And of course, we have changes that were brought forward from 2.x. Check out -the release notes for -[2.14.1](https://github.com/npm/npm/releases/tag/v2.14.1) and -[2.14.2](https://github.com/npm/npm/releases/tag/v2.14.2). - -#### BETA WARNINGS FOR FUN AND PROFIT - -**_THIS IS BETA SOFTWARE_**. `npm@3` will remain in beta until we're -confident that it's stable and have assessed the effect of the breaking -changes on the community. During that time we will still be doing `npm@2` -releases, with `npm@2` tagged as `latest` and `next`. We'll _also_ be -publishing new releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` -alongside those versions until we're ready to switch everyone over to -`npm@3`. We need your help to find and fix its remaining bugs. It's a -significant rewrite, so we are _sure_ there still significant bugs -remaining. So do us a solid and deploy it in non-critical CI environments -and for day-to-day use, but maybe don't use it for production maintenance or -frontline continuous deployment just yet. - -#### NPM UPDATE, NOW AGAIN YOUR FRIEND - -* [`f130a00`](https://github.com/npm/npm/commit/f130a00) - [#9095](https://github.com/npm/npm/issues/9095) - `npm update` once again works! Previously, after selecting packages - to update, it would then pick the wrong location to run the install - from. ([@iarna](https://github.com/iarna)) - -#### MORE VERBOSING FOR YOUR VERBOSE LIFECYCLES - -* [`d088b7d`](https://github.com/npm/npm/commit/d088b7d) - [#9227](https://github.com/npm/npm/pull/9227) - Add some additional logging at the verbose and silly levels - when running lifecycle scripts. Hopefully this will make - debugging issues with them a bit easier! - ([@saper](https://github.com/saper)) - -#### AND SOME OTHER BUG FIXES… - -* [`f4a5784`](https://github.com/npm/npm/commit/f4a5784) - [#9308](https://github.com/npm/npm/issues/9308) - Make fetching metadata for local modules faster! This ALSO means - that doing things like running `npm repo` won't build your - module and maybe run `prepublish`. - ([@iarna](https://github.com/iarna)) - -* [`4468c92`](https://github.com/npm/npm/commit/4468c92) - [#9205](https://github.com/npm/npm/issues/9205) - Fix a bug where local modules would sometimes not resolve relative - links using the correct base path. - ([@iarna](https://github.com/iarna)) - -* [`d395a6b`](https://github.com/npm/npm/commit/d395a6b) - [#8995](https://github.com/npm/npm/issues/8995) - Certain combinations of packages could result in different install orders for their - initial installation than for reinstalls run on the same folder. - ([@iarna](https://github.com/iarna)) - -* [`d119ea6`](https://github.com/npm/npm/commit/d119ea6) - [#9113](https://github.com/npm/npm/issues/9113) - Make extraneous packages _always_ up in `npm ls`. Previously, if an - extraneous package had a dependency that depended back on the original - package this would result in the package not showing up in `ls`. - ([@iarna](https://github.com/iarna)) - -* [`02420dc`](https://github.com/npm/npm/commit/02420dc) - [#9113](https://github.com/npm/npm/issues/9113) - Stop warning about missing top level package.json files. Errors in said - files will still be reported. - ([@iarna](https://github.com/iarna)) - -#### SOME DEP UPDATES - -* [`1ed1364`](https://github.com/npm/npm/commit/1ed1364) `rimraf@2.4.3` - ([@isaacs](https://github.com/isaacs)) Added EPERM to delay/retry loop -* [`e7b8315`](https://github.com/npm/npm/commit/e7b8315) `read@1.0.7` - Smaller distribution package, better metadata - ([@isaacs](https://github.com/isaacs)) - -#### SOME DEPS OF DEPS UPDATES - -* [`b273bcc`](https://github.com/npm/npm/commit/b273bcc) `mime-types@2.1.5` -* [`df6e225`](https://github.com/npm/npm/commit/df6e225) `mime-db@1.17.0` -* [`785f2ad`](https://github.com/npm/npm/commit/785f2ad) `is-my-json-valid@2.12.1` -* [`88170dd`](https://github.com/npm/npm/commit/88170dd) `form-data@1.0.0-rc3` -* [`af5357b`](https://github.com/npm/npm/commit/af5357b) `request@2.61.0` -* [`337f96a`](https://github.com/npm/npm/commit/337f96a) `chalk@1.1.1` -* [`3dfd74d`](https://github.com/npm/npm/commit/3dfd74d) `async@1.4.2` - -### v3.3.0 (2015-08-13): - -This is a pretty EXCITING week. But I may be a little excitable– or -possibly sleep deprived, it's sometimes hard to tell them apart. =D So -[Kat](https://github.com/zkat) really went the extra mile this week and got -the client side support for teams and orgs out in this week's 2.x release. -You can't use that just yet, 'cause we have to turn on some server side -stuff too, but this way it'll be there for you all the moment we do! Check -out the details over in the [2.14.0 release -notes](https://github.com/npm/npm/releases/tag/v2.14.0)! - -But we over here in 3.x ALSO got a new feature this week, check out the new -`--only` and `--also` flags for better control over when dev and production -dependencies are used by various npm commands. - -That, and some important bug fixes round out this week. Enjoy everyone! - -#### NEVER SHALL NOT BETA THE BETA - -**_THIS IS BETA SOFTWARE_**. EXCITING NEW BETA WARNING!!! Ok, I fibbed, -EXACTLY THE SAME BETA WARNINGS: `npm@3` will remain in beta until we're -confident that it's stable and have assessed the effect of the breaking -changes on the community. During that time we will still be doing `npm@2` -releases, with `npm@2` tagged as `latest` and `next`. We'll _also_ be -publishing new releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` -alongside those versions until we're ready to switch everyone over to -`npm@3`. We need your help to find and fix its remaining bugs. It's a -significant rewrite, so we are _sure_ there still significant bugs -remaining. So do us a solid and deploy it in non-critical CI environments -and for day-to-day use, but maybe don't use it for production maintenance or -frontline continuous deployment just yet. - -#### ONLY ALSO DEV - -Hey we've got a SUPER cool new feature for you all, thanks to the fantastic -work of [@davglass](https://github.com/davglass) and -[@bengl](https://github.com/bengl) we have `--only=prod`, -`--only=dev`, `--also=prod` and `--also=dev` options. These apply in -various ways to: `npm install`, `npm ls`, `npm outdated` and `npm update`. - -So for instance: - -``` -npm install --only=dev -``` - -Only installs dev dependencies. By contrast: - -``` -npm install --only=prod -``` - -Will only install prod dependencies and is very similar to `--production` -but differs in that it doesn't set the environment variables that -`--production` does. - -The related new flag, `--also` is most useful with things like: - -``` -npm shrinkwrap --also=dev -``` - -As shrinkwraps don't include dev deps by default. This replaces passing in -`--dev` in that scenario. - -And that leads into the fact that this deprecates `--dev` as its semantics -across commands were inconsistent and confusing. - -* [`3ab1eea`](https://github.com/npm/npm/commit/3ab1eea) - [#9024](https://github.com/npm/npm/pull/9024) - Add support for `--only`, `--also` and deprecate `--dev` - ([@bengl](https://github.com/bengl)) - -#### DON'T TOUCH! THAT'S NOT YOUR BIN - -* [`b31812e`](https://github.com/npm/npm/commit/b31812e) - [#8996](https://github.com/npm/npm/pull/8996) - When removing a module that has bin files, if one that we're going to - remove is a symlink to a DIFFERENT module, leave it alone. This only happens - when you have two modules that try to provide the same bin. - ([@iarna](https://github.com/iarna)) - -#### THERE'S AN END IN SIGHT - -* [`d2178a9`](https://github.com/npm/npm/commit/d2178a9) - [#9223](https://github.com/npm/npm/pull/9223) - Close a bunch of infinite loops that could show up with symlink cycles in your dependencies. - ([@iarna](https://github.com/iarna)) - -#### OOPS DIDN'T MEAN TO FIX THAT - -Well, not _just_ yet. This was scheduled for next week, but it snuck into -2.x this week. - -* [`139dd92`](https://github.com/npm/npm/commit/139dd92) - [#8716](https://github.com/npm/npm/pull/8716) - `npm init` will now only pick up the modules you install, not everything - else that got flattened with them. - ([@iarna](https://github.com/iarna)) - -### v3.2.2 (2015-08-08): - -Lot's of lovely bug fixes for `npm@3`. I'm also suuuuper excited that I -think we have a handle on stack explosions that effect a small portion of -our users. We also have some tantalizing clues as to where some low hanging -fruit may be for performance issues. - -And of course, in addition to the `npm@3` specific bug fixes, there are some -great one's coming in from `npm@2`! [@othiym23](https://github.com/othiym23) -put together that release this week– check out its -[release notes](https://github.com/npm/npm/releases/tag/v2.13.4) for the deets. - -#### AS ALWAYS STILL BETA - -**_THIS IS BETA SOFTWARE_**. Just like the airline safety announcements, -we're not taking this plane off till we finish telling you: `npm@3` will -remain in beta until we're confident that it's stable and have assessed the -effect of the breaking changes on the community. During that time we will -still be doing `npm@2` releases, with `npm@2` tagged as `latest` and `next`. -We'll _also_ be publishing new releases of `npm@3` as `npm@v3.x-next` and -`npm@v3.x-latest` alongside those versions until we're ready to switch -everyone over to `npm@3`. We need your help to find and fix its remaining -bugs. It's a significant rewrite, so we are _sure_ there still significant -bugs remaining. So do us a solid and deploy it in non-critical CI -environments and for day-to-day use, but maybe don't use it for production -maintenance or frontline continuous deployment just yet. - -#### BUG FIXES - -* [`a8c8a13`](https://github.com/npm/npm/commit/a8c8a13) - [#9050](https://github.com/npm/npm/issues/9050) - Resolve peer deps relative to the parent of the requirer - ([@iarna](http://github.com/iarna)) -* [`05f0226`](https://github.com/npm/npm/commit/05f0226) - [#9077](https://github.com/npm/npm/issues/9077) - Fix crash when saving `git+ssh` urls - ([@iarna](http://github.com/iarna)) -* [`e4a3808`](https://github.com/npm/npm/commit/e4a3808) - [#8951](https://github.com/npm/npm/issues/8951) - Extend our patch to allow `*` to match something when a package only has - prerelease versions to everything and not just the cache. - ([@iarna](http://github.com/iarna)) -* [`d135abf`](https://github.com/npm/npm/commit/d135abf) - [#8871](https://github.com/npm/npm/issues/8871) - Don't warn about a missing `package.json` or missing fields in the global - install directory. - ([@iarna](http://github.com/iarna)) - -#### DEP VERSION BUMPS - -* [`990ee4f`](https://github.com/npm/npm/commit/990ee4f) - `path-is-inside@1.0.1` ([@domenic](https://github.com/domenic)) -* [`1f71ec0`](https://github.com/npm/npm/commit/1f71ec0) - `lodash.clonedeep@3.0.2` ([@jdalton](https://github.com/jdalton)) -* [`a091354`](https://github.com/npm/npm/commit/a091354) - `marked@0.3.5` ([@chjj](https://github.com/chjj)) -* [`fc51f28`](https://github.com/npm/npm/commit/fc51f28) - `tap@1.3.2` ([@isaacs](https://github.com/isaacs)) -* [`3569ec0`](https://github.com/npm/npm/commit/3569ec0) - `nock@2.10.0` ([@pgte](https://github.com/pgte)) -* [`ad5f6fd`](https://github.com/npm/npm/commit/ad5f6fd) - `npm-registry-mock@1.0.1` ([@isaacs](https://github.com/isaacs)) - -### v3.2.1 (2015-07-31): - -#### AN EXTRA QUIET RELEASE - -A bunch of stuff got deferred for various reasons, which just means more -branches to land next week! - -Don't forget to check out [Kat's 2.x release](https://github.com/npm/npm/releases/tag/v2.13.4) for other quiet goodies. - -#### AS ALWAYS STILL BETA - -**_THIS IS BETA SOFTWARE_**. Yes, we're still reminding you of this. No, -you can't be excused. `npm@3` will remain in beta until we're confident -that it's stable and have assessed the effect of the breaking changes on the -community. During that time we will still be doing `npm@2` releases, with -`npm@2` tagged as `latest` and `next`. We'll _also_ be publishing new -releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` alongside those -versions until we're ready to switch everyone over to `npm@3`. We need your -help to find and fix its remaining bugs. It's a significant rewrite, so we -are _sure_ there still significant bugs remaining. So do us a solid and -deploy it in non-critical CI environments and for day-to-day use, but maybe -don't use it for production maintenance or frontline continuous deployment -just yet. - - -#### MAKING OUR TESTS TEST THE THING THEY TEST - -* [`6e53c3d`](https://github.com/npm/npm/commit/6e53c3d) - [#8985](https://github.com/npm/npm/pull/8985) - Many thanks to @bengl for noticing that one of our tests wasn't testing - what it claimed it was testing! ([@bengl](https://github.com/bengl)) - -#### MY PACKAGE.JSON WAS ALREADY IN THE RIGHT ORDER - -* [`eb2c7aa`](https://github.com/npm/npm/commit/d00d0f) - [#9068](https://github.com/npm/npm/pull/9079) - Stop sorting keys in the `package.json` that we haven't edited. Many - thanks to [@Qix-](https://github.com/Qix-) for bringing this up and - providing a first pass at a patch for this. - ([@iarna](https://github.com/iarna)) - -#### DEV DEP UPDATE - -* [`555f60c`](https://github.com/npm/npm/commit/555f60c) `marked@0.3.4` - -### v3.2.0 (2015-07-24): - -#### MORE CONFIG, BETTER WINDOWS AND A BUG FIX - -This is a smallish release with a new config option and some bug fixes. And -lots of module updates. - -#### BETA BETAS ON - -**_THIS IS BETA SOFTWARE_**. Yes, we're still reminding you of this. No, -you can't be excused. `npm@3` will remain in beta until we're confident -that it's stable and have assessed the effect of the breaking changes on the -community. During that time we will still be doing `npm@2` releases, with -`npm@2` tagged as `latest` and `next`. We'll _also_ be publishing new -releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` alongside those -versions until we're ready to switch everyone over to `npm@3`. We need your -help to find and fix its remaining bugs. It's a significant rewrite, so we -are _sure_ there still significant bugs remaining. So do us a solid and -deploy it in non-critical CI environments and for day-to-day use, but maybe -don't use it for production maintenance or frontline continuous deployment -just yet. - - -#### NEW CONFIGS, LESS PROGRESS - -* [`423d8f7`](https://github.com/npm/npm/commit/423d8f7) - [#8704](https://github.com/npm/npm/issues/8704) - Add the ability to disable the new progress bar with `--no-progress` - ([@iarna](https://github.com/iarna)) - -#### AND BUG FIXES - -* [`b3ee452`](https://github.com/npm/npm/commit/b3ee452) - [#9038](https://github.com/npm/npm/pull/9038) - We previously disabled the use of the new `fs.access` API on Windows, but - the bug we were seeing is fixed in `io.js@1.5.0` so we now use `fs.access` - if you're using that version or greater. - ([@iarna](https://github.com/iarna)) - -* [`b181fa3`](https://github.com/npm/npm/commit/b181fa3) - [#8921](https://github.com/npm/npm/issues/8921) - [#8637](https://github.com/npm/npm/issues/8637) - Rejigger how we validate modules for install. This allow is to fix - a problem where arch/os checking wasn't being done at all. - It also made it easy to add back in a check that declines to - install a module in itself unless you force it. - ([@iarna](https://github.com/iarna)) - -#### AND A WHOLE BUNCH OF SUBDEP VERSIONS - -These are all development dependencies and semver-compatible subdep -upgrades, so they should not have visible impact on users. - -* [`6b3f6d9`](https://github.com/npm/npm/commit/6b3f6d9) `standard@4.3.3` -* [`f4e22e5`](https://github.com/npm/npm/commit/f4e22e5) `readable-stream@2.0.2` (inside concat-stream) -* [`f130bfc`](https://github.com/npm/npm/commit/f130bfc) `minimatch@2.0.10` (inside node-gyp's copy of glob) -* [`36c6a0d`](https://github.com/npm/npm/commit/36c6a0d) `caseless@0.11.0` -* [`80df59c`](https://github.com/npm/npm/commit/80df59c) `chalk@1.1.0` -* [`ea935d9`](https://github.com/npm/npm/commit/ea935d9) `bluebird@2.9.34` -* [`3588a0c`](https://github.com/npm/npm/commit/3588a0c) `extend@3.0.0` -* [`c6a8450`](https://github.com/npm/npm/commit/c6a8450) `form-data@1.0.0-rc2` -* [`a04925b`](https://github.com/npm/npm/commit/a04925b) `har-validator@1.8.0` -* [`ee7c095`](https://github.com/npm/npm/commit/ee7c095) `has-ansi@2.0.0` -* [`944fc34`](https://github.com/npm/npm/commit/944fc34) `hawk@3.1.0` -* [`783dc7b`](https://github.com/npm/npm/commit/783dc7b) `lodash._basecallback@3.3.1` -* [`acef0fe`](https://github.com/npm/npm/commit/acef0fe) `lodash._baseclone@3.3.0` -* [`dfe959a`](https://github.com/npm/npm/commit/dfe959a) `lodash._basedifference@3.0.3` -* [`a03bc76`](https://github.com/npm/npm/commit/a03bc76) `lodash._baseflatten@3.1.4` -* [`8a07d50`](https://github.com/npm/npm/commit/8a07d50) `lodash._basetostring@3.0.1` -* [`7785e3f`](https://github.com/npm/npm/commit/7785e3f) `lodash._baseuniq@3.0.3` -* [`826fb35`](https://github.com/npm/npm/commit/826fb35) `lodash._createcache@3.1.2` -* [`76030b3`](https://github.com/npm/npm/commit/76030b3) `lodash._createpadding@3.6.1` -* [`1a49ec6`](https://github.com/npm/npm/commit/1a49ec6) `lodash._getnative@3.9.1` -* [`eebe47f`](https://github.com/npm/npm/commit/eebe47f) `lodash.isarguments@3.0.4` -* [`09994d4`](https://github.com/npm/npm/commit/09994d4) `lodash.isarray@3.0.4` -* [`b6f8dbf`](https://github.com/npm/npm/commit/b6f8dbf) `lodash.keys@3.1.2` -* [`c67dd6b`](https://github.com/npm/npm/commit/c67dd6b) `lodash.pad@3.1.1` -* [`4add042`](https://github.com/npm/npm/commit/4add042) `lodash.repeat@3.0.1` -* [`e04993c`](https://github.com/npm/npm/commit/e04993c) `lru-cache@2.6.5` -* [`2ed7da4`](https://github.com/npm/npm/commit/2ed7da4) `mime-db@1.15.0` -* [`ae08244`](https://github.com/npm/npm/commit/ae08244) `mime-types@2.1.3` -* [`e71410e`](https://github.com/npm/npm/commit/e71410e) `os-homedir@1.0.1` -* [`67c13e0`](https://github.com/npm/npm/commit/67c13e0) `process-nextick-args@1.0.2` -* [`12ee041`](https://github.com/npm/npm/commit/12ee041) `qs@4.0.0` -* [`15564a6`](https://github.com/npm/npm/commit/15564a6) `spdx-license-ids@1.0.2` -* [`8733bff`](https://github.com/npm/npm/commit/8733bff) `supports-color@2.0.0` -* [`230943c`](https://github.com/npm/npm/commit/230943c) `tunnel-agent@0.4.1` -* [`26a4653`](https://github.com/npm/npm/commit/26a4653) `ansi-styles@2.1.0` -* [`3d27081`](https://github.com/npm/npm/commit/3d27081) `bl@1.0.0` -* [`9efa110`](https://github.com/npm/npm/commit/9efa110) `async@1.4.0` - -#### MERGED FORWARD - -* As usual, we've ported all the `npm@2` goodies in this week's - [v2.13.3](https://github.com/npm/npm/releases/tag/v2.13.3) - release. - -### v3.1.3 (2015-07-17): - -Rebecca: So Kat, I hear this week's other release uses a dialog between us to -explain what changed? - -Kat: Well, you could say that… - -Rebecca: I would! This week I fixed more `npm@3` bugs! - -Kat: That sounds familiar. - -Rebecca: Eheheheh, well, before we look at those, a word from our sponsor… - -#### BETA IS AS BETA DOES - -**_THIS IS BETA SOFTWARE_**. Yes, we're still reminding you of this. No, -you can't be excused. `npm@3` will remain in beta until we're confident -that it's stable and have assessed the effect of the breaking changes on the -community. During that time we will still be doing `npm@2` releases, with -`npm@2` tagged as `latest` and `next`. We'll _also_ be publishing new -releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` alongside those -versions until we're ready to switch everyone over to `npm@3`. We need your -help to find and fix its remaining bugs. It's a significant rewrite, so we -are _sure_ there still significant bugs remaining. So do us a solid and -deploy it in non-critical CI environments and for day-to-day use, but maybe -don't use it for production maintenance or frontline continuous deployment -just yet. - -Rebecca: Ok, enough of the dialoguing, that's Kat's schtick. But do remember -kids, betas hide in dark hallways waiting to break your stuff, stuff like… - -#### SO MANY LINKS YOU COULD MAKE A CHAIN - -* [`6d69ec9`](https://github.com/npm/npm/6d69ec9) - [#8967](https://github.com/npm/npm/issues/8967) - Removing a module linked into your globals would result in having - all of its subdeps removed. Since the npm release process does - exactly this, it burned me -every- -single- -week-. =D - While we're here, we also removed extraneous warns that used to - spill out when you'd remove a symlink. - ([@iarna](https://github.com/iarna)) - -* [`fdb360f`](https://github.com/npm/npm/fdb360f) - [#8874](https://github.com/npm/npm/issues/8874) - Linking scoped modules was failing outright, but this fixes that - and updates our tests so we don't do it again. - ([@iarna](https://github.com/iarna)) - -#### WE'LL TRY NOT TO CRACK YOUR WINDOWS - -* [`9fafb18`](https://github.com/npm/npm/9fafb18) - [#8701](https://github.com/npm/npm/issues/8701) - `npm@3` introduced permissions checks that run before it actually tries to - do something. This saves you from having an install fail half way - through. We did this using the shiny new `fs.access` function available - in `node 0.12` and `io.js`, with fallback options for older nodes. Unfortunately - the way we implemented the fallback caused racey problems for Windows systems. - This fixes that by ensuring we only ever run any one check on a directory once. - BUT it turns out there are bugs in `fs.access` on Windows. So this ALSO just disables - the use of `fs.access` on Windows entirely until that settles out. - ([@iarna](https://github.com/iarna)) - -#### ZOOM ZOOM, DEP UPDATES - -* [`5656baa`](https://github.com/npm/npm/5656baa) - `gauge@1.2.2`: Better handle terminal resizes while printing the progress bar - ([@iarna](https://github.com/iarna)) - -#### MERGED FORWARD - -* Check out Kat's [super-fresh release notes for v2.13.2](https://github.com/npm/npm/releases/tag/v2.13.2) - and see all the changes we ported from `npm@2`. - -### v3.1.2 - -#### SO VERY BETA RELEASE - -So, `v3.1.1` managed to actually break installing local modules. And then -immediately after I drove to an island for the weekend. 😁 So let's get -this fixed outside the usual release train! - -Fortunately it didn't break installing _global_ modules and so you could -swap it out for another version at least. - -#### DISCLAIMER MEANS WHAT IT SAYS - -**_THIS IS BETA SOFTWARE_**. Yes, we're still reminding you of this. No, -you can't be excused. `npm@3` will remain in beta until we're confident -that it's stable and have assessed the effect of the breaking changes on the -community. During that time we will still be doing `npm@2` releases, with -`npm@2` tagged as `latest` and `next`. We'll _also_ be publishing new -releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` alongside those -versions until we're ready to switch everyone over to `npm@3`. We need your -help to find and fix its remaining bugs. It's a significant rewrite, so we -are _sure_ there still significant bugs remaining. So do us a solid and -deploy it in non-critical CI environments and for day-to-day use, but maybe -don't use it for production maintenance or frontline continuous deployment -just yet. - -#### THIS IS IT, THE REASON - -* [`f5e19df`](https://github.com/npm/npm/commit/f5e19df) - [#8893](https://github.com/npm/npm/issues/8893) - Fix crash when installing local modules introduced by the fix for - [#8608](https://github.com/npm/npm/issues/8608) - ([@iarna](https://github.com/iarna) - -### v3.1.1 - -#### RED EYE RELEASE - -Rebecca's up too late writing tests, so you can have `npm@3` bug fixes! Lots -of great new issues from you all! ❤️️ Keep it up! - -#### YUP STILL BETA, PLEASE PAY ATTENTION - -**_THIS IS BETA SOFTWARE_**. Yes, we're still reminding you of this. No, -you can't be excused. `npm@3` will remain in beta until we're confident -that it's stable and have assessed the effect of the breaking changes on the -community. During that time we will still be doing `npm@2` releases, with -`npm@2` tagged as `latest` and `next`. We'll _also_ be publishing new -releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` alongside those -versions until we're ready to switch everyone over to `npm@3`. We need your -help to find and fix its remaining bugs. It's a significant rewrite, so we -are _sure_ there still significant bugs remaining. So do us a solid and -deploy it in non-critical CI environments and for day-to-day use, but maybe -don't use it for production maintenance or frontline continuous deployment -just yet. - -#### BOOGS - -* [`9badfd6`](https://github.com/npm/npm/commit/9babfd63f19f2d80b2d2624e0963b0bdb0d76ef4) - [#8608](https://github.com/npm/npm/issues/8608) - Make global installs and uninstalls MUCH faster by only reading the directories of - modules referred to by arguments. - ([@iarna](https://github.com/iarna) -* [`075a5f0`](https://github.com/npm/npm/commit/075a5f046ab6837f489b08d44cb601e9fdb369b7) - [#8660](https://github.com/npm/npm/issues/8660) - Failed optional deps would still result in the optional deps own - dependencies being installed. We now find them and fail them out of the - tree. - ([@iarna](https://github.com/iarna) -* [`c9fbbb5`](https://github.com/npm/npm/commit/c9fbbb540083396ea58fd179d81131d959d8e049) - [#8863](https://github.com/npm/npm/issues/8863) - The "no compatible version found" error message was including only the - version requested, not the name of the package we wanted. Ooops! - ([@iarna](https://github.com/iarna) -* [`32e6bbd`](https://github.com/npm/npm/commit/32e6bbd21744dcbe8c0720ab53f60caa7f2a0588) - [#8806](https://github.com/npm/npm/issues/8806) - The "uninstall" lifecycle was being run after all of a module's dependencies has been - removed. This reverses that order-- this means "uninstall" lifecycles can make use - of the package's dependencies. - ([@iarna](https://github.com/iarna) - -#### MERGED FORWARD - -* Check out the [v2.13.1 release notes](https://github.com/npm/npm/releases/tag/v2.13.1) - and see all the changes we ported from `npm@2`. - -### v3.1.0 (2015-07-02): - -This has been a brief week of bug fixes, plus some fun stuff merged forward -from this weeks 2.x release. See the -[2.13.0 release notes](https://github.com/npm/npm/releases/tag/v2.13.0) -for details on that. - -You all have been AWESOME with -[all](https://github.com/npm/npm/milestones/3.x) -[the](https://github.com/npm/npm/milestones/3.2.0) -`npm@3` bug reports! Thank you and keep up the great work! - -#### NEW PLACE, SAME CODE - -Remember how last week we said `npm@3` would go to `3.0-next` and latest -tags? Yeaaah, no, please use `npm@v3.x-next` and `npm@v3.x-latest` going forward. - -I dunno why we said "suuure, we'll never do a feature release till we're out -of beta" when we're still forward porting `npm@2.x` features. `¯\_(ツ)_/¯` - -If you do accidentally use the old tag names, I'll be maintaining them -for a few releases, but they won't be around forever. - -#### YUP STILL BETA, PLEASE PAY ATTENTION - -**_THIS IS BETA SOFTWARE_**. `npm@3` will remain in beta until we're -confident that it's stable and have assessed the effect of the breaking -changes on the community. During that time we will still be doing `npm@2` -releases, with `npm@2` tagged as `latest` and `next`. We'll _also_ be -publishing new releases of `npm@3` as `npm@v3.x-next` and `npm@v3.x-latest` -alongside those versions until we're ready to switch everyone over to -`npm@3`. We need your help to find and fix its remaining bugs. It's a -significant rewrite, so we are _sure_ there still significant bugs -remaining. So do us a solid and deploy it in non-critical CI environments -and for day-to-day use, but maybe don't use it for production maintenance -or frontline continuous deployment just yet. - -#### BUGS ON THE WINDOWS - - * [`0030ade`](https://github.com/npm/npm/commit/0030ade) - [#8685](https://github.com/npm/npm/issues/8685) - Windows would hang when trying to clone git repos - ([@euprogramador](https://github.com/npm/npm/pull/8777)) - * [`b259bcc`](https://github.com/npm/npm/commit/b259bcc) - [#8786](https://github.com/npm/npm/pull/8786) - Windows permissions checks would cause installations to fail under some - circumstances. We're disabling the checks entirely for this release. - I'm hoping to check back with this next week to get a Windows friendly - fix in. - ([@iarna](https://github.com/iarna)) - -#### SO MANY BUGS SQUASHED, JUST CALL US RAID - - * [`0848698`](https://github.com/npm/npm/commit/0848698) - [#8686](https://github.com/npm/npm/pull/8686) - Stop leaving progress bar cruft on the screen during publication - ([@ajcrites](https://github.com/ajcrites)) - * [`57c3cea`](https://github.com/npm/npm/commit/57c3cea) - [#8695](https://github.com/npm/npm/pull/8695) - Remote packages with shrinkwraps made npm cause node + iojs to explode - and catch fire. NO MORE. - ([@iarna](https://github.com/iarna)) - * [`2875ba3`](https://github.com/npm/npm/commit/2875ba3) - [#8723](https://github.com/npm/npm/pull/8723) - I uh, told you that engineStrict checking had gone away last week. - TURNS OUT I LIED. So this is making that actually be true. - ([@iarna](https://github.com/iarna)) - * [`28064e5`](https://github.com/npm/npm/commit/28064e5) - [#3358](https://github.com/npm/npm/issues/3358) - Consistently allow Unicode BOMs at the start of package.json files. - Previously this was allowed some of time, like when you were installing - modules, but not others, like running npm version or installing w/ - `--save`. - ([@iarna](https://github.com/iarna)) - * [`3cb6ad2`](https://github.com/npm/npm/commit/3cb6ad2) - [#8736](https://github.com/npm/npm/issues/8766) - `npm@3` wasn't running the "install" lifecycle in your current (toplevel) - module. This broke modules that relied on C compilation. BOO. - ([@iarna](https://github.com/iarna)) - * [`68da583`](https://github.com/npm/npm/commit/68da583) - [#8766](https://github.com/npm/npm/issues/8766) - To my great shame, `npm link package` wasn't working AT ALL if you - didn't have `package` already installed. - ([@iarna](https://github.com/iarna)) - * [`edd7448`](https://github.com/npm/npm/commit/edd7448) - `read-package-tree@5.0.0`: This update makes read-package-tree not explode - when there's bad data in your node_modules folder. `npm@2` silently - ignores this sort of thing. - ([@iarna](https://github.com/iarna)) - * [`0bb08c8`](https://github.com/npm/npm/commit/0bb08c8) - [#8778](https://github.com/npm/npm/pull/8778) - RELATEDLY, we now show any errors from your node_modules folder after - your installation completes as warnings. We're also reporting these in - `npm ls` now. - ([@iarna](https://github.com/iarna)) - * [`6c248ff`](https://github.com/npm/npm/commit/6c248ff) - [#8779](https://github.com/npm/npm/pull/8779) - Hey, you know how we used to complain if your `package.json` was - missing stuff? Well guess what, we are again. I know, I know, you can - thank me later. - ([@iarna](https://github.com/iarna)) - * [`d6f7c98`](https://github.com/npm/npm/commit/d6f7c98) - So, when we were rolling back after errors we had untested code that - tried to undo moves. Being untested it turns out it was very broken. - I've removed it until we have time to do this right. - ([@iarna](https://github.com/iarna)) - -#### NEW VERSION - -Just the one. Others came in via the 2.x release. Do check out its -changelog, immediately following this message. - - * [`4e602c5`](https://github.com/npm/npm/commit/4e602c5) `lodash@3.2.2` - -### v3.0.0 (2015-06-25): - -Wow, it's finally here! This has been a long time coming. We are all -delighted and proud to be getting this out into the world, and are looking -forward to working with the npm user community to get it production-ready -as quickly as possible. - -`npm@3` constitutes a nearly complete rewrite of npm's installer to be -easier to maintain, and to bring a bunch of valuable new features and -design improvements to you all. - -[@othiym23](https://github.com/othiym23) and -[@isaacs](https://github.com/isaacs) have been -[talking about the changes](http://blog.npmjs.org/post/91303926460/npm-cli-roadmap-a-periodic-update) -in this release for well over a year, and it's been the primary focus of -[@iarna](https://github.com/iarna) since she joined the team. - -Given that this is a near-total rewrite, all changes listed here are -[@iarna](https://github.com/iarna)'s work unless otherwise specified. - -#### NO, REALLY, READ THIS PARAGRAPH. IT'S THE IMPORTANT ONE. - -**_THIS IS BETA SOFTWARE_**. `npm@3` will remain in beta until we're -confident that it's stable and have assessed the effect of the breaking -changes on the community. During that time we will still be doing `npm@2` -releases, with `npm@2` tagged as `latest` and `next`. We'll _also_ be -publishing new releases of `npm@3` as `npm@3.0-next` and `npm@3.0-latest` -alongside those versions until we're ready to switch everyone over to -`npm@3`. We need your help to find and fix its remaining bugs. It's a -significant rewrite, so we are _sure_ there still significant bugs -remaining. So do us a solid and deploy it in non-critical CI environments -and for day-to-day use, but maybe don't use it for production maintenance -or frontline continuous deployment just yet. - -#### BREAKING CHANGES - -##### `peerDependencies` - -`grunt`, `gulp`, and `broccoli` plugin maintainers take note! You will be -affected by this change! - -* [#6930](https://github.com/npm/npm/issues/6930) - ([#6565](https://github.com/npm/npm/issues/6565)) - `peerDependencies` no longer cause _anything_ to be implicitly installed. - Instead, npm will now warn if a packages `peerDependencies` are missing, - but it's up to the consumer of the module (i.e. you) to ensure the peers - get installed / are included in `package.json` as direct `dependencies` - or `devDependencies` of your package. -* [#3803](https://github.com/npm/npm/issues/3803) - npm also no longer checks `peerDependencies` until after it has fully - resolved the tree. - -This shifts the responsibility for fulfilling peer dependencies from library -/ framework / plugin maintainers to application authors, and is intended to -get users out of the dependency hell caused by conflicting `peerDependency` -constraints. npm's job is to keep you _out_ of dependency hell, not put you -in it. - -##### `engineStrict` - -* [#6931](https://github.com/npm/npm/issues/6931) The rarely-used - `package.json` option `engineStrict` has been deprecated for several - months, producing warnings when it was used. Starting with `npm@3`, the - value of the field is ignored, and engine violations will only produce - warnings. If you, as a user, want strict `engines` field enforcement, - just run `npm config set engine-strict true`. - -As with the peer dependencies change, this is about shifting control from -module authors to application authors. It turns out `engineStrict` was very -difficult to understand even harder to use correctly, and more often than -not just made modules using it difficult to deploy. - -##### `npm view` - -* [`77f1aec`](https://github.com/npm/npm/commit/77f1aec) With `npm view` (aka - `npm info`), always return arrays for versions, maintainers, etc. Previously - npm would return a plain value if there was only one, and multiple values if - there were more. ([@KenanY](https://github.com/KenanY)) - -#### KNOWN BUGS - -Again, this is a _**BETA RELEASE**_, so not everything is working just yet. -Here are the issues that we already know about. If you run into something -that isn't on this list, -[let us know](https://github.com/npm/npm/issues/new)! - -* [#8575](https://github.com/npm/npm/issues/8575) - Circular deps will never be removed by the prune-on-uninstall code. -* [#8588](https://github.com/npm/npm/issues/8588) - Local deps where the dep name and the name in the package.json differ - don't result in an error. -* [#8637](https://github.com/npm/npm/issues/8637) - Modules can install themselves as direct dependencies. `npm@2` declined to - do this. -* [#8660](https://github.com/npm/npm/issues/8660) - Dependencies of failed optional dependencies aren't rolled back when the - optional dependency is, and then are reported as extraneous thereafter. - -#### NEW FEATURES - -##### The multi-stage installer! - -* [#5919](https://github.com/npm/npm/issues/5919) - Previously the installer had a set of steps it executed for each package - and it would immediately start executing them as soon as it decided to - act on a package. - - But now it executes each of those steps at the same time for all - packages, waiting for all of one stage to complete before moving on. This - eliminates many race conditions and makes the code easier to reason - about. - -This fixes, for instance: - -* [#6926](https://github.com/npm/npm/issues/6926) - ([#5001](https://github.com/npm/npm/issues/5001), - [#6170](https://github.com/npm/npm/issues/6170)) - `install` and `postinstall` lifecycle scripts now only execute `after` - all the module with the script's dependencies are installed. - -##### Install: it looks different! - -You'll now get a tree much like the one produced by `npm ls` that -highlights in orange the packages that were installed. Similarly, any -removed packages will have their names prefixed by a `-`. - -Also, `npm outdated` used to include the name of the module in the -`Location` field: - -``` -Package Current Wanted Latest Location -deep-equal MISSING 1.0.0 1.0.0 deep-equal -glob 4.5.3 4.5.3 5.0.10 rimraf > glob -``` - -Now it shows the module that required it as the final point in the -`Location` field: - -``` -Package Current Wanted Latest Location -deep-equal MISSING 1.0.0 1.0.0 npm -glob 4.5.3 4.5.3 5.0.10 npm > rimraf -``` - -Previously the `Location` field was telling you where the module was on -disk. Now it tells you what requires the module. When more than one thing -requires the module you'll see it listed once for each thing requiring it. - -##### Install: it works different! - -* [#6928](https://github.com/npm/npm/issues/6928) - ([#2931](https://github.com/npm/npm/issues/2931) - [#2950](https://github.com/npm/npm/issues/2950)) - `npm install` when you have an `npm-shrinkwrap.json` will ensure you have - the modules specified in it are installed in exactly the shape specified - no matter what you had when you started. -* [#6913](https://github.com/npm/npm/issues/6913) - ([#1341](https://github.com/npm/npm/issues/1341) - [#3124](https://github.com/npm/npm/issues/3124) - [#4956](https://github.com/npm/npm/issues/4956) - [#6349](https://github.com/npm/npm/issues/6349) - [#5465](https://github.com/npm/npm/issues/5465)) - `npm install` when some of your dependencies are missing sub-dependencies - will result in those sub-dependencies being installed. That is, `npm - install` now knows how to fix broken installs, most of the time. -* [#5465](https://github.com/npm/npm/issues/5465) - If you directly `npm install` a module that's already a subdep of - something else and your new version is incompatible, it will now install - the previous version nested in the things that need it. -* [`a2b50cf`](https://github.com/npm/npm/commit/a2b50cf) - [#5693](https://github.com/npm/npm/issues/5693) - When installing a new module, if it's mentioned in your - `npm-shrinkwrap.json` or your `package.json` use the version specifier - from there if you didn't specify one yourself. - -##### Flat, flat, flat! - -Your dependencies will now be installed *maximally flat*. Insofar as is -possible, all of your dependencies, and their dependencies, and THEIR -dependencies will be installed in your project's `node_modules` folder with no -nesting. You'll only see modules nested underneath one another when two (or -more) modules have conflicting dependencies. - -* [#3697](https://github.com/npm/npm/issues/3697) - This will hopefully eliminate most cases where Windows users ended up - with paths that were too long for Explorer and other standard tools to - deal with. -* [#6912](https://github.com/npm/npm/issues/6912) - ([#4761](https://github.com/npm/npm/issues/4761) - [#4037](https://github.com/npm/npm/issues/4037)) - This also means that your installs will be deduped from the start. -* [#5827](https://github.com/npm/npm/issues/5827) - This deduping even extends to git deps. -* [#6936](https://github.com/npm/npm/issues/6936) - ([#5698](https://github.com/npm/npm/issues/5698)) - Various commands are dedupe aware now. - -This has some implications for the behavior of other commands: - -* `npm uninstall` removes any dependencies of the module that you specified - that aren't required by any other module. Previously, it would only - remove those that happened to be installed under it, resulting in left - over cruft if you'd ever deduped. -* `npm ls` now shows you your dependency tree organized around what - requires what, rather than where those modules are on disk. -* [#6937](https://github.com/npm/npm/issues/6937) - `npm dedupe` now flattens the tree in addition to deduping. - -And bundling of dependencies when packing or publishing changes too: - -* [#2442](https://github.com/npm/npm/issues/2442) - bundledDependencies no longer requires that you specify deduped sub deps. - npm can now see that a dependency is required by something bundled and - automatically include it. To put that another way, bundledDependencies - should ONLY include things that you included in dependencies, - optionalDependencies or devDependencies. -* [#5437](https://github.com/npm/npm/issues/5437) - When bundling a dependency that's both a `devDependency` and the child of - a regular `dependency`, npm bundles the child dependency. - -As a demonstration of our confidence in our own work, npm's own -dependencies are now flattened, deduped, and bundled in the `npm@3` style. -This means that `npm@3` can't be packed or published by `npm@2`, which is -something to be aware of if you're hacking on npm. - -##### Shrinkwraps: they are a-changin'! - -First of all, they should be idempotent now -([#5779](https://github.com/npm/npm/issues/5779)). No more differences -because the first time you install (without `npm-shrinkwrap.json`) and the -second time (with `npm-shrinkwrap.json`). - -* [#6781](https://github.com/npm/npm/issues/6781) - Second, if you save your changes to `package.json` and you have - `npm-shrinkwrap.json`, then it will be updated as well. This applies to - all of the commands that update your tree: - * `npm install --save` - * `npm update --save` - * `npm dedupe --save` ([#6410](https://github.com/npm/npm/issues/6410)) - * `npm uninstall --save` -* [#4944](https://github.com/npm/npm/issues/4944) - ([#5161](https://github.com/npm/npm/issues/5161) - [#5448](https://github.com/npm/npm/issues/5448)) - Third, because `node_modules` folders are now deduped and flat, - shrinkwrap has to also be smart enough to handle this. - -And finally, enjoy this shrinkwrap bug fix: - -* [#3675](https://github.com/npm/npm/issues/3675) - When shrinkwrapping a dependency that's both a `devDependency` and the - child of a regular `dependency`, npm now correctly includes the child. - -##### The Age of Progress (Bars)! - -* [#6911](https://github.com/npm/npm/issues/6911) - ([#1257](https://github.com/npm/npm/issues/1257) - [#5340](https://github.com/npm/npm/issues/5340) - [#6420](https://github.com/npm/npm/issues/6420)) - The spinner is gone (yay? boo? will you miss it?), and in its place npm - has _progress bars_, so you actually have some sense of how long installs - will take. It's provided in Unicode and non-Unicode variants, and Unicode - support is automatically detected from your environment. - -#### TINY JEWELS - -The bottom is where we usually hide the less interesting bits of each -release, but each of these are small but incredibly useful bits of this -release, and very much worth checking out: - -* [`9ebe312`](https://github.com/npm/npm/commit/9ebe312) - Build system maintainers, rejoice: npm does a better job of cleaning up - after itself in your temporary folder. -* [#6942](https://github.com/npm/npm/issues/6942) - Check for permissions issues prior to actually trying to install - anything. -* Emit warnings at the end of the installation when possible, so that - they'll be on your screen when npm stops. -* [#3505](https://github.com/npm/npm/issues/3505) - `npm --dry-run`: You can now ask that npm only report what it _would have - done_ with the new `--dry-run` flag. This can be passed to any of the - commands that change your `node_modules` folder: `install`, `uninstall`, - `update` and `dedupe`. -* [`81b46fb`](https://github.com/npm/npm/commit/81b46fb) - npm now knows the correct URLs for `npm bugs` and `npm repo` for - repositories hosted on Bitbucket and GitLab, just like it does for GitHub - (and GitHub support now extends to projects hosted as gists as well as - traditional repositories). -* [`5be4008a`](https://github.com/npm/npm/commit/5be4008a09730cfa3891d9f145e4ec7f2accd144) - npm has been cleaned up to pass the [`standard`](http://npm.im/standard) - style checker. Forrest and Rebecca both feel this makes it easier to read - and understand the code, and should also make it easier for new - contributors to put merge-ready patches. - ([@othiym23](https://github.com/othiym23)) - -#### ZARRO BOOGS - -* [`6401643`](https://github.com/npm/npm/commit/6401643) - Make sure the global install directory exists before installing to it. - ([@thefourtheye](https://github.com/thefourtheye)) -* [#6158](https://github.com/npm/npm/issues/6158) - When we remove modules we do so inside-out running unbuild for each one. -* [`960a765`](https://github.com/npm/npm/commit/960a765) - The short usage information for each subcommand has been brought in sync - with the documentation. ([@smikes](https://github.com/smikes)) |