Revert "deps: upgrade npm to 5.8.0"

This reverts commit 25a816dcda7b1db0929501acfe13f2fe5119759b.

PR-URL: https://github.com/nodejs/node/pull/19837
Reviewed-By: Gus Caplan <me@gus.host>

29 files changed, 167 insertions, 461 deletions

diff --git a/deps/npm/lib/auth/legacy.js b/deps/npm/lib/auth/legacy.js
index 08de61bff0..92bf44c119 100644
--- a/deps/npm/lib/auth/legacy.js
+++ b/deps/npm/lib/auth/legacy.js
@@ -6,74 +6,52 @@ const npm = require('../npm.js')
 const output = require('../utils/output.js')
 const pacoteOpts = require('../config/pacote')
 const fetchOpts = require('../config/fetch-opts')
-const opener = require('opener')
 
-const openerPromise = (url) => new Promise((resolve, reject) => {
-  opener(url, { command: npm.config.get('browser') }, (er) => er ? reject(er) : resolve())
-})
+module.exports.login = function login (creds, registry, scope, cb) {
+  let username = creds.username || ''
+  let password = creds.password || ''
+  let email = creds.email || ''
+  const auth = {}
+  if (npm.config.get('otp')) auth.otp = npm.config.get('otp')
 
-const loginPrompter = (creds) => {
-  const opts = { log: log }
-  return read.username('Username:', creds.username, opts).then((u) => {
-    creds.username = u
-    return read.password('Password:', creds.password)
+  return read.username('Username:', username, {log: log}).then((u) => {
+    username = u
+    return read.password('Password: ', password)
   }).then((p) => {
-    creds.password = p
-    return read.email('Email: (this IS public) ', creds.email, opts)
+    password = p
+    return read.email('Email: (this IS public) ', email, {log: log})
   }).then((e) => {
-    creds.email = e
-    return creds
-  })
-}
-
-module.exports.login = (creds, registry, scope, cb) => {
-  const conf = {
-    log: log,
-    creds: creds,
-    registry: registry,
-    auth: {
-      otp: npm.config.get('otp')
-    },
-    scope: scope,
-    opts: fetchOpts.fromPacote(pacoteOpts())
-  }
-  login(conf).then((newCreds) => cb(null, newCreds)).catch(cb)
-}
-
-function login (conf) {
-  return profile.login(openerPromise, loginPrompter, conf)
-  .catch((err) => {
-    if (err.code === 'EOTP') throw err
-    const u = conf.creds.username
-    const p = conf.creds.password
-    const e = conf.creds.email
-    if (!(u && p && e)) throw err
-    return profile.adduserCouch(u, e, p, conf)
-  })
-  .catch((err) => {
-    if (err.code !== 'EOTP') throw err
-    return read.otp('Authenticator provided OTP:').then((otp) => {
-      conf.auth.otp = otp
-      const u = conf.creds.username
-      const p = conf.creds.password
-      return profile.loginCouch(u, p, conf)
+    email = e
+    return profile.login(username, password, {registry: registry, auth: auth}).catch((err) => {
+      if (err.code === 'EOTP') throw err
+      return profile.adduser(username, email, password, {
+        registry: registry,
+        opts: fetchOpts.fromPacote(pacoteOpts())
+      })
+    }).catch((err) => {
+      if (err.code === 'EOTP' && !auth.otp) {
+        return read.otp('Authenticator provided OTP:').then((otp) => {
+          auth.otp = otp
+          return profile.login(username, password, {registry: registry, auth: auth})
+        })
+      } else {
+        throw err
+      }
     })
   }).then((result) => {
     const newCreds = {}
     if (result && result.token) {
       newCreds.token = result.token
     } else {
-      newCreds.username = conf.creds.username
-      newCreds.password = conf.creds.password
-      newCreds.email = conf.creds.email
+      newCreds.username = username
+      newCreds.password = password
+      newCreds.email = email
       newCreds.alwaysAuth = npm.config.get('always-auth')
     }
 
-    const usermsg = conf.creds.username ? ' user ' + conf.creds.username : ''
-    conf.log.info('login', 'Authorized' + usermsg)
-    const scopeMessage = conf.scope ? ' to scope ' + conf.scope : ''
-    const userout = conf.creds.username ? ' as ' + conf.creds.username : ''
-    output('Logged in%s%s on %s.', userout, scopeMessage, conf.registry)
-    return newCreds
-  })
+    log.info('adduser', 'Authorized user %s', username)
+    const scopeMessage = scope ? ' to scope ' + scope : ''
+    output('Logged in as %s%s on %s.', username, scopeMessage, registry)
+    cb(null, newCreds)
+  }).catch(cb)
 }
diff --git a/deps/npm/lib/ci.js b/deps/npm/lib/ci.js
deleted file mode 100644
index 6a3183d977..0000000000
--- a/deps/npm/lib/ci.js
+++ /dev/null
@@ -1,37 +0,0 @@
-'use strict'
-
-const Installer = require('libcipm')
-const lifecycleOpts = require('./config/lifecycle.js')
-const npm = require('./npm.js')
-const npmlog = require('npmlog')
-const pacoteOpts = require('./config/pacote.js')
-
-ci.usage = 'npm ci'
-
-ci.completion = (cb) => cb(null, [])
-
-Installer.CipmConfig.impl(npm.config, {
-  get: npm.config.get,
-  set: npm.config.set,
-  toLifecycle (moreOpts) {
-    return lifecycleOpts(moreOpts)
-  },
-  toPacote (moreOpts) {
-    return pacoteOpts(moreOpts)
-  }
-})
-
-module.exports = ci
-function ci (args, cb) {
-  return new Installer({
-    config: npm.config,
-    log: npmlog
-  })
-  .run()
-  .then(
-    (details) => console.error(`added ${details.pkgCount} packages in ${
-      details.runTime / 1000
-    }s`)
-  )
-  .then(() => cb(), cb)
-}
diff --git a/deps/npm/lib/config/cmd-list.js b/deps/npm/lib/config/cmd-list.js
index 1f618cdb9a..49c445a4f0 100644
--- a/deps/npm/lib/config/cmd-list.js
+++ b/deps/npm/lib/config/cmd-list.js
@@ -22,7 +22,6 @@ var affordances = {
   'la': 'ls',
   'll': 'ls',
   'verison': 'version',
-  'ic': 'ci',
   'isntall': 'install',
   'dist-tags': 'dist-tag',
   'apihelp': 'help',
@@ -47,7 +46,6 @@ var affordances = {
 
 // these are filenames in .
 var cmdList = [
-  'ci',
   'install',
   'install-test',
   'uninstall',
diff --git a/deps/npm/lib/config/core.js b/deps/npm/lib/config/core.js
index 54a74bb847..50cf4772e7 100644
--- a/deps/npm/lib/config/core.js
+++ b/deps/npm/lib/config/core.js
@@ -331,10 +331,7 @@ Conf.prototype.parse = function (content, file) {
 Conf.prototype.add = function (data, marker) {
   try {
     Object.keys(data).forEach(function (k) {
-      const newKey = envReplace(k)
-      const newField = parseField(data[k], newKey)
-      delete data[k]
-      data[newKey] = newField
+      data[k] = parseField(data[k], k)
     })
   } catch (e) {
     this.emit('error', e)
diff --git a/deps/npm/lib/config/defaults.js b/deps/npm/lib/config/defaults.js
index 865805eb27..c049f213fa 100644
--- a/deps/npm/lib/config/defaults.js
+++ b/deps/npm/lib/config/defaults.js
@@ -130,7 +130,7 @@ Object.defineProperty(exports, 'defaults', {get: function () {
 
     cidr: null,
 
-    color: process.env.NO_COLOR == null,
+    color: true,
     depth: Infinity,
     description: true,
     dev: false,
@@ -193,7 +193,6 @@ Object.defineProperty(exports, 'defaults', {get: function () {
     'progress': !process.env.TRAVIS && !process.env.CI,
     proxy: null,
     'https-proxy': null,
-    'no-proxy': null,
     'user-agent': 'npm/{npm-version} ' +
                     'node/{node-version} ' +
                     '{platform} ' +
@@ -313,7 +312,6 @@ exports.types = {
   'metrics-registry': [null, String],
   'node-options': [null, String],
   'node-version': [null, semver],
-  'no-proxy': [null, String, Array],
   offline: Boolean,
   'onload-script': [null, String],
   only: [null, 'dev', 'development', 'prod', 'production'],
diff --git a/deps/npm/lib/config/pacote.js b/deps/npm/lib/config/pacote.js
index 0793d3a6fc..ec43178c77 100644
--- a/deps/npm/lib/config/pacote.js
+++ b/deps/npm/lib/config/pacote.js
@@ -37,7 +37,6 @@ function pacoteOpts (moreOpts) {
     preferOnline: npm.config.get('prefer-online') || npm.config.get('cache-max') <= 0,
     projectScope: npm.projectScope,
     proxy: npm.config.get('https-proxy') || npm.config.get('proxy'),
-    noProxy: npm.config.get('no-proxy'),
     refer: npm.registry.refer,
     registry: npm.config.get('registry'),
     retry: {
diff --git a/deps/npm/lib/dedupe.js b/deps/npm/lib/dedupe.js
index c763499f6b..71e60619c4 100644
--- a/deps/npm/lib/dedupe.js
+++ b/deps/npm/lib/dedupe.js
@@ -142,7 +142,7 @@ function hoistChildren_ (tree, diff, seen, next) {
         [andComputeMetadata(tree)]
       ], done)
     }
-    var hoistTo = earliestInstallable(tree, tree.parent, child.package, log)
+    var hoistTo = earliestInstallable(tree, tree.parent, child.package)
     if (hoistTo) {
       move(child, hoistTo, diff)
       chain([
diff --git a/deps/npm/lib/install.js b/deps/npm/lib/install.js
index 7a7d75c908..42906f2394 100644
--- a/deps/npm/lib/install.js
+++ b/deps/npm/lib/install.js
@@ -220,8 +220,6 @@ function Installer (where, dryrun, args, opts) {
   this.noPackageJsonOk = !!args.length
   this.topLevelLifecycles = !args.length
 
-  this.autoPrune = npm.config.get('package-lock')
-
   const dev = npm.config.get('dev')
   const only = npm.config.get('only')
   const onlyProd = /^prod(uction)?$/.test(only)
@@ -438,8 +436,8 @@ Installer.prototype.pruneIdealTree = function (cb) {
   // if our lock file didn't have the requires field and there
   // are any fake children then forgo pruning until we have more info.
   if (!this.idealTree.hasRequiresFromLock && this.idealTree.children.some((n) => n.fakeChild)) return cb()
-  const toPrune = this.idealTree.children
-    .filter((child) => isExtraneous(child) && (this.autoPrune || child.removing))
+  var toPrune = this.idealTree.children
+    .filter(isExtraneous)
     .map((n) => ({name: moduleName(n)}))
   return removeExtraneous(toPrune, this.idealTree, cb)
 }
@@ -694,19 +692,27 @@ Installer.prototype.readLocalPackageData = function (cb) {
 Installer.prototype.cloneCurrentTreeToIdealTree = function (cb) {
   validate('F', arguments)
   log.silly('install', 'cloneCurrentTreeToIdealTree')
-
-  this.idealTree = copyTree(this.currentTree)
+  this.idealTree = copyTree(this.currentTree, (child) => {
+    // Filter out any children we didn't install ourselves. They need to be
+    // reinstalled in order for things to be correct.
+    return child.isTop || isLink(child) || (
+      child.package &&
+      child.package._resolved &&
+      (child.package._integrity || child.package._shasum)
+    )
+  })
   this.idealTree.warnings = []
   cb()
 }
 
+function isLink (child) {
+  return child.isLink || (child.parent && isLink(child.parent))
+}
+
 Installer.prototype.loadShrinkwrap = function (cb) {
   validate('F', arguments)
   log.silly('install', 'loadShrinkwrap')
-  readShrinkwrap.andInflate(this.idealTree, iferr(cb, () => {
-    computeMetadata(this.idealTree)
-    cb()
-  }))
+  readShrinkwrap.andInflate(this.idealTree, cb)
 }
 
 Installer.prototype.getInstalledModules = function () {
@@ -768,9 +774,6 @@ Installer.prototype.printInstalledForHuman = function (diffs, cb) {
   var added = 0
   var updated = 0
   var moved = 0
-  // Count the number of contributors to packages added, tracking
-  // contributors we've seen, so we can produce a running unique count.
-  var contributors = new Set()
   diffs.forEach(function (action) {
     var mutation = action[0]
     var pkg = action[1]
@@ -781,26 +784,6 @@ Installer.prototype.printInstalledForHuman = function (diffs, cb) {
       ++moved
     } else if (mutation === 'add') {
       ++added
-      // Count contributors to added packages. Start by combining `author`
-      // and `contributors` data into a single array of contributor-people
-      // for this package.
-      var people = []
-      var meta = pkg.package
-      if (meta.author) people.push(meta.author)
-      if (meta.contributors && Array.isArray(meta.contributors)) {
-        people = people.concat(meta.contributors)
-      }
-      // Make sure a normalized string for every person behind this
-      // package is in `contributors`.
-      people.forEach(function (person) {
-        // Ignore errors from malformed `author` and `contributors`.
-        try {
-          var normalized = normalizePerson(person)
-        } catch (error) {
-          return
-        }
-        if (!contributors.has(normalized)) contributors.add(normalized)
-      })
     } else if (mutation === 'update' || mutation === 'update-linked') {
       ++updated
     }
@@ -812,11 +795,7 @@ Installer.prototype.printInstalledForHuman = function (diffs, cb) {
     }).join('\n') + '\n'
   }
   var actions = []
-  if (added) {
-    var action = 'added ' + packages(added)
-    if (contributors.size) action += from(contributors.size)
-    actions.push(action)
-  }
+  if (added) actions.push('added ' + packages(added))
   if (removed) actions.push('removed ' + packages(removed))
   if (updated) actions.push('updated ' + packages(updated))
   if (moved) actions.push('moved ' + packages(moved))
@@ -836,23 +815,6 @@ Installer.prototype.printInstalledForHuman = function (diffs, cb) {
   function packages (num) {
     return num + ' package' + (num > 1 ? 's' : '')
   }
-
-  function from (num) {
-    return ' from ' + num + ' contributor' + (num > 1 ? 's' : '')
-  }
-
-  // Values of `author` and elements of `contributors` in `package.json`
-  // files can be e-mail style strings or Objects with `name`, `email,
-  // and `url` String properties.  Convert Objects to Strings so that
-  // we can efficiently keep a set of contributors we have already seen.
-  function normalizePerson (argument) {
-    if (typeof argument === 'string') return argument
-    var returned = ''
-    if (argument.name) returned += argument.name
-    if (argument.email) returned += ' <' + argument.email + '>'
-    if (argument.url) returned += ' (' + argument.email + ')'
-    return returned
-  }
 }
 
 Installer.prototype.printInstalledForJSON = function (diffs, cb) {
diff --git a/deps/npm/lib/install/action/extract-worker.js b/deps/npm/lib/install/action/extract-worker.js
index 2b082b4a57..24508c7804 100644
--- a/deps/npm/lib/install/action/extract-worker.js
+++ b/deps/npm/lib/install/action/extract-worker.js
@@ -10,9 +10,9 @@ module.exports = (args, cb) => {
   const spec = parsed[0]
   const extractTo = parsed[1]
   const opts = parsed[2]
-  if (!opts.log) {
+  if (!opts.log && opts.loglevel) {
     opts.log = npmlog
+    opts.log.level = opts.loglevel
   }
-  opts.log.level = opts.loglevel || opts.log.level
   BB.resolve(extract(spec, extractTo, opts)).nodeify(cb)
 }
diff --git a/deps/npm/lib/install/action/extract.js b/deps/npm/lib/install/action/extract.js
index e8d7a6c4f6..6b827f36ea 100644
--- a/deps/npm/lib/install/action/extract.js
+++ b/deps/npm/lib/install/action/extract.js
@@ -4,7 +4,9 @@ const BB = require('bluebird')
 
 const stat = BB.promisify(require('graceful-fs').stat)
 const gentlyRm = BB.promisify(require('../../utils/gently-rm.js'))
+const log = require('npmlog')
 const mkdirp = BB.promisify(require('mkdirp'))
+const moduleName = require('../../utils/module-name.js')
 const moduleStagingPath = require('../module-staging-path.js')
 const move = require('../../utils/move.js')
 const npa = require('npm-package-arg')
@@ -57,11 +59,12 @@ function extract (staging, pkg, log) {
     pacoteOpts = require('../../config/pacote')
   }
   const opts = pacoteOpts({
-    integrity: pkg.package._integrity,
-    resolved: pkg.package._resolved
+    integrity: pkg.package._integrity
   })
   const args = [
-    pkg.package._requested,
+    pkg.package._resolved
+    ? npa.resolve(pkg.package.name, pkg.package._resolved)
+    : pkg.package._requested,
     extractTo,
     opts
   ]
@@ -109,6 +112,18 @@ function readBundled (pkg, staging, extractTo) {
   }, {concurrency: 10})
 }
 
+function getTree (pkg) {
+  while (pkg.parent) pkg = pkg.parent
+  return pkg
+}
+
+function warn (pkg, code, msg) {
+  const tree = getTree(pkg)
+  const err = new Error(msg)
+  err.code = code
+  tree.warnings.push(err)
+}
+
 function stageBundledModule (bundler, child, staging, parentPath) {
   const stageFrom = path.join(parentPath, 'node_modules', child.package.name)
   const stageTo = moduleStagingPath(staging, child)
@@ -131,6 +146,15 @@ function finishModule (bundler, child, stageTo, stageFrom) {
       return move(stageFrom, stageTo)
     })
   } else {
-    return stat(stageFrom).then(() => gentlyRm(stageFrom), () => {})
+    return stat(stageFrom).then(() => {
+      const bundlerId = packageId(bundler)
+      if (!getTree(bundler).warnings.some((w) => {
+        return w.code === 'EBUNDLEOVERRIDE'
+      })) {
+        warn(bundler, 'EBUNDLEOVERRIDE', `${bundlerId} had bundled packages that do not match the required version(s). They have been replaced with non-bundled versions.`)
+      }
+      log.verbose('bundle', `EBUNDLEOVERRIDE: Replacing ${bundlerId}'s bundled version of ${moduleName(child)} with ${packageId(child)}.`)
+      return gentlyRm(stageFrom)
+    }, () => {})
   }
 }
diff --git a/deps/npm/lib/install/actions.js b/deps/npm/lib/install/actions.js
index a34d03ffe2..9608a943a5 100644
--- a/deps/npm/lib/install/actions.js
+++ b/deps/npm/lib/install/actions.js
@@ -118,7 +118,7 @@ function doParallel (type, staging, actionsToRun, log, next) {
     }
     return acc
   }, [])
-  log.silly('doParallel', type + ' ' + acts.length)
+  log.silly('doParallel', type + ' ' + actionsToRun.length)
   time(log)
   if (!acts.length) { return next() }
   return withInit(actions[type], () => {
diff --git a/deps/npm/lib/install/copy-tree.js b/deps/npm/lib/install/copy-tree.js
index 2bf7064f33..a5b558cf59 100644
--- a/deps/npm/lib/install/copy-tree.js
+++ b/deps/npm/lib/install/copy-tree.js
@@ -1,26 +1,27 @@
 'use strict'
 var createNode = require('./node.js').create
-module.exports = function (tree) {
-  return copyTree(tree, {})
+module.exports = function (tree, filter) {
+  return copyTree(tree, {}, filter)
 }
 
-function copyTree (tree, cache) {
+function copyTree (tree, cache, filter) {
+  if (filter && !filter(tree)) { return null }
   if (cache[tree.path]) { return cache[tree.path] }
   var newTree = cache[tree.path] = createNode(Object.assign({}, tree))
-  copyModuleList(newTree, 'children', cache)
+  copyModuleList(newTree, 'children', cache, filter)
   newTree.children.forEach(function (child) {
     child.parent = newTree
   })
-  copyModuleList(newTree, 'requires', cache)
-  copyModuleList(newTree, 'requiredBy', cache)
+  copyModuleList(newTree, 'requires', cache, filter)
+  copyModuleList(newTree, 'requiredBy', cache, filter)
   return newTree
 }
 
-function copyModuleList (tree, key, cache) {
+function copyModuleList (tree, key, cache, filter) {
   var newList = []
   if (tree[key]) {
     tree[key].forEach(function (child) {
-      const copy = copyTree(child, cache)
+      const copy = copyTree(child, cache, filter)
       if (copy) {
         newList.push(copy)
       }
diff --git a/deps/npm/lib/install/deps.js b/deps/npm/lib/install/deps.js
index 54cc5258fa..93c4adffd7 100644
--- a/deps/npm/lib/install/deps.js
+++ b/deps/npm/lib/install/deps.js
@@ -33,7 +33,6 @@ var getSaveType = require('./save.js').getSaveType
 var unixFormatPath = require('../utils/unix-format-path.js')
 var isExtraneous = require('./is-extraneous.js')
 var isRegistry = require('../utils/is-registry.js')
-var hasModernMeta = require('./has-modern-meta.js')
 
 // The export functions in this module mutate a dependency tree, adding
 // items to them.
@@ -112,7 +111,7 @@ function computeMetadata (tree, seen) {
   const reqs = tree.swRequires || {}
   for (let name of Object.keys(deps)) {
     if (findChild(name, deps[name])) continue
-    if (name in reqs && findChild(name, reqs[name])) continue
+    if (findChild(name, reqs[name])) continue
     tree.missingDeps[name] = deps[name]
   }
   if (tree.isTop) {
@@ -333,21 +332,9 @@ exports.removeDeps = function (args, tree, saveToDependencies, next) {
       parent.requires = parent.requires.filter((child) => child !== pkgToRemove)
     }
     pkgToRemove.requiredBy = pkgToRemove.requiredBy.filter((parent) => parent !== tree)
-    flagAsRemoving(pkgToRemove)
   }
   next()
 }
-
-function flagAsRemoving (toRemove, seen) {
-  if (!seen) seen = new Set()
-  if (seen.has(toRemove)) return
-  seen.add(toRemove)
-  toRemove.removing = true
-  toRemove.requires.forEach((required) => {
-    flagAsRemoving(required, seen)
-  })
-}
-
 exports.removeExtraneous = function (args, tree, next) {
   for (let pkg of args) {
     var pkgName = moduleName(pkg)
@@ -539,7 +526,7 @@ function addDependency (name, versionSpec, tree, log, done) {
   }
   var child = findRequirement(tree, name, req)
   if (!child && swReq) child = findRequirement(tree, name, swReq)
-  if (hasModernMeta(child)) {
+  if (child) {
     resolveWithExistingModule(child, tree)
     if (child.package._shrinkwrap === undefined) {
       readShrinkwrap.andInflate(child, function (er) { next(er, child, log) })
@@ -547,42 +534,12 @@ function addDependency (name, versionSpec, tree, log, done) {
       next(null, child, log)
     }
   } else {
-    if (child) {
-      if (req.registry) {
-        req = childDependencySpecifier(tree, name, child.package.version)
-      }
-      if (child.fromBundle) reportBundleOverride(child, log)
-      removeObsoleteDep(child, log)
-    }
     fetchPackageMetadata(req, packageRelativePath(tree), {tracker: log.newItem('fetchMetadata')}, iferr(next, function (pkg) {
       resolveWithNewModule(pkg, tree, log, next)
     }))
   }
 }
 
-function getTop (pkg) {
-  const seen = new Set()
-  while (pkg.parent && !seen.has(pkg.parent)) {
-    pkg = pkg.parent
-    seen.add(pkg)
-  }
-  return pkg
-}
-
-function reportBundleOverride (child, log) {
-  const code = 'EBUNDLEOVERRIDE'
-  const top = getTop(child.fromBundle)
-  const bundlerId = packageId(child.fromBundle)
-  if (!top.warnings.some((w) => {
-    return w.code === code
-  })) {
-    const err = new Error(`${bundlerId} had bundled packages that do not match the required version(s). They have been replaced with non-bundled versions.`)
-    err.code = code
-    top.warnings.push(err)
-  }
-  if (log) log.verbose('bundle', `${code}: Replacing ${bundlerId}'s bundled version of ${moduleName(child)} with ${packageId(child)}.`)
-}
-
 function resolveWithExistingModule (child, tree) {
   validate('OO', arguments)
   addRequiredDep(tree, child)
@@ -635,7 +592,7 @@ function resolveWithNewModule (pkg, tree, log, next) {
   return isInstallable(pkg, (err) => {
     let installable = !err
     addBundled(pkg, (bundleErr) => {
-      var parent = earliestInstallable(tree, tree, pkg, log) || tree
+      var parent = earliestInstallable(tree, tree, pkg) || tree
       var isLink = pkg._requested.type === 'directory'
       var child = createChild({
         package: pkg,
@@ -652,10 +609,7 @@ function resolveWithNewModule (pkg, tree, log, next) {
       var hasBundled = child.children.length
 
       var replaced = replaceModuleByName(parent, 'children', child)
-      if (replaced) {
-        if (replaced.fromBundle) reportBundleOverride(replaced, log)
-        removeObsoleteDep(replaced)
-      }
+      if (replaced) removeObsoleteDep(replaced)
       addRequiredDep(tree, child)
       child.location = flatNameFromTree(child)
 
@@ -740,25 +694,12 @@ function preserveSymlinks () {
 // Find the highest level in the tree that we can install this module in.
 // If the module isn't installed above us yet, that'd be the very top.
 // If it is, then it's the level below where its installed.
-var earliestInstallable = exports.earliestInstallable = function (requiredBy, tree, pkg, log) {
-  validate('OOOO', arguments)
-
+var earliestInstallable = exports.earliestInstallable = function (requiredBy, tree, pkg) {
+  validate('OOO', arguments)
   function undeletedModuleMatches (child) {
     return !child.removed && moduleName(child) === pkg.name
   }
-  const undeletedMatches = tree.children.filter(undeletedModuleMatches)
-  if (undeletedMatches.length) {
-    // if there's a conflict with another child AT THE SAME level then we're replacing it, so
-    // mark it as removed and continue with resolution normally.
-    if (tree === requiredBy) {
-      undeletedMatches.forEach((pkg) => {
-        if (pkg.fromBundle) reportBundleOverride(pkg, log)
-        removeObsoleteDep(pkg, log)
-      })
-    } else {
-      return null
-    }
-  }
+  if (tree.children.some(undeletedModuleMatches)) return null
 
   // If any of the children of this tree have conflicting
   // binaries then we need to decline to install this package here.
@@ -797,5 +738,5 @@ var earliestInstallable = exports.earliestInstallable = function (requiredBy, tr
 
   if (!preserveSymlinks() && /^[.][.][\\/]/.test(path.relative(tree.parent.realpath, tree.realpath))) return tree
 
-  return (earliestInstallable(requiredBy, tree.parent, pkg, log) || tree)
+  return (earliestInstallable(requiredBy, tree.parent, pkg) || tree)
 }
diff --git a/deps/npm/lib/install/diff-trees.js b/deps/npm/lib/install/diff-trees.js
index 06e6b77a91..4316f351cc 100644
--- a/deps/npm/lib/install/diff-trees.js
+++ b/deps/npm/lib/install/diff-trees.js
@@ -70,9 +70,6 @@ function sriMatch (aa, bb) {
 function pkgAreEquiv (aa, bb) {
   // coming in we know they share a path…
 
-  // if one is inside a link and the other is not, then they are not equivalent
-  // this happens when we're replacing a linked dep with a non-linked version
-  if (aa.isInLink !== bb.isInLink) return false
   // if they share package metadata _identity_, they're the same thing
   if (aa.package === bb.package) return true
   // if they share integrity information, they're the same thing
diff --git a/deps/npm/lib/install/has-modern-meta.js b/deps/npm/lib/install/has-modern-meta.js
deleted file mode 100644
index 382e74c70c..0000000000
--- a/deps/npm/lib/install/has-modern-meta.js
+++ /dev/null
@@ -1,19 +0,0 @@
-'use strict'
-module.exports = hasModernMeta
-
-const npa = require('npm-package-arg')
-const moduleName = require('../utils/module-name.js')
-
-function isLink (child) {
-  return child.isLink || (child.parent && isLink(child.parent))
-}
-
-function hasModernMeta (child) {
-  if (!child) return false
-  const resolved = child.package._resolved && npa.resolve(moduleName(child), child.package._resolved)
-  return child.isTop || isLink(child) || (
-    child.package &&
-    resolved &&
-    (child.package._integrity || child.package._shasum || resolved.type === 'git')
-  )
-}
diff --git a/deps/npm/lib/install/inflate-shrinkwrap.js b/deps/npm/lib/install/inflate-shrinkwrap.js
index e596ca94ab..43ac9136f0 100644
--- a/deps/npm/lib/install/inflate-shrinkwrap.js
+++ b/deps/npm/lib/install/inflate-shrinkwrap.js
@@ -14,8 +14,6 @@ const realizeShrinkwrapSpecifier = require('./realize-shrinkwrap-specifier.js')
 const validate = require('aproba')
 const path = require('path')
 const isRegistry = require('../utils/is-registry.js')
-const hasModernMeta = require('./has-modern-meta.js')
-const ssri = require('ssri')
 
 module.exports = function (tree, sw, opts, finishInflating) {
   if (!fetchPackageMetadata) {
@@ -70,7 +68,7 @@ function normalizePackageDataNoErrors (pkg) {
 
 function inflatableChild (onDiskChild, name, topPath, tree, sw, requested, opts) {
   validate('OSSOOOO|ZSSOOOO', arguments)
-  if (hasModernMeta(onDiskChild) && childIsEquivalent(sw, requested, onDiskChild)) {
+  if (onDiskChild && childIsEquivalent(sw, requested, onDiskChild)) {
     // The version on disk matches the shrinkwrap entry.
     if (!onDiskChild.fromShrinkwrap) onDiskChild.fromShrinkwrap = true
     onDiskChild.package._requested = requested
@@ -108,7 +106,7 @@ function makeFakeChild (name, topPath, tree, sw, requested) {
     name: name,
     version: sw.version,
     _id: name + '@' + sw.version,
-    _resolved: sw.resolved,
+    _resolved: adaptResolved(requested, sw.resolved),
     _requested: requested,
     _optional: sw.optional,
     _development: sw.dev,
@@ -146,6 +144,23 @@ function makeFakeChild (name, topPath, tree, sw, requested) {
   return child
 }
 
+function adaptResolved (requested, resolved) {
+  const registry = requested.scope
+  ? npm.config.get(`${requested.scope}:registry`) || npm.config.get('registry')
+  : npm.config.get('registry')
+  if (!isRegistry(requested) || (resolved && resolved.indexOf(registry) === 0)) {
+    // Nothing to worry about here. Pass it through.
+    return resolved
+  } else {
+    // We could fast-path for registry.npmjs.org here, but if we do, it
+    // would end up getting written back to the `resolved` field. By always
+    // returning `null` for other registries, `pacote.extract()` will take
+    // care of any required metadata fetches internally, without altering
+    // the tree we're going to write out to shrinkwrap/lockfile.
+    return null
+  }
+}
+
 function fetchChild (topPath, tree, sw, requested) {
   return fetchPackageMetadata(requested, topPath).then((pkg) => {
     pkg._from = sw.from || requested.raw
@@ -181,11 +196,7 @@ function fetchChild (topPath, tree, sw, requested) {
 function childIsEquivalent (sw, requested, child) {
   if (!child) return false
   if (child.fromShrinkwrap) return true
-  if (
-    sw.integrity &&
-    child.package._integrity &&
-    ssri.parse(sw.integrity).match(child.package._integrity)
-  ) return true
+  if (sw.integrity && child.package._integrity === sw.integrity) return true
   if (child.isLink && requested.type === 'directory') return path.relative(child.realpath, requested.fetchSpec) === ''
 
   if (sw.resolved) return child.package._resolved === sw.resolved
diff --git a/deps/npm/lib/install/read-shrinkwrap.js b/deps/npm/lib/install/read-shrinkwrap.js
index a48a4aea00..45e883caa2 100644
--- a/deps/npm/lib/install/read-shrinkwrap.js
+++ b/deps/npm/lib/install/read-shrinkwrap.js
@@ -25,7 +25,14 @@ function readShrinkwrap (child, next) {
         log.warn('read-shrinkwrap', 'Ignoring package-lock.json because there is already an npm-shrinkwrap.json. Please use only one of the two.')
       }
       const name = shrinkwrap ? 'npm-shrinkwrap.json' : 'package-lock.json'
-      const parsed = parsePkgLock(shrinkwrap || lockfile, name)
+      let parsed = null
+      if (shrinkwrap || lockfile) {
+        try {
+          parsed = parseJSON(shrinkwrap || lockfile)
+        } catch (ex) {
+          throw ex
+        }
+      }
       if (parsed && parsed.lockfileVersion !== PKGLOCK_VERSION) {
         log.warn('read-shrinkwrap', `This version of npm is compatible with lockfileVersion@${PKGLOCK_VERSION}, but ${name} was generated for lockfileVersion@${parsed.lockfileVersion || 0}. I'll try to do my best with it!`)
       }
@@ -36,8 +43,7 @@ function readShrinkwrap (child, next) {
 
 function maybeReadFile (name, child) {
   return readFileAsync(
-    path.join(child.path, name),
-    'utf8'
+    path.join(child.path, name)
   ).catch({code: 'ENOENT'}, () => null)
 }
 
@@ -50,57 +56,3 @@ module.exports.andInflate = function (child, next) {
     }
   }))
 }
-
-const PARENT_RE = /\|{7,}/g
-const OURS_RE = /\<{7,}/g
-const THEIRS_RE = /\={7,}/g
-const END_RE = /\>{7,}/g
-
-module.exports._isDiff = isDiff
-function isDiff (str) {
-  return str.match(OURS_RE) && str.match(THEIRS_RE) && str.match(END_RE)
-}
-
-module.exports._parsePkgLock = parsePkgLock
-function parsePkgLock (str, filename) {
-  if (!str) { return null }
-  try {
-    return parseJSON(str)
-  } catch (e) {
-    if (isDiff(str)) {
-      log.warn('conflict', `A git conflict was detected in ${filename}. Attempting to auto-resolve.`)
-      const pieces = str.split(/[\n\r]+/g).reduce((acc, line) => {
-        if (line.match(PARENT_RE)) acc.state = 'parent'
-        else if (line.match(OURS_RE)) acc.state = 'ours'
-        else if (line.match(THEIRS_RE)) acc.state = 'theirs'
-        else if (line.match(END_RE)) acc.state = 'top'
-        else {
-          if (acc.state === 'top' || acc.state === 'ours') acc.ours += line
-          if (acc.state === 'top' || acc.state === 'theirs') acc.theirs += line
-          if (acc.state === 'top' || acc.state === 'parent') acc.parent += line
-        }
-        return acc
-      }, {
-        state: 'top',
-        ours: '',
-        theirs: '',
-        parent: ''
-      })
-      try {
-        const ours = parseJSON(pieces.ours)
-        const theirs = parseJSON(pieces.theirs)
-        return reconcileLockfiles(ours, theirs)
-      } catch (_e) {
-        log.error('conflict', `Automatic conflict resolution failed. Please manually resolve conflicts in ${filename} and try again.`)
-        log.silly('conflict', `Error during resolution: ${_e}`)
-        throw e
-      }
-    } else {
-      throw e
-    }
-  }
-}
-
-function reconcileLockfiles (parent, ours, theirs) {
-  return Object.assign({}, ours, theirs)
-}
diff --git a/deps/npm/lib/install/save.js b/deps/npm/lib/install/save.js
index 3f62643b80..f0c61f555d 100644
--- a/deps/npm/lib/install/save.js
+++ b/deps/npm/lib/install/save.js
@@ -3,7 +3,6 @@
 const createShrinkwrap = require('../shrinkwrap.js').createShrinkwrap
 const deepSortObject = require('../utils/deep-sort-object.js')
 const detectIndent = require('detect-indent')
-const detectNewline = require('detect-newline')
 const fs = require('graceful-fs')
 const iferr = require('iferr')
 const log = require('npmlog')
@@ -11,7 +10,6 @@ const moduleName = require('../utils/module-name.js')
 const npm = require('../npm.js')
 const parseJSON = require('../utils/parse-json.js')
 const path = require('path')
-const stringifyPackage = require('../utils/stringify-package')
 const validate = require('aproba')
 const without = require('lodash.without')
 const writeFileAtomic = require('write-file-atomic')
@@ -62,8 +60,7 @@ function savePackageJson (tree, next) {
   // don't use readJson, because we don't want to do all the other
   // tricky npm-specific stuff that's in there.
   fs.readFile(saveTarget, 'utf8', iferr(next, function (packagejson) {
-    const indent = detectIndent(packagejson).indent
-    const newline = detectNewline(packagejson)
+    const indent = detectIndent(packagejson).indent || '  '
     try {
       tree.package = parseJSON(packagejson)
     } catch (ex) {
@@ -125,7 +122,7 @@ function savePackageJson (tree, next) {
       tree.package.bundleDependencies = deepSortObject(bundle)
     }
 
-    var json = stringifyPackage(tree.package, indent, newline)
+    var json = JSON.stringify(tree.package, null, indent) + '\n'
     if (json === packagejson) {
       log.verbose('shrinkwrap', 'skipping write for package.json because there were no changes.')
       next()
diff --git a/deps/npm/lib/pack.js b/deps/npm/lib/pack.js
index b6a08d8650..f6a0eff805 100644
--- a/deps/npm/lib/pack.js
+++ b/deps/npm/lib/pack.js
@@ -120,9 +120,7 @@ function packDirectory (mani, dir, target) {
         cwd: dir,
         prefix: 'package/',
         portable: true,
-        // Provide a specific date in the 1980s for the benefit of zip,
-        // which is confounded by files dated at the Unix epoch 0.
-        mtime: new Date('1985-10-26T08:15:00.000Z'),
+        noMtime: true,
         gzip: true
       }
 
@@ -172,7 +170,7 @@ function packGitDep (manifest, dir) {
         return acc
       }, [])
       const child = cp.spawn(process.env.NODE || process.execPath, [
-        require.resolve('../bin/npm-cli.js'),
+        require.main.filename,
         'install',
         '--dev',
         '--prod',
diff --git a/deps/npm/lib/profile.js b/deps/npm/lib/profile.js
index 016e898157..587a26ca8b 100644
--- a/deps/npm/lib/profile.js
+++ b/deps/npm/lib/profile.js
@@ -82,18 +82,7 @@ function config () {
     registry: npm.config.get('registry'),
     otp: npm.config.get('otp')
   }
-  const creds = npm.config.getCredentialsByURI(conf.registry)
-  if (creds.token) {
-    conf.auth = {token: creds.token}
-  } else if (creds.username) {
-    conf.auth = {basic: {username: creds.username, password: creds.password}}
-  } else if (creds.auth) {
-    const auth = Buffer.from(creds.auth, 'base64').toString().split(':', 2)
-    conf.auth = {basic: {username: auth[0], password: auth[1]}}
-  } else {
-    conf.auth = {}
-  }
-
+  conf.auth = npm.config.getCredentialsByURI(conf.registry)
   if (conf.otp) conf.auth.otp = conf.otp
   return conf
 }
@@ -166,17 +155,12 @@ function set (args) {
     return Promise.reject(Error(`"${prop}" is not a property we can set. Valid properties are: ` + writableProfileKeys.join(', ')))
   }
   return Bluebird.try(() => {
-    if (prop === 'password') {
-      return readUserInfo.password('Current password: ').then((current) => {
-        return readPasswords().then((newpassword) => {
-          value = {old: current, new: newpassword}
-        })
+    if (prop !== 'password') return
+    return readUserInfo.password('Current password: ').then((current) => {
+      return readPasswords().then((newpassword) => {
+        value = {old: current, new: newpassword}
       })
-    } else if (prop === 'email') {
-      return readUserInfo.password('Password: ').then((current) => {
-        return {password: current, email: value}
-      })
-    }
+    })
     function readPasswords () {
       return readUserInfo.password('New password: ').then((password1) => {
         return readUserInfo.password('       Again:     ').then((password2) => {
diff --git a/deps/npm/lib/prune.js b/deps/npm/lib/prune.js
index 010e471e4b..4ac8139576 100644
--- a/deps/npm/lib/prune.js
+++ b/deps/npm/lib/prune.js
@@ -26,7 +26,6 @@ function prune (args, cb) {
 
 function Pruner (where, dryrun, args) {
   Installer.call(this, where, dryrun, args)
-  this.autoPrune = true
 }
 util.inherits(Pruner, Installer)
 
@@ -65,4 +64,3 @@ Pruner.prototype.loadAllDepsIntoIdealTree = function (cb) {
 
 Pruner.prototype.runPreinstallTopLevelLifecycles = function (cb) { cb() }
 Pruner.prototype.runPostinstallTopLevelLifecycles = function (cb) { cb() }
-Pruner.prototype.saveToDependencies = function (cb) { cb() }
diff --git a/deps/npm/lib/shrinkwrap.js b/deps/npm/lib/shrinkwrap.js
index 603056ec94..1db39f00cb 100644
--- a/deps/npm/lib/shrinkwrap.js
+++ b/deps/npm/lib/shrinkwrap.js
@@ -4,7 +4,6 @@ const BB = require('bluebird')
 
 const chain = require('slide').chain
 const detectIndent = require('detect-indent')
-const detectNewline = require('detect-newline')
 const readFile = BB.promisify(require('graceful-fs').readFile)
 const getRequested = require('./install/get-requested.js')
 const id = require('./install/deps.js')
@@ -19,7 +18,6 @@ const npm = require('./npm.js')
 const path = require('path')
 const readPackageTree = BB.promisify(require('read-package-tree'))
 const ssri = require('ssri')
-const stringifyPackage = require('./utils/stringify-package')
 const validate = require('aproba')
 const writeFileAtomic = require('write-file-atomic')
 const unixFormatPath = require('./utils/unix-format-path.js')
@@ -181,12 +179,11 @@ function save (dir, pkginfo, opts, cb) {
         {
           path: path.resolve(dir, opts.defaultFile || PKGLOCK),
           data: '{}',
-          indent: pkg && pkg.indent,
-          newline: pkg && pkg.newline
+          indent: (pkg && pkg.indent) || 2
         }
       )
-      const updated = updateLockfileMetadata(pkginfo, pkg && JSON.parse(pkg.raw))
-      const swdata = stringifyPackage(updated, info.indent, info.newline)
+      const updated = updateLockfileMetadata(pkginfo, pkg && pkg.data)
+      const swdata = JSON.stringify(updated, null, info.indent) + '\n'
       if (swdata === info.raw) {
         // skip writing if file is identical
         log.verbose('shrinkwrap', `skipping write for ${path.basename(info.path)} because there were no changes.`)
@@ -247,8 +244,8 @@ function checkPackageFile (dir, name) {
     return {
       path: file,
       raw: data,
-      indent: detectIndent(data).indent,
-      newline: detectNewline(data)
+      data: JSON.parse(data),
+      indent: detectIndent(data).indent || 2
     }
   }).catch({code: 'ENOENT'}, () => {})
 }
diff --git a/deps/npm/lib/token.js b/deps/npm/lib/token.js
index 350582782d..2a3b65e6ad 100644
--- a/deps/npm/lib/token.js
+++ b/deps/npm/lib/token.js
@@ -13,8 +13,6 @@ const pulseTillDone = require('./utils/pulse-till-done.js')
 
 module.exports = token
 
-token._validateCIDRList = validateCIDRList
-
 token.usage =
   'npm token list\n' +
   'npm token revoke <tokenKey>\n' +
@@ -83,17 +81,7 @@ function config () {
     registry: npm.config.get('registry'),
     otp: npm.config.get('otp')
   }
-  const creds = npm.config.getCredentialsByURI(conf.registry)
-  if (creds.token) {
-    conf.auth = {token: creds.token}
-  } else if (creds.username) {
-    conf.auth = {basic: {username: creds.username, password: creds.password}}
-  } else if (creds.auth) {
-    const auth = Buffer.from(creds.auth, 'base64').toString().split(':', 2)
-    conf.auth = {basic: {username: auth[0], password: auth[1]}}
-  } else {
-    conf.auth = {}
-  }
+  conf.auth = npm.config.getCredentialsByURI(conf.registry)
   if (conf.otp) conf.auth.otp = conf.otp
   return conf
 }
@@ -161,14 +149,8 @@ function rm (args) {
       }
     })
     return Bluebird.map(toRemove, (key) => {
-      return profile.removeToken(key, conf).catch((ex) => {
-        if (ex.code !== 'EOTP') throw ex
-        log.info('token', 'failed because revoking this token requires OTP')
-        return readUserInfo.otp('Authenticator provided OTP:').then((otp) => {
-          conf.auth.otp = otp
-          return profile.removeToken(key, conf)
-        })
-      })
+      progress.info('token', 'removing', key)
+      profile.removeToken(key, conf).then(() => profile.completeWork(1))
     })
   })).then(() => {
     if (conf.json) {
@@ -223,8 +205,7 @@ function validateCIDR (cidr) {
 }
 
 function validateCIDRList (cidrs) {
-  const maybeList = cidrs ? (Array.isArray(cidrs) ? cidrs : [cidrs]) : []
-  const list = maybeList.length === 1 ? maybeList[0].split(/,\s*/) : maybeList
+  const list = Array.isArray(cidrs) ? cidrs : cidrs ? cidrs.split(/,\s*/) : []
   list.forEach(validateCIDR)
   return list
 }
diff --git a/deps/npm/lib/utils/error-message.js b/deps/npm/lib/utils/error-message.js
index cd31d7d714..85504f5edc 100644
--- a/deps/npm/lib/utils/error-message.js
+++ b/deps/npm/lib/utils/error-message.js
@@ -23,17 +23,8 @@ function errorMessage (er) {
     case 'EACCES':
     case 'EPERM':
       short.push(['', er])
-      detail.push([
-        '',
-        [
-          '\nThe operation was rejected by your operating system.',
-          (process.platform === 'win32'
-            ? 'It\'s possible that the file was already in use (by a text editor or antivirus),\nor that you lack permissions to access it.'
-            : 'It is likely you do not have the permissions to access this file as the current user'),
-          '\nIf you believe this might be a permissions issue, please double-check the',
-          'permissions of the file and its containing directories, or try running',
-          'the command again as root/Administrator (though this is not recommended).'
-        ].join('\n')])
+      detail.push(['', ['\nPlease try running this command again as root/Administrator.'
+                ].join('\n')])
       break
 
     case 'ELIFECYCLE':
@@ -61,25 +52,6 @@ function errorMessage (er) {
       break
 
     case 'EJSONPARSE':
-      const path = require('path')
-      // Check whether we ran into a conflict in our own package.json
-      if (er.file === path.join(npm.prefix, 'package.json')) {
-        const isDiff = require('../install/read-shrinkwrap.js')._isDiff
-        const txt = require('fs').readFileSync(er.file, 'utf8')
-        if (isDiff(txt)) {
-          detail.push([
-            '',
-            [
-              'Merge conflict detected in your package.json.',
-              '',
-              'Please resolve the package.json conflict and retry the command:',
-              '',
-              `$ ${process.argv.join(' ')}`
-            ].join('\n')
-          ])
-          break
-        }
-      }
       short.push(['', er.message])
       short.push(['', 'File: ' + er.file])
       detail.push([
diff --git a/deps/npm/lib/utils/parse-json.js b/deps/npm/lib/utils/parse-json.js
index c4149d282d..5c0b959a0d 100644
--- a/deps/npm/lib/utils/parse-json.js
+++ b/deps/npm/lib/utils/parse-json.js
@@ -1,7 +1,6 @@
 'use strict'
-var parseJsonWithErrors = require('json-parse-better-errors')
 var parseJSON = module.exports = function (content) {
-  return parseJsonWithErrors(stripBOM(content))
+  return JSON.parse(stripBOM(content))
 }
 
 parseJSON.noExceptions = function (content) {
diff --git a/deps/npm/lib/utils/stringify-package.js b/deps/npm/lib/utils/stringify-package.js
deleted file mode 100644
index 0cc9de0a36..0000000000
--- a/deps/npm/lib/utils/stringify-package.js
+++ /dev/null
@@ -1,17 +0,0 @@
-'use strict'
-
-module.exports = stringifyPackage
-
-const DEFAULT_INDENT = 2
-const CRLF = '\r\n'
-const LF = '\n'
-
-function stringifyPackage (data, indent, newline) {
-  const json = JSON.stringify(data, null, indent || DEFAULT_INDENT)
-
-  if (newline === CRLF) {
-    return json.replace(/\n/g, CRLF) + CRLF
-  }
-
-  return json + LF
-}
diff --git a/deps/npm/lib/utils/unsupported.js b/deps/npm/lib/utils/unsupported.js
index 15fa7396d0..b586d035ce 100644
--- a/deps/npm/lib/utils/unsupported.js
+++ b/deps/npm/lib/utils/unsupported.js
@@ -5,7 +5,8 @@ var supportedNode = [
   {ver: '6', min: '6.0.0'},
   {ver: '7', min: '7.0.0'},
   {ver: '8', min: '8.0.0'},
-  {ver: '9', min: '9.0.0'}
+  {ver: '9', min: '9.0.0'},
+  {ver: '10', min: '10.0.0'}
 ]
 var knownBroken = '<4.7.0'
 
@@ -25,7 +26,7 @@ exports.checkForBrokenNode = function () {
     supportedNode.forEach(function (rel) {
       if (semver.satisfies(nodejs.version, rel.ver)) {
         console.error('Node.js ' + rel.ver + " is supported but the specific version you're running has")
-        console.error('a bug known to break npm. Please update to at least ' + rel.min + ' to use this')
+        console.error(`a bug known to break npm. Please update to at least ${rel.min} to use this`)
         console.error('version of npm. You can find the latest release of Node.js at https://nodejs.org/')
         process.exit(1)
       }
diff --git a/deps/npm/lib/version.js b/deps/npm/lib/version.js
index 23880b61a5..edcd664f2a 100644
--- a/deps/npm/lib/version.js
+++ b/deps/npm/lib/version.js
@@ -4,7 +4,6 @@ const BB = require('bluebird')
 const assert = require('assert')
 const chain = require('slide').chain
 const detectIndent = require('detect-indent')
-const detectNewline = require('detect-newline')
 const fs = require('graceful-fs')
 const readFile = BB.promisify(require('graceful-fs').readFile)
 const git = require('./utils/git.js')
@@ -15,7 +14,6 @@ const output = require('./utils/output.js')
 const parseJSON = require('./utils/parse-json.js')
 const path = require('path')
 const semver = require('semver')
-const stringifyPackage = require('./utils/stringify-package')
 const writeFileAtomic = require('write-file-atomic')
 
 version.usage = 'npm version [<newversion> | major | minor | patch | premajor | preminor | prepatch | prerelease | from-git]' +
@@ -35,7 +33,7 @@ function version (args, silent, cb_) {
   }
   if (args.length > 1) return cb_(version.usage)
 
-  readPackage(function (er, data, indent, newline) {
+  readPackage(function (er, data, indent) {
     if (!args.length) return dump(data, cb_)
 
     if (er) {
@@ -117,16 +115,14 @@ function readPackage (cb) {
   fs.readFile(packagePath, 'utf8', function (er, data) {
     if (er) return cb(new Error(er))
     var indent
-    var newline
     try {
-      indent = detectIndent(data).indent
-      newline = detectNewline(data)
+      indent = detectIndent(data).indent || '  '
       data = JSON.parse(data)
     } catch (e) {
       er = e
       data = null
     }
-    cb(er, data, indent, newline)
+    cb(er, data, indent)
   })
 }
 
@@ -136,10 +132,10 @@ function updatePackage (newVersion, silent, cb_) {
     cb_(er)
   }
 
-  readPackage(function (er, data, indent, newline) {
+  readPackage(function (er, data, indent) {
     if (er) return cb(new Error(er))
     data.version = newVersion
-    write(data, 'package.json', indent, newline, cb)
+    write(data, 'package.json', indent, cb)
   })
 }
 
@@ -172,17 +168,15 @@ function updateShrinkwrap (newVersion, cb) {
       const file = shrinkwrap ? SHRINKWRAP : PKGLOCK
       let data
       let indent
-      let newline
       try {
         data = parseJSON(shrinkwrap || lockfile)
-        indent = detectIndent(shrinkwrap || lockfile).indent
-        newline = detectNewline(shrinkwrap || lockfile)
+        indent = detectIndent(shrinkwrap || lockfile).indent || '  '
       } catch (err) {
         log.error('version', `Bad ${file} data.`)
         return cb(err)
       }
       data.version = newVersion
-      write(data, file, indent, newline, (err) => {
+      write(data, file, indent, (err) => {
         if (err) {
           log.error('version', `Failed to update version in ${file}`)
           return cb(err)
@@ -327,14 +321,14 @@ function addLocalFile (file, options, ignoreFailure) {
   : p
 }
 
-function write (data, file, indent, newline, cb) {
+function write (data, file, indent, cb) {
   assert(data && typeof data === 'object', 'must pass data to version write')
   assert(typeof file === 'string', 'must pass filename to write to version write')
 
   log.verbose('version.write', 'data', data, 'to', file)
   writeFileAtomic(
     path.join(npm.localPrefix, file),
-    new Buffer(stringifyPackage(data, indent, newline)),
+    new Buffer(JSON.stringify(data, null, indent || 2) + '\n'),
     cb
   )
 }
diff --git a/deps/npm/lib/xmas.js b/deps/npm/lib/xmas.js
index 65c0c131ab..25535533e1 100644
--- a/deps/npm/lib/xmas.js
+++ b/deps/npm/lib/xmas.js
@@ -48,7 +48,7 @@ module.exports = function (args, cb) {
   w('\n\n')
   log.heading = ''
   log.addLevel('npm', 100000, log.headingStyle)
-  log.npm('loves you', 'Happy Xmas, JavaScripters!')
+  log.npm('loves you', 'Happy Xmas, Noders!')
   cb()
 }
 var dg = false