deps: upgrade npm to 5.0.0

PR-URL: https://github.com/nodejs/node/pull/13276
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

1 files changed, 89 insertions, 35 deletions

diff --git a/deps/npm/man/man1/npm-install.1 b/deps/npm/man/man1/npm-install.1
index 2bacec4055..2dca6a4b8f 100644
--- a/deps/npm/man/man1/npm-install.1
+++ b/deps/npm/man/man1/npm-install.1
@@ -10,19 +10,22 @@ npm install [<@scope>/]<name>
 npm install [<@scope>/]<name>@<tag>
 npm install [<@scope>/]<name>@<version>
 npm install [<@scope>/]<name>@<version range>
+npm install <git\-host>:<git\-user>/<repo\-name>
+npm install <git repo url>
 npm install <tarball file>
 npm install <tarball url>
 npm install <folder>
 
 alias: npm i
-common options: [\-S|\-\-save|\-D|\-\-save\-dev|\-O|\-\-save\-optional] [\-E|\-\-save\-exact] [\-B|\-\-save\-bundle] [\-\-dry\-run]
+common options: [\-P|\-\-save\-prod|\-D|\-\-save\-dev|\-O|\-\-save\-optional] [\-E|\-\-save\-exact] [\-B|\-\-save\-bundle] [\-\-no\-save] [\-\-dry\-run]
 .fi
 .RE
 .SH DESCRIPTION
 .P
 This command installs a package, and any packages that it depends on\. If the
-package has a shrinkwrap file, the installation of dependencies will be driven
-by that\. See npm help shrinkwrap\.
+package has a package\-lock or shrinkwrap file, the installation of dependencies
+will be driven by that, with an \fBnpm\-shrinkwrap\.json\fP taking precedence if both
+files exist\. See npm help 5 package\-lock\.json and npm help shrinkwrap\.
 .P
 A \fBpackage\fP is:
 .RS 0
@@ -61,12 +64,16 @@ after packing it up into a tarball (b)\.
   \fBdevDependencies\fP\|\.
 .IP \(bu 2
 \fBnpm install <folder>\fP:
-  Install a package that is sitting in a folder on the filesystem\.
+  Install the package in the directory as a symlink in the current project\.
+  Its dependencies will be installed before it's linked\. If \fB<folder>\fP sits
+  inside the root of your project, its dependencies may be hoisted to the
+  toplevel \fBnode_modules\fP as they would for other types of dependencies\.
 .IP \(bu 2
 \fBnpm install <tarball file>\fP:
   Install a package that is sitting on the filesystem\.  Note: if you just want
   to link a dev directory into your npm root, you can do this more easily by
-  using \fBnpm link\fP\|\.
+  using \fBnpm link\fP\|\. The filename \fImust\fR use \fB\|\.tar\fP, \fB\|\.tar\.gz\fP, or \fB\|\.tgz\fP as
+  the extension\.
   Example:
 .P
 .RS 2
@@ -86,11 +93,11 @@ after packing it up into a tarball (b)\.
 .fi
 .RE
 .IP \(bu 2
-\fBnpm install [<@scope>/]<name> [\-S|\-\-save|\-D|\-\-save\-dev|\-O|\-\-save\-optional]\fP:
+\fBnpm install [<@scope>/]<name>\fP:
   Do a \fB<name>@<tag>\fP install, where \fB<tag>\fP is the "tag" config\. (See
   npm help 7 \fBnpm\-config\fP\|\. The config's default value is \fBlatest\fP\|\.)
-  In most cases, this will install the latest version
-  of the module published on npm\.
+  In most cases, this will install the version of the modules tagged as
+  \fBlatest\fP on the npm registry\.
   Example:
 .P
 .RS 2
@@ -98,15 +105,24 @@ after packing it up into a tarball (b)\.
     npm install sax
 .fi
 .RE
-  \fBnpm install\fP takes 3 exclusive, optional flags which save or update
-  the package version in your main package\.json:
+  \fBnpm install\fP saves any specified packages into \fBdependencies\fP by default\.
+  Additionally, you can control where and how they get saved with some
+  additional flags:
 .RS 0
 .IP \(bu 2
-\fB\-S, \-\-save\fP: Package will appear in your \fBdependencies\fP\|\.
+\fB\-P, \-\-save\-prod\fP: Package will appear in your \fBdependencies\fP\|\. This is the
+.P
+.RS 2
+.nf
+               default unless `\-D` or `\-O` are present\.
+.fi
+.RE
 .IP \(bu 2
 \fB\-D, \-\-save\-dev\fP: Package will appear in your \fBdevDependencies\fP\|\.
 .IP \(bu 2
 \fB\-O, \-\-save\-optional\fP: Package will appear in your \fBoptionalDependencies\fP\|\.
+.IP \(bu 2
+\fB\-\-no\-save\fP: Prevents saving to \fBdependencies\fP\|\.
 When using any of the above options to save dependencies to your
 package\.json, there are two additional, optional flags:
 .IP \(bu 2
@@ -115,8 +131,8 @@ exact version rather than using npm's default semver range
 operator\.
 .IP \(bu 2
 \fB\-B, \-\-save\-bundle\fP: Saved dependencies will also be added to your \fBbundleDependencies\fP list\.
-Further, if you have an \fBnpm\-shrinkwrap\.json\fP then it will be updated as
-well\.
+Further, if you have an \fBnpm\-shrinkwrap\.json\fP or \fBpackage\-lock\.json\fP then it
+will be updated as well\.
 \fB<scope>\fP is optional\. The package will be downloaded from the registry
 associated with the specified scope\. If no registry is associated with
 the given scope the default registry is assumed\. See npm help 7 \fBnpm\-scope\fP\|\.
@@ -127,13 +143,13 @@ Examples:
 .P
 .RS 2
 .nf
-npm install sax \-\-save
+npm install sax
 npm install githubname/reponame
 npm install @myorg/privatepackage
 npm install node\-tap \-\-save\-dev
 npm install dtrace\-provider \-\-save\-optional
-npm install readable\-stream \-\-save \-\-save\-exact
-npm install ansi\-regex \-\-save \-\-save\-bundle
+npm install readable\-stream \-\-save\-exact
+npm install ansi\-regex \-\-save\-bundle
 .fi
 .RE
 
@@ -190,21 +206,29 @@ fetch the package by name if it is not valid\.
 .RE
 .IP \(bu 2
 \fBnpm install <git remote url>\fP:
-  Installs the package from the hosted git provider, cloning it with
-  \fBgit\fP\|\. First it tries via the https (git with github) and if that fails, via ssh\.
+  Installs the package from the hosted git provider, cloning it with \fBgit\fP\|\.
+  For a full git remote url, only that URL will be attempted\.
 .P
 .RS 2
 .nf
-    <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>[#<commit\-ish>]
+    <protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>[#<commit\-ish> | #semver:<semver>]
 .fi
 .RE
-  \fB<protocol>\fP is one of \fBgit\fP, \fBgit+ssh\fP, \fBgit+http\fP, \fBgit+https\fP,
-  or \fBgit+file\fP\|\.
-  If no \fB<commit\-ish>\fP is specified, then \fBmaster\fP is used\.
-  If the repository makes use of submodules, those submodules will
-  be cloned as well\.
-  The following git environment variables are recognized by npm and will be added
-  to the environment when running git:
+  \fB<protocol>\fP is one of \fBgit\fP, \fBgit+ssh\fP, \fBgit+http\fP, \fBgit+https\fP, or
+  \fBgit+file\fP\|\.
+  If \fB#<commit\-ish>\fP is provided, it will be used to clone exactly that
+  commit\. If the commit\-ish has the format \fB#semver:<semver>\fP, \fB<semver>\fP can
+  be any valid semver range or exact version, and npm will look for any tags
+  or refs matching that range in the remote repository, much as it would for a
+  registry dependency\. If neither \fB#<commit\-ish>\fP or \fB#semver:<semver>\fP is
+  specified, then \fBmaster\fP is used\.
+  If the repository makes use of submodules, those submodules will be cloned
+  as well\.
+  If the package being installed contains a \fBprepare\fP script, its
+  \fBdependencies\fP and \fBdevDependencies\fP will be installed, and the prepare
+  script will be run, before the package is packaged and installed\.
+  The following git environment variables are recognized by npm and will be
+  added to the environment when running git:
 .RS 0
 .IP \(bu 2
 \fBGIT_ASKPASS\fP
@@ -226,6 +250,7 @@ Examples:
 .RS 2
 .nf
 npm install git+ssh://git@github\.com:npm/npm\.git#v1\.0\.27
+npm install git+ssh://git@github\.com:npm/npm#semver:^5\.0
 npm install git+https://isaacs@github\.com/npm/npm\.git
 npm install git://github\.com/npm/npm\.git#v1\.0\.27
 GIT_SSH_COMMAND='ssh \-i ~/\.ssh/custom_ident' npm install git+ssh://git@github\.com:npm/npm\.git
@@ -239,7 +264,15 @@ GIT_SSH_COMMAND='ssh \-i ~/\.ssh/custom_ident' npm install git+ssh://git@github\
 \fBnpm install github:<githubname>/<githubrepo>[#<commit\-ish>]\fP:
   Install the package at \fBhttps://github\.com/githubname/githubrepo\fP by
   attempting to clone it using \fBgit\fP\|\.
-  If you don't specify a \fIcommit\-ish\fR then \fBmaster\fP will be used\.
+  If \fB#<commit\-ish>\fP is provided, it will be used to clone exactly that
+  commit\. If the commit\-ish has the format \fB#semver:<semver>\fP, \fB<semver>\fP can
+  be any valid semver range or exact version, and npm will look for any tags
+  or refs matching that range in the remote repository, much as it would for a
+  registry dependency\. If neither \fB#<commit\-ish>\fP or \fB#semver:<semver>\fP is
+  specified, then \fBmaster\fP is used\.
+  As with regular git dependencies, \fBdependencies\fP and \fBdevDependencies\fP will
+  be installed if the package has a \fBprepare\fP script, before the package is
+  done installing\.
   Examples:
 .P
 .RS 2
@@ -249,11 +282,13 @@ GIT_SSH_COMMAND='ssh \-i ~/\.ssh/custom_ident' npm install git+ssh://git@github\
 .fi
 .RE
 .IP \(bu 2
-\fBnpm install gist:[<githubname>/]<gistID>[#<commit\-ish>]\fP:
+\fBnpm install gist:[<githubname>/]<gistID>[#<commit\-ish>|#semver:<semver>]\fP:
   Install the package at \fBhttps://gist\.github\.com/gistID\fP by attempting to
   clone it using \fBgit\fP\|\. The GitHub username associated with the gist is
-  optional and will not be saved in \fBpackage\.json\fP if \fB\-S\fP or \fB\-\-save\fP is used\.
-  If you don't specify a \fIcommit\-ish\fR then \fBmaster\fP will be used\.
+  optional and will not be saved in \fBpackage\.json\fP\|\.
+  As with regular git dependencies, \fBdependencies\fP and \fBdevDependencies\fP will
+  be installed if the package has a \fBprepare\fP script, before the package is
+  done installing\.
   Example:
 .P
 .RS 2
@@ -265,7 +300,15 @@ GIT_SSH_COMMAND='ssh \-i ~/\.ssh/custom_ident' npm install git+ssh://git@github\
 \fBnpm install bitbucket:<bitbucketname>/<bitbucketrepo>[#<commit\-ish>]\fP:
   Install the package at \fBhttps://bitbucket\.org/bitbucketname/bitbucketrepo\fP
   by attempting to clone it using \fBgit\fP\|\.
-  If you don't specify a \fIcommit\-ish\fR then \fBmaster\fP will be used\.
+  If \fB#<commit\-ish>\fP is provided, it will be used to clone exactly that
+  commit\. If the commit\-ish has the format \fB#semver:<semver>\fP, \fB<semver>\fP can
+  be any valid semver range or exact version, and npm will look for any tags
+  or refs matching that range in the remote repository, much as it would for a
+  registry dependency\. If neither \fB#<commit\-ish>\fP or \fB#semver:<semver>\fP is
+  specified, then \fBmaster\fP is used\.
+  As with regular git dependencies, \fBdependencies\fP and \fBdevDependencies\fP will
+  be installed if the package has a \fBprepare\fP script, before the package is
+  done installing\.
   Example:
 .P
 .RS 2
@@ -277,12 +320,21 @@ GIT_SSH_COMMAND='ssh \-i ~/\.ssh/custom_ident' npm install git+ssh://git@github\
 \fBnpm install gitlab:<gitlabname>/<gitlabrepo>[#<commit\-ish>]\fP:
   Install the package at \fBhttps://gitlab\.com/gitlabname/gitlabrepo\fP
   by attempting to clone it using \fBgit\fP\|\.
-  If you don't specify a \fIcommit\-ish\fR then \fBmaster\fP will be used\.
+  If \fB#<commit\-ish>\fP is provided, it will be used to clone exactly that
+  commit\. If the commit\-ish has the format \fB#semver:<semver>\fP, \fB<semver>\fP can
+  be any valid semver range or exact version, and npm will look for any tags
+  or refs matching that range in the remote repository, much as it would for a
+  registry dependency\. If neither \fB#<commit\-ish>\fP or \fB#semver:<semver>\fP is
+  specified, then \fBmaster\fP is used\.
+  As with regular git dependencies, \fBdependencies\fP and \fBdevDependencies\fP will
+  be installed if the package has a \fBprepare\fP script, before the package is
+  done installing\.
   Example:
 .P
 .RS 2
 .nf
     npm install gitlab:mygitlabuser/myproject
+    npm install gitlab:myusr/myproj#semver:^5\.0
 .fi
 .RE
 
@@ -322,7 +374,7 @@ global \fBnode_modules\fP folder\. Only your direct dependencies will show in
 \fBnode_modules\fP and everything they depend on will be flattened in their
 \fBnode_modules\fP folders\. This obviously will eliminate some deduping\.
 .P
-The \fB\-\-ignore\-scripts\fP argument will cause npm to not execute any 
+The \fB\-\-ignore\-scripts\fP argument will cause npm to not execute any
 scripts defined in the package\.json\. See npm help 7 \fBnpm\-scripts\fP\|\.
 .P
 The \fB\-\-legacy\-bundling\fP argument will cause npm to install the package such
@@ -339,7 +391,7 @@ The \fB\-\-no\-optional\fP argument will prevent optional dependencies from
 being installed\.
 .P
 The \fB\-\-no\-shrinkwrap\fP argument, which will ignore an available
-shrinkwrap file and use the package\.json instead\.
+package lock or shrinkwrap file and use the package\.json instead\.
 .P
 The \fB\-\-nodedir=/path/to/node/source\fP argument will allow npm to find the
 node source code so that npm can compile native modules\.
@@ -397,7 +449,9 @@ A
 .RE
 .P
 Because B's D@1 will be installed in the top level, C now has to install D@2
-privately for itself\.
+privately for itself\. This algorithm is deterministic, but different trees may
+be produced if two dependencies are requested for installation in a different
+order\.
 .P
 See npm help 5 folders for a more detailed description of the specific
 folder structures that npm creates\.