deps: upgrade npm to 5.6.0

PR-URL: https://github.com/nodejs/node/pull/17777
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gibson Fahnestock <gibfahn@gmail.com>

17 files changed, 344 insertions, 734 deletions

diff --git a/deps/npm/test/tap/add-remote-git-file.js b/deps/npm/test/tap/add-remote-git-file.js
index 546a73ff65..20392af877 100644
--- a/deps/npm/test/tap/add-remote-git-file.js
+++ b/deps/npm/test/tap/add-remote-git-file.js
@@ -10,6 +10,7 @@ var rimraf = require('rimraf')
 var test = require('tap').test
 
 var npm = require('../../lib/npm.js')
+var fetchPackageMetadata = require('../../lib/fetch-package-metadata.js')
 var common = require('../common-tap.js')
 
 var pkg = resolve(__dirname, 'add-remote-git-file')
@@ -34,13 +35,15 @@ test('setup', function (t) {
 
 test('cache from repo', function (t) {
   process.chdir(pkg)
-  return npm.commands.cache.add(cloneURL).then((data) => {
+  fetchPackageMetadata(cloneURL, process.cwd(), {}, (err, manifest) => {
+    if (err) t.fail(err.message)
     t.equal(
-      url.parse(data.manifest._resolved).protocol,
+      url.parse(manifest._resolved).protocol,
       'git+file:',
       'npm didn\'t go crazy adding git+git+git+git'
     )
-    t.equal(data.manifest._spec.type, 'git', 'cached git')
+    t.equal(manifest._requested.type, 'git', 'cached git')
+    t.end()
   })
 })
 
diff --git a/deps/npm/test/tap/bearer-token-check.js b/deps/npm/test/tap/bearer-token-check.js
index 23870d2f21..e3af793e60 100644
--- a/deps/npm/test/tap/bearer-token-check.js
+++ b/deps/npm/test/tap/bearer-token-check.js
@@ -1,8 +1,9 @@
 var resolve = require('path').resolve
 var writeFileSync = require('graceful-fs').writeFileSync
 
+var fs = require('fs')
 var mkdirp = require('mkdirp')
-var mr = require('npm-registry-mock')
+var http = require('http')
 var osenv = require('osenv')
 var rimraf = require('rimraf')
 var test = require('tap').test
@@ -18,25 +19,29 @@ var tarballPath = '/scoped-underscore/-/scoped-underscore-1.3.1.tgz'
 var tarballURL = 'http://127.0.0.1:' + common.port + tarballPath
 var tarball = resolve(__dirname, '../fixtures/scoped-underscore-1.3.1.tgz')
 
-var server
-
-var EXEC_OPTS = { cwd: pkg }
-
-function mocks (server) {
-  var auth = 'Bearer 0xabad1dea'
-  server.get(tarballPath, { authorization: auth }).reply(403, {
-    error: 'token leakage',
-    reason: 'This token should not be sent.'
-  })
-  server.get(tarballPath).replyWithFile(200, tarball)
-}
+var EXEC_OPTS = { cwd: pkg, stdio: [0, 'pipe', 2] }
+
+var auth = 'Bearer 0xabad1dea'
+var server = http.createServer()
+server.on('request', (req, res) => {
+  if (req.method === 'GET' && req.url === tarballPath) {
+    if (req.headers.authorization === auth) {
+      res.writeHead(403, 'this token should not be sent')
+      res.end()
+    } else {
+      res.writeHead(200, 'ok')
+      res.end(fs.readFileSync(tarball))
+    }
+  } else {
+    res.writeHead(500)
+    res.end()
+  }
+})
 
 test('setup', function (t) {
-  mr({ port: common.port, plugin: mocks }, function (er, s) {
-    server = s
-    t.ok(s, 'set up mock registry')
+  server.listen(common.port, () => {
     setup()
-    t.end()
+    t.done()
   })
 })
 
@@ -44,7 +49,6 @@ test('authed npm install with tarball not on registry', function (t) {
   common.npm(
     [
       'install',
-      '--loglevel', 'silent',
       '--json',
       '--fetch-retries', 0,
       '--registry', common.registry,
@@ -52,7 +56,7 @@ test('authed npm install with tarball not on registry', function (t) {
     ],
     EXEC_OPTS,
     function (err, code, stdout, stderr) {
-      t.ifError(err, 'test runner executed without error')
+      if (err) throw err
       t.equal(code, 0, 'npm install exited OK')
       t.comment(stdout.trim())
       t.comment(stderr.trim())
@@ -79,9 +83,10 @@ test('authed npm install with tarball not on registry', function (t) {
 })
 
 test('cleanup', function (t) {
-  server.close()
-  cleanup()
-  t.end()
+  server.close(() => {
+    cleanup()
+    t.end()
+  })
 })
 
 var contents = '@scoped:registry=' + common.registry + '\n' +
diff --git a/deps/npm/test/tap/config-basic.js b/deps/npm/test/tap/config-basic.js
index b8102da90c..2787f81371 100644
--- a/deps/npm/test/tap/config-basic.js
+++ b/deps/npm/test/tap/config-basic.js
@@ -4,7 +4,6 @@ var common = require('./00-config-setup.js')
 var path = require('path')
 
 var projectData = {
-  'save-prefix': '~',
   'legacy-bundling': true
 }
 
diff --git a/deps/npm/test/tap/config-builtin.js b/deps/npm/test/tap/config-builtin.js
index 53d00a31a7..038f47dd12 100644
--- a/deps/npm/test/tap/config-builtin.js
+++ b/deps/npm/test/tap/config-builtin.js
@@ -15,7 +15,6 @@ var biData = { 'builtin-config': true }
 var cli = { foo: 'bar', heading: 'foo', 'git-tag-version': false }
 
 var projectData = {
-  'save-prefix': '~',
   'legacy-bundling': true
 }
 
diff --git a/deps/npm/test/tap/files-and-ignores.js b/deps/npm/test/tap/files-and-ignores.js
index 6d44f3ea35..6d8b43e9d5 100644
--- a/deps/npm/test/tap/files-and-ignores.js
+++ b/deps/npm/test/tap/files-and-ignores.js
@@ -626,6 +626,36 @@ test('folder-based inclusion works', function (t) {
   })
 })
 
+test('file that starts with @ sign included normally', (t) => {
+  const fixture = new Tacks(
+    Dir({
+      'package.json': File({
+        name: 'npm-test-files',
+        version: '1.2.5'
+      }),
+      '@sub1': Dir({
+        sub: Dir({
+          include1: File('')
+        })
+      }),
+      sub2: Dir({
+        '@include': File(''),
+        '@sub3': Dir({
+          include1: File('')
+        })
+      })
+    })
+  )
+  withFixture(t, fixture, function (done) {
+    t.ok(fileExists('@sub1/sub/include1'), '@ dir included')
+
+    t.ok(fileExists('sub2/@include'), '@ file included')
+    t.ok(fileExists('sub2/@sub3/include1'), 'nested @ dir included')
+
+    done()
+  })
+})
+
 function fileExists (file) {
   try {
     return !!fs.statSync(path.resolve(targetpath, 'package', file))
diff --git a/deps/npm/test/tap/install-package-lock-only.js b/deps/npm/test/tap/install-package-lock-only.js
new file mode 100644
index 0000000000..b117dc97e3
--- /dev/null
+++ b/deps/npm/test/tap/install-package-lock-only.js
@@ -0,0 +1,86 @@
+'use strict'
+var fs = require('fs')
+var path = require('path')
+var test = require('tap').test
+var mr = require('npm-registry-mock')
+var Tacks = require('tacks')
+var File = Tacks.File
+var Dir = Tacks.Dir
+var extend = Object.assign || require('util')._extend
+var common = require('../common-tap.js')
+
+var basedir = path.join(__dirname, path.basename(__filename, '.js'))
+var testdir = path.join(basedir, 'testdir')
+var cachedir = path.join(basedir, 'cache')
+var globaldir = path.join(basedir, 'global')
+var tmpdir = path.join(basedir, 'tmp')
+
+var pkgLockPath = path.join(testdir, 'package-lock.json')
+var nodeModulesPath = path.join(testdir, 'node_modules')
+
+var conf = {
+  cwd: testdir,
+  env: extend(extend({}, process.env), {
+    npm_config_cache: cachedir,
+    npm_config_tmp: tmpdir,
+    npm_config_prefix: globaldir,
+    npm_config_registry: common.registry,
+    npm_config_loglevel: 'warn'
+  })
+}
+
+var server
+var fixture = new Tacks(Dir({
+  cache: Dir(),
+  global: Dir(),
+  tmp: Dir(),
+  testdir: Dir({
+    'package.json': File({
+      name: 'install-package-lock-only',
+      version: '1.0.0',
+      dependencies: {
+        mkdirp: '^0.3.4'
+      }
+    })
+  })
+}))
+
+function setup () {
+  cleanup()
+  fixture.create(basedir)
+}
+
+function cleanup () {
+  fixture.remove(basedir)
+}
+
+test('setup', function (t) {
+  setup()
+  mr({port: common.port, throwOnUnmatched: true}, function (err, s) {
+    if (err) throw err
+    server = s
+    t.done()
+  })
+})
+
+test('package-lock-only', function (t) {
+  return common.npm(['install', '--package-lock-only'], conf).spread((code, stdout, stderr) => {
+    t.is(code, 0, 'command ran ok')
+    t.comment(stdout.trim())
+    t.comment(stderr.trim())
+    // Verify that node_modules does not exist
+    t.notOk(fs.existsSync(nodeModulesPath), 'ensure that node_modules does not exist')
+
+    // Verify that package-lock.json exists and has `mkdirp@0.3.5` in it.
+    t.ok(fs.existsSync(pkgLockPath), 'ensure that package-lock.json was created')
+    var pkgLock = JSON.parse(fs.readFileSync(pkgLockPath, 'utf-8'))
+    t.equal(pkgLock.dependencies.mkdirp.version, '0.3.5')
+    t.done()
+  })
+})
+
+test('cleanup', function (t) {
+  server.close()
+  cleanup()
+  t.done()
+})
diff --git a/deps/npm/test/tap/install-shrinkwrapped-git.js b/deps/npm/test/tap/install-shrinkwrapped-git.js
index f697980de9..db22acc7f6 100644
--- a/deps/npm/test/tap/install-shrinkwrapped-git.js
+++ b/deps/npm/test/tap/install-shrinkwrapped-git.js
@@ -30,6 +30,7 @@ var childPackageJSON = JSON.stringify({
 })
 
 test('setup', function (t) {
+  cleanup()
   setup(function (err, result) {
     t.ifError(err, 'git started up successfully')
 
diff --git a/deps/npm/test/tap/is-registry.js b/deps/npm/test/tap/is-registry.js
new file mode 100644
index 0000000000..832eb537d3
--- /dev/null
+++ b/deps/npm/test/tap/is-registry.js
@@ -0,0 +1,27 @@
+'use strict'
+const test = require('tap').test
+const npa = require('npm-package-arg')
+const isRegistry = require('../../lib/utils/is-registry.js')
+
+test('current npa', (t) => {
+  t.is(Boolean(isRegistry(npa('foo@1.0.0'))), true, 'version')
+  t.is(Boolean(isRegistry(npa('foo@^1.0.0'))), true, 'range')
+  t.is(Boolean(isRegistry(npa('foo@test'))), true, 'tag')
+  t.is(Boolean(isRegistry(npa('foo@git://foo.bar/test.git'))), false, 'git')
+  t.is(Boolean(isRegistry(npa('foo@foo/bar'))), false, 'github')
+  t.is(Boolean(isRegistry(npa('foo@http://example.com/example.tgz'))), false, 'remote')
+  t.is(Boolean(isRegistry(npa('foo@file:example.tgz'))), false, 'file')
+  t.is(Boolean(isRegistry(npa('foo@file:example/'))), false, 'dir')
+  t.done()
+})
+
+test('legacy spec data', (t) => {
+  t.is(Boolean(isRegistry({type: 'version'})), true, 'version')
+  t.is(Boolean(isRegistry({type: 'range'})), true, 'range')
+  t.is(Boolean(isRegistry({type: 'tag'})), true, 'tag')
+  t.is(Boolean(isRegistry({type: 'git'})), false, 'git')
+  t.is(Boolean(isRegistry({type: 'file'})), false, 'file')
+  t.is(Boolean(isRegistry({type: 'directory'})), false, 'directory')
+  t.is(Boolean(isRegistry({type: 'remote'})), false, 'remote')
+  t.done()
+})
diff --git a/deps/npm/test/tap/lockfile-http-deps.js b/deps/npm/test/tap/lockfile-http-deps.js
new file mode 100644
index 0000000000..058525c947
--- /dev/null
+++ b/deps/npm/test/tap/lockfile-http-deps.js
@@ -0,0 +1,91 @@
+'use strict'
+const fs = require('fs')
+var path = require('path')
+var test = require('tap').test
+var mr = require('npm-registry-mock')
+var Tacks = require('tacks')
+var File = Tacks.File
+var Dir = Tacks.Dir
+var extend = Object.assign || require('util')._extend
+var common = require('../common-tap.js')
+
+var basedir = path.join(__dirname, path.basename(__filename, '.js'))
+var testdir = path.join(basedir, 'testdir')
+var cachedir = path.join(basedir, 'cache')
+var globaldir = path.join(basedir, 'global')
+var tmpdir = path.join(basedir, 'tmp')
+
+var conf = {
+  cwd: testdir,
+  env: extend(extend({}, process.env), {
+    npm_config_cache: cachedir,
+    npm_config_tmp: tmpdir,
+    npm_config_prefix: globaldir,
+    npm_config_registry: common.registry,
+    npm_config_loglevel: 'warn'
+  })
+}
+
+var server
+var fixture = new Tacks(Dir({
+  cache: Dir(),
+  global: Dir(),
+  tmp: Dir(),
+  testdir: Dir({
+    'package-lock.json': File({
+      name: 'http-locks',
+      version: '1.0.0',
+      lockfileVersion: 1,
+      requires: true,
+      dependencies: {
+        minimist: {
+          version: common.registry + '/minimist/-/minimist-0.0.5.tgz',
+          integrity: 'sha1-16oye87PUY+RBqxrjwA/o7zqhWY='
+        }
+      }
+    }),
+    'package.json': File({
+      name: 'http-locks',
+      version: '1.0.0',
+      dependencies: {
+        minimist: common.registry + '/minimist/-/minimist-0.0.5.tgz'
+      }
+    })
+  })
+}))
+
+function setup () {
+  cleanup()
+  fixture.create(basedir)
+}
+
+function cleanup () {
+  fixture.remove(basedir)
+}
+
+test('setup', function (t) {
+  setup()
+  mr({port: common.port, throwOnUnmatched: true}, function (err, s) {
+    if (err) throw err
+    server = s
+    t.done()
+  })
+})
+
+test('http deps in lock files', function (t) {
+  common.npm(['install'], conf, function (err, code, stdout, stderr) {
+    if (err) throw err
+    t.is(code, 0, 'command ran ok')
+    t.comment(stdout.trim())
+    t.comment(stderr.trim())
+    const minPackage = JSON.parse(fs.readFileSync(testdir + '/node_modules/minimist/package.json'))
+    t.is(minPackage.version, '0.0.5', 'package version was maintained')
+    t.done()
+  })
+})
+
+test('cleanup', function (t) {
+  server.close()
+  cleanup()
+  t.done()
+})
diff --git a/deps/npm/test/tap/optional-metadep-rollback-collision.js b/deps/npm/test/tap/optional-metadep-rollback-collision.js
index ce62e005ba..f4ac6bdc79 100644
--- a/deps/npm/test/tap/optional-metadep-rollback-collision.js
+++ b/deps/npm/test/tap/optional-metadep-rollback-collision.js
@@ -158,7 +158,7 @@ test('setup', function (t) {
   })
 })
 test('go go test racer', function (t) {
-  common.npm(
+  return common.npm(
     [
       '--prefix', pkg,
       '--fetch-retries', '0',
@@ -175,19 +175,13 @@ test('go go test racer', function (t) {
         PATH: process.env.PATH,
         Path: process.env.Path
       },
-      stdio: [ 0, 'pipe', 2 ]
-    },
-    function (er, code, stdout, stderr) {
-      t.ifError(er, 'install ran to completion without error')
-      t.is(code, 0, 'npm install exited with code 0')
+      stdio: 'pipe'
+    }).spread((code, stdout, stderr) => {
+      t.comment(stdout.trim())
       t.comment(stderr.trim())
-      // stdout should be empty, because we only have one, optional, dep and
-      // if it fails we shouldn't try installing anything
-      t.equal(stdout, '')
+      t.is(code, 0, 'npm install exited with code 0')
       t.notOk(/not ok/.test(stdout), 'should not contain the string \'not ok\'')
-      t.end()
-    }
-  )
+    })
 })
 
 test('verify results', function (t) {
diff --git a/deps/npm/test/tap/process-logger.js b/deps/npm/test/tap/process-logger.js
new file mode 100644
index 0000000000..45c4e708cc
--- /dev/null
+++ b/deps/npm/test/tap/process-logger.js
@@ -0,0 +1,12 @@
+'use strict'
+const test = require('tap').test
+require('../../lib/npm.js')
+
+test('process logging', (t) => {
+  t.ok(process.listenerCount('log') >= 1, `log listener attached ${process.listenerCount('log')} >= 1`)
+  t.doesNotThrow(() => process.emit('log', 'error', 'test', 'this'), 'logging does not throw')
+  t.doesNotThrow(() => process.emit('log', 2348), 'invalid args do not throw')
+  t.doesNotThrow(() => process.emit('log', null), 'null does not throw')
+  t.doesNotThrow(() => process.emit('log', {}), 'obj does not throw')
+  t.done()
+})
diff --git a/deps/npm/test/tap/shrinkwrap-_auth.js b/deps/npm/test/tap/shrinkwrap-_auth.js
index d96cfa9dc3..5aff86fb08 100644
--- a/deps/npm/test/tap/shrinkwrap-_auth.js
+++ b/deps/npm/test/tap/shrinkwrap-_auth.js
@@ -1,10 +1,14 @@
+'use strict'
+
+var fs = require('fs')
 var path = require('path')
 var writeFileSync = require('graceful-fs').writeFileSync
 
 var mkdirp = require('mkdirp')
-var mr = require('npm-registry-mock')
 var osenv = require('osenv')
+var http = require('http')
 var rimraf = require('rimraf')
+var ssri = require('ssri')
 var test = require('tap').test
 
 var common = require('../common-tap.js')
@@ -16,26 +20,33 @@ var modules = path.resolve(pkg, 'node_modules')
 var tarballPath = '/scoped-underscore/-/scoped-underscore-1.3.1.tgz'
 var tarballURL = common.registry + tarballPath
 var tarball = path.resolve(__dirname, '../fixtures/scoped-underscore-1.3.1.tgz')
+var tarballIntegrity = ssri.fromData(fs.readFileSync(tarball)).toString()
 
 var _auth = '0xabad1dea'
-
-var server
-
-function mocks (server) {
-  var auth = 'Basic ' + _auth
-  server.get(tarballPath, { authorization: auth }).replyWithFile(200, tarball)
-  server.get(tarballPath).reply(401, {
-    error: 'unauthorized',
-    reason: 'You are not authorized to access this db.'
-  })
-}
+var server = http.createServer()
+const errors = []
+server.on('request', (req, res) => {
+  const auth = 'Basic ' + _auth
+  if (req.method === 'GET' && req.url === tarballPath) {
+    if (req.headers.authorization === auth) {
+      res.writeHead(200, 'ok')
+      res.end(fs.readFileSync(tarball))
+    } else {
+      res.writeHead(403, 'unauthorized')
+      errors.push("Got authorization of '" + req.headers.authorization + "' expected '" + auth + "'")
+      res.end()
+    }
+  } else {
+    res.writeHead(500)
+    errors.push('Unknown request: ' + req.method + ' ' + req.url)
+    res.end()
+  }
+})
 
 test('setup', function (t) {
-  mr({ port: common.port, plugin: mocks }, function (er, s) {
-    server = s
-    t.ok(s, 'set up mock registry')
+  server.listen(common.port, () => {
     setup()
-    t.end()
+    t.done()
   })
 })
 
@@ -43,15 +54,17 @@ test('authed npm install with shrinkwrapped global package using _auth', functio
   common.npm(
     [
       'install',
-      '--loglevel', 'warn',
+      '--loglevel', 'error',
       '--json',
       '--fetch-retries', 0,
+      '--registry', common.registry,
       '--userconfig', outfile
     ],
     {cwd: pkg, stdio: [0, 'pipe', 2]},
     function (err, code, stdout) {
       if (err) throw err
       t.equal(code, 0, 'npm install exited OK')
+      errors.forEach((err) => t.comment('Error: ' + err))
       try {
         var results = JSON.parse(stdout)
         t.match(results, {added: [{name: '@scoped/underscore', version: '1.3.1'}]}, '@scoped/underscore installed')
@@ -66,13 +79,13 @@ test('authed npm install with shrinkwrapped global package using _auth', functio
 })
 
 test('cleanup', function (t) {
-  server.close()
-  cleanup()
-  t.end()
+  server.close(() => {
+    cleanup()
+    t.end()
+  })
 })
 
-var contents = 'registry=' + common.registry + '\n' +
-               '_auth=' + _auth + '\n' +
+var contents = '_auth=' + _auth + '\n' +
                '\'always-auth\'=true\n'
 
 var json = {
@@ -86,9 +99,11 @@ var json = {
 var shrinkwrap = {
   name: 'test-package-install',
   version: '1.0.0',
+  lockfileVersion: 1,
   dependencies: {
     '@scoped/underscore': {
       resolved: tarballURL,
+      integrity: tarballIntegrity,
       version: '1.3.1'
     }
   }
diff --git a/deps/npm/test/tap/shrinkwrap-global-auth.js b/deps/npm/test/tap/shrinkwrap-global-auth.js
index be04d99c78..76fa0a4662 100644
--- a/deps/npm/test/tap/shrinkwrap-global-auth.js
+++ b/deps/npm/test/tap/shrinkwrap-global-auth.js
@@ -1,3 +1,6 @@
+'use strict'
+
+var fs = require('fs')
 var path = require('path')
 var writeFileSync = require('graceful-fs').writeFileSync
 
@@ -5,6 +8,7 @@ var mkdirp = require('mkdirp')
 var mr = require('npm-registry-mock')
 var osenv = require('osenv')
 var rimraf = require('rimraf')
+var ssri = require('ssri')
 var test = require('tap').test
 
 var common = require('../common-tap.js')
@@ -16,6 +20,7 @@ var modules = path.resolve(pkg, 'node_modules')
 var tarballPath = '/scoped-underscore/-/scoped-underscore-1.3.1.tgz'
 var tarballURL = common.registry + tarballPath
 var tarball = path.resolve(__dirname, '../fixtures/scoped-underscore-1.3.1.tgz')
+var tarballIntegrity = ssri.fromData(fs.readFileSync(tarball)).toString()
 
 var server
 
@@ -41,10 +46,11 @@ test('authed npm install with shrinkwrapped global package', function (t) {
   common.npm(
     [
       'install',
-      '--loglevel', 'warn',
+      '--loglevel', 'error',
       '--json',
       '--fetch-retries', 0,
-      '--userconfig', outfile
+      '--userconfig', outfile,
+      '--registry', common.registry
     ],
     {cwd: pkg, stdio: [0, 'pipe', 2]},
     function (err, code, stdout) {
@@ -84,9 +90,11 @@ var json = {
 var shrinkwrap = {
   name: 'test-package-install',
   version: '1.0.0',
+  lockfileVersion: 1,
   dependencies: {
     '@scoped/underscore': {
       resolved: tarballURL,
+      integrity: tarballIntegrity,
       version: '1.3.1'
     }
   }
diff --git a/deps/npm/test/tap/shrinkwrap-scoped-auth.js b/deps/npm/test/tap/shrinkwrap-scoped-auth.js
index 1b000f9385..72c3b51198 100644
--- a/deps/npm/test/tap/shrinkwrap-scoped-auth.js
+++ b/deps/npm/test/tap/shrinkwrap-scoped-auth.js
@@ -1,3 +1,6 @@
+'use strict'
+
+var fs = require('fs')
 var path = require('path')
 var writeFileSync = require('graceful-fs').writeFileSync
 
@@ -5,6 +8,7 @@ var mkdirp = require('mkdirp')
 var mr = require('npm-registry-mock')
 var osenv = require('osenv')
 var rimraf = require('rimraf')
+var ssri = require('ssri')
 var test = require('tap').test
 
 var common = require('../common-tap.js')
@@ -16,6 +20,7 @@ var modules = path.resolve(pkg, 'node_modules')
 var tarballPath = '/scoped-underscore/-/scoped-underscore-1.3.1.tgz'
 var tarballURL = common.registry + tarballPath
 var tarball = path.resolve(__dirname, '../fixtures/scoped-underscore-1.3.1.tgz')
+var tarballIntegrity = ssri.fromData(fs.readFileSync(tarball)).toString()
 
 var server
 
@@ -41,10 +46,11 @@ test('authed npm install with shrinkwrapped scoped package', function (t) {
   common.npm(
     [
       'install',
-      '--loglevel', 'warn',
+      '--loglevel', 'error',
       '--json',
       '--fetch-retries', 0,
-      '--userconfig', outfile
+      '--userconfig', outfile,
+      '--registry', common.registry
     ],
     {cwd: pkg, stdio: [0, 'pipe', 2]},
     function (err, code, stdout) {
@@ -83,9 +89,11 @@ var json = {
 var shrinkwrap = {
   name: 'test-package-install',
   version: '1.0.0',
+  lockfileVersion: 1,
   dependencies: {
     '@scoped/underscore': {
       resolved: tarballURL,
+      integrity: tarballIntegrity,
       version: '1.3.1'
     }
   }
diff --git a/deps/npm/test/tap/unit-gentlyrm.js b/deps/npm/test/tap/unit-gentlyrm.js
deleted file mode 100644
index 8ea0a11fc2..0000000000
--- a/deps/npm/test/tap/unit-gentlyrm.js
+++ /dev/null
@@ -1,387 +0,0 @@
-'use strict'
-var test = require('tap').test
-var requireInject = require('require-inject')
-var path = require('path')
-
-function error (code) {
-  var er = new Error()
-  er.code = code
-  return er
-}
-
-function platformPath (unixPath) {
-  if (unixPath[0] === '/') {
-    return path.resolve(unixPath)
-  } else {
-    return path.join.apply(path, unixPath.split('/'))
-  }
-}
-
-function makeObjUsePlatformPaths (obj) {
-  if (typeof obj === 'string') {
-    return platformPath(obj)
-  } else if (obj == null || typeof obj !== 'object') {
-    return obj
-  } else {
-    Object.keys(obj).forEach(function (key) {
-      var newKey = platformPath(key)
-      obj[key] = makeObjUsePlatformPaths(obj[key])
-      if (newKey !== key) {
-        obj[newKey] = obj[key]
-        delete obj[key]
-      }
-    })
-  }
-  return obj
-}
-
-function makeArgsUsePlatformPaths (fn) {
-  return function () {
-    var args = Array.prototype.slice.call(arguments)
-    return fn.apply(null, makeObjUsePlatformPaths(args))
-  }
-}
-
-function pathIs (t, arg1, arg2, msg) {
-  t.is(arg1, makeObjUsePlatformPaths(arg2), msg)
-}
-
-function pathIsDeeply (t, arg1, arg2, msg) {
-  t.isDeeply(arg1, makeObjUsePlatformPaths(arg2), msg)
-}
-
-function mockWith (fixture) {
-  makeObjUsePlatformPaths(fixture)
-  return {
-    '../../lib/npm.js': {},
-    'graceful-fs': {
-      lstat: function (path, cb) {
-        path = platformPath(path)
-        var entry = fixture[path]
-        if (!entry) return cb(error('ENOENT'))
-        cb(null, {
-          isDirectory: function () { return entry.type === 'directory' },
-          isSymbolicLink: function () { return entry.type === 'symlink' },
-          isFile: function () { return entry.type === 'file' || entry.type === 'cmdshim' || entry.type === 'error' }
-        })
-      },
-      readlink: function (path, cb) {
-        path = platformPath(path)
-        var entry = fixture[path]
-        if (!entry) return cb(error('ENOENT'))
-        if (entry.type !== 'symlink') return cb(error('EINVAL'))
-        cb(null, entry.dest)
-      }
-    },
-    'read-cmd-shim': function (path, cb) {
-      path = platformPath(path)
-      var entry = fixture[path]
-      if (!entry) return cb(error('ENOENT'))
-      if (entry.type === 'directory') return cb(error('EISDIR'))
-      if (entry.type === 'error') return cb(error(entry.code))
-      if (entry.type !== 'cmdshim') return cb(error('ENOTASHIM'))
-      cb(null, entry.dest)
-    }
-  }
-}
-
-test('readLinkOrShim', function (t) {
-  t.plan(10)
-
-  var mocks = mockWith({
-    '/path/to/directory': { type: 'directory' },
-    '/path/to/link': { type: 'symlink', dest: '../to/file' },
-    '/path/to/file': { type: 'file' },
-    '/path/to/cmdshim': { type: 'cmdshim', dest: '../to/file' },
-    '/path/to/invalid': { type: 'error', code: 'EINVAL' }
-  })
-
-  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mocks)
-  var readLinkOrShim = makeArgsUsePlatformPaths(gentlyRm._readLinkOrShim)
-
-  readLinkOrShim('/path/to/nowhere', function (er, path) {
-    t.is(er && er.code, 'ENOENT', 'missing files are errors')
-  })
-  readLinkOrShim('/path/to/invalid', function (er, path) {
-    t.is(er && er.code, 'EINVAL', 'other errors pass through too')
-  })
-  readLinkOrShim('/path/to/directory', function (er, path) {
-    t.ifError(er, "reading dirs isn't an error")
-    pathIs(t, path, null, 'reading non links/cmdshims gives us null')
-  })
-  readLinkOrShim('/path/to/file', function (er, path) {
-    t.ifError(er, "reading non-cmdshim files isn't an error")
-    pathIs(t, path, null, 'reading non links/cmdshims gives us null')
-  })
-  readLinkOrShim('/path/to/link', function (er, path) {
-    t.ifError(er, "reading links isn't an error")
-    pathIs(t, path, '../to/file', 'reading links works')
-  })
-  readLinkOrShim('/path/to/cmdshim', function (er, path) {
-    t.ifError(er, "reading cmdshims isn't an error")
-    pathIs(t, path, '../to/file', 'reading cmdshims works')
-  })
-  t.done()
-})
-
-test('resolveSymlink', function (t) {
-  t.plan(9)
-
-  var mocks = mockWith({
-    '/path/to/directory': { type: 'directory' },
-    '/path/to/link': { type: 'symlink', dest: '../to/file' },
-    '/path/to/file': { type: 'file' },
-    '/path/to/cmdshim': { type: 'cmdshim', dest: '../to/file' }
-  })
-
-  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mocks)
-  var resolveSymlink = makeArgsUsePlatformPaths(gentlyRm._resolveSymlink)
-
-  resolveSymlink('/path/to/nowhere', function (er, path) {
-    t.is(er && er.code, 'ENOENT', 'missing files are errors')
-  })
-
-  // these aren't symlinks so we get back what we passed in
-  resolveSymlink('/path/to/directory', function (er, path) {
-    t.ifError(er, "reading dirs isn't an error")
-    pathIs(t, path, '/path/to/directory', 'reading non links/cmdshims gives us path we passed in')
-  })
-  resolveSymlink('/path/to/file', function (er, path) {
-    t.ifError(er, "reading non-cmdshim files isn't an error")
-    pathIs(t, path, '/path/to/file', 'reading non links/cmdshims gives us the path we passed in')
-  })
-
-  // these are symlinks so the resolved version is platform specific
-  resolveSymlink('/path/to/link', function (er, path) {
-    t.ifError(er, "reading links isn't an error")
-    pathIs(t, path, '/path/to/file', 'reading links works')
-  })
-  resolveSymlink('/path/to/cmdshim', function (er, path) {
-    t.ifError(er, "reading cmdshims isn't an error")
-    pathIs(t, path, '/path/to/file', 'reading cmdshims works')
-  })
-  t.done()
-})
-
-test('readAllLinks', function (t) {
-  t.plan(16)
-
-  var mocks = mockWith({
-    '/path/to/directory': { type: 'directory' },
-    '/path/to/link': { type: 'symlink', dest: '../to/file' },
-    '/path/to/file': { type: 'file' },
-    '/path/to/cmdshim': { type: 'cmdshim', dest: '../to/file' },
-    '/path/to/linktolink': { type: 'symlink', dest: 'link' },
-    '/path/to/linktolink^2': { type: 'symlink', dest: 'linktolink' },
-    '/path/to/linktocmdshim': { type: 'symlink', dest: 'cmdshim' },
-    '/path/to/linktobad': { type: 'symlink', dest: '/does/not/exist' }
-  })
-
-  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mocks)
-  var readAllLinks = makeArgsUsePlatformPaths(gentlyRm._readAllLinks)
-
-  readAllLinks('/path/to/nowhere', function (er, path) {
-    t.is(er && er.code, 'ENOENT', 'missing files are errors')
-  })
-  readAllLinks('/path/to/directory', function (er, path) {
-    t.ifError(er, "reading dirs isn't an error")
-    pathIsDeeply(t, path, ['/path/to/directory'], 'reading non links/cmdshims gives us path we passed in')
-  })
-  readAllLinks('/path/to/file', function (er, path) {
-    t.ifError(er, "reading non-cmdshim files isn't an error")
-    pathIsDeeply(t, path, ['/path/to/file'], 'reading non links/cmdshims gives us the path we passed in')
-  })
-  readAllLinks('/path/to/linktobad', function (er, path) {
-    t.is(er && er.code, 'ENOENT', 'links to missing files are errors')
-  })
-  readAllLinks('/path/to/link', function (er, results) {
-    t.ifError(er, "reading links isn't an error")
-    pathIsDeeply(t, results, ['/path/to/link', '/path/to/file'], 'reading links works')
-  })
-  readAllLinks('/path/to/cmdshim', function (er, path) {
-    t.ifError(er, "reading cmdshims isn't an error")
-    pathIsDeeply(t, path, ['/path/to/cmdshim', '/path/to/file'], 'reading cmdshims works')
-  })
-  readAllLinks('/path/to/linktolink', function (er, path) {
-    t.ifError(er, "reading link to link isn't an error")
-    pathIsDeeply(t, path, ['/path/to/linktolink', '/path/to/link', '/path/to/file'], 'reading link to link works')
-  })
-  readAllLinks('/path/to/linktolink^2', function (er, path) {
-    t.ifError(er, "reading link to link to link isn't an error")
-    pathIsDeeply(t, path, ['/path/to/linktolink^2', '/path/to/linktolink', '/path/to/link', '/path/to/file'], 'reading link to link to link works')
-  })
-  readAllLinks('/path/to/linktocmdshim', function (er, path) {
-    t.ifError(er, "reading link to cmdshim isn't an error")
-    pathIsDeeply(t, path, ['/path/to/linktocmdshim', '/path/to/cmdshim', '/path/to/file'], 'reading link to cmdshim works')
-  })
-  t.done()
-})
-
-test('areAnyInsideAny', function (t) {
-  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mockWith({}))
-  var areAnyInsideAny = makeArgsUsePlatformPaths(gentlyRm._areAnyInsideAny)
-
-  var noneOneToOne = areAnyInsideAny(['/abc'], ['/xyz'])
-  t.is(noneOneToOne, false, 'none inside: one to one')
-  var noneOneToMany = areAnyInsideAny(['/abc'], ['/rst', '/uvw', '/xyz'])
-  t.is(noneOneToMany, false, 'none inside: one to many')
-  var noneManyToOne = areAnyInsideAny(['/abc', '/def', '/ghi'], ['/xyz'])
-  t.is(noneManyToOne, false, 'none inside: many to one')
-  var noneManyToMany = areAnyInsideAny(['/abc', '/def', '/ghi'], ['/rst', '/uvw', '/xyz'])
-  t.is(noneManyToMany, false, 'none inside: many to many')
-
-  var oneToOne = areAnyInsideAny(['/one/toOne'], ['/one'])
-  pathIsDeeply(t, oneToOne, {target: '/one/toOne', path: '/one'}, 'first: one to one')
-
-  var firstOneToMany = areAnyInsideAny(['/abc/def'], ['/abc', '/def', '/ghi'])
-  pathIsDeeply(t, firstOneToMany, {target: '/abc/def', path: '/abc'}, 'first: one to many')
-  var secondOneToMany = areAnyInsideAny(['/def/ghi'], ['/abc', '/def', '/ghi'])
-  pathIsDeeply(t, secondOneToMany, {target: '/def/ghi', path: '/def'}, 'second: one to many')
-  var lastOneToMany = areAnyInsideAny(['/ghi/jkl'], ['/abc', '/def', '/ghi'])
-  pathIsDeeply(t, lastOneToMany, {target: '/ghi/jkl', path: '/ghi'}, 'last: one to many')
-
-  var firstManyToOne = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/abc'])
-  pathIsDeeply(t, firstManyToOne, {target: '/abc/def', path: '/abc'}, 'first: many to one')
-  var secondManyToOne = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/uvw'])
-  pathIsDeeply(t, secondManyToOne, {target: '/uvw/def', path: '/uvw'}, 'second: many to one')
-  var lastManyToOne = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/xyz'])
-  pathIsDeeply(t, lastManyToOne, {target: '/xyz/def', path: '/xyz'}, 'last: many to one')
-
-  var firstToFirst = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/abc', '/uvw', '/xyz'])
-  pathIsDeeply(t, firstToFirst, {target: '/abc/def', path: '/abc'}, 'first to first: many to many')
-  var firstToSecond = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/nope', '/abc', '/xyz'])
-  pathIsDeeply(t, firstToSecond, {target: '/abc/def', path: '/abc'}, 'first to second: many to many')
-  var firstToLast = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/nope', '/nooo', '/abc'])
-  pathIsDeeply(t, firstToLast, {target: '/abc/def', path: '/abc'}, 'first to last: many to many')
-
-  var secondToFirst = areAnyInsideAny(['/!!!', '/abc/def', '/xyz/def'], ['/abc', '/uvw', '/xyz'])
-  pathIsDeeply(t, secondToFirst, {target: '/abc/def', path: '/abc'}, 'second to first: many to many')
-  var secondToSecond = areAnyInsideAny(['/!!!', '/abc/def', '/xyz/def'], ['/nope', '/abc', '/xyz'])
-  pathIsDeeply(t, secondToSecond, {target: '/abc/def', path: '/abc'}, 'second to second: many to many')
-  var secondToLast = areAnyInsideAny(['/!!!', '/abc/def', '/uvw/def'], ['/nope', '/nooo', '/abc'])
-  pathIsDeeply(t, secondToLast, {target: '/abc/def', path: '/abc'}, 'second to last: many to many')
-
-  var lastToFirst = areAnyInsideAny(['/!!!', '/???', '/abc/def'], ['/abc', '/uvw', '/xyz'])
-  pathIsDeeply(t, lastToFirst, {target: '/abc/def', path: '/abc'}, 'last to first: many to many')
-  var lastToSecond = areAnyInsideAny(['/!!!', '/???', '/abc/def'], ['/nope', '/abc', '/xyz'])
-  pathIsDeeply(t, lastToSecond, {target: '/abc/def', path: '/abc'}, 'last to second: many to many')
-  var lastToLast = areAnyInsideAny(['/!!!', '/???', '/abc/def'], ['/nope', '/nooo', '/abc'])
-  pathIsDeeply(t, lastToLast, {target: '/abc/def', path: '/abc'}, 'last to last: many to many')
-
-  t.done()
-})
-
-test('isEverInside', function (t) {
-  t.plan(15)
-
-  var mocks = mockWith({
-    '/path/other/link': { type: 'symlink', dest: '../to/file' },
-    '/path/to/file': { type: 'file' },
-    '/path/to': { type: 'directory' },
-    '/linkpath': { type: 'symlink', dest: '../path/to' },
-    '/path/to/invalid': { type: 'error', code: 'EINVAL' }
-  })
-
-  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mocks)
-  var isEverInside = makeArgsUsePlatformPaths(gentlyRm._isEverInside)
-
-  isEverInside('/path/to/file', ['/path/to', '/path/to/invalid'], function (er, inside) {
-    t.ifError(er)
-    pathIsDeeply(t, inside, {target: '/path/to/file', path: '/path/to'}, 'bad paths are ignored if something matches')
-  })
-
-  isEverInside('/path/to/invalid', ['/path/to/invalid'], function (er, inside) {
-    t.is(er && er.code, 'EINVAL', 'errors bubble out')
-  })
-
-  isEverInside('/path/to/file', ['/ten'], function (er, inside) {
-    t.ifError(er)
-    t.is(inside, false, 'not inside')
-  })
-  isEverInside('/path/to/nowhere', ['/ten'], function (er, inside) {
-    t.ifError(er)
-    t.is(inside, false, 'missing target')
-  })
-
-  isEverInside('/path/to/file', ['/path/to'], function (er, inside) {
-    t.ifError(er)
-    pathIsDeeply(t, inside, {target: '/path/to/file', path: '/path/to'}, 'plain file in plain path')
-  })
-  isEverInside('/path/other/link', ['/path/to'], function (er, inside) {
-    t.ifError(er)
-    pathIsDeeply(t, inside, {target: '/path/to/file', path: '/path/to'}, 'link in plain path')
-  })
-
-  isEverInside('/path/to/file', ['/linkpath'], function (er, inside) {
-    t.ifError(er)
-    pathIsDeeply(t, inside, {target: '/path/to/file', path: '/path/to'}, 'plain file in link path')
-  })
-  isEverInside('/path/other/link', ['/linkpath'], function (er, inside) {
-    t.ifError(er)
-    pathIsDeeply(t, inside, {target: '/path/to/file', path: '/path/to'}, 'link in link path')
-  })
-
-  t.done()
-})
-
-test('isSafeToRm', function (t) {
-  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mockWith({}))
-  var isSafeToRm = makeArgsUsePlatformPaths(gentlyRm._isSafeToRm)
-
-  t.plan(12)
-
-  function testIsSafeToRm (t, parent, target, shouldPath, shouldBase, msg) {
-    isSafeToRm(parent, target, function (er, path, base) {
-      t.ifError(er, msg + ' no error')
-      pathIs(t, path, shouldPath, msg + ' path')
-      pathIs(t, base, shouldBase, msg + ' base')
-    })
-  }
-
-  function testNotIsSafeToRm (t, parent, target, msg) {
-    isSafeToRm(parent, target, function (er) {
-      t.is(er && er.code, 'EEXIST', msg + ' error')
-    })
-  }
-
-  var unmanagedParent = {path: '/foo', managed: false}
-  var managedParent = {path: '/foo', managed: true}
-  var targetInParent = {
-    path: '/foo/bar/baz',
-    inParent: {
-      target: '/foo/bar/baz',
-      path: '/foo'
-    }
-  }
-  var targetLinkInParent = {
-    path: '/foo/bar/baz',
-    inParent: {
-      target: '/other/area/baz',
-      path: '/other/area'
-    }
-  }
-  var targetManagedLinkNotInParent = {
-    path: '/foo/bar/baz',
-    managed: true,
-    inParent: false,
-    symlink: '/foo/bar/bark'
-  }
-  var targetUnmanagedLink = {
-    path: '/not/managed/baz',
-    managed: false,
-    inParent: false,
-    symlink: '/not/managed/foo'
-  }
-  var targetUnmanagedFile = {
-    path: '/not/managed/baz',
-    managed: false,
-    inParent: false,
-    symlink: false
-  }
-  testNotIsSafeToRm(t, unmanagedParent, targetInParent, 'unmanaged parent')
-  testIsSafeToRm(t, managedParent, targetInParent, '/foo/bar/baz', '/foo', 'path is in parent')
-  testIsSafeToRm(t, managedParent, targetLinkInParent, '/foo/bar/baz', '/foo/bar', 'path links to parent')
-  testIsSafeToRm(t, managedParent, targetManagedLinkNotInParent, undefined, undefined, 'managed but not owned by package')
-  testNotIsSafeToRm(t, managedParent, targetUnmanagedLink, 'unmanaged link')
-  testNotIsSafeToRm(t, managedParent, targetUnmanagedFile, 'unmanaged file')
-})
diff --git a/deps/npm/test/tap/unit-link.js b/deps/npm/test/tap/unit-link.js
deleted file mode 100644
index 4f4083e110..0000000000
--- a/deps/npm/test/tap/unit-link.js
+++ /dev/null
@@ -1,281 +0,0 @@
-'use strict'
-var util = require('util')
-var test = require('tap').test
-var requireInject = require('require-inject')
-var dezalgo = require('dezalgo')
-var mkdirp = require('mkdirp')
-var path = require('path')
-
-test('gently/force', function (t) {
-  t.plan(5)
-
-  linkOk(t, 'gently=true, force=false, works', {
-    // args
-    from: 'wibble',
-    to: '/foo/bar/baz',
-    gently: true,
-    abs: true,
-    force: false,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: true}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/bar/wibble': {isLink: false}},
-    stat: {'/foo/bar/wibble': true},
-    symlink: {'/foo/bar/wibble': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-
-  linkNotOk(t, 'gently=true, force=false, does not work', {
-    // args
-    from: 'wibble',
-    to: '/foo/bar/baz',
-    gently: true,
-    abs: true,
-    force: false,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: false}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/bar/wibble': {isLink: false}},
-    stat: {'/foo/bar/wibble': true},
-    symlink: {'/foo/bar/wibble': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-
-  linkOk(t, 'gently=false, force=false, aok', {
-    // args
-    from: 'wibble',
-    to: '/foo/bar/baz',
-    gently: false,
-    abs: true,
-    force: false,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: false}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/bar/wibble': {isLink: false}},
-    stat: {'/foo/bar/wibble': true},
-    symlink: {'/foo/bar/wibble': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-
-  linkOk(t, 'gently=true, force=true, aok', {
-    // args
-    from: 'wibble',
-    to: '/foo/bar/baz',
-    gently: true,
-    abs: true,
-    force: true,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: false}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/bar/wibble': {isLink: false}},
-    stat: {'/foo/bar/wibble': true},
-    symlink: {'/foo/bar/wibble': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-
-  linkOk(t, 'gently=false, force=true, aok', {
-    // args
-    from: 'wibble',
-    to: '/foo/bar/baz',
-    gently: false,
-    abs: true,
-    force: true,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: false}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/bar/wibble': {isLink: false}},
-    stat: {'/foo/bar/wibble': true},
-    symlink: {'/foo/bar/wibble': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-})
-
-test('abs, noabs', function (t) {
-  t.plan(4)
-
-  linkOk(t, 'abs', {
-    // args
-    from: 'wibble',
-    to: '/foo/bar/baz',
-    gently: true,
-    abs: true,
-    force: false,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: true}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/bar/wibble': {isLink: false}},
-    stat: {'/foo/bar/wibble': true},
-    symlink: {'/foo/bar/wibble': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-
-  linkOk(t, 'relative', {
-    // args
-    from: 'wibble',
-    to: '/foo/bar/baz',
-    gently: true,
-    abs: false,
-    force: false,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: true}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/bar/wibble': {isLink: false}},
-    stat: {'/foo/bar/wibble': true},
-    symlink: {'wibble': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-
-  linkOk(t, 'relative ..', {
-    // args
-    from: '../wibble/bark/blump',
-    to: '/foo/bar/baz',
-    gently: true,
-    abs: false,
-    force: false,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: true}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/wibble/bark/blump': {isLink: false}},
-    stat: {'/foo/wibble/bark/blump': true},
-    symlink: {'../wibble/bark/blump': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-
-  linkOk(t, 'relative .. deep', {
-    // args
-    from: 'zib/zap/../../../wibble/bark/blump',
-    to: '/foo/bar/baz',
-    gently: true,
-    abs: false,
-    force: false,
-
-    // expect
-    rm: {'/foo/bar/baz': {gently: true}},
-    mkdir: {'/foo/bar': true},
-    lstat: {'/foo/wibble/bark/blump': {isLink: false}},
-    stat: {'/foo/wibble/bark/blump': true},
-    symlink: {'../wibble/bark/blump': {'/foo/bar/baz': 'junction'}},
-    readlink: {}
-  })
-})
-
-function linkOk (t, msg, opts) {
-  testLink(opts, function (err) {
-    t.ifError(err, msg)
-  })
-}
-
-function linkNotOk (t, msg, opts) {
-  testLink(opts, function (err) {
-    t.ok(err, msg)
-  })
-}
-
-function platformPath (unixPath) {
-  if (unixPath[0] === '/') {
-    return path.resolve(unixPath)
-  } else {
-    return path.join.apply(path, unixPath.split('/'))
-  }
-}
-
-function platformerize (obj) {
-  Object.keys(obj).forEach(function (key) {
-    var newKey = platformPath(key)
-    if (typeof obj[key] === 'object') {
-      platformerize(obj[key])
-    } else if (typeof obj[key] === 'string') {
-      obj[key] = platformPath(obj[key])
-    }
-    if (newKey !== key) {
-      obj[newKey] = obj[key]
-      delete obj[key]
-    }
-  })
-}
-
-function testLink (opts, cb) {
-  var mkdirpMock = dezalgo(function (dir, cb) {
-    if (opts.mkdir[dir]) {
-      cb()
-    } else {
-      cb(new Error('mkdirp failed: ' + util.inspect(dir)))
-    }
-  })
-  // sync version used by istanbul for test coverage
-  // we shouldn't have to do this ;.;
-  // require-inject and/or instanbul will need patching
-  mkdirpMock.sync = mkdirp.sync
-
-  // convert any paths in our opts into platform specific paths, for windows support.
-  platformerize(opts)
-
-  var link = requireInject('../../lib/utils/link.js', {
-    '../../lib/npm.js': {
-      config: {
-        get: function (name) {
-          if (name !== 'force') return new Error('unknown config key: ' + name)
-          return opts.force
-        }
-      }
-    },
-    '../../lib/utils/gently-rm.js': dezalgo(function (toRemove, gently, basedir, cb) {
-      if (opts.rm[toRemove] && opts.rm[toRemove].gently === gently) {
-        cb()
-      } else {
-        cb(new Error('Removing toRemove: ' + util.inspect(toRemove) +
-          ' gently: ' + util.inspect(gently) +
-          ' not allowed: ' + util.inspect(opts.rm)))
-      }
-    }),
-    'mkdirp': mkdirpMock,
-    'graceful-fs': {
-      'stat': dezalgo(function (file, cb) {
-        if (opts.stat[file]) {
-          cb(null, {})
-        } else {
-          cb(new Error('stat failed for: ' + util.inspect(file)))
-        }
-      }),
-      'lstat': dezalgo(function (file, cb) {
-        if (opts.lstat[file]) {
-          var linkStat = opts.lstat[file]
-          cb(null, {
-            isSymbolicLink: function () {
-              return linkStat.isLink
-            }
-          })
-        } else {
-          cb(new Error('lstat failed for: ' + util.inspect(file)))
-        }
-      }),
-      'symlink': dezalgo(function (from, to, type, cb) {
-        if (!cb) {
-          cb = type
-          type = null
-        }
-        if (opts.symlink[from] && opts.symlink[from][to] === type) {
-          cb()
-        } else {
-          cb(new Error('symlink failed from: ' + util.inspect(from) + ' to: ' + util.inspect(to) + ' type: ' + util.inspect(type)))
-        }
-      }),
-      'readlink': function (file, cb) {
-        if (opts.readlink[file]) {
-          cb()
-        } else {
-          cb(new Error('readlink failed for: ' + util.inspect(file)))
-        }
-      }
-    }
-  })
-  link(opts.from, opts.to, opts.gently, opts.abs, cb)
-}
diff --git a/deps/npm/test/tap/update-examples.js b/deps/npm/test/tap/update-examples.js
index 5484478955..532a67f386 100644
--- a/deps/npm/test/tap/update-examples.js
+++ b/deps/npm/test/tap/update-examples.js
@@ -125,7 +125,7 @@ function mockInstaller (where, dryrun, what) {
 }
 mockInstaller.prototype = {}
 mockInstaller.prototype.run = function (cb) {
-  cb()
+  return cb ? cb() : Promise.resolve()
 }
 
 var npm = requireInject.installGlobally('../../lib/npm.js', {