"Fossies" - the Fresh Open Source Software Archive

Member "node-v12.18.4-win-x86/node_modules/npm/changelogs/CHANGELOG-5.md" (14 Feb 2020, 134900 Bytes) of package /windows/www/node-v12.18.4-win-x86.zip:


As a special service "Fossies" has tried to format the requested source page into HTML format (assuming markdown format). Alternatively you can here view or download the uninterpreted source code file. A member file download can also be achieved by clicking within a package contents listing on the according byte size field.

v5.10.0 (2018-05-10):

AUDIT SHOULDN’T WAIT FOREVER

This will likely be reduced further with the goal that the audit process shouldn’t noticibly slow down your builds regardless of your network situation.

v5.10.0-next.1 (2018-05-07):

EXTENDED npm init SCAFFOLDING

Thanks to the wonderful efforts of [@jdalton](https://github.com/jdalton) of lodash fame, npm init can now be used to invoke custom scaffolding tools!

You can now do things like npm init react-app or npm init esm to scaffold an npm package by running create-react-app and create-esm, respectively. This also adds an npm create alias, to correspond to Yarn’s yarn create feature, which inspired this.

DEPENDENCY AUDITING

This version of npm adds a new command, npm audit, which will run a security audit of your project’s dependency tree and notify you about any actions you may need to take.

The registry-side services required for this command to work will be available on the main npm registry in the coming weeks. Until then, you won’t get much out of trying to use this on the CLI.

As part of this change, the npm CLI now sends scrubbed and cryptographically anonymized metadata about your dependency tree to your configured registry, to allow notifying you about the existence of critical security flaws. For details about how the CLI protects your privacy when it shares this metadata, see npm help audit, or read the docs for npm audit online. You can disable this altogether by doing npm config set audit false, but will no longer benefit from the service.

CTRL-C OUT DURING PACKAGE EXTRACTION AS MUCH AS YOU WANT!

SHRONKWRAPS AND LACKFILES

If a published modules had legacy npm-shrinkwrap.json we were saving ordinary registry dependencies (name@version) to your package-lock.json as https:// URLs instead of versions.

MORE package-lock.json FORMAT CHANGES?!

DOCUMENTATION IMPROVEMENTS

BUGFIXES

DOCS

DEPENDENCY UPDATES

v5.10.0-next.0 (2018-04-12):

NEW FEATURES

BUG FIXES

DEPENDENCY UPDATES

v5.9.0 (2018-03-23):

Coming to you this week are a fancy new package view, pack/publish previews and a handful of bug fixes! Let’s get right in!

NEW PACKAGE VIEW

There’s a new npm view in town. You might it as npm info or npm show. The new output gives you a nicely summarized view that for most packages fits on one screen. If you ask it for --json you’ll still get the same results, so your scripts should still work fine.

PACK AND PUBLISH PREVIEWS

The npm pack and npm publish commands print out a summary of the files included in the package. They also both now take the --dry-run flag, so you can double check your .npmignore settings before doing a publish.

MERGE CONFLICT, SMERGE CONFLICT

If you resolve a package-lock.json merge conflict with npm install we now suggest you setup a merge driver to handle these automatically for you. If you’re reading this and you’d like to set it up now, run:

npx npm-merge-driver install -g

MISC BITS

DEPENDENCY UPDATES

v5.8.0 (2018-03-08):

Hey again, everyone! While last release was focused largely around PRs from the CLI team, this release is mostly pulling in community PRs in npm itself and its dependencies! We’ve got a good chunk of wonderful contributions for y’all, and even new features and performance improvements! 🎉

We’re hoping to continue our biweekly (as in every-other-week biweekly) release schedule from now on, so you should be seeing more steady npm releases from here on out. And that’s good, ’cause we’ve got a ton of new stuff on our roadmap for this year. Keep an eye out for exciting news. 👀

FEATURES

NPM CI

I hope y’all have been having fun with npm ci so far! Since this is the first release since that went out, we’ve had a few fixes and improvements now that folks have actually gotten their hands on it! Benchmarks have been super promising so far, and I’ve gotten messages from a lot of you saying you’ve sped up your CI work by 2-5x in some cases! Have a good example? Tell us on Twitter!

npm ci is, right now, the fastest installer you can use in CI situations, so go check it out if you haven’t already! We’ll continue doing performance improvements on it, and a lot of those will help make npm install fast as well. 🏎😎

This libcipm release includes a number of improvements:

BUGFIXES

DOCUMENTATION

MISC

OTHER DEPENDENCY BUMPS

v5.7.1 (2018-02-22):

This release reverts a patch that could cause some ownership changes on system files when running from some directories when also using sudo. 😲

Thankfully, it only affected users running npm@next, which is part of our staggered release system, which we use to prevent issues like this from going out into the wider world before we can catch them. Users on latest would have never seen this!

The original patch was added to increase consistency and reliability of methods npm uses to avoid writing files as root in places it shouldn’t, but the change was applied in places that should have used regular mkdirp. This release reverts that patch.

v5.7.0 (2018-02-20):

Hey y’all, it’s been a while. Expect our release rate to increase back to normal here, as we’ve got a lot in the pipeline. Right now we’ve got a bunch of things from folks at npm. In the next release we’ll be focusing on user contributions and there are a lot of them queued up!

This release brings a bunch of exciting new features and bug fixes.

PACKAGE-LOCK GIT MERGE CONFLICT RESOLUTION

Allow npm install to fix package-lock.json and npm-shrinkwrap.json files that have merge conflicts in them without your having to edit them. It works in conjunction with npm-merge-driver to entirely eliminate package-lock merge conflicts.

NPM CI

The new npm ci command installs from your lock-file ONLY. If your package.json and your lock-file are out of sync then it will report an error.

It works by throwing away your node_modules and recreating it from scratch.

Beyond guaranteeing you that you’ll only get what is in your lock-file it’s also much faster (2x-10x!) than npm install when you don’t start with a node_modules.

As you may take from the name, we expect it to be a big boon to continuous integration environments. We also expect that folks who do production deploys from git tags will see major gains.

OTHER NEW FEATURES

BIG FIXES TO PRUNING

BUG FIXES TO TOKENS AND PROFILES

OTHER BUG FIXES

DEPENDENCY UPDATES

v5.6.0 (2017-11-27):

Features!

You may have noticed this is a semver-minor bump. Wondering why? This is why!

Node 9

Previously, it turns out npm broke on the latest Node, node@9. We went ahead and fixed it up so y’all should be able to use the latest npm again!

Bug Fixes

UX

Refactors

Usually, we don’t include internal refactor stuff in our release notes, but it’s worth calling out some of them because they’re part of a larger effort the CLI team and associates are undertaking to modularize npm itself so other package managers and associated tools can reuse all that code!

Docs

Dependency Bumps

v5.5.1 (2017-10-04):

A very quick, record time, patch release, of a bug fix to a (sigh) last minute bug fix.

v5.5.0 (2017-10-04):

Hey y’all, this is a big new feature release! We’ve got some security related goodies plus a some quality-of-life improvements for anyone who uses the public registry (so, virtually everyone).

The changes largely came together in one piece, so I’m just gonna leave the commit line here:

TWO FACTOR AUTHENTICATION

You can now enable two-factor authentication for your npm account. You can even do it from the CLI. In fact, you have to, for the time being:

npm profile enable-tfa

With the default two-factor authentication mode you’ll be prompted to enter a one-time password when logging in, when publishing and when modifying access rights to your modules.

TOKEN MANAGEMENT

You can now create, list and delete authentication tokens from the comfort of the command line. Authentication tokens created this way can have NEW restrictions placed on them. For instance, you can create a read-only token to give to your CI. It will be able to download your private modules but it won’t be able to publish or modify modules. You can also create tokens that can only be used from certain network addresses. This way you can lock down access to your corporate VPN or other trusted machines.

Deleting tokens isn’t new, you could do it via the website but now you can do it via the CLI as well.

CHANGE YOUR PASSWORD, SET YOUR EMAIL

You can finally change your password from the CLI with npm profile set password! You can also update your email address with npm profile set email <address>. If you change your email address we’ll send you a new verification email so you verify that its yours.

AND EVERYTHING ELSE ON YOUR PROFILE

You can also update all of the other attributes of your profile that previously you could only update via the website: fullname, homepage, freenode, twitter and github.

AVAILABLE STAND ALONE

All of these features were implemented in a stand alone library, so if you have use for them in your own project you can find them in npm-profile on the registry. There’s also a little mini-cli written just for it at npm-profile-cli. You might also be interested in the API documentation for these new features: user profile editing and authentication.

BUG FIXES

DEPENDENCY UPDATES

v5.4.2 (2017-09-14):

This is a small bug fix release wrapping up most of the issues introduced with 5.4.0.

Bugs

Ux

Docs

v5.4.1 (2017-09-06):

This is a very small bug fix release to fix a problem where permissions on installed binaries were being set incorrectly.

v5.4.0 (2017-08-22):

Here’s another small big release, with a handful bunch of fixes and a couple of small new features! This release has been incubating rather longer than usual and it’s grown quite a bit in that time. I’m also excited to say that it has contributions from 27 different folks, which is a new record for us. Our previous record was 5.1.0 at 21. Before that the record had been held by 1.3.16 since December of 2013.

chart of contributor counts by version, showing an increasing rate over time and spikes mid in the 1.x series and later at 5.x

If you can’t get enough of the bleeding edge, I encourage you to check out our canary release of npm. Get it with npm install -g npmc. It’s going to be seeing some exciting stuff in the next couple of weeks, starting with a rewritten npm dedupe, but moving on to… well, you’ll just have to wait and find out.

PERFORMANCE

FEATURES

BUGFIXES

DOCUMENTATION

POSSIBLY INTERESTING DEPENDENCY UPDATES

CHORES

v5.3.0 (2017-07-12):

As mentioned before, we’re continuing to do relatively rapid, smaller releases as we keep working on stomping out npm@5 issues! We’ve made a lot of progress since 5.0 already, and this release is no exception.

FEATURES

BUGFIXES

DOCUMENTATION

Have we mentioned we really like documentation patches? Keep sending them in! Small patches are just fine, and they’re a great way to get started contributing to npm!

v5.2.0 (2017-07-05):

It’s only been a couple of days but we’ve got some bug fixes we wanted to get out to you all. We also believe that npx is ready to be bundled with npm, which we’re really excited about!

npx!!!

npx is a tool intended to help round out the experience of using packages from the npm registry — the same way npm makes it super easy to install and manage dependencies hosted on the registry, npx is meant to make it easy to use CLI tools and other executables hosted on the registry. It greatly simplifies a number of things that, until now, required a bit of ceremony to do with plain npm.

[@zkat](https://github.com/zkat) has a great introduction post to npx that I highly recommend you give a read

BUG FIXES

DOC FIXES

v5.1.0 (2017-07-05):

Hey y’all~

We’ve got some goodies for you here, including npm@5’s first semver-minor release! This version includes a huge number of fixes, particularly for some of the critical bugs users were running into after upgrading npm. You should overall see a much more stable experience, and we’re going to continue hacking on fixes for the time being. Semver-major releases, specially for tools like npm, are bound to cause some instability, and getting npm@5 stable is the CLI team’s top priority for now!

Not that bugfixes are the only things that landed, either: between improvements that fell out of the bugfixes, and some really cool work by community members like [@mikesherov](https://github.com/mikesherov), npm@5.1.0 is twice as fast as npm@5.0.0 in some benchmarks. We’re not stopping there, either: you can expect a steady stream of speed improvements over the course of the year. It’s not top priority, but we’ll keep doing what we can to make sure npm saves its users as much time as possible.

Hang on to your seats. At 100 commits, this release is a bit of a doozy. 😎

FEATURES

Semver-minor releases, of course, mean that there’s a new feature somewhere, right? Here’s what’s bumping that number for us this time:

PERFORMANCE

BUGFIXES

DOCS

MISC

Not all contributions need to be visible features, docs, or bugfixes! It’s super helpful when community members go over our code and help clean it up, too!

v5.0.4 (2017-06-13):

Hey y’all. This is another minor patch release with a variety of little fixes we’ve been accumulating~

v5.0.3 (2017-06-05)

Happy Monday, y’all! We’ve got another npm release for you with the fruits of our ongoing bugsquashing efforts. You can expect at least one more this week, but probably more – and as we announced last week, we’ll be merging fixes more rapidly into the npmc canary so you can get everything as soon as possible!

Hope y’all are enjoying npm5 in the meantime, and don’t hesitate to file issues for anything you find! The goal is to get this release rock-solid as soon as we can. 💚

v5.0.2 (2017-06-02)

Here’s another patch release, soon after the other!

This particular release includes a slew of fixes to npm’s git support, which was causing some issues for a chunk of people, specially those who were using self-hosted/Enterprise repos. All of those should be back in working condition now.

There’s another shiny thing you might wanna know about: npm has a Canary release now! The npm5 experiment we did during our beta proved to be incredibly successful: users were able to have a tight feedback loop between reports and getting the bugfixes they needed, and the CLI team was able to roll out experimental patches and have the community try them out right away. So we want to keep doing that.

From now on, you’ll be able to install the ‘npm canary’ with npm i -g npmc. This release will be a separate binary (npmc. Because canary. Get it?), which will update independently of the main CLI. Most of the time, this will track release-next or something close to it. We might occasionally toss experimental branches in there to see if our more adventurous users run into anything interesting with it. For example, the current canary (npmc@5.0.1-canary.6) includes an experimental multiproc branch that parallelizes tarball extraction across multiple processes.

If you find any issues while running the canary version, please report them and let us know it came from npmc! It would be tremendously helpful, and finding things early is a huge reason to have it there. Happy hacking!

A NOTE ABOUT THE ISSUE TRACKER

Just a heads up: We’re preparing to do a massive cleanup of the issue tracker. It’s been a long time since it was something we could really keep up with, and we didn’t have a process for dealing with it that could actually be sustainable.

We’re still sussing the details out, and we’ll talk about it more when we’re about to do it, but the plan is essentially to close old, abandoned issues and start over. We will also add some automation around issue management so that things that we can’t keep up with don’t just stay around forever.

Stay tuned!

GIT YOLO

COOL NEW OUTPUT

The new summary output has been really well received! One downside that reared its head as more people used it, though, is that it doesn’t really tell you anything about the toplevel versions it installed. So, if you did npm i -g foo, it would just say “added 1 package”. This patch by [@rmg](https://github.com/rmg) keeps things concise while still telling you what you got! So now, you’ll see something like this:

$ npm i -g foo bar
+ foo@1.2.3
+ bar@3.2.1
added 234 packages in .005ms

OTHER BUGFIXES

DOC UPDATES

DEP UPDATES

v5.0.1 (2017-05-31):

Hey y’all! Hope you’re enjoying the new npm!

As you all know, fresh software that’s gone through major overhauls tends to miss a lot of spots the old one used to handle well enough, and npm@5 is no exception. The CLI team will be doing faster release cycles that go directly to the latest tag for a couple of weeks while 5 stabilizes a bit and we’re confident the common low-hanging fruit people are running into are all taken care of.

With that said: this is our first patch release! The biggest focus is fixing up a number of git-related issues that folks ran into right out the door. It also fixes other things, like some proxy/auth-related issues, and even has a neat speed boost! (You can expect more speed bumps in the coming releases as pending work starts landing, too!)

Thanks everyone who’s been reporting issues and submitting patches!

BUGFIXES

DOCUMENTATION

OTHER CHANGES

v5.0.0 (2017-05-25)

Wowowowowow npm@5!

This release marks months of hard work for the young, scrappy, and hungry CLI team, and includes some changes we’ve been hoping to do for literally years. npm@5 takes npm a pretty big step forward, significantly improving its performance in almost all common situations, fixing a bunch of old errors due to the architecture, and just generally making it more robust and fault-tolerant. It comes with changes to make life easier for people doing monorepos, for users who want consistency/security guarantees, and brings semver support to git dependencies. See below for all the deets!

Breaking Changes

Feature Summary

Installer changes

$ npm install
npm added 125, removed 32, updated 148 and moved 5 packages in 5.032s.
$

Publishing

Cache Rewrite!

We’ve been talking about rewriting the cache for a loooong time. So here it is. Lots of exciting stuff ahead. The rewrite will also enable some exciting future features, but we’ll talk about those when they’re actually in the works. #15666 is the main PR for all these changes. Additional PRs/commits are linked inline.