Skip to content

chore(deps): update npm to v6 #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
renovate wants to merge 2 commits into from
Closed

chore(deps): update npm to v6 #2

renovate wants to merge 2 commits into from

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Oct 21, 2018

This PR contains the following updates:

Package Type Update Change References
npm engines major >=5.0.0 -> >=6.4.1 homepage, source

Release Notes

npm/cli

v6.4.1

Compare Source

BUGFIXES
DEPENDENCY BUMPS
DOCUMENTATION

v6.4.0

Compare Source

NEW FEATURES
  • 6e9f04b0b
    npm/cli#​8
    Search for authentication token defined by environment variables by preventing
    the translation layer from env variable to npm option from breaking
    :_authToken.
    (@​mkhl)
  • 84bfd23e7
    npm/cli#​35
    Stop filtering out non-IPv4 addresses from local-addrs, making npm actually
    use IPv6 addresses when it must.
    (@​valentin2105)
  • 792c8c709
    npm/cli#​31
    configurable audit level for non-zero exit
    npm audit currently exits with exit code 1 if any vulnerabilities are found of any level.
    Add a flag of --audit-level to npm audit to allow it to pass if only vulnerabilities below a certain level are found.
    Example: npm audit --audit-level=high will exit with 0 if only low or moderate level vulns are detected.
    (@​lennym)
BUGFIXES
DEPENDENCY UPDATES

A very special dependency update event! Since the release of
node-gyp@3.8.0, an awkward
version conflict that was preventing request from begin flattened was
resolved. This means two things:

  1. We've cut down the npm tarball size by another 200kb, to 4.6MB
  2. npm audit now shows no vulnerabilities for npm itself!

Thanks, @​rvagg!

DOCUMENTATION

v6.3.0

Compare Source

This is basically the same as the prerelease, but two dependencies have been
bumped due to bugs that had been around for a while.

v6.2.0

Compare Source

In case you missed it, we
moved!. We
look forward to seeing future PRs landing in
npm/cli in the future, and we'll be chatting with
you all in npm.community. Go check it out!

This final release of npm@6.2.0 includes a couple of features that weren't
quite ready on time but that we'd still like to include. Enjoy!

FEATURES
FIXES
DEPENDENCY BUMPS
  • d9b2712a6
    request@2.81.0: Downgraded to allow better deduplication. This does
    introduce a bunch of hoek-related audit reports, but they don't affect npm
    itself so we consider it safe. We'll upgrade request again once node-gyp
    unpins it.
    (@​simov)
  • 2ac48f863
    node-gyp@3.7.0
    (@​MylesBorins)
  • 8dc6d7640
    cli-table3@​0.5.0: cli-table2 is unmaintained and required lodash. With
    this dependency bump, we've removed lodash from our tree, which cut back
    tarball size by another 300kb.
    (@​Turbo87)
  • 90c759fee
    npm-audit-report@1.3.1
    (@​zkat)
  • 4231a0a1e
    Add cli-table3 to bundleDeps.
    (@​iarna)
  • 322d9c2f1
    Make standard happy.
    (@​iarna)
DOCS

v6.1.0

Compare Source

FIX WRITE AFTER END ERROR

First introduced in 5.8.0, this finally puts to bed errors where you would
occasionally see Error: write after end at MiniPass.write.

DETECT CHANGES IN GIT SPECIFIERS
  • 0e1726c03
    We can now determine if the commitid of a git dependency in the lockfile is derived
    from the specifier in the package.json and if it isn't we now trigger an update for it.
    (@​iarna)
OTHER BUGS
  • 442d2484f
    2f0c88351
    631d30a34
    When requesting the update of a direct dependency that was also a
    transitive dependency to a version incompatible with the transitive
    requirement and you had a lock-file but did not have a node_modules
    folder then npm would fail to provide a new copy of the transitive
    dependency, resulting in an invalid lock-file that could not self heal.
    (@​iarna)
  • be5dd0f49
    #​20715
    Cleanup output of npm ci summary report.
    (@​legodude17)
  • 98ffe4adb
    Node.js now has a test that scans for things that look like conflict
    markers in source code. This was triggering false positives on a fixture in a test
    of npm's ability to heal lockfiles with conflicts in them.
    (@​iarna)
DEPENDENCY UPDATES

v6.0.1

Compare Source

AUDIT SHOULDN'T WAIT FOREVER

This will likely be reduced further with the goal that the audit process
shouldn't noticibly slow down your builds regardless of your network
situation.

Looking forward

We're still a way from having node@11, so now's a good time to ensure we
don't warn about being used with it.

v6.0.0

Compare Source

Hey y'all! Here's another npm@6 release -- with node@10 around the corner,
this might well be the last prerelease before we tag 6.0.0! There's two major
features included with this release, along with a few miscellaneous fixes and
changes.

EXTENDED npm init SCAFFOLDING

Thanks to the wonderful efforts of @​jdalton of
lodash fame, npm init can now be used to invoke custom scaffolding tools!

You can now do things like npm init react-app or npm init esm to scaffold an
npm package by running create-react-app and create-esm, respectively. This
also adds an npm create alias, to correspond to Yarn's yarn create feature,
which inspired this.

DEPENDENCY AUDITING

This version of npm adds a new command, npm audit, which will run a security
audit of your project's dependency tree and notify you about any actions you may
need to take.

The registry-side services required for this command to work will be available
on the main npm registry in the coming weeks. Until then, you won't get much out
of trying to use this on the CLI.

As part of this change, the npm CLI now sends scrubbed and cryptographically
anonymized metadata about your dependency tree to your configured registry, to
allow notifying you about the existence of critical security flaws. For details
about how the CLI protects your privacy when it shares this metadata, see npm help audit, or read the docs for npm audit
online. You
can disable this altogether by doing npm config set audit false, but will no
longer benefit from the service.

MORE package-lock.json FORMAT CHANGES?!
  • 820f74ae2
    #​20384
    Add from field back into package-lock for git dependencies. This will give
    npm the information it needs to figure out whether git deps are valid,
    specially when running with legacy install metadata or in
    --package-lock-only mode when there's no node_modules. This should help
    remove a significant amount of git-related churn on the lock-file.
    (@​zkat)
BUGFIXES
  • 9d5d0a18a
    #​20358
    npm install-test (aka npm it) will no longer generate package-lock.json
    when running with --no-package-lock or package-lock=false.
    (@​raymondfeng)
  • e4ed976e2
    2facb35fb
    9c1eb945b
    #​20390
    Fix a scenario where a git dependency had a comittish associated with it
    that was not a complete commitid. npm would never consider that entry
    in the package.json as matching the entry in the package-lock.json and
    this resulted in inappropriate pruning or reinstallation of git
    dependencies. This has been addressed in two ways, first, the addition of the
    from field as described in #​20384 means
    we can exactly match the package.json. Second, when that's missing (when working with
    older package-lock.json files), we assume that the match is ok. (If
    it's not, we'll fix it up when a real installation is done.)
    (@​iarna)
DEPENDENCIES
DOCS

v5.10.0

Compare Source

v5.8.0

Compare Source

v5.7.1

Compare Source

v5.7.0

Compare Source

v5.6.0

Compare Source

v5.5.1

Compare Source

v5.5.0

Compare Source

v5.4.2

Compare Source

v5.4.1

Compare Source

v5.4.0

Compare Source

v5.3.0

Compare Source

v5.2.0

Compare Source

v5.1.0

Compare Source

v5.0.4

Compare Source

v5.0.3

Compare Source

v5.0.2

Compare Source

v5.0.1

Compare Source

Renovate configuration

📅 Schedule: At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever PR becomes conflicted, or if you modify the PR title to begin with "rebase!".

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR has been generated by Renovate Bot. View repository job log here.

@renovate
Copy link
Contributor Author

renovate bot commented Oct 21, 2018

Renovate Ignore Notification

As this PR has been closed unmerged, Renovate will ignore this upgrade and you will not receive PRs for any future 6.x releases. However, if you upgrade to 6.x manually then Renovate will then reenable updates for minor and patch updates automatically.

If this PR was closed by mistake or you changed your mind, you can simply rename this PR and you will soon get a fresh replacement PR opened.

@renovate renovate bot deleted the renovate/npm-6.x branch October 21, 2018 21:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@TheAlexLichter @renovate-bot