deps: upgrade npm to 9.5.0

PR-URL: nodejs#46673
Reviewed-By: Luke Karrys <luke@lukekarrys.com>
Reviewed-By: Moshe Atlow <moshe@atlow.co.il>
Reviewed-By: Ruy Adorno <ruyadorno@google.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

deps/npm/docs/content/commands/npm-access.md

@@ -67,8 +67,7 @@ You must have privileges to set the access of a package:
 * You have been given read-write privileges for a package, either as a member
   of a team or directly as an owner.
 
-If you have two-factor authentication enabled then you'll be prompted to
-provide an otp token, or may use the `--otp=...` option to specify it on
+If you have two-factor authentication enabled then you'll be prompted to provide a second factor, or may use the `--otp=...` option to specify it on
 the command line.
 
 If your account is not paid, then attempts to publish scoped packages will

deps/npm/docs/content/commands/npm-audit.md

@@ -408,7 +408,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-ci.md

@@ -310,7 +310,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-dedupe.md

@@ -269,7 +269,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-dist-tag.md

@@ -22,12 +22,12 @@ Add, remove, and enumerate distribution tags on a package:
   or the [`--tag` config](/using-npm/config#tag) if not specified. If you have
   two-factor authentication on auth-and-writes then you’ll need to include a
   one-time password on the command line with
-  `--otp <one-time password>`, or at the OTP prompt.
+  `--otp <one-time password>`, or go through a second factor flow based on your `authtype`.
 
 * rm: Clear a tag that is no longer in use from the package. If you have
   two-factor authentication on auth-and-writes then you’ll need to include
   a one-time password on the command line with `--otp <one-time password>`,
-  or at the OTP prompt.
+  or go through a second factor flow based on your `authtype`
 
 * ls: Show all of the dist-tags for a package, defaulting to the package in
   the current prefix. This is the default action if none is specified.

deps/npm/docs/content/commands/npm-find-dupes.md

@@ -196,7 +196,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-install-ci-test.md

@@ -256,7 +256,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-install-test.md

@@ -257,7 +257,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-install.md

@@ -647,7 +647,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-link.md

@@ -336,7 +336,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-ls.md

@@ -27,7 +27,7 @@ packages will *also* show the paths to the specified packages.  For
 example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@9.4.0 /path/to/npm
+npm@9.5.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```
@@ -236,7 +236,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-owner.md

@@ -30,8 +30,8 @@ or you can't.  Future versions may contain more fine-grained access levels, but
 that is not implemented at this time.
 
 If you have two-factor authentication enabled with `auth-and-writes` (see
-[`npm-profile`](/commands/npm-profile)) then you'll need to include an otp
-on the command line when changing ownership with `--otp`.
+[`npm-profile`](/commands/npm-profile)) then you'll need to go through a second factor
+flow when changing ownership or include an otp on the command line with `--otp`.
 
 ### Configuration
 

deps/npm/docs/content/commands/npm-prune.md

@@ -157,7 +157,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-publish.md

@@ -194,6 +194,13 @@ the specified workspaces, and not on the root project.
 
 This value is not exported to the environment for child processes.
 
+#### `provenance`
+
+* Default: false
+* Type: Boolean
+
+Indicates that a provenance statement should be generated.
+
 ### See Also
 
 * [package spec](/using-npm/package-spec)

deps/npm/docs/content/commands/npm-rebuild.md

@@ -130,7 +130,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-team.md

@@ -28,7 +28,8 @@ as `@org:newteam` in these commands.
 
 If you have two-factor authentication enabled in `auth-and-writes` mode, then
 you can provide a code from your authenticator with `[--otp <otpcode>]`.
-If you don't include this then you will be prompted.
+If you don't include this then you will be taken through a second factor flow based
+on your `authtype`.
 
 * create / destroy:
   Create a new team, or destroy an existing one. Note: You cannot remove the

deps/npm/docs/content/commands/npm-uninstall.md

@@ -123,7 +123,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm-update.md

@@ -387,7 +387,7 @@ This value is not exported to the environment for child processes.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-9.4.0
+9.5.0
 
 ### Description
 

deps/npm/docs/content/using-npm/config.md

@@ -691,7 +691,7 @@ number, if not already set in package.json.
 
 #### `install-links`
 
-* Default: true
+* Default: false
 * Type: Boolean
 
 When set file: protocol dependencies will be packed and installed as regular
@@ -1005,6 +1005,13 @@ operations, if `process.stderr` is a TTY.
 
 Set to `false` to suppress the progress bar.
 
+#### `provenance`
+
+* Default: false
+* Type: Boolean
+
+Indicates that a provenance statement should be generated.
+
 #### `proxy`
 
 * Default: null

deps/npm/docs/output/commands/npm-access.html

@@ -205,8 +205,7 @@ <h3 id="details">Details</h3>
 <li>You have been given read-write privileges for a package, either as a member
 of a team or directly as an owner.</li>
 </ul>
-<p>If you have two-factor authentication enabled then you'll be prompted to
-provide an otp token, or may use the <code>--otp=...</code> option to specify it on
+<p>If you have two-factor authentication enabled then you'll be prompted to provide a second factor, or may use the <code>--otp=...</code> option to specify it on
 the command line.</p>
 <p>If your account is not paid, then attempts to publish scoped packages will
 fail with an HTTP 402 status code (logically enough), unless you use

deps/npm/docs/output/commands/npm-audit.html

@@ -454,7 +454,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-ci.html

@@ -399,7 +399,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-dedupe.html

@@ -358,7 +358,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-dist-tag.html

@@ -160,13 +160,13 @@ <h3 id="description">Description</h3>
 or the <a href="../using-npm/config#tag.html"><code>--tag</code> config</a> if not specified. If you have
 two-factor authentication on auth-and-writes then you’ll need to include a
 one-time password on the command line with
-<code>--otp &lt;one-time password&gt;</code>, or at the OTP prompt.</p>
+<code>--otp &lt;one-time password&gt;</code>, or go through a second factor flow based on your <code>authtype</code>.</p>
 </li>
 <li>
 <p>rm: Clear a tag that is no longer in use from the package. If you have
 two-factor authentication on auth-and-writes then you’ll need to include
 a one-time password on the command line with <code>--otp &lt;one-time password&gt;</code>,
-or at the OTP prompt.</p>
+or go through a second factor flow based on your <code>authtype</code></p>
 </li>
 <li>
 <p>ls: Show all of the dist-tags for a package, defaulting to the package in

deps/npm/docs/output/commands/npm-find-dupes.html

@@ -304,7 +304,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-install-ci-test.html

@@ -356,7 +356,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-install-test.html

@@ -357,7 +357,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-install.html

@@ -683,7 +683,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-link.html

@@ -410,7 +410,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-ls.html

@@ -160,7 +160,7 @@ <h3 id="description">Description</h3>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">npm@9.4.0 /path/to/npm
+<pre><code class="language-bash">npm@9.5.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>
@@ -333,7 +333,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-owner.html

@@ -166,8 +166,8 @@ <h3 id="description">Description</h3>
 or you can't.  Future versions may contain more fine-grained access levels, but
 that is not implemented at this time.</p>
 <p>If you have two-factor authentication enabled with <code>auth-and-writes</code> (see
-<a href="../commands/npm-profile.html"><code>npm-profile</code></a>) then you'll need to include an otp
-on the command line when changing ownership with <code>--otp</code>.</p>
+<a href="../commands/npm-profile.html"><code>npm-profile</code></a>) then you'll need to go through a second factor
+flow when changing ownership or include an otp on the command line with <code>--otp</code>.</p>
 <h3 id="configuration">Configuration</h3>
 <h4 id="registry"><code>registry</code></h4>
 <ul>

deps/npm/docs/output/commands/npm-prune.html

@@ -268,7 +268,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-publish.html

@@ -142,7 +142,7 @@ <h1 id="npm-publish">npm-publish</h1>
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#files-included-in-package">Files included in package</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#tag"><code>tag</code></a></li><li><a href="#access"><code>access</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#otp"><code>otp</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
+<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#files-included-in-package">Files included in package</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#tag"><code>tag</code></a></li><li><a href="#access"><code>access</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#otp"><code>otp</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li><li><a href="#provenance"><code>provenance</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
 </section>
 
 <div id="_content"><h3 id="synopsis">Synopsis</h3>
@@ -306,6 +306,12 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 all workspaces via the <code>workspaces</code> flag, will cause npm to operate only on
 the specified workspaces, and not on the root project.</p>
 <p>This value is not exported to the environment for child processes.</p>
+<h4 id="provenance"><code>provenance</code></h4>
+<ul>
+<li>Default: false</li>
+<li>Type: Boolean</li>
+</ul>
+<p>Indicates that a provenance statement should be generated.</p>
 <h3 id="see-also">See Also</h3>
 <ul>
 <li><a href="../using-npm/package-spec.html">package spec</a></li>

deps/npm/docs/output/commands/npm-rebuild.html

@@ -250,7 +250,7 @@ <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <h4 id="install-links"><code>install-links</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
 <p>When set file: protocol dependencies will be packed and installed as regular

deps/npm/docs/output/commands/npm-team.html

@@ -162,7 +162,8 @@ <h3 id="description">Description</h3>
 as <code>@org:newteam</code> in these commands.</p>
 <p>If you have two-factor authentication enabled in <code>auth-and-writes</code> mode, then
 you can provide a code from your authenticator with <code>[--otp &lt;otpcode&gt;]</code>.
-If you don't include this then you will be prompted.</p>
+If you don't include this then you will be taken through a second factor flow based
+on your <code>authtype</code>.</p>
 <ul>
 <li>
 <p>create / destroy: