deps: upgrade npm to 7.18.1

PR-URL: nodejs#39065
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruy Adorno <ruyadorno@github.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

deps/npm/docs/content/commands/npm-audit.md

@@ -250,8 +250,14 @@ Not supported by all npm commands.
 * Default: false
 * Type: Boolean
 
-If set to true, it will update only the `package-lock.json`, instead of
-checking `node_modules` and downloading dependencies.
+If set to true, the current operation will only use the `package-lock.json`,
+ignoring `node_modules`.
+
+For `update` this means only the `package-lock.json` will be updated,
+instead of checking `node_modules` and downloading dependencies.
+
+For `list` this means the output will be based on the tree described by the
+`package-lock.json`, rather than the contents of `node_modules`.
 
 #### `omit`
 

deps/npm/docs/content/commands/npm-ls.md

@@ -155,18 +155,21 @@ variable will be set to `'production'` for all lifecycle scripts.
 * Default: false
 * Type: Boolean
 
-If true, then local installs will link if there is a suitable globally
-installed package.
+Used with `npm ls`, limiting output to only those packages that are linked.
 
-Note that this means that local installs can cause things to be installed
-into the global space at the same time. The link is only done if one of the
-two conditions are met:
+#### `package-lock-only`
 
-* The package is not already installed globally, or
-* the globally installed version is identical to the version that is being
-  installed locally.
+* Default: false
+* Type: Boolean
+
+If set to true, the current operation will only use the `package-lock.json`,
+ignoring `node_modules`.
+
+For `update` this means only the `package-lock.json` will be updated,
+instead of checking `node_modules` and downloading dependencies.
 
-When used with `npm ls`, only show packages that are linked.
+For `list` this means the output will be based on the tree described by the
+`package-lock.json`, rather than the contents of `node_modules`.
 
 #### `unicode`
 

deps/npm/docs/content/commands/npm-pack.md

@@ -36,6 +36,13 @@ Whether or not to output JSON data, rather than the normal output.
 
 Not supported by all npm commands.
 
+#### `pack-destination`
+
+* Default: "."
+* Type: String
+
+Directory in which `npm pack` will save tarballs.
+
 #### `workspace`
 
 * Default:

deps/npm/docs/content/using-npm/config.md

@@ -743,18 +743,7 @@ Use of `legacy-peer-deps` is not recommended, as it will not enforce the
 * Default: false
 * Type: Boolean
 
-If true, then local installs will link if there is a suitable globally
-installed package.
-
-Note that this means that local installs can cause things to be installed
-into the global space at the same time. The link is only done if one of the
-two conditions are met:
-
-* The package is not already installed globally, or
-* the globally installed version is identical to the version that is being
-  installed locally.
-
-When used with `npm ls`, only show packages that are linked.
+Used with `npm ls`, limiting output to only those packages that are linked.
 
 #### `local-address`
 
@@ -878,6 +867,13 @@ when publishing or changing package permissions with `npm access`.
 If not set, and a registry response fails with a challenge for a one-time
 password, npm will prompt on the command line for one.
 
+#### `pack-destination`
+
+* Default: "."
+* Type: String
+
+Directory in which `npm pack` will save tarballs.
+
 #### `package`
 
 * Default:
@@ -902,8 +898,14 @@ package-locks disabled use `npm prune`.
 * Default: false
 * Type: Boolean
 
-If set to true, it will update only the `package-lock.json`, instead of
-checking `node_modules` and downloading dependencies.
+If set to true, the current operation will only use the `package-lock.json`,
+ignoring `node_modules`.
+
+For `update` this means only the `package-lock.json` will be updated,
+instead of checking `node_modules` and downloading dependencies.
+
+For `list` this means the output will be based on the tree described by the
+`package-lock.json`, rather than the contents of `node_modules`.
 
 #### `parseable`
 

deps/npm/docs/output/commands/npm-audit.html

@@ -324,8 +324,12 @@ <h4 id="package-lock-only"><code>package-lock-only</code></h4>
 <li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
-<p>If set to true, it will update only the <code>package-lock.json</code>, instead of
-checking <code>node_modules</code> and downloading dependencies.</p>
+<p>If set to true, the current operation will only use the <code>package-lock.json</code>,
+ignoring <code>node_modules</code>.</p>
+<p>For <code>update</code> this means only the <code>package-lock.json</code> will be updated,
+instead of checking <code>node_modules</code> and downloading dependencies.</p>
+<p>For <code>list</code> this means the output will be based on the tree described by the
+<code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
 <h4 id="omit"><code>omit</code></h4>
 <ul>
 <li>Default: ‘dev’ if the <code>NODE_ENV</code> environment variable is set to

deps/npm/docs/output/commands/npm-ls.html

@@ -141,7 +141,7 @@ <h1 id="npm-ls">npm-ls</h1>
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#note-design-changes-pending">Note: Design Changes Pending</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#all"><code>all</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#long"><code>long</code></a></li><li><a href="#parseable"><code>parseable</code></a></li><li><a href="#global"><code>global</code></a></li><li><a href="#depth"><code>depth</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#link"><code>link</code></a></li><li><a href="#unicode"><code>unicode</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
+<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#note-design-changes-pending">Note: Design Changes Pending</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#all"><code>all</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#long"><code>long</code></a></li><li><a href="#parseable"><code>parseable</code></a></li><li><a href="#global"><code>global</code></a></li><li><a href="#depth"><code>depth</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#link"><code>link</code></a></li><li><a href="#package-lock-only"><code>package-lock-only</code></a></li><li><a href="#unicode"><code>unicode</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
 </section>
 
 <div id="_content"><h3 id="synopsis">Synopsis</h3>
@@ -159,7 +159,7 @@ <h3 id="description">Description</h3>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm’s source tree will show:</p>
-<pre lang="bash"><code>npm@7.17.0 /path/to/npm
+<pre lang="bash"><code>npm@7.18.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>
@@ -263,17 +263,18 @@ <h4 id="link"><code>link</code></h4>
 <li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
-<p>If true, then local installs will link if there is a suitable globally
-installed package.</p>
-<p>Note that this means that local installs can cause things to be installed
-into the global space at the same time. The link is only done if one of the
-two conditions are met:</p>
+<p>Used with <code>npm ls</code>, limiting output to only those packages that are linked.</p>
+<h4 id="package-lock-only"><code>package-lock-only</code></h4>
 <ul>
-<li>The package is not already installed globally, or</li>
-<li>the globally installed version is identical to the version that is being
-installed locally.</li>
+<li>Default: false</li>
+<li>Type: Boolean</li>
 </ul>
-<p>When used with <code>npm ls</code>, only show packages that are linked.</p>
+<p>If set to true, the current operation will only use the <code>package-lock.json</code>,
+ignoring <code>node_modules</code>.</p>
+<p>For <code>update</code> this means only the <code>package-lock.json</code> will be updated,
+instead of checking <code>node_modules</code> and downloading dependencies.</p>
+<p>For <code>list</code> this means the output will be based on the tree described by the
+<code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
 <h4 id="unicode"><code>unicode</code></h4>
 <ul>
 <li>Default: false on windows, true on mac/unix systems with a unicode locale,

deps/npm/docs/output/commands/npm-pack.html

@@ -141,7 +141,7 @@ <h1 id="npm-pack">npm-pack</h1>
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li></ul><li><a href="#description">Description</a></li><li><a href="#see-also">See Also</a></li></ul></div>
+<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#pack-destination"><code>pack-destination</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li></ul><li><a href="#description">Description</a></li><li><a href="#see-also">See Also</a></li></ul></div>
 </section>
 
 <div id="_content"><h3 id="synopsis">Synopsis</h3>
@@ -168,6 +168,12 @@ <h4 id="json"><code>json</code></h4>
 </ul>
 <p>Whether or not to output JSON data, rather than the normal output.</p>
 <p>Not supported by all npm commands.</p>
+<h4 id="pack-destination"><code>pack-destination</code></h4>
+<ul>
+<li>Default: “.”</li>
+<li>Type: String</li>
+</ul>
+<p>Directory in which <code>npm pack</code> will save tarballs.</p>
 <h4 id="workspace"><code>workspace</code></h4>
 <ul>
 <li>Default:</li>

deps/npm/docs/output/commands/npm.html

@@ -148,7 +148,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 <pre lang="bash"><code>npm &lt;command&gt; [args]
 </code></pre>
 <h3 id="version">Version</h3>
-<p>7.17.0</p>
+<p>7.18.1</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/lib/audit.js

@@ -58,7 +58,7 @@ class Audit extends ArboristWorkspaceCmd {
       audit: true,
       path: this.npm.prefix,
       reporter,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
 
     const arb = new Arborist(opts)

deps/npm/lib/base-command.js

@@ -1,6 +1,7 @@
 // Base class for npm.commands[cmd]
 const usageUtil = require('./utils/usage.js')
 const ConfigDefinitions = require('./utils/config/definitions.js')
+const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 class BaseCommand {
   constructor (npm) {
@@ -72,5 +73,13 @@ class BaseCommand {
       { code: 'ENOWORKSPACES' }
     )
   }
+
+  async setWorkspaces (filters) {
+    // TODO npm guards workspaces/global mode so we should use this.npm.prefix?
+    const ws = await getWorkspaces(filters, { path: this.npm.localPrefix })
+    this.workspaces = ws
+    this.workspaceNames = [...ws.keys()]
+    this.workspacePaths = [...ws.values()]
+  }
 }
 module.exports = BaseCommand

deps/npm/lib/ci.js

@@ -55,7 +55,7 @@ class CI extends ArboristWorkspaceCmd {
       path: where,
       log: this.npm.log,
       save: false, // npm ci should never modify the lockfile or package.json
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
 
     const arb = new Arborist(opts)

deps/npm/lib/cli.js

@@ -20,6 +20,7 @@ module.exports = (process) => {
 
   const npm = require('../lib/npm.js')
   const errorHandler = require('../lib/utils/error-handler.js')
+  errorHandler.setNpm(npm)
 
   // if npm is called as "npmg" or "npm_g", then
   // run in global mode.

deps/npm/lib/dedupe.js

@@ -50,7 +50,7 @@ class Dedupe extends ArboristWorkspaceCmd {
       log: this.npm.log,
       path: where,
       dryRun,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
     const arb = new Arborist(opts)
     await arb.dedupe(opts)

deps/npm/lib/diff.js

@@ -8,7 +8,6 @@ const npmlog = require('npmlog')
 const pacote = require('pacote')
 const pickManifest = require('npm-pick-manifest')
 
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const readPackageName = require('./utils/read-package-name.js')
 const BaseCommand = require('./base-command.js')
 
@@ -90,9 +89,8 @@ class Diff extends BaseCommand {
   }
 
   async diffWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    for (const workspacePath of workspaces.values()) {
+    await this.setWorkspaces(filters)
+    for (const workspacePath of this.workspacePaths) {
       this.top = workspacePath
       this.prefix = workspacePath
       await this.diff(args)
@@ -104,7 +102,6 @@ class Diff extends BaseCommand {
   async packageName (path) {
     let name
     try {
-      // TODO this won't work as expected in global mode
       name = await readPackageName(this.prefix)
     } catch (e) {
       npmlog.verbose('diff', 'could not read project dir package.json')

deps/npm/lib/dist-tag.js

@@ -5,7 +5,6 @@ const semver = require('semver')
 
 const otplease = require('./utils/otplease.js')
 const readPackageName = require('./utils/read-package-name.js')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const BaseCommand = require('./base-command.js')
 
 class DistTag extends BaseCommand {
@@ -180,10 +179,9 @@ class DistTag extends BaseCommand {
   }
 
   async listWorkspaces (filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
 
-    for (const [name] of workspaces) {
+    for (const name of this.workspaceNames) {
       try {
         this.npm.output(`${name}:`)
         await this.list(npa(name), this.npm.flatOptions)

deps/npm/lib/docs.js

@@ -2,7 +2,6 @@ const log = require('npmlog')
 const pacote = require('pacote')
 const openUrl = require('./utils/open-url.js')
 const hostedFromMani = require('./utils/hosted-git-info-from-manifest.js')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 const BaseCommand = require('./base-command.js')
 class Docs extends BaseCommand {
@@ -42,9 +41,8 @@ class Docs extends BaseCommand {
   }
 
   async docsWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    return this.docs([...workspaces.values()])
+    await this.setWorkspaces(filters)
+    return this.docs(this.workspacePaths)
   }
 
   async getDocs (pkg) {

deps/npm/lib/exec.js

@@ -1,7 +1,6 @@
 const libexec = require('libnpmexec')
 const BaseCommand = require('./base-command.js')
 const getLocationMsg = require('./exec/get-workspace-location-msg.js')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 // it's like this:
 //
@@ -68,7 +67,6 @@ class Exec extends BaseCommand {
   // can be named correctly
   async _exec (_args, { locationMsg, path, runPath }) {
     const args = [..._args]
-    const cache = this.npm.config.get('cache')
     const call = this.npm.config.get('call')
     const color = this.npm.config.get('color')
     const {
@@ -89,7 +87,6 @@ class Exec extends BaseCommand {
       ...flatOptions,
       args,
       call,
-      cache,
       color,
       localBin,
       locationMsg,
@@ -105,16 +102,15 @@ class Exec extends BaseCommand {
   }
 
   async _execWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
     const color = this.npm.config.get('color')
 
-    for (const workspacePath of workspaces.values()) {
-      const locationMsg = await getLocationMsg({ color, path: workspacePath })
+    for (const path of this.workspacePaths) {
+      const locationMsg = await getLocationMsg({ color, path })
       await this._exec(args, {
         locationMsg,
-        path: workspacePath,
-        runPath: workspacePath,
+        path,
+        runPath: path,
       })
     }
   }

deps/npm/lib/explain.js

@@ -46,8 +46,8 @@ class Explain extends ArboristWorkspaceCmd {
     const arb = new Arborist({ path: this.npm.prefix, ...this.npm.flatOptions })
     const tree = await arb.loadActual()
 
-    if (this.workspaces && this.workspaces.length)
-      this.filterSet = arb.workspaceDependencySet(tree, this.workspaces)
+    if (this.workspaceNames && this.workspaceNames.length)
+      this.filterSet = arb.workspaceDependencySet(tree, this.workspaceNames)
 
     const nodes = new Set()
     for (const arg of args) {

deps/npm/lib/fund.js

@@ -95,7 +95,7 @@ class Fund extends ArboristWorkspaceCmd {
     const fundingInfo = getFundingInfo(tree, {
       ...this.flatOptions,
       log: this.npm.log,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     })
 
     if (this.npm.config.get('json'))