|
| 1 | +### v2.15.4 (2016-04-21): |
| 2 | + |
| 3 | +Gosh, it's been a peaceful couple of weeks! |
| 4 | + |
| 5 | +Overall, the CLI team has been focused on the project to [get the test suite |
| 6 | +passing on Windows](https://github.com/npm/npm/pull/11444). Our efforts should |
| 7 | +be paying off soon -- there's only a couple of tests left! |
| 8 | + |
| 9 | +It's very unlikely those particular changes will make their way into our current |
| 10 | +`npm@2` LTS release, I think, but it will help `npm@3` a lot, as well as |
| 11 | +whatever version makes it into [`node@6`, which will eventually be the next |
| 12 | +Node.js LTS](https://github.com/nodejs/node/pull/6155). |
| 13 | + |
| 14 | +As far as this week goes, we've got a couple of dep updates and doc fixes. |
| 15 | +Always happy to see community contributions flying in. 💚 |
| 16 | + |
| 17 | +#### DEP UPDATE MAGIC |
| 18 | + |
| 19 | +* [`b178c4a`](https://github.com/npm/npm/commit/b178c4ac9ce91c0a0794526a38b553c759132d18) |
| 20 | + `spdx-license-ids@1.2.1`: |
| 21 | + Minor project-related tweaks -- no license changes. |
| 22 | + ([@shinnn](https://github.com/shinnn)) |
| 23 | +* [`1adf179`](https://github.com/npm/npm/commit/1adf179948ab8cb97dfb2f46a61e9f37d944c42a) |
| 24 | + `normalize-git-url@3.0.2`: |
| 25 | + Fixes `file://` URLs on Windows. Turns out stuff like `file://C:\hello` is |
| 26 | + actually fairly weird for a URL (it's not actually a valid URL, but we're just |
| 27 | + gonna pretend.😉) |
| 28 | + ([@zkat](https://github.com/zkat)) |
| 29 | +* [`9cfd56c`](https://github.com/npm/npm/commit/9cfd56cdadc040c0b2fa7654cdb5e7d22dbef7cb) |
| 30 | + `fs-vacuum@1.2.9`: |
| 31 | + This one goes out to our fans at Big Blue: There was an AIX-specific issue |
| 32 | + where `fs.rmDir` was failing with `EEXIST` instead of `ENOTEMPTY` with |
| 33 | + non-empty directories. |
| 34 | + ([@richardlau](https://github.com/richardlau)) |
| 35 | + |
| 36 | +#### HOORAY DOC CONTRIBUTIONS |
| 37 | + |
| 38 | +No seriously, we love these. Keep 'em comin'! |
| 39 | + |
| 40 | +* [`2afe8bf`](https://github.com/npm/npm/commit/2afe8bf415a159baa181a8102f72c96e1d189bc9) |
| 41 | + [#12415](https://github.com/npm/npm/pull/12415) |
| 42 | + Clarify that the `--cert` and `--key` options are actual certs and keys, not |
| 43 | + paths to files containing them. |
| 44 | + ([@rvedotrc](https://github.com/rvedotrc)) |
| 45 | +* [`3522560`](https://github.com/npm/npm/commit/3522560b0a4bb6c9717a34f9728f156fd9760cad) |
| 46 | + [#12107](https://github.com/npm/npm/pull/12107) |
| 47 | + Document `npm login` as an alias to `npm adduser`. People are still surprised |
| 48 | + by this so often. |
| 49 | + ([@gnerkus](https://github.com/gnerkus)) |
| 50 | + |
| 51 | +### v2.15.3 (2016-03-31): |
| 52 | + |
| 53 | +Hiiiiiii!~👋 |
| 54 | + |
| 55 | +We're really happy to be getting more and more community contributions! Keep it |
| 56 | +up! We really appreciate folks trying to help us, and we'll do our best to help |
| 57 | +point you in the right direction. Even things like documentation are a huge |
| 58 | +help. And remember -- you get socks for it, too!🎁 |
| 59 | + |
| 60 | +This week is as quiet as usual, aside from fixing a regression to `npm |
| 61 | +deprecate` you might want to pay attention to! Other than that, just docs and |
| 62 | +deps, as any good LTS release train should be. 🙆 |
| 63 | + |
| 64 | +#### FIXME |
| 65 | + |
| 66 | +* [`6e0b66e`](https://github.com/npm/npm/commit/6e0b66e282aa27d1b5371e2babaa859924121730) |
| 67 | + [#11884](https://github.com/npm/npm/pull/11884) |
| 68 | + Include `node_modules` in the list of files and directories that npm won't |
| 69 | + include in packages ordinarily. (Modules listed in `bundledDependencies` and |
| 70 | + things that those modules rely on, ARE included of course.) |
| 71 | + ([@Jameskmonger](https://github.com/Jameskmonger)) |
| 72 | +* [`9896290`](https://github.com/npm/npm/commit/98962909b160364030705575202ad133971033c1) |
| 73 | + [#12079](https://github.com/npm/npm/pull/12079) |
| 74 | + Back in `npm@2.13.1` we included [a patch that made it so `npm install pkg` |
| 75 | + was basically `npm install pkg@latest` instead of |
| 76 | + `pkg@*`](https://github.com/npm/npm/pull/9170) This is probably what most |
| 77 | + users expected, but it also ended up [breaking `npm |
| 78 | + deprecate`](https://github.com/npm/npm/pull/9170) when no version was provided |
| 79 | + for a package. In that case, we were using `*` to mean "deprecate all |
| 80 | + versions" and relying on the `pkg` -> `pkg@*` conversion. This patch fixes |
| 81 | + `npm deprecate pkg` to work as it used to by special casing that particular |
| 82 | + command's behavior. |
| 83 | + ([@polm](https://github.com/polm)) |
| 84 | +* [`6c1628f`](https://github.com/npm/npm/commit/6c1628f62b657db6c116be13849d00933a3388cd) |
| 85 | + [#12146](https://github.com/npm/npm/pull/12146) |
| 86 | + Adds `make doc-clean` to `prepublish` script, to clear out previously built |
| 87 | + docs before publishing a new npm version. |
| 88 | + ([@watilde](https://github.com/watilde)) |
| 89 | +* [`6d3017e`](https://github.com/npm/npm/commit/6d3017e6eed8a771b395d10130ac1f498e2d3211) |
| 90 | + [#12146](https://github.com/npm/npm/pull/12146) |
| 91 | + Adds `doc-clean` phony target to `make publish`. |
| 92 | + ([@watilde](https://github.com/watilde)) |
| 93 | + |
| 94 | +#### DOCS |
| 95 | + |
| 96 | +* [`d43921c`](https://github.com/npm/npm/commit/d43921c546617cdb94bbee444d7d67ef55f38dc5) |
| 97 | + [#12147](https://github.com/npm/npm/pull/12147) |
| 98 | + Document that the current behavior of `engines` is just to warn if the node |
| 99 | + platform is incompatible. |
| 100 | + ([@reconbot](https://github.com/reconbot)) |
| 101 | +* [`3cfe99e`](https://github.com/npm/npm/commit/3cfe99e3a757c5d8cbb1c2789410e9802563abac) |
| 102 | + [#12093](https://github.com/npm/npm/pull/12093) |
| 103 | + Update `bugs` url in `package.json` to use the `https` URL for Github. |
| 104 | + ([@watilde](https://github.com/watilde)) |
| 105 | +* [`ecf865f`](https://github.com/npm/npm/commit/ecf865f4eed1419c75442e0d52bc34ba1647de15) |
| 106 | + [#12075](https://github.com/npm/npm/pull/12075) |
| 107 | + Add the `--ignore-scripts` flag to the `npm install` docs. |
| 108 | + ([@paulirish](https://github.com/paulirish)) |
| 109 | +* [`f0e6db3`](https://github.com/npm/npm/commit/f0e6db32827d88680ef2320e60c0863754a4fbc5) |
| 110 | + [#12063](https://github.com/npm/npm/pull/12063) |
| 111 | + Various minor fixes to the html docs homepage. |
| 112 | + ([@watilde](https://github.com/watilde)) |
| 113 | + |
| 114 | +#### DEPS |
| 115 | + |
| 116 | +* [`e2660de`](https://github.com/npm/npm/commit/e2660de1c08ed68a1c6fc4ee75d10376595979be) |
| 117 | + `npmlog@2.0.3` |
| 118 | + ([@iarna](https://github.com/iarna)) |
| 119 | + |
1 | 120 | ### v2.15.2 (2016-03-24): |
2 | 121 |
|
3 | 122 | It's always nice to see new contributors. 💚 |
@@ -44,9 +163,62 @@ we'll link to that in the (near?) future, when it's ready to roll out. |
44 | 163 |
|
45 | 164 | ### v2.15.1 (2016-03-17): |
46 | 165 |
|
47 | | -It's another one of those releases again! Docs and tests, it turns out, have a |
48 | | -pretty easy time getting into LTS releases, and boring is exactly how LTS should |
49 | | -be. 💁 |
| 166 | +#### SECURITY ADVISORY: BEARER TOKEN DISCLOSURE |
| 167 | + |
| 168 | +This release includes [the fix for a |
| 169 | +vulnerability](https://github.com/npm/npm/commit/fea8cc92cee02c720b58f95f14d315507ccad401) |
| 170 | +that could cause the unintentional leakage of bearer tokens. |
| 171 | + |
| 172 | +Here are details on this vulnerability and how it affects you. |
| 173 | + |
| 174 | +##### DETAILS |
| 175 | + |
| 176 | +Since 2014, npm’s registry has used HTTP bearer tokens to authenticate requests |
| 177 | +from the npm’s command-line interface. A design flaw meant that the CLI was |
| 178 | +sending these bearer tokens with _every_ request made by logged-in users, |
| 179 | +regardless of the destination of their request. (The bearers only should have |
| 180 | +been included for requests made against a registry or registries used for the |
| 181 | +current install.) |
| 182 | + |
| 183 | +An attacker could exploit this flaw by setting up an HTTP server that could |
| 184 | +collect authentication information, then use this authentication information to |
| 185 | +impersonate the users whose tokens they collected. This impersonation would |
| 186 | +allow them to do anything the compromised users could do, including publishing |
| 187 | +new versions of packages. |
| 188 | + |
| 189 | +With the fixes we’ve released, the CLI will only send bearer tokens with |
| 190 | +requests made against a registry. |
| 191 | + |
| 192 | +##### THINK YOU'RE AT RISK? REGENERATE YOUR TOKENS |
| 193 | + |
| 194 | +If you believe that your bearer token may have been leaked, [invalidate your |
| 195 | +current npm bearer tokens](https://www.npmjs.com/settings/tokens) and rerun |
| 196 | +`npm login` to generate new tokens. Keep in mind that this may cause continuous |
| 197 | +integration builds in services like Travis to break, in which case you’ll need |
| 198 | +to update the tokens in your CI server’s configuration. |
| 199 | + |
| 200 | +##### WILL THIS BREAK MY CURRENT SETUP? |
| 201 | + |
| 202 | +Maybe. |
| 203 | + |
| 204 | +npm’s CLI team believes that the fix won’t break any existing registry setups. |
| 205 | +Due to the large number of registry software suites out in the wild, though, |
| 206 | +it’s possible our change will be breaking in some cases. |
| 207 | + |
| 208 | +If so, please [file an issue](https://github.com/npm/npm/issues/new) describing |
| 209 | +the software you’re using and how it broke. Our team will work with you to |
| 210 | +mitigate the breakage. |
| 211 | + |
| 212 | +##### CREDIT & THANKS |
| 213 | + |
| 214 | +Thanks to Mitar, Will White & the team at Mapbox, Max Motovilov, and James |
| 215 | +Taylor for reporting this vulnerability to npm. |
| 216 | + |
| 217 | +### BACK TO YOUR REGULARLY SCHEDULED PROGRAMMING |
| 218 | + |
| 219 | +Aside from that, it's another one of those releases again! Docs and tests, it |
| 220 | +turns out, have a pretty easy time getting into LTS releases, and boring is |
| 221 | +exactly how LTS should be. 💁 |
50 | 222 |
|
51 | 223 | #### DOCS |
52 | 224 |
|
|
0 commit comments