nodejs · isaacs · Feb 27, 2020
diff --git a/deps/npm/AUTHORS b/deps/npm/AUTHORS
@@ -682,3 +682,9 @@ Zhenya Vinogradov <zhenyavinogradov@gmail.com>
 Rafael Hengles <rhengles@gmail.com>
 Jan-Philip Gehrcke <jp@opstrace.com>
 Caleb Sacks <16855387+clabe45@users.noreply.github.com>
+Kyle Getz <kgetz@arista.com>
+Sean Healy <s@xib.ca>
+Netanel Gilad <netanelg@wix.com>
+Dave Nicolson <david.nicolson@gmail.com>
+Ajay Narain Mathur <ajaynarainmathur@gmail.com>
+Vitaliy Markitanov <9357021+vit100@users.noreply.github.com>
diff --git a/deps/npm/CHANGELOG.md b/deps/npm/CHANGELOG.md
@@ -1,3 +1,41 @@
+## 6.14.1 (2020-02-26)
+
+* [`303e5c11e`](https://github.com/npm/cli/commit/303e5c11e7db34cf014107aecd2e81c821bfde8d)
+  `hosted-git-info@2.8.7`
+  Fixes a regression where scp-style git urls are passed to the WhatWG URL
+  parser, which does not handle them properly.
+  ([@isaacs](https://github.com/isaacs))
+
+## 6.14.0 (2020-02-25)
+
+### FEATURES
+* [`30f170877`](https://github.com/npm/cli/commit/30f170877954acd036cb234a581e4eb155049b82) [#731](https://github.com/npm/cli/pull/731) add support for multiple funding sources ([@ljharb](https://github.com/ljharb) & [@ruyadorno](hhttps://github.com/ruyadorno/))
+
+### BUG FIXES
+* [`55916b130`](https://github.com/npm/cli/commit/55916b130ef52984584678f2cc17c15c1f031cb5) [#508](https://github.com/npm/cli/pull/508) fix: check `npm.config` before accessing its members ([@kaiyoma](https://github.com/kaiyoma))
+* [`7d0cd65b2`](https://github.com/npm/cli/commit/7d0cd65b23c0986b631b9b54d87bbe74902cc023) [#733](https://github.com/npm/cli/pull/733) fix: access grant with unscoped packages ([@netanelgilad](https://github.com/netanelgilad))
+* [`28c3d40d6`](https://github.com/npm/cli/commit/28c3d40d65eef63f9d6ccb60b99ac57f5057a46e), [`0769c5b20`](https://github.com/npm/cli/commit/30f170877954acd036cb234a581e4eb155049b82) [#945](https://github.com/npm/cli/pull/945), [#697](https://github.com/npm/cli/pull/697) fix: allow new major versions of node to be automatically considered "supported" ([@isaacs](https://github.com/isaacs), [@ljharb](https://github.com/ljharb))
+
+### DEPENDENCIES
+* [`6f39e93`](https://github.com/npm/hosted-git-info/commit/6f39e93bae9162663af6f15a9d10bce675dd5de3) `hosted-git-info@2.8.6` ([@darcyclarke](https://github.com/darcyclarke))
+  * fix: passwords & usernames are escaped properly in git deps ([@stevenhilder](https://github.com/stevenhilder))
+* [`f14b594ee`](https://github.com/npm/cli/commit/f14b594ee9dbfc98ed0b65c65d904782db4f31ad) `chownr@1.1.4` ([@isaacs](https://github.com/isaacs))
+* [`77044150b`](https://github.com/npm/cli/commit/77044150b763d67d997f9ff108219132ea922678) `npm-packlist@1.4.8` ([@isaacs](https://github.com/isaacs))
+* [`1d112461a`](https://github.com/npm/cli/commit/1d112461ad8dc99e5ff7fabb5177e8c2f89a9755) `npm-registry-fetch@4.0.3` ([@isaacs](https://github.com/isaacs))
+  * [`ba8b4fe`](https://github.com/npm/npm-registry-fetch/commit/ba8b4fe60eb6cdf9b39012560aec596eda8ce924) fix: always bypass cache when ?write=true 
+* [`a47fed760`](https://github.com/npm/cli/commit/a47fed7603a6ed31dcc314c0c573805f05a96830) `readable-stream@3.6.0`
+  * [`3bbf2d6`](https://github.com/nodejs/readable-stream/commit/3bbf2d6feb45b03f4e46a2ae8251601ad2262121) fix: babel's "loose mode" class transform enbrittles BufferList ([@ljharb](https://github.com/ljharb)) 
+
+### DOCUMENTATION
+* [`284c1c055`](https://github.com/npm/cli/commit/284c1c055a28c4b334496101799acefe3c54ceb3), [`fbb5f0e50`](https://github.com/npm/cli/commit/fbb5f0e50e54425119fa3f03c5de93e4cb6bfda7) [#729](https://github.com/npm/cli/pull/729) update lifecycle hooks docs
+  ([@seanhealy](https://github.com/seanhealy), [@mikemimik](https://github.com/mikemimik)) 
+* [`1c272832d`](https://github.com/npm/cli/commit/1c272832d048300e409882313305c416dc6f21a2) [#787](https://github.com/npm/cli/pull/787) fix: trademarks typo ([@dnicolson](https://github.com/dnicolson))
+* [`f6ff41776`](https://github.com/npm/cli/commit/f6ff417767d52418cc8c9e7b9731ede2c3916d2e) [#936](https://github.com/npm/cli/pull/936) fix: postinstall example ([@ajaymathur](https://github.com/ajaymathur))
+* [`373224b16`](https://github.com/npm/cli/commit/373224b16e019b7b63d8f0b4c5d4adb7e5cb80dd) [#939](https://github.com/npm/cli/pull/939) fix: bad links in publish docs ([@vit100](https://github.com/vit100))
+
+### MISCELLANEOUS
+* [`85c79636d`](https://github.com/npm/cli/commit/85c79636df31bac586c0e380c4852ee155a7723c) [#736](https://github.com/npm/cli/pull/736) add script to update dist-tags ([@mikemimik](https://github.com/mikemimik))
+
 ## 6.13.7 (2020-01-28)
 
 ### BUG FIXES

diff --git a/deps/npm/bin/node-gyp-bin/node-gyp.cmd b/deps/npm/bin/node-gyp-bin/node-gyp.cmd
@@ -1,5 +1,5 @@
-if not defined npm_config_node_gyp (
-  node "%~dp0\..\..\node_modules\node-gyp\bin\node-gyp.js" %*
-) else (
+if not defined npm_config_node_gyp (
+  node "%~dp0\..\..\node_modules\node-gyp\bin\node-gyp.js" %*
+) else (
   node "%npm_config_node_gyp%" %*
-)
+)
diff --git a/deps/npm/bin/npm.cmd b/deps/npm/bin/npm.cmd
@@ -1,19 +1,19 @@
-:: Created by npm, please don't edit manually.
-@ECHO OFF
-
-SETLOCAL
-
-SET "NODE_EXE=%~dp0\node.exe"
-IF NOT EXIST "%NODE_EXE%" (
-  SET "NODE_EXE=node"
-)
-
-SET "NPM_CLI_JS=%~dp0\node_modules\npm\bin\npm-cli.js"
-FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_CLI_JS%" prefix -g') DO (
-  SET "NPM_PREFIX_NPM_CLI_JS=%%F\node_modules\npm\bin\npm-cli.js"
-)
-IF EXIST "%NPM_PREFIX_NPM_CLI_JS%" (
-  SET "NPM_CLI_JS=%NPM_PREFIX_NPM_CLI_JS%"
-)
-
-"%NODE_EXE%" "%NPM_CLI_JS%" %*
+:: Created by npm, please don't edit manually.
+@ECHO OFF
+
+SETLOCAL
+
+SET "NODE_EXE=%~dp0\node.exe"
+IF NOT EXIST "%NODE_EXE%" (
+  SET "NODE_EXE=node"
+)
+
+SET "NPM_CLI_JS=%~dp0\node_modules\npm\bin\npm-cli.js"
+FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_CLI_JS%" prefix -g') DO (
+  SET "NPM_PREFIX_NPM_CLI_JS=%%F\node_modules\npm\bin\npm-cli.js"
+)
+IF EXIST "%NPM_PREFIX_NPM_CLI_JS%" (
+  SET "NPM_CLI_JS=%NPM_PREFIX_NPM_CLI_JS%"
+)
+
+"%NODE_EXE%" "%NPM_CLI_JS%" %*
diff --git a/deps/npm/bin/npx.cmd b/deps/npm/bin/npx.cmd
@@ -1,20 +1,20 @@
-:: Created by npm, please don't edit manually.
-@ECHO OFF
-
-SETLOCAL
-
-SET "NODE_EXE=%~dp0\node.exe"
-IF NOT EXIST "%NODE_EXE%" (
-  SET "NODE_EXE=node"
-)
-
-SET "NPM_CLI_JS=%~dp0\node_modules\npm\bin\npm-cli.js"
-SET "NPX_CLI_JS=%~dp0\node_modules\npm\bin\npx-cli.js"
-FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_CLI_JS%" prefix -g') DO (
-  SET "NPM_PREFIX_NPX_CLI_JS=%%F\node_modules\npm\bin\npx-cli.js"
-)
-IF EXIST "%NPM_PREFIX_NPX_CLI_JS%" (
-  SET "NPX_CLI_JS=%NPM_PREFIX_NPX_CLI_JS%"
-)
-
-"%NODE_EXE%" "%NPX_CLI_JS%" %*
+:: Created by npm, please don't edit manually.
+@ECHO OFF
+
+SETLOCAL
+
+SET "NODE_EXE=%~dp0\node.exe"
+IF NOT EXIST "%NODE_EXE%" (
+  SET "NODE_EXE=node"
+)
+
+SET "NPM_CLI_JS=%~dp0\node_modules\npm\bin\npm-cli.js"
+SET "NPX_CLI_JS=%~dp0\node_modules\npm\bin\npx-cli.js"
+FOR /F "delims=" %%F IN ('CALL "%NODE_EXE%" "%NPM_CLI_JS%" prefix -g') DO (
+  SET "NPM_PREFIX_NPX_CLI_JS=%%F\node_modules\npm\bin\npx-cli.js"
+)
+IF EXIST "%NPM_PREFIX_NPX_CLI_JS%" (
+  SET "NPX_CLI_JS=%NPM_PREFIX_NPX_CLI_JS%"
+)
+
+"%NODE_EXE%" "%NPX_CLI_JS%" %*
diff --git a/deps/npm/changelogs/CHANGELOG-5.md b/deps/npm/changelogs/CHANGELOG-5.md
@@ -1935,7 +1935,7 @@ helpful when community members go over our code and help clean it up, too!
 * [`9e5b76140`](https://github.com/npm/npm/commit/9e5b76140ffdb7dcd12aa402793644213fb8c5d7)
   [#17411](https://github.com/npm/npm/pull/17411)
   Convert all callback-style `move` usage to use Promises.
-  ([@vramana](https://github.com/vramana))
+  ([@vramana](https://github.com/vramana))
 * [`0711c08f7`](https://github.com/npm/npm/commit/0711c08f779ac641ec42ecc96f604c8861008b28)
   [#17394](https://github.com/npm/npm/pull/17394)
   Remove unused argument in `deepSortObject`.

diff --git a/deps/npm/docs/content/cli-commands/npm-fund.md b/deps/npm/docs/content/cli-commands/npm-fund.md
@@ -21,7 +21,8 @@ a given project. If no package name is provided, it will list all
 dependencies that are looking for funding in a tree-structure in which
 are listed the type of funding and the url to visit. If a package name
 is provided then it tries to open its funding url using the `--browser`
-config param.
+config param; if there are multiple funding sources for the package, the
+user will be instructed to pass the `--which` command to disambiguate.
 
 The list will avoid duplicated entries and will stack all packages
 that share the same type/url as a single entry. Given this nature the
@@ -38,8 +39,8 @@ The browser that is called by the `npm fund` command to open websites.
 
 #### json
 
-* Default: false
 * Type: Boolean
+* Default: false
 
 Show information in JSON format.
 
@@ -51,6 +52,13 @@ Show information in JSON format.
 Whether to represent the tree structure using unicode characters.
 Set it to `false` in order to use all-ansi output.
 
+#### which
+
+* Type: Number
+* Default: undefined
+
+If there are multiple funding sources, which 1-indexed source URL to open.
+
 ## See Also
 
 * [npm docs](/cli-commands/npm-docs)

diff --git a/deps/npm/docs/content/cli-commands/npm-publish.md b/deps/npm/docs/content/cli-commands/npm-publish.md
@@ -73,9 +73,9 @@ included and packs them into a tarball to be uploaded to the registry.
 
 * [npm registry](/using-npm/registry)
 * [npm scope](/using-npm/scope)
-* [npm adduser](/cli-commands/npm-adduser)
-* [npm owner](/cli-commands/npm-owner)
-* [npm deprecate](/cli-commands/npm-deprecate)
-* [npm dist-tag](/cli-commands/npm-dist-tag)
-* [npm pack](/cli-commands/npm-pack)
-* [npm profile](/cli-commands/npm-profile)
+* [npm adduser](/cli-commands/adduser)
+* [npm owner](/cli-commands/owner)
+* [npm deprecate](/cli-commands/deprecate)
+* [npm dist-tag](/cli-commands/dist-tag)
+* [npm pack](/cli-commands/pack)
+* [npm profile](/cli-commands/profile)
diff --git a/deps/npm/docs/content/configuring-npm/package-json.md b/deps/npm/docs/content/configuring-npm/package-json.md
@@ -197,7 +197,8 @@ npm also sets a top-level "maintainers" field with your npm user info.
 ### funding
 
 You can specify an object containing an URL that provides up-to-date
-information about ways to help fund development of your package:
+information about ways to help fund development of your package, or
+a string URL, or an array of these:
 
     "funding": {
       "type" : "individual",
@@ -209,10 +210,26 @@ information about ways to help fund development of your package:
       "url" : "https://www.patreon.com/my-account"
     }
 
+    "funding": "http://example.com/donate"
+
+    "funding": [
+      {
+        "type" : "individual",
+        "url" : "http://example.com/donate"
+      },
+      "http://example.com/donateAlso",
+      {
+        "type" : "patreon",
+        "url" : "https://www.patreon.com/my-account"
+      }
+    ]
+
+
 Users can use the `npm fund` subcommand to list the `funding` URLs of all
 dependencies of their project, direct and indirect. A shortcut to visit each
 funding url is also available when providing the project name such as:
-`npm fund <projectname>`.
+`npm fund <projectname>` (when there are multiple URLs, the first one will be
+visited)
 
 ### files
 

diff --git a/deps/npm/docs/content/using-npm/disputes.md b/deps/npm/docs/content/using-npm/disputes.md
@@ -105,7 +105,7 @@ If you see bad behavior like this, please report it to <abuse@npmjs.com> right
 away. **You are never expected to resolve abusive behavior on your own. We are
 here to help.**
 
-### Trademarkss
+### Trademarks
 
 If you think another npm publisher is infringing your trademark, such as by
 using a confusingly similar package name, email <abuse@npmjs.com> with a link to