deps: upgrade npm to 8.12.0

deps/npm/docs/content/commands/npm-adduser.md

@@ -87,6 +87,20 @@ npm init --scope=@foo --yes
 ```
 
 
+<!-- automatically generated, do not edit manually -->
+<!-- see lib/utils/config/definitions.js -->
+
+#### `auth-type`
+
+* Default: "legacy"
+* Type: "legacy", "webauthn", "sso", "saml", or "oauth"
+* DEPRECATED: The SSO/SAML/OAuth methods are deprecated and will be removed in
+  a future version of npm in favor of web-based login.
+
+What authentication strategy to use with `adduser`/`login`.
+
+Pass `webauthn` to use a web-based login.
+
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 

deps/npm/docs/content/commands/npm-init.md

@@ -253,6 +253,17 @@ This value is not exported to the environment for child processes.
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 
+#### `workspaces-update`
+
+* Default: true
+* Type: Boolean
+
+If set to true, the npm cli will run an update after operations that may
+possibly change the workspaces installed to the `node_modules` folder.
+
+<!-- automatically generated, do not edit manually -->
+<!-- see lib/utils/config/definitions.js -->
+
 #### `include-workspace-root`
 
 * Default: false

deps/npm/docs/content/configuring-npm/package-json.md

@@ -643,6 +643,26 @@ git+https://isaacs@github.com/npm/cli.git
 git://github.com/npm/cli.git#v1.0.27
 ```
 
+When installing from a `git` repository, the presence of certain fields in the
+`package.json` will cause npm to believe it needs to perform a build. To do so
+your repository will be cloned into a temporary directory, all of its deps
+installed, relevant scripts run, and the resulting directory packed and
+installed.
+
+This flow will occur if your git dependency uses `workspaces`, or if any of the
+following scripts are present:
+
+* `build`
+* `prepare`
+* `prepack`
+* `preinstall`
+* `install`
+* `postinstall`
+
+If your git repository includes pre-built artifacts, you will likely want to
+make sure that none of the above scripts are defined, or your dependency
+will be rebuilt for every installation.
+
 #### GitHub URLs
 
 As of version 1.1.65, you can refer to GitHub urls as just "foo":

deps/npm/docs/content/using-npm/config.md

@@ -1891,12 +1891,14 @@ When set to `dev` or `development`, this is an alias for `--include=dev`.
 #### `auth-type`
 
 * Default: "legacy"
-* Type: "legacy", "sso", "saml", or "oauth"
-* DEPRECATED: This method of SSO/SAML/OAuth is deprecated and will be removed
-  in a future version of npm in favor of web-based login.
+* Type: "legacy", "webauthn", "sso", "saml", or "oauth"
+* DEPRECATED: The SSO/SAML/OAuth methods are deprecated and will be removed in
+  a future version of npm in favor of web-based login.
 
 What authentication strategy to use with `adduser`/`login`.
 
+Pass `webauthn` to use a web-based login.
+
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->
 

deps/npm/docs/content/using-npm/scripts.md

@@ -203,6 +203,12 @@ will default the `start` command to `node server.js`.  `prestart` and
 * `test`
 * `posttest`
 
+#### [`npm version`](/commands/npm-version)
+
+* `preversion`
+* `version`
+* `postversion`
+
 #### A Note on a lack of [`npm uninstall`](/commands/npm-uninstall) scripts
 
 While npm v6 had `uninstall` lifecycle scripts, npm v7 does not. Removal of a package can happen for a wide variety of reasons, and there's no clear way to currently give the script enough context to be useful.

deps/npm/docs/output/commands/npm-adduser.html

@@ -142,7 +142,7 @@ <h1 id="npm-adduser">npm-adduser</h1>
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#registry"><code>registry</code></a></li><li><a href="#scope"><code>scope</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
+<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#registry"><code>registry</code></a></li><li><a href="#scope"><code>scope</code></a></li><li><a href="#auth-type"><code>auth-type</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
 </section>
 
 <div id="_content"><h3 id="synopsis">Synopsis</h3>
@@ -204,6 +204,17 @@ <h4 id="scope"><code>scope</code></h4>
 </code></pre>
 <!-- raw HTML omitted -->
 <!-- raw HTML omitted -->
+<h4 id="auth-type"><code>auth-type</code></h4>
+<ul>
+<li>Default: "legacy"</li>
+<li>Type: "legacy", "webauthn", "sso", "saml", or "oauth"</li>
+<li>DEPRECATED: The SSO/SAML/OAuth methods are deprecated and will be removed in
+a future version of npm in favor of web-based login.</li>
+</ul>
+<p>What authentication strategy to use with <code>adduser</code>/<code>login</code>.</p>
+<p>Pass <code>webauthn</code> to use a web-based login.</p>
+<!-- raw HTML omitted -->
+<!-- raw HTML omitted -->
 <!-- raw HTML omitted -->
 <h3 id="see-also">See Also</h3>
 <ul>

deps/npm/docs/output/commands/npm-init.html

@@ -142,7 +142,7 @@ <h1 id="npm-init">npm-init</h1>
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><ul><li><a href="#forwarding-additional-options">Forwarding additional options</a></li></ul><li><a href="#examples">Examples</a></li><li><a href="#workspaces-support">Workspaces support</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#yes"><code>yes</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
+<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><ul><li><a href="#forwarding-additional-options">Forwarding additional options</a></li></ul><li><a href="#examples">Examples</a></li><li><a href="#workspaces-support">Workspaces support</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#yes"><code>yes</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li><li><a href="#workspaces-update"><code>workspaces-update</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
 </section>
 
 <div id="_content"><h3 id="synopsis">Synopsis</h3>
@@ -339,6 +339,15 @@ <h4 id="workspaces"><code>workspaces</code></h4>
 <p>This value is not exported to the environment for child processes.</p>
 <!-- raw HTML omitted -->
 <!-- raw HTML omitted -->
+<h4 id="workspaces-update"><code>workspaces-update</code></h4>
+<ul>
+<li>Default: true</li>
+<li>Type: Boolean</li>
+</ul>
+<p>If set to true, the npm cli will run an update after operations that may
+possibly change the workspaces installed to the <code>node_modules</code> folder.</p>
+<!-- raw HTML omitted -->
+<!-- raw HTML omitted -->
 <h4 id="include-workspace-root"><code>include-workspace-root</code></h4>
 <ul>
 <li>Default: false</li>

deps/npm/docs/output/commands/npm-ls.html

@@ -166,7 +166,7 @@ <h3 id="description">Description</h3>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre lang="bash"><code>npm@8.11.0 /path/to/npm
+<pre lang="bash"><code>npm@8.12.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>

deps/npm/docs/output/commands/npm.html

@@ -149,7 +149,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 <!-- raw HTML omitted -->
 <!-- raw HTML omitted -->
 <h3 id="version">Version</h3>
-<p>8.11.0</p>
+<p>8.12.0</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/docs/output/configuring-npm/package-json.html

@@ -629,6 +629,24 @@ <h4 id="git-urls-as-dependencies">Git URLs as Dependencies</h4>
 git+https://isaacs@github.com/npm/cli.git
 git://github.com/npm/cli.git#v1.0.27
 </code></pre>
+<p>When installing from a <code>git</code> repository, the presence of certain fields in the
+<code>package.json</code> will cause npm to believe it needs to perform a build. To do so
+your repository will be cloned into a temporary directory, all of its deps
+installed, relevant scripts run, and the resulting directory packed and
+installed.</p>
+<p>This flow will occur if your git dependency uses <code>workspaces</code>, or if any of the
+following scripts are present:</p>
+<ul>
+<li><code>build</code></li>
+<li><code>prepare</code></li>
+<li><code>prepack</code></li>
+<li><code>preinstall</code></li>
+<li><code>install</code></li>
+<li><code>postinstall</code></li>
+</ul>
+<p>If your git repository includes pre-built artifacts, you will likely want to
+make sure that none of the above scripts are defined, or your dependency
+will be rebuilt for every installation.</p>
 <h4 id="github-urls">GitHub URLs</h4>
 <p>As of version 1.1.65, you can refer to GitHub urls as just "foo":
 "user/foo-project".  Just as with git URLs, a <code>commit-ish</code> suffix can be

deps/npm/docs/output/using-npm/config.html

@@ -1660,11 +1660,12 @@ <h4 id="also"><code>also</code></h4>
 <h4 id="auth-type"><code>auth-type</code></h4>
 <ul>
 <li>Default: "legacy"</li>
-<li>Type: "legacy", "sso", "saml", or "oauth"</li>
-<li>DEPRECATED: This method of SSO/SAML/OAuth is deprecated and will be removed
-in a future version of npm in favor of web-based login.</li>
+<li>Type: "legacy", "webauthn", "sso", "saml", or "oauth"</li>
+<li>DEPRECATED: The SSO/SAML/OAuth methods are deprecated and will be removed in
+a future version of npm in favor of web-based login.</li>
 </ul>
 <p>What authentication strategy to use with <code>adduser</code>/<code>login</code>.</p>
+<p>Pass <code>webauthn</code> to use a web-based login.</p>
 <!-- raw HTML omitted -->
 <!-- raw HTML omitted -->
 <h4 id="cache-max"><code>cache-max</code></h4>

deps/npm/docs/output/using-npm/scripts.html

@@ -142,7 +142,7 @@ <h1 id="scripts">scripts</h1>
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><li><a href="#pre--post-scripts">Pre &amp; Post Scripts</a></li><li><a href="#life-cycle-scripts">Life Cycle Scripts</a></li><ul><li><a href="#prepare-and-prepublish">Prepare and Prepublish</a></li></ul><li><a href="#life-cycle-operation-order">Life Cycle Operation Order</a></li><ul><li><a href="#npm-cache-add"><a href="../commands/npm-cache.html"><code>npm cache add</code></a></a></li><li><a href="#npm-ci"><a href="../commands/npm-ci.html"><code>npm ci</code></a></a></li><li><a href="#npm-diff"><a href="../commands/npm-diff.html"><code>npm diff</code></a></a></li><li><a href="#npm-install"><a href="../commands/npm-install.html"><code>npm install</code></a></a></li><li><a href="#npm-pack"><a href="../commands/npm-pack.html"><code>npm pack</code></a></a></li><li><a href="#npm-publish"><a href="../commands/npm-publish.html"><code>npm publish</code></a></a></li><li><a href="#npm-rebuild"><a href="../commands/npm-rebuild.html"><code>npm rebuild</code></a></a></li><li><a href="#npm-restart"><a href="../commands/npm-restart.html"><code>npm restart</code></a></a></li><li><a href="#npm-run-user-defined"><a href="../commands/npm-run-script.html"><code>npm run &lt;user defined&gt;</code></a></a></li><li><a href="#npm-start"><a href="../commands/npm-start.html"><code>npm start</code></a></a></li><li><a href="#npm-stop"><a href="../commands/npm-stop.html"><code>npm stop</code></a></a></li><li><a href="#npm-test"><a href="../commands/npm-test.html"><code>npm test</code></a></a></li><li><a href="#a-note-on-a-lack-of-npm-uninstall-scripts">A Note on a lack of <a href="../commands/npm-uninstall.html"><code>npm uninstall</code></a> scripts</a></li></ul><li><a href="#user">User</a></li><li><a href="#environment">Environment</a></li><ul><li><a href="#path">path</a></li><li><a href="#packagejson-vars">package.json vars</a></li><li><a href="#current-lifecycle-event">current lifecycle event</a></li></ul><li><a href="#examples">Examples</a></li><li><a href="#exiting">Exiting</a></li><li><a href="#best-practices">Best Practices</a></li><li><a href="#see-also">See Also</a></li></ul></div>
+<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><li><a href="#pre--post-scripts">Pre &amp; Post Scripts</a></li><li><a href="#life-cycle-scripts">Life Cycle Scripts</a></li><ul><li><a href="#prepare-and-prepublish">Prepare and Prepublish</a></li></ul><li><a href="#life-cycle-operation-order">Life Cycle Operation Order</a></li><ul><li><a href="#npm-cache-add"><a href="../commands/npm-cache.html"><code>npm cache add</code></a></a></li><li><a href="#npm-ci"><a href="../commands/npm-ci.html"><code>npm ci</code></a></a></li><li><a href="#npm-diff"><a href="../commands/npm-diff.html"><code>npm diff</code></a></a></li><li><a href="#npm-install"><a href="../commands/npm-install.html"><code>npm install</code></a></a></li><li><a href="#npm-pack"><a href="../commands/npm-pack.html"><code>npm pack</code></a></a></li><li><a href="#npm-publish"><a href="../commands/npm-publish.html"><code>npm publish</code></a></a></li><li><a href="#npm-rebuild"><a href="../commands/npm-rebuild.html"><code>npm rebuild</code></a></a></li><li><a href="#npm-restart"><a href="../commands/npm-restart.html"><code>npm restart</code></a></a></li><li><a href="#npm-run-user-defined"><a href="../commands/npm-run-script.html"><code>npm run &lt;user defined&gt;</code></a></a></li><li><a href="#npm-start"><a href="../commands/npm-start.html"><code>npm start</code></a></a></li><li><a href="#npm-stop"><a href="../commands/npm-stop.html"><code>npm stop</code></a></a></li><li><a href="#npm-test"><a href="../commands/npm-test.html"><code>npm test</code></a></a></li><li><a href="#npm-version"><a href="../commands/npm-version.html"><code>npm version</code></a></a></li><li><a href="#a-note-on-a-lack-of-npm-uninstall-scripts">A Note on a lack of <a href="../commands/npm-uninstall.html"><code>npm uninstall</code></a> scripts</a></li></ul><li><a href="#user">User</a></li><li><a href="#environment">Environment</a></li><ul><li><a href="#path">path</a></li><li><a href="#packagejson-vars">package.json vars</a></li><li><a href="#current-lifecycle-event">current lifecycle event</a></li></ul><li><a href="#examples">Examples</a></li><li><a href="#exiting">Exiting</a></li><li><a href="#best-practices">Best Practices</a></li><li><a href="#see-also">See Also</a></li></ul></div>
 </section>
 
 <div id="_content"><h3 id="description">Description</h3>
@@ -338,6 +338,12 @@ <h4 id="npm-test"><a href="../commands/npm-test.html"><code>npm test</code></a><
 <li><code>test</code></li>
 <li><code>posttest</code></li>
 </ul>
+<h4 id="npm-version"><a href="../commands/npm-version.html"><code>npm version</code></a></h4>
+<ul>
+<li><code>preversion</code></li>
+<li><code>version</code></li>
+<li><code>postversion</code></li>
+</ul>
 <h4 id="a-note-on-a-lack-of-npm-uninstall-scripts">A Note on a lack of <a href="../commands/npm-uninstall.html"><code>npm uninstall</code></a> scripts</h4>
 <p>While npm v6 had <code>uninstall</code> lifecycle scripts, npm v7 does not. Removal of a package can happen for a wide variety of reasons, and there's no clear way to currently give the script enough context to be useful.</p>
 <p>Reasons for a package removal include:</p>

deps/npm/lib/commands/adduser.js

@@ -3,6 +3,7 @@ const replaceInfo = require('../utils/replace-info.js')
 const BaseCommand = require('../base-command.js')
 const authTypes = {
   legacy: require('../auth/legacy.js'),
+  webauthn: require('../auth/legacy.js'),
   oauth: require('../auth/oauth.js'),
   saml: require('../auth/saml.js'),
   sso: require('../auth/sso.js'),
@@ -14,6 +15,7 @@ class AddUser extends BaseCommand {
   static params = [
     'registry',
     'scope',
+    'auth-type',
   ]
 
   static ignoreImplicitWorkspace = true

deps/npm/lib/commands/init.js

@@ -8,13 +8,22 @@ const libexec = require('libnpmexec')
 const mapWorkspaces = require('@npmcli/map-workspaces')
 const PackageJson = require('@npmcli/package-json')
 const log = require('../utils/log-shim.js')
+const updateWorkspaces = require('../workspaces/update-workspaces.js')
 
 const getLocationMsg = require('../exec/get-workspace-location-msg.js')
 const BaseCommand = require('../base-command.js')
 
 class Init extends BaseCommand {
   static description = 'Create a package.json file'
-  static params = ['yes', 'force', 'workspace', 'workspaces', 'include-workspace-root']
+  static params = [
+    'yes',
+    'force',
+    'workspace',
+    'workspaces',
+    'workspaces-update',
+    'include-workspace-root',
+  ]
+
   static name = 'init'
   static usage = [
     '[--force|-f|--yes|-y|--scope]',
@@ -46,11 +55,13 @@ class Init extends BaseCommand {
     const pkg = await rpj(resolve(this.npm.localPrefix, 'package.json'))
     const wPath = filterArg => resolve(this.npm.localPrefix, filterArg)
 
+    const workspacesPaths = []
     // npm-exec style, runs in the context of each workspace filter
     if (args.length) {
       for (const filterArg of filters) {
         const path = wPath(filterArg)
         await mkdirp(path)
+        workspacesPaths.push(path)
         await this.execCreate({ args, path })
         await this.setWorkspace({ pkg, workspacePath: path })
       }
@@ -61,9 +72,13 @@ class Init extends BaseCommand {
     for (const filterArg of filters) {
       const path = wPath(filterArg)
       await mkdirp(path)
+      workspacesPaths.push(path)
       await this.template(path)
       await this.setWorkspace({ pkg, workspacePath: path })
     }
+
+    // reify packages once all workspaces have been initialized
+    await this.update(workspacesPaths)
   }
 
   async execCreate ({ args, path }) {
@@ -196,6 +211,34 @@ class Init extends BaseCommand {
 
     await pkgJson.save()
   }
+
+  async update (workspacesPaths) {
+    // translate workspaces paths into an array containing workspaces names
+    const workspaces = []
+    for (const path of workspacesPaths) {
+      const pkgPath = resolve(path, 'package.json')
+      const { name } = await rpj(pkgPath)
+        .catch(() => ({}))
+
+      if (name) {
+        workspaces.push(name)
+      }
+    }
+
+    const {
+      config,
+      flatOptions,
+      localPrefix,
+    } = this.npm
+
+    await updateWorkspaces({
+      config,
+      flatOptions,
+      localPrefix,
+      npm: this.npm,
+      workspaces,
+    })
+  }
 }
 
 module.exports = Init

deps/npm/lib/commands/version.js

@@ -3,9 +3,7 @@ const { resolve } = require('path')
 const { promisify } = require('util')
 const readFile = promisify(require('fs').readFile)
 
-const Arborist = require('@npmcli/arborist')
-const reifyFinish = require('../utils/reify-finish.js')
-
+const updateWorkspaces = require('../workspaces/update-workspaces.js')
 const BaseCommand = require('../base-command.js')
 
 class Version extends BaseCommand {
@@ -137,32 +135,20 @@ class Version extends BaseCommand {
     return this.list(results)
   }
 
-  async update (args) {
-    if (!this.npm.flatOptions.workspacesUpdate || !args.length) {
-      return
-    }
-
-    // default behavior is to not save by default in order to avoid
-    // race condition problems when publishing multiple workspaces
-    // that have dependencies on one another, it might still be useful
-    // in some cases, which then need to set --save
-    const save = this.npm.config.isDefault('save')
-      ? false
-      : this.npm.config.get('save')
-
-    // runs a minimalistic reify update, targetting only the workspaces
-    // that had version updates and skipping fund/audit/save
-    const opts = {
-      ...this.npm.flatOptions,
-      audit: false,
-      fund: false,
-      path: this.npm.localPrefix,
-      save,
-    }
-    const arb = new Arborist(opts)
-
-    await arb.reify({ ...opts, update: args })
-    await reifyFinish(this.npm, arb)
+  async update (workspaces) {
+    const {
+      config,
+      flatOptions,
+      localPrefix,
+    } = this.npm
+
+    await updateWorkspaces({
+      config,
+      flatOptions,
+      localPrefix,
+      npm: this.npm,
+      workspaces,
+    })
   }
 }