npm · Oct 3, 2023 · Oct 3, 2023 · Oct 6, 2023 · Oct 9, 2023 · Oct 9, 2023
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,5 +1,5 @@
 {
-  ".": "10.2.0",
+  ".": "10.2.1",
   "workspaces/arborist": "7.2.0",
   "workspaces/libnpmaccess": "8.0.1",
   "workspaces/libnpmdiff": "6.0.2",
@@ -12,5 +12,5 @@
   "workspaces/libnpmsearch": "7.0.0",
   "workspaces/libnpmteam": "6.0.0",
   "workspaces/libnpmversion": "5.0.0",
-  "workspaces/config": "8.0.0"
+  "workspaces/config": "8.0.1"
 }
diff --git a/AUTHORS b/AUTHORS
@@ -901,3 +901,7 @@ Yuku Kotani <poyo0315@gmail.com>
 Vlad-Ștefan Harbuz <291640+vladh@users.noreply.github.com>
 siemhesda <143130929+siemhesda@users.noreply.github.com>
 Carl <carl@carlfoster.io>
+jpg619 <141764922+jpg619@users.noreply.github.com>
+Frazer Smith <frazer.dev@outlook.com>
+Aaron <2738518+NeonArray@users.noreply.github.com>
+Wes Todd <wes@wesleytodd.com>
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,35 @@
 # Changelog
 
+## [10.2.1](https://github.com/npm/cli/compare/v10.2.0...v10.2.1) (2023-10-18)
+
+### Bug Fixes
+
+* [`35c92fe`](https://github.com/npm/cli/commit/35c92fec3d053d303cc8057faa0ff4fe6e7cdc8a) [#6902](https://github.com/npm/cli/pull/6902) Add check to pkg command to deal with empty values (#6902) (@NeonArray)
+* [`5b6172f`](https://github.com/npm/cli/commit/5b6172f01c88b73e83a75a508bbdcad92231ead5) [#6895](https://github.com/npm/cli/pull/6895) logout from custom registry (@wraithgar)
+* [`8423d4f`](https://github.com/npm/cli/commit/8423d4f133a40c8ceb0e1a75d23aa95fbf4f5b65) [#6895](https://github.com/npm/cli/pull/6895) delete auth from proper location on logout (@wraithgar)
+* [`0cfe9de`](https://github.com/npm/cli/commit/0cfe9de1c74b20d3e04ecc26ccf594196d101afe) [#6873](https://github.com/npm/cli/pull/6873) audit: spelling error in message (#6873) (@Fdawgs)
+
+### Documentation
+
+* [`5142735`](https://github.com/npm/cli/commit/5142735c462e285a7a7d9bcbd562885c6ef96c96) [#6894](https://github.com/npm/cli/pull/6894) update npm build description (#6894) (@siemhesda)
+* [`2e4b4ad`](https://github.com/npm/cli/commit/2e4b4ad8bef158def1b2302846ab294fe7a83de4) [#6861](https://github.com/npm/cli/pull/6861) npm publish content modification (#6861) (@jpg619)
+
+### Dependencies
+
+* [`96e1637`](https://github.com/npm/cli/commit/96e1637117b6614b5ad861d86d828746d5db356c) [#6915](https://github.com/npm/cli/pull/6915) `cmd-shim@6.0.2` (#6915)
+* [`b405da1`](https://github.com/npm/cli/commit/b405da1672e05d55bd22e476091891c443bcbeab) [#6899](https://github.com/npm/cli/pull/6899) `bin-links@4.0.3`
+* [`ef69d36`](https://github.com/npm/cli/commit/ef69d362fa81640ac3ca60a6e01921c17f7a76cb) [#6895](https://github.com/npm/cli/pull/6895) `npm-registry-fetch@16.1.0`
+* [`337c903`](https://github.com/npm/cli/commit/337c9038605b97431e06d2f470229f4370703b13) [#6882](https://github.com/npm/cli/pull/6882) `spdx-license-ids@3.0.16`
+* [`e6b0be7`](https://github.com/npm/cli/commit/e6b0be7d3b3cd7f66612f9adb6c4de829335b607) [#6882](https://github.com/npm/cli/pull/6882) `socks-proxy-agent@8.0.2`
+* [`ee6892e`](https://github.com/npm/cli/commit/ee6892e69079b07c0a8747d873018819a97e3877) [#6882](https://github.com/npm/cli/pull/6882) `readable-stream@4.4.2`
+* [`61c3ee9`](https://github.com/npm/cli/commit/61c3ee9a073528b30676ec66fdd29788ea7be09d) [#6882](https://github.com/npm/cli/pull/6882) `minipass@7.0.4`
+* [`14d31fd`](https://github.com/npm/cli/commit/14d31fdcc747f420158d254d0ac258a848bc888c) [#6882](https://github.com/npm/cli/pull/6882) `is-core-module@2.13.0`
+* [`03f3d2e`](https://github.com/npm/cli/commit/03f3d2e1d13cd12f23a946cfb9065b8e8fbe129b) [#6882](https://github.com/npm/cli/pull/6882) `https-proxy-agent@7.0.2`
+* [`e0163c6`](https://github.com/npm/cli/commit/e0163c6787f3877c3ad6c84d8af44378f7eed23b) [#6882](https://github.com/npm/cli/pull/6882) `are-we-there-yet@4.0.1`
+* [`fca804a`](https://github.com/npm/cli/commit/fca804adec57e176bb2a2e60bf84df44e661478f) [#6882](https://github.com/npm/cli/pull/6882) `ci-info@3.9.0`
+* [`6af582f`](https://github.com/npm/cli/commit/6af582f23bf046a224d5679e917977f0bb3f95e3) [#6882](https://github.com/npm/cli/pull/6882) `npm-install-checks@6.3.0`
+* [Workspace](https://github.com/npm/cli/releases/tag/config-v8.0.1): `@npmcli/config@8.0.1`
+
 ## [10.2.0](https://github.com/npm/cli/compare/v10.1.0...v10.2.0) (2023-10-02)
 
 ### Features

diff --git a/docs/lib/content/commands/npm-rebuild.md b/docs/lib/content/commands/npm-rebuild.md
@@ -10,14 +10,29 @@ description: Rebuild a package
 
 ### Description
 
-This command runs the `npm build` command on the matched folders.  This is
-useful when you install a new version of node, and must recompile all your
-C++ addons with the new binary.  It is also useful when installing with
-`--ignore-scripts` and `--no-bin-links`, to explicitly choose which
-packages to build and/or link bins.
-
-If one or more package specs are provided, then only packages with a
-name and version matching one of the specifiers will be rebuilt.
+This command does the following:
+
+1. Execute lifecycle scripts (`preinstall`, `install`, `postinstall`, `prepare`)
+2. Links bins depending on whether bin links are enabled
+
+This command is particularly useful in scenarios including but not limited to:
+
+1. Installing a new version of **node.js**, where you need to recompile all your C++ add-ons with the updated binary.
+2. Installing with `--ignore-scripts` and `--no-bin-links`, to explicitly choose which packages to build and/or link bins.
+
+If one or more package specs are provided, then only packages with a name and version matching one of the specifiers will be rebuilt.
+
+Usually, you should not need to run `npm rebuild` as it is already done for you as part of npm install (unless you suppressed these steps with `--ignore-scripts` or `--no-bin-links`).
+
+If there is a `binding.gyp` file in the root of your package, then npm will use a default install hook:
+
+```
+"scripts": {
+    "install": "node-gyp rebuild"
+}
+```
+
+This default behavior is suppressed if the `package.json` has its own `install` or `preinstall` scripts. It is also suppressed if the package specifies `"gypfile": false`
 
 ### Configuration
 

diff --git a/docs/lib/content/using-npm/scripts.md b/docs/lib/content/using-npm/scripts.md
@@ -159,8 +159,6 @@ These are run from the scripts of `<pkg-name>`
 * `publish`
 * `postpublish`
 
-`prepare` will not run during `--dry-run`
-
 #### [`npm rebuild`](/commands/npm-rebuild)
 
 * `preinstall`

diff --git a/lib/commands/audit.js b/lib/commands/audit.js
@@ -55,7 +55,7 @@ class VerifySignatures {
     // Didn't find any dependencies that could be verified, e.g. only local
     // deps, missing version, not on a registry etc.
     if (!this.auditedWithKeysCount) {
-      throw new Error('found no dependencies to audit that where installed from ' +
+      throw new Error('found no dependencies to audit that were installed from ' +
                       'a supported registry')
     }
 

diff --git a/lib/commands/logout.js b/lib/commands/logout.js
@@ -1,5 +1,5 @@
-const getAuth = require('npm-registry-fetch/lib/auth.js')
 const npmFetch = require('npm-registry-fetch')
+const { getAuth } = npmFetch
 const log = require('../utils/log-shim')
 const BaseCommand = require('../base-command.js')
 
@@ -19,10 +19,14 @@ class Logout extends BaseCommand {
 
     const auth = getAuth(reg, this.npm.flatOptions)
 
+    const level = this.npm.config.find(`${auth.regKey}:${auth.authKey}`)
+
+    // find the config level and only delete from there
     if (auth.token) {
       log.verbose('logout', `clearing token for ${reg}`)
       await npmFetch(`/-/user/token/${encodeURIComponent(auth.token)}`, {
         ...this.npm.flatOptions,
+        registry: reg,
         method: 'DELETE',
         ignoreBody: true,
       })
@@ -34,12 +38,12 @@ class Logout extends BaseCommand {
     }
 
     if (scope) {
-      this.npm.config.delete(regRef, 'user')
+      this.npm.config.delete(regRef, level)
     }
 
-    this.npm.config.clearCredentialsByURI(reg)
+    this.npm.config.clearCredentialsByURI(reg, level)
 
-    await this.npm.config.save('user')
+    await this.npm.config.save(level)
   }
 }
 module.exports = Logout
diff --git a/lib/utils/queryable.js b/lib/utils/queryable.js
@@ -111,13 +111,9 @@ const getter = ({ data, key }) => {
       }, {})
       return _data
     } else {
-      // if can't find any more values, it means it's just over
-      // and there's nothing to return
-      if (!_data[k]) {
+      if (!Object.hasOwn(_data, k)) {
         return undefined
       }
-
-      // otherwise sets the next value
       _data = _data[k]
     }
 

diff --git a/mock-registry/lib/index.js b/mock-registry/lib/index.js
@@ -252,6 +252,11 @@ class MockRegistry {
       .reply(200, { token })
   }
 
+  logout (token) {
+    this.nock = this.nock.delete(this.fullPath(`/-/user/token/${encodeURIComponent(token)}`))
+      .reply(200, { ok: true })
+  }
+
   // team can be a team or a username
   getPackages ({ user, team, packages = {}, times = 1, responseCode = 200 }) {
     let uri

diff --git a/node_modules/@npmcli/agent/node_modules/https-proxy-agent/dist/index.js b/node_modules/@npmcli/agent/node_modules/https-proxy-agent/dist/index.js
@@ -81,7 +81,11 @@ class HttpsProxyAgent extends agent_base_1.Agent {
         let socket;
         if (proxy.protocol === 'https:') {
             debug('Creating `tls.Socket`: %o', this.connectOpts);
-            socket = tls.connect(this.connectOpts);
+            const servername = this.connectOpts.servername || this.connectOpts.host;
+            socket = tls.connect({
+                ...this.connectOpts,
+                servername: servername && net.isIP(servername) ? undefined : servername
+            });
         }
         else {
             debug('Creating `net.Socket`: %o', this.connectOpts);

diff --git a/node_modules/@npmcli/agent/node_modules/https-proxy-agent/dist/parse-proxy-response.js b/node_modules/@npmcli/agent/node_modules/https-proxy-agent/dist/parse-proxy-response.js
@@ -47,7 +47,10 @@ function parseProxyResponse(socket) {
                 read();
                 return;
             }
-            const headerParts = buffered.slice(0, endOfHeaders).toString('ascii').split('\r\n');
+            const headerParts = buffered
+                .slice(0, endOfHeaders)
+                .toString('ascii')
+                .split('\r\n');
             const firstLine = headerParts.shift();
             if (!firstLine) {
                 socket.destroy();

diff --git a/node_modules/@npmcli/agent/node_modules/https-proxy-agent/package.json b/node_modules/@npmcli/agent/node_modules/https-proxy-agent/package.json
@@ -1,6 +1,6 @@
 {
   "name": "https-proxy-agent",
-  "version": "7.0.1",
+  "version": "7.0.2",
   "description": "An HTTP(s) proxy `http.Agent` implementation for HTTPS",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",

diff --git a/node_modules/@npmcli/agent/node_modules/socks-proxy-agent/dist/index.js b/node_modules/@npmcli/agent/node_modules/socks-proxy-agent/dist/index.js
@@ -33,6 +33,7 @@ const debug_1 = __importDefault(require("debug"));
 const dns = __importStar(require("dns"));
 const net = __importStar(require("net"));
 const tls = __importStar(require("tls"));
+const url_1 = require("url");
 const debug = (0, debug_1.default)('socks-proxy-agent');
 function parseSocksURL(url) {
     let lookup = false;
@@ -88,7 +89,7 @@ function parseSocksURL(url) {
 class SocksProxyAgent extends agent_base_1.Agent {
     constructor(uri, opts) {
         super(opts);
-        const url = typeof uri === 'string' ? new URL(uri) : uri;
+        const url = typeof uri === 'string' ? new url_1.URL(uri) : uri;
         const { proxy, lookup } = parseSocksURL(url);
         this.shouldLookup = lookup;
         this.proxy = proxy;

diff --git a/node_modules/@npmcli/agent/node_modules/socks-proxy-agent/package.json b/node_modules/@npmcli/agent/node_modules/socks-proxy-agent/package.json
@@ -1,6 +1,6 @@
 {
   "name": "socks-proxy-agent",
-  "version": "8.0.1",
+  "version": "8.0.2",
   "description": "A SOCKS proxy `http.Agent` implementation for HTTP and HTTPS",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -107,7 +107,7 @@
     "socks5h"
   ],
   "dependencies": {
-    "agent-base": "^7.0.1",
+    "agent-base": "^7.0.2",
     "debug": "^4.3.4",
     "socks": "^2.7.1"
   },
@@ -117,16 +117,16 @@
     "@types/dns2": "^2.0.3",
     "@types/jest": "^29.5.1",
     "@types/node": "^14.18.45",
-    "async-listen": "^2.1.0",
+    "async-listen": "^3.0.0",
     "async-retry": "^1.3.3",
     "cacheable-lookup": "^6.1.0",
     "dns2": "^2.1.0",
     "jest": "^29.5.0",
     "socksv5": "github:TooTallNate/socksv5#fix/dstSock-close-event",
     "ts-jest": "^29.1.0",
     "typescript": "^5.0.4",
-    "tsconfig": "0.0.0",
-    "proxy": "2.0.1"
+    "proxy": "2.1.1",
+    "tsconfig": "0.0.0"
   },
   "engines": {
     "node": ">= 14"

diff --git a/node_modules/are-we-there-yet/lib/tracker-base.js b/node_modules/are-we-there-yet/lib/tracker-base.js
@@ -1,11 +1,13 @@
 'use strict'
-var EventEmitter = require('events').EventEmitter
-var util = require('util')
+const EventEmitter = require('events')
 
-var trackerId = 0
-var TrackerBase = module.exports = function (name) {
-  EventEmitter.call(this)
-  this.id = ++trackerId
-  this.name = name
+let trackerId = 0
+class TrackerBase extends EventEmitter {
+  constructor (name) {
+    super()
+    this.id = ++trackerId
+    this.name = name
+  }
 }
-util.inherits(TrackerBase, EventEmitter)
+
+module.exports = TrackerBase