.release-please-manifest.json

@@ -1,16 +1,16 @@
 {
-  ".": "10.2.3",
+  ".": "10.2.4",
   "workspaces/arborist": "7.2.1",
   "workspaces/libnpmaccess": "8.0.1",
   "workspaces/libnpmdiff": "6.0.3",
-  "workspaces/libnpmexec": "7.0.3",
+  "workspaces/libnpmexec": "7.0.4",
   "workspaces/libnpmfund": "5.0.1",
   "workspaces/libnpmhook": "10.0.0",
   "workspaces/libnpmorg": "6.0.1",
   "workspaces/libnpmpack": "6.0.3",
-  "workspaces/libnpmpublish": "9.0.1",
+  "workspaces/libnpmpublish": "9.0.2",
   "workspaces/libnpmsearch": "7.0.0",
   "workspaces/libnpmteam": "6.0.0",
   "workspaces/libnpmversion": "5.0.1",
-  "workspaces/config": "8.0.1"
+  "workspaces/config": "8.0.2"
 }

AUTHORS

@@ -908,3 +908,7 @@ Wes Todd <wes@wesleytodd.com>
 Mike McCready <66998419+MikeMcC399@users.noreply.github.com>
 Piotr Kmieć <103869106+Gekuro@users.noreply.github.com>
 Santoshraj2 <143222321+Santoshraj2@users.noreply.github.com>
+Jamie Tanna <github@jamietanna.co.uk>
+三咲智子 Kevin Deng <sxzz@sxzz.moe>
+Manuel Spigolon <behemoth89@gmail.com>
+Robin <robin.knipe@gmail.com>

CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## [10.2.4](https://github.com/npm/cli/compare/v10.2.3...v10.2.4) (2023-11-14)
+
+### Bug Fixes
+
+* [`cd291e7`](https://github.com/npm/cli/commit/cd291e7aa52e56fc45f8245e67c77e0ed3711b07) [#6995](https://github.com/npm/cli/pull/6995) refactor search formatting code (#6995) (@wraithgar)
+* [`f3a7380`](https://github.com/npm/cli/commit/f3a7380a45323dbf6c74015e418de3963fb11a69) [#6973](https://github.com/npm/cli/pull/6973) look in workspace for exec commands (#6973) (@wraithgar)
+* [`d11496b`](https://github.com/npm/cli/commit/d11496b26dfee5957e7e2a1b328f346b2aca9348) [#6977](https://github.com/npm/cli/pull/6977) pkg: properly output in workspace mode (#6977) (@wraithgar)
+* [`0f70088`](https://github.com/npm/cli/commit/0f7008851f1c250405e8dc326f15d535e8fc1eae) [#6969](https://github.com/npm/cli/pull/6969) correctly handle object licenses in SBOM generation (#6969) (@jamietanna)
+* [`dce3b08`](https://github.com/npm/cli/commit/dce3b0896ba81b2109fea42ab32edd8a3193324c) [#6951](https://github.com/npm/cli/pull/6951) properly catch missing url opener error (#6951) (@wraithgar)
+
+### Documentation
+
+* [`a38836c`](https://github.com/npm/cli/commit/a38836ce9d703f5012ff4d4a8a4e3b9a9aedc025) [#6616](https://github.com/npm/cli/pull/6616) add path usage for view command (#6616) (@RobinKnipe)
+* [`da18e4f`](https://github.com/npm/cli/commit/da18e4f9baa180beeb325a384759a26a19ac2919) [#6987](https://github.com/npm/cli/pull/6987) update npm-prune description (#6987) (@Eomm)
+
+### Dependencies
+
+* [`e9ec2f7`](https://github.com/npm/cli/commit/e9ec2f7005e7326d9a819978b251cf0a05062538) [#6994](https://github.com/npm/cli/pull/6994) `lru-cache@10.0.2`
+* [`faf9eff`](https://github.com/npm/cli/commit/faf9efffb7bfe6efde6e53830cb054b34c3a6ea3) [#6994](https://github.com/npm/cli/pull/6994) `is-core-module@2.13.1`
+* [`b00e780`](https://github.com/npm/cli/commit/b00e7808e370513e79ca31c261958377984e7444) [#6994](https://github.com/npm/cli/pull/6994) `@sigstore/sign@2.2.0`
+* [`4613774`](https://github.com/npm/cli/commit/461377426d998ed79400501b09e1ee67c32bee23) [#6994](https://github.com/npm/cli/pull/6994) hoisting newer deps in favor of older ones
+* [`54c4f7b`](https://github.com/npm/cli/commit/54c4f7b8705b2c9d5b8bc5bb846f4e7863735b7e) [#6994](https://github.com/npm/cli/pull/6994) `signal-exit@4.1.0`
+* [`8c5882f`](https://github.com/npm/cli/commit/8c5882f3eed305bbd3514d7143f9d92e9577e1b9) [#6994](https://github.com/npm/cli/pull/6994) `strip-ansi@7.1.0`
+* [`cd0c649`](https://github.com/npm/cli/commit/cd0c649ec2b421b59012854e61788a11a77194f2) [#6994](https://github.com/npm/cli/pull/6994) `ci-info@4.0.0`
+* [`a0a58b7`](https://github.com/npm/cli/commit/a0a58b735c418d8555a06890b63098c68f53106e) [#6994](https://github.com/npm/cli/pull/6994) `@sigstore/tuf@2.2.0`
+* [`b3a53c6`](https://github.com/npm/cli/commit/b3a53c6ab5fd933fc7f8258c155ed31be834393e) [#6949](https://github.com/npm/cli/pull/6949) `is-cidr@5.0.3` (#6949)
+* [Workspace](https://github.com/npm/cli/releases/tag/config-v8.0.2): `@npmcli/config@8.0.2`
+* [Workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v7.0.4): `libnpmexec@7.0.4`
+* [Workspace](https://github.com/npm/cli/releases/tag/libnpmpublish-v9.0.2): `libnpmpublish@9.0.2`
+
 ## [10.2.3](https://github.com/npm/cli/compare/v10.2.2...v10.2.3) (2023-11-02)
 
 ### Dependencies

DEPENDENCIES.md

@@ -318,7 +318,7 @@ graph LR;
   glob-->minimatch;
   glob-->minipass;
   glob-->path-scurry;
-  has-->function-bind;
+  hasown-->function-bind;
   hosted-git-info-->lru-cache;
   http-proxy-agent-->agent-base;
   http-proxy-agent-->debug;
@@ -334,7 +334,7 @@ graph LR;
   init-package-json-->validate-npm-package-license;
   init-package-json-->validate-npm-package-name;
   is-cidr-->cidr-regex;
-  is-core-module-->has;
+  is-core-module-->hasown;
   isaacs-cliui-->string-width-cjs;
   isaacs-cliui-->string-width;
   isaacs-cliui-->strip-ansi-cjs;
@@ -441,6 +441,7 @@ graph LR;
   libnpmversion-->require-inject;
   libnpmversion-->semver;
   libnpmversion-->tap;
+  lru-cache-->semver;
   lru-cache-->yallist;
   make-fetch-happen-->cacache;
   make-fetch-happen-->http-cache-semantics;

docs/lib/content/commands/npm-prune.md

@@ -16,10 +16,9 @@ then only packages matching one of the supplied names are removed.
 Extraneous packages are those present in the `node_modules` folder that are
 not listed as any package's dependency list.
 
-If the `--production` flag is specified or the `NODE_ENV` environment
+If the `--omit=dev` flag is specified or the `NODE_ENV` environment
 variable is set to `production`, this command will remove the packages
-specified in your `devDependencies`. Setting `--no-production` will negate
-`NODE_ENV` being set to `production`.
+specified in your `devDependencies`.
 
 If the `--dry-run` flag is used then no changes will actually be made.
 

docs/lib/content/commands/npm-view.md

@@ -28,6 +28,13 @@ For example, to show the dependencies of the `ronn` package at version
 npm view ronn@0.3.5 dependencies
 ```
 
+By default, `npm view` shows data about the current project context (by looking for a `package.json`).
+To show field data for the current project use a file path (i.e. `.`):
+
+```bash
+npm view . dependencies
+```
+
 You can view child fields by separating them with a period.
 To view the git repository URL for the latest version of `npm`, you would run the following command:
 

lib/commands/exec.js

@@ -34,24 +34,33 @@ class Exec extends BaseCommand {
     for (const [name, path] of this.workspaces) {
       const locationMsg =
         `in workspace ${this.npm.chalk.green(name)} at location:\n${this.npm.chalk.dim(path)}`
-      await this.callExec(args, { locationMsg, runPath: path })
+      await this.callExec(args, { name, locationMsg, runPath: path })
     }
   }
 
-  async callExec (args, { locationMsg, runPath } = {}) {
-    // This is where libnpmexec will look for locally installed packages
+  async callExec (args, { name, locationMsg, runPath } = {}) {
+    // This is where libnpmexec will look for locally installed packages at the project level
     const localPrefix = this.npm.localPrefix
+    // This is where libnpmexec will look for locally installed packages at the workspace level
+    let localBin = this.npm.localBin
+    let path = localPrefix
 
     // This is where libnpmexec will actually run the scripts from
     if (!runPath) {
       runPath = process.cwd()
+    } else {
+      // We have to consider if the workspace has its own separate versions
+      // libnpmexec will walk up to localDir after looking here
+      localBin = resolve(this.npm.localDir, name, 'node_modules', '.bin')
+      // We also need to look for `bin` entries in the workspace package.json
+      // libnpmexec will NOT look in the project root for the bin entry
+      path = runPath
     }
 
     const call = this.npm.config.get('call')
     let globalPath
     const {
       flatOptions,
-      localBin,
       globalBin,
       globalDir,
       chalk,
@@ -79,14 +88,14 @@ class Exec extends BaseCommand {
       // copy args so they dont get mutated
       args: [...args],
       call,
-      localBin,
-      locationMsg,
+      chalk,
       globalBin,
       globalPath,
+      localBin,
+      locationMsg,
       output,
-      chalk,
       packages,
-      path: localPrefix,
+      path,
       runPath,
       scriptShell,
       yes,

lib/commands/outdated.js

@@ -6,7 +6,6 @@ const npa = require('npm-package-arg')
 const pickManifest = require('npm-pick-manifest')
 const localeCompare = require('@isaacs/string-locale-compare')('en')
 
-const ansiTrim = require('strip-ansi')
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 
 class Outdated extends ArboristWorkspaceCmd {
@@ -23,6 +22,7 @@ class Outdated extends ArboristWorkspaceCmd {
   ]
 
   async exec (args) {
+    const { default: stripAnsi } = await import('strip-ansi')
     const global = resolve(this.npm.globalDir, '..')
     const where = this.npm.global
       ? global
@@ -106,7 +106,7 @@ class Outdated extends ArboristWorkspaceCmd {
 
       const tableOpts = {
         align: ['l', 'r', 'r', 'r', 'l'],
-        stringLength: s => ansiTrim(s).length,
+        stringLength: s => stripAnsi(s).length,
       }
       this.npm.output(table(outTable, tableOpts))
     }

lib/commands/pkg.js

@@ -82,10 +82,9 @@ class Pkg extends BaseCommand {
       }
     }
 
-    // only outputs if not running with workspaces config,
-    // in case you're retrieving info for workspaces the pkgWorkspaces
-    // will handle the output to make sure it get keyed by ws name
-    if (!this.npm.config.get('workspaces')) {
+    // only outputs if not running with workspaces config
+    // execWorkspaces will handle the output otherwise
+    if (!this.workspaces) {
       this.npm.output(JSON.stringify(result, null, 2))
     }
 

lib/commands/search.js

@@ -81,12 +81,12 @@ class Search extends BaseCommand {
 
     const filterStream = new FilterStream()
 
-    // Grab a configured output stream that will spit out packages in the
-    // desired format.
-    const outputStream = formatSearchStream({
+    const { default: stripAnsi } = await import('strip-ansi')
+    // Grab a configured output stream that will spit out packages in the desired format.
+    const outputStream = await formatSearchStream({
       args, // --searchinclude options are not highlighted
       ...opts,
-    })
+    }, stripAnsi)
 
     log.silly('search', 'searching packages')
     const p = new Pipeline(

lib/commands/token.js

@@ -1,5 +1,4 @@
 const Table = require('cli-table3')
-const { v4: isCidrV4, v6: isCidrV6 } = require('is-cidr')
 const log = require('../utils/log-shim.js')
 const profile = require('npm-profile')
 
@@ -137,7 +136,7 @@ class Token extends BaseCommand {
     const readonly = conf.readOnly
 
     const password = await readUserInfo.password()
-    const validCIDR = this.validateCIDRList(cidr)
+    const validCIDR = await this.validateCIDRList(cidr)
     log.info('token', 'creating')
     const result = await pulseTillDone.withPromise(
       otplease(this.npm, conf, c => profile.createToken(password, readonly, validCIDR, c))
@@ -209,7 +208,8 @@ class Token extends BaseCommand {
     return byId
   }
 
-  validateCIDRList (cidrs) {
+  async validateCIDRList (cidrs) {
+    const { v4: isCidrV4, v6: isCidrV6 } = await import('is-cidr')
     const maybeList = [].concat(cidrs).filter(Boolean)
     const list = maybeList.length === 1 ? maybeList[0].split(/,\s*/) : maybeList
     for (const cidr of list) {