.github/workflows/node-integration.yml

@@ -335,7 +335,7 @@ jobs:
                 }
               }
 
-              const env = { ...meta.envVar }
+              const env = { ...meta.envVar, NODE_VERSION }
               matrix.push({
                 package,
                 version: context.version,
@@ -455,28 +455,28 @@ jobs:
             rm -f .taprc.bak
           fi
 
-          commandCount=$(echo '${{ toJSON(matrix.commands) }}' | jq -r 'length')
-          if [[ $commandCount -eq 1 ]]; then
-            COMMAND=$(echo '${{ toJSON(matrix.commands) }}' | jq -r '.[0]')
-            $COMMAND
-            STEPEXIT=$?
-            if [[ $STEPEXIT -ne 0 ]]; then
-              if [[ "${{ matrix.flaky }}" == "true" || "${{ matrix.knownFailure }}" == "true" ]]; then
-                echo "::warning ::$COMMAND failed, exit $STEPEXIT"
-                exit 0
-              fi
-            fi
-            exit $STEPEXIT
-          fi
-
           for row in $(echo '${{ toJSON(matrix.commands) }}' | jq -r '.[] | @base64'); do
+            FAILCOUNT=0
             COMMAND=$(echo "$row" | base64 --decode)
             echo "::group::$COMMAND"
             $COMMAND
             STEPEXIT=$?
             if [[ $STEPEXIT -ne 0 ]]; then
-              if [[ "${{ matrix.flaky }}" == "true" || "${{ matrix.knownFailure }}" == "true" ]]; then
+              FAILCOUNT=1
+              if [[ "${{ matrix.knownFailure }}" == "true" || "$NODE_VERSION" == "nightly" ]]; then
                 echo "::warning ::$COMMAND failed, exit: $STEPEXIT"
+              elif [[ "${{ matrix.flaky }}" ]]; then
+                while [[ $STEPEXIT -ne 0 && $FAILCOUNT -lt 3 ]]; do
+                  $COMMAND
+                  STEPEXIT=$?
+                  if [[ $STEPEXIT -ne 0 ]]; then
+                    ((FAILCOUNT=FAILCOUNT+1))
+                  fi
+                done
+
+                if [[ $STEPEXIT -ne 0 ]]; then
+                  echo "::warning ::$COMMAND still failing after $FAILCOUNT attempts, exit: $STEPEXIT"
+                fi
               else
                 FINALEXIT=$STEPEXIT
                 echo "::error ::$COMMAND failed, exit: $STEPEXIT"
@@ -486,9 +486,10 @@ jobs:
           done
           exit $FINALEXIT
       - name: Set conclusion
+        env: ${{ matrix.env }}
         run: |
           EXIT=1
-          if [[ "${{ steps.command.outcome }}" == "success" || "${{ matrix.flaky }}" == "true" || "${{ matrix.knownFailure }}" == "true" ]]; then
+          if [[ "${{ steps.command.outcome }}" == "success" || "${{ matrix.flaky }}" == "true" || "${{ matrix.knownFailure }}" == "true" || $NODE_VERSION == "nightly"]]; then
             EXIT=0
           fi
           exit $EXIT

.github/workflows/release.yml

@@ -315,7 +315,7 @@ jobs:
       matrix:
         nodeVersion:
           - 18
-          - 19
+          - 20
           - nightly
     uses: ./.github/workflows/node-integration.yml
     with:

.release-please-manifest.json

@@ -1,16 +1,16 @@
 {
-  ".": "9.6.4",
-  "workspaces/arborist": "6.2.7",
+  ".": "9.6.5",
+  "workspaces/arborist": "6.2.8",
   "workspaces/libnpmaccess": "7.0.2",
-  "workspaces/libnpmdiff": "5.0.15",
-  "workspaces/libnpmexec": "5.0.15",
-  "workspaces/libnpmfund": "4.0.15",
+  "workspaces/libnpmdiff": "5.0.16",
+  "workspaces/libnpmexec": "5.0.16",
+  "workspaces/libnpmfund": "4.0.16",
   "workspaces/libnpmhook": "9.0.3",
   "workspaces/libnpmorg": "5.0.3",
-  "workspaces/libnpmpack": "5.0.15",
+  "workspaces/libnpmpack": "5.0.16",
   "workspaces/libnpmpublish": "7.1.3",
   "workspaces/libnpmsearch": "6.0.2",
   "workspaces/libnpmteam": "5.0.3",
   "workspaces/libnpmversion": "4.0.2",
-  "workspaces/config": "6.1.5"
+  "workspaces/config": "6.1.6"
 }

AUTHORS

@@ -879,3 +879,4 @@ David Tanner <darthtanner@gmail.com>
 Jeff Mealo <jeffreymealo@gmail.com>
 Kevin Rouchut <kevin.rouchut@gmail.com>
 Stafford Williams <staff0rd@users.noreply.github.com>
+CharlieWONG <charlie-wong@outlook.com>

CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## [9.6.5](https://github.com/npm/cli/compare/v9.6.4...v9.6.5) (2023-04-19)
+
+### Bug Fixes
+
+* [`33dc428`](https://github.com/npm/cli/commit/33dc4285fd8c698c539faae10fe1bf76ceedb6b1) [#6374](https://github.com/npm/cli/pull/6374) account for npx package-name with no spec (@wraithgar)
+* [`82879f6`](https://github.com/npm/cli/commit/82879f69c72681f636be73d13c4464e35f258954) [#6225](https://github.com/npm/cli/pull/6225) lazy loading of arborist and pacote (#6225) (@wraithgar)
+* [`f4e73ab`](https://github.com/npm/cli/commit/f4e73ab87e0aa1e214f978d4723e85ee2cfdd9c8) [#6322](https://github.com/npm/cli/pull/6322) remove incompatible params from ci (#6322) (@wraithgar)
+* [`c7fe1c7`](https://github.com/npm/cli/commit/c7fe1c70eef49fa666f9f25ec941afa8b6acbf05) [#6328](https://github.com/npm/cli/pull/6328) save raw data to file, not parsed data (@wraithgar)
+
+### Documentation
+
+* [`31214a6`](https://github.com/npm/cli/commit/31214a6d9e9d4e973f5a5462543ea1d91d7bbf65) [#6381](https://github.com/npm/cli/pull/6381) Update description for publish --provenance flag (#6381) (@feelepxyz)
+* [`997bcdf`](https://github.com/npm/cli/commit/997bcdf8d4fd3e5ecdd224060fb166b43c3ffb19) [#6329](https://github.com/npm/cli/pull/6329) fix npm cache folder location for windows (#6329) (@charlie-wong)
+
+### Dependencies
+
+* [`fae5e00`](https://github.com/npm/cli/commit/fae5e0063215e97ee18a60f8136a06045d621ec2) [#6372](https://github.com/npm/cli/pull/6372) `sigstore@1.3.0` (#6372)
+* [`3fa9542`](https://github.com/npm/cli/commit/3fa9542d7f3c0123cb3c49a40f6d5b7bc8d857a5) [#6363](https://github.com/npm/cli/pull/6363) `semver@7.5.0`
+* [`e49844e`](https://github.com/npm/cli/commit/e49844e1c6943be193d8f700d85dac4ddaa91967) [#6363](https://github.com/npm/cli/pull/6363) `minipass-fetch@3.0.2`
+* [`357cc29`](https://github.com/npm/cli/commit/357cc29a335e684391c7b840019223e555919406) [#6363](https://github.com/npm/cli/pull/6363) `walk-up-path@3.0.1`
+* [`2c80b1e`](https://github.com/npm/cli/commit/2c80b1ede7b6a3c49b3255e171759d30913f0c74) [#6363](https://github.com/npm/cli/pull/6363) `ini@4.1.0`
+* [`5933841`](https://github.com/npm/cli/commit/593384149feea848c60b2e6524d1cc1730a35798) [#6363](https://github.com/npm/cli/pull/6363) `minipass@4.2.8`
+* [`b39d54e`](https://github.com/npm/cli/commit/b39d54e877e992a583f0d8185da1c3773737801d) [#6363](https://github.com/npm/cli/pull/6363) `minimatch@7.4.6`
+* [`201aa5a`](https://github.com/npm/cli/commit/201aa5adcdfcb65ff215c4440244978c44c3ed8b) [#6363](https://github.com/npm/cli/pull/6363) `ssri@10.0.3`
+* [`acb9120`](https://github.com/npm/cli/commit/acb912089c02c34f73a7d1e431bce563da98777f) [#6363](https://github.com/npm/cli/pull/6363) `read@2.1.0`
+* [`2472205`](https://github.com/npm/cli/commit/247220552bc19a5751542289605f38ab9b74e124) [#6363](https://github.com/npm/cli/pull/6363) `npm-registry-fetch@14.0.4`
+* [`2780714`](https://github.com/npm/cli/commit/278071456b3f90e1d3e46857679f547fa98781f0) [#6363](https://github.com/npm/cli/pull/6363) `npm-install-checks@6.1.1`
+* [`b5af015`](https://github.com/npm/cli/commit/b5af015e63c75b33184ae329a27e994d6ef94506) [#6363](https://github.com/npm/cli/pull/6363) `make-fetch-happen@11.1.0`
+* [`14c498d`](https://github.com/npm/cli/commit/14c498d7dbc13e0bc0f1d9438c0f7f1abd7f98d8) [#6363](https://github.com/npm/cli/pull/6363) `@npmcli/metavuln-calculator@5.0.1`
+* [Workspace](https://github.com/npm/cli/releases/tag/arborist-v6.2.8): `@npmcli/arborist@6.2.8`
+* [Workspace](https://github.com/npm/cli/releases/tag/config-v6.1.6): `@npmcli/config@6.1.6`
+* [Workspace](https://github.com/npm/cli/releases/tag/libnpmdiff-v5.0.16): `libnpmdiff@5.0.16`
+* [Workspace](https://github.com/npm/cli/releases/tag/libnpmexec-v5.0.16): `libnpmexec@5.0.16`
+* [Workspace](https://github.com/npm/cli/releases/tag/libnpmfund-v4.0.16): `libnpmfund@4.0.16`
+* [Workspace](https://github.com/npm/cli/releases/tag/libnpmpack-v5.0.16): `libnpmpack@5.0.16`
+
 ## [9.6.4](https://github.com/npm/cli/compare/v9.6.3...v9.6.4) (2023-04-05)
 
 ### Documentation

DEPENDENCIES.md

@@ -136,7 +136,6 @@ graph LR;
   npm-->read;
   npm-->semver;
   npm-->ssri;
-  npm-->treeverse;
   npm-->validate-npm-package-name;
   npm-->write-file-atomic;
   npm-bundled-->npm-normalize-package-bin;
@@ -184,7 +183,6 @@ graph LR;
   npmcli-arborist-->read-package-json-fast;
   npmcli-arborist-->semver;
   npmcli-arborist-->ssri;
-  npmcli-arborist-->treeverse;
   npmcli-config-->ini;
   npmcli-config-->nopt;
   npmcli-config-->npmcli-eslint-config["@npmcli/eslint-config"];
@@ -772,6 +770,7 @@ graph LR;
   tuf-js-->make-fetch-happen;
   tuf-js-->tufjs-models["@tufjs/models"];
   tufjs-models-->minimatch;
+  tufjs-models-->tufjs-canonical-json["@tufjs/canonical-json"];
   unique-filename-->unique-slug;
   unique-slug-->imurmurhash;
   validate-npm-package-license-->spdx-correct;
@@ -800,4 +799,4 @@ packages higher up the chain.
  - @npmcli/git, make-fetch-happen, @npmcli/config, init-package-json
  - @npmcli/installed-package-contents, @npmcli/map-workspaces, cacache, npm-pick-manifest, @npmcli/run-script, read-package-json, promzard
  - @npmcli/docs, @npmcli/fs, npm-bundled, read-package-json-fast, unique-filename, npm-install-checks, npm-package-arg, npm-packlist, normalize-package-data, @npmcli/package-json, bin-links, nopt, npmlog, parse-conflict-json, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, treeverse, minify-registry-metadata, ini, @npmcli/disparity-colors, mute-stream, npm-audit-report, npm-user-validate
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, are-we-there-yet, gauge, minify-registry-metadata, ini, @npmcli/disparity-colors, mute-stream, npm-audit-report, npm-user-validate

docs/lib/content/commands/npm-config.md

@@ -35,7 +35,7 @@ npm set key=value [key=value...]
 
 Sets each of the config keys to the value provided.
 
-If value is omitted, then it sets it to an empty string.
+If value is omitted, the key will be removed from your config file entirely.
 
 Note: for backwards compatibility, `npm config set key value` is supported
 as an alias for `npm config set key=value`.

docs/lib/content/configuring-npm/folders.md

@@ -72,7 +72,7 @@ Man pages are not installed on Windows systems.
 #### Cache
 
 See [`npm cache`](/commands/npm-cache).  Cache files are stored in `~/.npm` on Posix, or
-`%AppData%/npm-cache` on Windows.
+`%LocalAppData%/npm-cache` on Windows.
 
 This is controlled by the [`cache` config](/using-npm/config#cache) param.
 

lib/commands/audit.js

@@ -1,4 +1,3 @@
-const Arborist = require('@npmcli/arborist')
 const auditReport = require('npm-audit-report')
 const fetch = require('npm-registry-fetch')
 const localeCompare = require('@isaacs/string-locale-compare')('en')
@@ -413,6 +412,7 @@ class Audit extends ArboristWorkspaceCmd {
 
   async auditAdvisories (args) {
     const reporter = this.npm.config.get('json') ? 'json' : 'detail'
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       audit: true,
@@ -445,6 +445,7 @@ class Audit extends ArboristWorkspaceCmd {
     }
 
     log.verbose('loading installed dependencies')
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path: this.npm.prefix,

lib/commands/cache.js

@@ -1,5 +1,4 @@
 const cacache = require('cacache')
-const Arborist = require('@npmcli/arborist')
 const pacote = require('pacote')
 const fs = require('fs/promises')
 const { join } = require('path')
@@ -162,7 +161,7 @@ class Cache extends BaseCommand {
       return pacote.tarball.stream(spec, stream => {
         stream.resume()
         return stream.promise()
-      }, { ...this.npm.flatOptions, Arborist })
+      }, { ...this.npm.flatOptions })
     }))
   }
 

lib/commands/ci.js

@@ -1,18 +1,31 @@
-const Arborist = require('@npmcli/arborist')
 const reifyFinish = require('../utils/reify-finish.js')
 const runScript = require('@npmcli/run-script')
 const fs = require('fs/promises')
 const log = require('../utils/log-shim.js')
 const validateLockfile = require('../utils/validate-lockfile.js')
 
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
-const Install = require('./install.js')
 
 class CI extends ArboristWorkspaceCmd {
   static description = 'Clean install a project'
   static name = 'ci'
 
-  static params = Install.params
+  // These are in the order they will show up in when running "-h"
+  static params = [
+    'install-strategy',
+    'legacy-bundling',
+    'global-style',
+    'omit',
+    'strict-peer-deps',
+    'package-lock',
+    'foreground-scripts',
+    'ignore-scripts',
+    'audit',
+    'bin-links',
+    'fund',
+    'dry-run',
+    ...super.params,
+  ]
 
   async exec () {
     if (this.npm.global) {
@@ -22,6 +35,7 @@ class CI extends ArboristWorkspaceCmd {
     }
 
     const where = this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       packageLock: true, // npm ci should never skip lock files

lib/commands/config.js

@@ -163,7 +163,13 @@ class Config extends BaseCommand {
           `The \`${baseKey}\` option is deprecated, and can not be set in this way${deprecated}`
         )
       }
-      this.npm.config.set(key, val || '', where)
+
+      if (val === '') {
+        this.npm.config.delete(key, where)
+      } else {
+        this.npm.config.set(key, val, where)
+      }
+
       if (!this.npm.config.validate(where)) {
         log.warn('config', 'omitting invalid config values')
       }

lib/commands/dedupe.js

@@ -1,5 +1,4 @@
 // dedupe duplicated packages, or find them in the tree
-const Arborist = require('@npmcli/arborist')
 const reifyFinish = require('../utils/reify-finish.js')
 
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
@@ -31,6 +30,7 @@ class Dedupe extends ArboristWorkspaceCmd {
 
     const dryRun = this.npm.config.get('dry-run')
     const where = this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path: where,

lib/commands/diff.js

@@ -2,7 +2,6 @@ const { resolve } = require('path')
 const semver = require('semver')
 const libnpmdiff = require('libnpmdiff')
 const npa = require('npm-package-arg')
-const Arborist = require('@npmcli/arborist')
 const pacote = require('pacote')
 const pickManifest = require('npm-pick-manifest')
 const log = require('../utils/log-shim')
@@ -146,6 +145,7 @@ class Diff extends BaseCommand {
     if (spec.registry) {
       let actualTree
       let node
+      const Arborist = require('@npmcli/arborist')
       try {
         const opts = {
           ...this.npm.flatOptions,
@@ -257,6 +257,7 @@ class Diff extends BaseCommand {
 
   async findVersionsByPackageName (specs) {
     let actualTree
+    const Arborist = require('@npmcli/arborist')
     try {
       const opts = {
         ...this.npm.flatOptions,

lib/commands/explain.js

@@ -1,6 +1,4 @@
 const { explainNode } = require('../utils/explain-dep.js')
-const completion = require('../utils/completion/installed-deep.js')
-const Arborist = require('@npmcli/arborist')
 const npa = require('npm-package-arg')
 const semver = require('semver')
 const { relative, resolve } = require('path')
@@ -21,6 +19,7 @@ class Explain extends ArboristWorkspaceCmd {
   // TODO
   /* istanbul ignore next */
   async completion (opts) {
+    const completion = require('../utils/completion/installed-deep.js')
     return completion(this.npm, opts)
   }
 
@@ -29,6 +28,7 @@ class Explain extends ArboristWorkspaceCmd {
       throw this.usageError()
     }
 
+    const Arborist = require('@npmcli/arborist')
     const arb = new Arborist({ path: this.npm.prefix, ...this.npm.flatOptions })
     const tree = await arb.loadActual()
 

lib/commands/fund.js

@@ -1,12 +1,10 @@
 const archy = require('archy')
-const Arborist = require('@npmcli/arborist')
 const pacote = require('pacote')
 const semver = require('semver')
 const npa = require('npm-package-arg')
 const { depth } = require('treeverse')
 const { readTree: getFundingInfo, normalizeFunding, isValidFunding } = require('libnpmfund')
 
-const completion = require('../utils/completion/installed-deep.js')
 const openUrl = require('../utils/open-url.js')
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 
@@ -39,6 +37,7 @@ class Fund extends ArboristWorkspaceCmd {
   // TODO
   /* istanbul ignore next */
   async completion (opts) {
+    const completion = require('../utils/completion/installed-deep.js')
     return completion(this.npm, opts)
   }
 
@@ -64,6 +63,7 @@ class Fund extends ArboristWorkspaceCmd {
     }
 
     const where = this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
     const arb = new Arborist({ ...this.npm.flatOptions, path: where })
     const tree = await arb.loadActual()
 
@@ -80,6 +80,7 @@ class Fund extends ArboristWorkspaceCmd {
     // TODO: add !workspacesEnabled option handling to libnpmfund
     const fundingInfo = getFundingInfo(tree, {
       ...this.flatOptions,
+      Arborist,
       workspaces: this.workspaceNames,
     })