core:release 9.9.2

.eslintrc.js

@@ -13,6 +13,7 @@ module.exports = {
   ignorePatterns: [
     'docs/**',
     'smoke-tests/**',
+    'mock-globals/**',
     'mock-registry/**',
     'workspaces/**',
   ],

.eslintrc.local.js

@@ -0,0 +1,37 @@
+const { resolve, relative } = require('path')
+
+// Create an override to lockdown a file to es6 syntax only
+// and only allow it to require an allowlist of files
+const rel = (p) => relative(__dirname, resolve(__dirname, p))
+const braces = (a) => a.length > 1 ? `{${a.map(rel).join(',')}}` : a[0]
+
+const es6Files = (e) => Object.entries(e).map(([file, allow]) => ({
+  files: `./${rel(file)}`,
+  parserOptions: {
+    ecmaVersion: 6,
+  },
+  rules: Array.isArray(allow) ? {
+    'node/no-restricted-require': ['error', [{
+      name: ['/**', `!${__dirname}/${braces(allow)}`],
+      message: `This file can only require: ${allow.join(',')}`,
+    }]],
+  } : {},
+}))
+
+module.exports = {
+  rules: {
+    'no-console': 'error',
+  },
+  overrides: es6Files({
+    'index.js': ['lib/cli.js'],
+    'bin/npm-cli.js': ['lib/cli.js'],
+    'lib/cli.js': ['lib/es6/validate-engines.js'],
+    'lib/es6/validate-engines.js': ['package.json'],
+    // TODO: This file should also have its requires restricted as well since it
+    // is an entry point but it currently pulls in config definitions which have
+    // a large require graph, so that is not currently feasible. A future config
+    // refactor should keep that in mind and see if only config definitions can
+    // be exported in a way that is compatible with ES6.
+    'bin/npx-cli.js': null,
+  }),
+}

.gitattributes

@@ -1,2 +1,27 @@
-/node_modules/**    linguist-generated=false
-/package-lock.json  linguist-generated=false
+# normalize all line endings by default
+* text=auto
+
+# our shell/bin scripts always need to be LF
+/bin/* text eol=lf
+/workspaces/arborist/bin/index.js text eol=lf
+/configure text eol=lf
+
+# our cmd scripts always need to be CRLF
+/bin/**/*.cmd text eol=crlf
+
+# ignore all line endings in node_modules since we dont control that
+/node_modules/** -text
+
+# the files we write should be LF so they can be generated cross platform
+/node_modules/.gitignore text eol=lf
+/workspaces/arborist/test/fixtures/.gitignore text eol=lf
+/DEPENDENCIES.md text eol=lf
+/AUTHORS text eol=lf
+
+# fixture tarballs should be treated as binary
+/workspaces/*/test/fixtures/**/*.tgz binary
+
+# these hint to GitHub to show these files as not generated so they default to
+# showing the full diff in pull requests
+/node_modules/** linguist-generated=false
+/package-lock.json linguist-generated=false

.github/ISSUE_TEMPLATE/bug_10.yml

@@ -0,0 +1,63 @@
+name: 🐞 Bug v10
+description: File a bug/issue against v10.x
+title: "[BUG] <title>"
+labels: [Bug, Needs Triage, Release 10.x]
+body:
+- type: checkboxes
+  attributes:
+    label: Is there an existing issue for this?
+    description: Please [search here](https://github.com/npm/cli/issues) to see if an issue already exists for your problem.
+    options:
+    - label: I have searched the existing issues
+      required: true
+- type: checkboxes
+  attributes:
+    label: This issue exists in the latest npm version
+    description: Please make sure you have installed the latest npm and verified it is still an issue.
+    options:
+    - label: I am using the latest npm
+      required: true
+- type: textarea
+  attributes:
+    label: Current Behavior
+    description: A clear & concise description of what you're experiencing.
+  validations:
+    required: false
+- type: textarea
+  attributes:
+    label: Expected Behavior
+    description: A clear & concise description of what you expected to happen.
+  validations:
+    required: false
+- type: textarea
+  attributes:
+    label: Steps To Reproduce
+    description: Steps to reproduce the behavior.
+    value: |
+      1. In this environment...
+      2. With this config...
+      3. Run '...'
+      4. See error...
+  validations:
+    required: false
+- type: textarea
+  attributes:
+    label: Environment
+    description: |
+      examples:
+        - **`npm -v`**: **npm**: 10.0.0
+        - **`node -v`**: **Node.js**: 18.0.0
+        - **OS Name**: Ubuntu 20.04
+        - **System Model Name**: Macbook Pro
+        - **`npm config ls`**: `; "user" config from ...`
+    value: |
+        - npm:
+        - Node.js:
+        - OS Name:
+        - System Model Name:
+        - npm config:
+        ```ini
+        ; copy and paste output from `npm config ls` here
+        ```
+  validations:
+    required: false

.github/workflows/audit.yml

@@ -25,11 +25,16 @@ jobs:
           git config --global user.name "npm CLI robot"
       - name: Setup Node
         uses: actions/setup-node@v3
+        id: node
         with:
-          node-version: 18.x
+          node-version: 20.x
+          check-latest: contains('20.x', '.x')
           cache: npm
+
+      - name: Check Git Status
+        run: node scripts/git-dirty.js
       - name: Reset Deps
-        run: node . run resetdeps -- --package-lock
+        run: node scripts/resetdeps.js --package-lock
       - name: Run Production Audit
         run: node . audit --omit=dev
       - name: Run Full Audit

.github/workflows/benchmark.yml

@@ -6,6 +6,7 @@ on:
       - '*'
     paths:
       - lib/**
+      - workspaces/**/lib/**
   issue_comment:
     types:
       - created
@@ -17,63 +18,70 @@ jobs:
     steps:
       - name: Incoming Pull Request
         if: |
-          github.event_name == 'pull_request' || (
+          (
+            github.event_name == 'pull_request' &&
+            github.event.pull_request.head.repo.full_name == 'npm/cli' 
+          ) || (
             github.event_name == 'issue_comment' &&
             github.event.issue.pull_request &&
             github.event.issue.state == 'open' &&
             startsWith(github.event.comment.body, '@npm-cli-bot benchmark this')
           )
-        env:
-          # gh cli uses these env vars for owner/repo/token
-          GH_REPO: "npm/benchmarks"
-          GITHUB_TOKEN: ${{ secrets.BENCHMARK_DISPATCH_TOKEN }}
-        run: |
-          EVENT_NAME="${{ github.event_name }}"
-          OWNER="${{ github.event.repository.owner.login }}"
-          REPO="${{ github.event.repository.name }}"
-          PR=""
-
-          if [[ "$EVENT_NAME" == "pull_request" ]]; then
-            if [[ "$GITHUB_TOKEN" == "" ]]; then
-              echo "No auth - from fork pull request, exiting"
-              exit 0
-            fi
-            PR="${{ github.event.pull_request.number }}"
-          else
-            PR="${{ github.event.issue.number }}"
-            SENDER="${{ github.event.comment.user.login }}"
-            ROLE=$(gh api repos/${OWNER}/${REPO}/collaborators/${SENDER}/permission -q '.permission')
-
-            if [[ "$ROLE" != "admin" ]]; then
-              echo "${SENDER} is ${ROLE}, not an admin, exiting"
-              exit 0
-            fi
-
-            # add emoji to comment if user is an admin to signal
-            # benchmark is running
-            COMMENT_NODE_ID="${{ github.event.comment.node_id }}"
-            QUERY='mutation ($inputData:AddReactionInput!) {
-              addReaction (input:$inputData) {
-                reaction { content }
-              }
-            }'
-            echo '{
-              "query": "'${QUERY}'",
-              "variables": {
-                "inputData": {
-                  "subjectId": "'"${COMMENT_NODE_ID}"'",
-                  "content": "ROCKET"
-                }
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.BENCHMARK_DISPATCH_TOKEN }}
+          script: |
+            const {
+              payload,
+              eventName,
+              repo: { owner, repo },
+              issue: { number },
+            } = context
+
+            if (eventName === 'issue_comment') {
+              const res = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner,
+                repo,
+                username: payload.comment.user.login,
+              })
+              if (res.data.permission !== 'admin') {
+                core.info(`Commenter is not an admin, exiting`)
+                return
               }
-            }' | gh api graphql --input -
-          fi
-
-          EVENT="${EVENT_NAME} ${OWNER}/${REPO}#${PR}"
-          echo '{
-            "event_type": "'"$EVENT"'",
-            "client_payload": {
-              "pr_id": "'"$PR"'",
-              "repo": "'"$REPO"'",
-              "owner": "'"$OWNER"'"
+
+              // add emoji to comment if user is an admin to signal benchmark is running
+              await github.rest.reactions.createForIssueComment({
+                owner,
+                repo,
+                comment_id: payload.comment.node_id,
+                content: 'rocket',
+              })
             }
-          }' | gh api repos/{owner}/{repo}/dispatches --input -
+
+            const pullRequest = payload.pull_request || await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: number,
+            }).then(r => r.data)
+
+            core.info(`Pull request: ${pullRequest.number}`)
+            core.info(`Base ref: ${pullRequest.base.ref}`)
+
+            const matchesRelease = pullRequest.base.ref.match(/^release\/v(\d+)$/)
+            const targetSpec = matchesRelease ? matchesRelease[1] : 'latest'
+            core.info(`Target spec: ${targetSpec}`)
+
+            const eventType = `"${eventName} ${owner}/${repo}#${pullRequest.number}"`
+            core.info(`Event type: ${eventType}`)
+
+            await github.rest.repos.createDispatchEvent({
+              owner: 'npm',
+              repo: 'benchmarks',
+              event_type: eventType,
+              client_payload: {
+                owner,
+                repo,
+                pr_id: number,
+                target_spec: targetSpec,
+              },
+            })