deps: upgrade npm to 10.2.4

PR-URL: #50751
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>

deps/npm/docs/content/commands/npm-ls.md

@@ -27,7 +27,7 @@ packages will *also* show the paths to the specified packages.  For
 example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@10.2.3 /path/to/npm
+npm@10.2.4 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```

deps/npm/docs/content/commands/npm-prune.md

@@ -18,10 +18,9 @@ then only packages matching one of the supplied names are removed.
 Extraneous packages are those present in the `node_modules` folder that are
 not listed as any package's dependency list.
 
-If the `--production` flag is specified or the `NODE_ENV` environment
+If the `--omit=dev` flag is specified or the `NODE_ENV` environment
 variable is set to `production`, this command will remove the packages
-specified in your `devDependencies`. Setting `--no-production` will negate
-`NODE_ENV` being set to `production`.
+specified in your `devDependencies`.
 
 If the `--dry-run` flag is used then no changes will actually be made.
 

deps/npm/docs/content/commands/npm-view.md

@@ -32,6 +32,13 @@ For example, to show the dependencies of the `ronn` package at version
 npm view ronn@0.3.5 dependencies
 ```
 
+By default, `npm view` shows data about the current project context (by looking for a `package.json`).
+To show field data for the current project use a file path (i.e. `.`):
+
+```bash
+npm view . dependencies
+```
+
 You can view child fields by separating them with a period.
 To view the git repository URL for the latest version of `npm`, you would run the following command:
 

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-10.2.3
+10.2.4
 
 ### Description
 

deps/npm/docs/output/commands/npm-ls.html

@@ -160,7 +160,7 @@ <h3 id="description">Description</h3>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">npm@10.2.3 /path/to/npm
+<pre><code class="language-bash">npm@10.2.4 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>

deps/npm/docs/output/commands/npm-prune.html

@@ -153,10 +153,9 @@ <h3 id="description">Description</h3>
 then only packages matching one of the supplied names are removed.</p>
 <p>Extraneous packages are those present in the <code>node_modules</code> folder that are
 not listed as any package's dependency list.</p>
-<p>If the <code>--production</code> flag is specified or the <code>NODE_ENV</code> environment
+<p>If the <code>--omit=dev</code> flag is specified or the <code>NODE_ENV</code> environment
 variable is set to <code>production</code>, this command will remove the packages
-specified in your <code>devDependencies</code>. Setting <code>--no-production</code> will negate
-<code>NODE_ENV</code> being set to <code>production</code>.</p>
+specified in your <code>devDependencies</code>.</p>
 <p>If the <code>--dry-run</code> flag is used then no changes will actually be made.</p>
 <p>If the <code>--json</code> flag is used, then the changes <code>npm prune</code> made (or would
 have made with <code>--dry-run</code>) are printed as a JSON object.</p>

deps/npm/docs/output/commands/npm-view.html

@@ -161,6 +161,10 @@ <h3 id="description">Description</h3>
 <code>0.3.5</code>, you could do the following:</p>
 <pre><code class="language-bash">npm view ronn@0.3.5 dependencies
 </code></pre>
+<p>By default, <code>npm view</code> shows data about the current project context (by looking for a <code>package.json</code>).
+To show field data for the current project use a file path (i.e. <code>.</code>):</p>
+<pre><code class="language-bash">npm view . dependencies
+</code></pre>
 <p>You can view child fields by separating them with a period.
 To view the git repository URL for the latest version of <code>npm</code>, you would run the following command:</p>
 <pre><code class="language-bash">npm view npm repository.url

deps/npm/docs/output/commands/npm.html

@@ -150,7 +150,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>10.2.3</p>
+<p>10.2.4</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/lib/commands/exec.js

@@ -34,24 +34,33 @@ class Exec extends BaseCommand {
     for (const [name, path] of this.workspaces) {
       const locationMsg =
         `in workspace ${this.npm.chalk.green(name)} at location:\n${this.npm.chalk.dim(path)}`
-      await this.callExec(args, { locationMsg, runPath: path })
+      await this.callExec(args, { name, locationMsg, runPath: path })
     }
   }
 
-  async callExec (args, { locationMsg, runPath } = {}) {
-    // This is where libnpmexec will look for locally installed packages
+  async callExec (args, { name, locationMsg, runPath } = {}) {
+    // This is where libnpmexec will look for locally installed packages at the project level
     const localPrefix = this.npm.localPrefix
+    // This is where libnpmexec will look for locally installed packages at the workspace level
+    let localBin = this.npm.localBin
+    let path = localPrefix
 
     // This is where libnpmexec will actually run the scripts from
     if (!runPath) {
       runPath = process.cwd()
+    } else {
+      // We have to consider if the workspace has its own separate versions
+      // libnpmexec will walk up to localDir after looking here
+      localBin = resolve(this.npm.localDir, name, 'node_modules', '.bin')
+      // We also need to look for `bin` entries in the workspace package.json
+      // libnpmexec will NOT look in the project root for the bin entry
+      path = runPath
     }
 
     const call = this.npm.config.get('call')
     let globalPath
     const {
       flatOptions,
-      localBin,
       globalBin,
       globalDir,
       chalk,
@@ -79,14 +88,14 @@ class Exec extends BaseCommand {
       // copy args so they dont get mutated
       args: [...args],
       call,
-      localBin,
-      locationMsg,
+      chalk,
       globalBin,
       globalPath,
+      localBin,
+      locationMsg,
       output,
-      chalk,
       packages,
-      path: localPrefix,
+      path,
       runPath,
       scriptShell,
       yes,

deps/npm/lib/commands/outdated.js

@@ -6,7 +6,6 @@ const npa = require('npm-package-arg')
 const pickManifest = require('npm-pick-manifest')
 const localeCompare = require('@isaacs/string-locale-compare')('en')
 
-const ansiTrim = require('strip-ansi')
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 
 class Outdated extends ArboristWorkspaceCmd {
@@ -23,6 +22,7 @@ class Outdated extends ArboristWorkspaceCmd {
   ]
 
   async exec (args) {
+    const { default: stripAnsi } = await import('strip-ansi')
     const global = resolve(this.npm.globalDir, '..')
     const where = this.npm.global
       ? global
@@ -106,7 +106,7 @@ class Outdated extends ArboristWorkspaceCmd {
 
       const tableOpts = {
         align: ['l', 'r', 'r', 'r', 'l'],
-        stringLength: s => ansiTrim(s).length,
+        stringLength: s => stripAnsi(s).length,
       }
       this.npm.output(table(outTable, tableOpts))
     }

deps/npm/lib/commands/pkg.js

@@ -82,10 +82,9 @@ class Pkg extends BaseCommand {
       }
     }
 
-    // only outputs if not running with workspaces config,
-    // in case you're retrieving info for workspaces the pkgWorkspaces
-    // will handle the output to make sure it get keyed by ws name
-    if (!this.npm.config.get('workspaces')) {
+    // only outputs if not running with workspaces config
+    // execWorkspaces will handle the output otherwise
+    if (!this.workspaces) {
       this.npm.output(JSON.stringify(result, null, 2))
     }
 

deps/npm/lib/commands/search.js

@@ -81,12 +81,12 @@ class Search extends BaseCommand {
 
     const filterStream = new FilterStream()
 
-    // Grab a configured output stream that will spit out packages in the
-    // desired format.
-    const outputStream = formatSearchStream({
+    const { default: stripAnsi } = await import('strip-ansi')
+    // Grab a configured output stream that will spit out packages in the desired format.
+    const outputStream = await formatSearchStream({
       args, // --searchinclude options are not highlighted
       ...opts,
-    })
+    }, stripAnsi)
 
     log.silly('search', 'searching packages')
     const p = new Pipeline(

deps/npm/lib/commands/token.js

@@ -1,5 +1,4 @@
 const Table = require('cli-table3')
-const { v4: isCidrV4, v6: isCidrV6 } = require('is-cidr')
 const log = require('../utils/log-shim.js')
 const profile = require('npm-profile')
 
@@ -137,7 +136,7 @@ class Token extends BaseCommand {
     const readonly = conf.readOnly
 
     const password = await readUserInfo.password()
-    const validCIDR = this.validateCIDRList(cidr)
+    const validCIDR = await this.validateCIDRList(cidr)
     log.info('token', 'creating')
     const result = await pulseTillDone.withPromise(
       otplease(this.npm, conf, c => profile.createToken(password, readonly, validCIDR, c))
@@ -209,7 +208,8 @@ class Token extends BaseCommand {
     return byId
   }
 
-  validateCIDRList (cidrs) {
+  async validateCIDRList (cidrs) {
+    const { v4: isCidrV4, v6: isCidrV6 } = await import('is-cidr')
     const maybeList = [].concat(cidrs).filter(Boolean)
     const list = maybeList.length === 1 ? maybeList[0].split(/,\s*/) : maybeList
     for (const cidr of list) {