Merge pull request #136 from npm/latest

Create a new pull request by comparing changes across two branches

.github/workflows/ci-release.yml

@@ -145,12 +145,12 @@ jobs:
           conclusion: ${{ job.status }}
           check_id: ${{ steps.create-check.outputs.check-id }}
 
-  smoke-publish:
-    # This cant be tested on Windows because our node_modules directory
-    # checks in symlinks which are not supported there. This should be
-    # fixed somehow, because this means some forms of local development
-    # are likely broken on Windows as well.
-    name: Smoke Publish - ${{ matrix.platform.name }} - ${{ matrix.node-version }}
+  smoke-tests:
+    # This cant be tested on Windows because our node_modules directory	
+    # checks in symlinks which are not supported there. This should be	
+    # fixed somehow, because this means some forms of local development	
+    # are likely broken on Windows as well.	
+    name: Smoke Tests - ${{ matrix.platform.name }} - ${{ matrix.node-version }}
     if: github.repository_owner == 'npm'
     strategy:
       fail-fast: false
@@ -182,7 +182,7 @@ jobs:
         if: ${{ inputs.check-sha }}
         uses: ./.github/actions/create-check
         with:
-          name: "Smoke Publish - ${{ matrix.platform.name }} - ${{ matrix.node-version }}"
+          name: "Smoke Tests - ${{ matrix.platform.name }} - ${{ matrix.node-version }}"
           token: ${{ secrets.GITHUB_TOKEN }}
           sha: ${{ inputs.check-sha }}
       - name: Setup Node
@@ -196,8 +196,69 @@ jobs:
         run: node scripts/git-dirty.js
       - name: Reset Deps
         run: node scripts/resetdeps.js
-      - name: Smoke Publish
-        run: ./scripts/smoke-publish-test.sh
+      - name: Smoke Tests
+        run: ./scripts/smoke-tests.sh
+      - name: Conclude Check
+        uses: LouisBrunner/[email protected]
+        if: steps.create-check.outputs.check-id && always()
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          conclusion: ${{ job.status }}
+          check_id: ${{ steps.create-check.outputs.check-id }}
+
+  publish-dryrun:
+    # This cant be tested on Windows because our node_modules directory	
+    # checks in symlinks which are not supported there. This should be	
+    # fixed somehow, because this means some forms of local development	
+    # are likely broken on Windows as well.	
+    name: Publish Dry-Run - ${{ matrix.platform.name }} - ${{ matrix.node-version }}
+    if: github.repository_owner == 'npm'
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - name: Linux
+            os: ubuntu-latest
+            shell: bash
+        node-version:
+          - 20.17.0
+          - 20.x
+          - 22.9.0
+          - 22.x
+    runs-on: ${{ matrix.platform.os }}
+    defaults:
+      run:
+        shell: ${{ matrix.platform.shell }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+      - name: Setup Git User
+        run: |
+          git config --global user.email "[email protected]"
+          git config --global user.name "npm CLI robot"
+      - name: Create Check
+        id: create-check
+        if: ${{ inputs.check-sha }}
+        uses: ./.github/actions/create-check
+        with:
+          name: "Publish Dry-Run - ${{ matrix.platform.name }} - ${{ matrix.node-version }}"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          sha: ${{ inputs.check-sha }}
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        id: node
+        with:
+          node-version: ${{ matrix.node-version }}
+          check-latest: contains(matrix.node-version, '.x')
+          cache: npm
+      - name: Check Git Status
+        run: node scripts/git-dirty.js
+      - name: Reset Deps
+        run: node scripts/resetdeps.js
+      - name: Publish Dry-Run
+        run: node ./scripts/publish.js --pack-destination=$RUNNER_TEMP --smoke-publish=true
       - name: Conclude Check
         uses: LouisBrunner/[email protected]
         if: steps.create-check.outputs.check-id && always()

.github/workflows/ci.yml

@@ -147,6 +147,10 @@ jobs:
         run: node . run licenses
 
   smoke-tests:
+    # This cant be tested on Windows because our node_modules directory	
+    # checks in symlinks which are not supported there. This should be	
+    # fixed somehow, because this means some forms of local development	
+    # are likely broken on Windows as well.	
     name: Smoke Tests
     if: github.repository_owner == 'npm'
     runs-on: ubuntu-latest
@@ -156,10 +160,20 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
       - name: Setup Git User
         run: |
           git config --global user.email "[email protected]"
           git config --global user.name "npm CLI robot"
+      - name: Create Check
+        id: create-check
+        if: ${{ inputs.check-sha }}
+        uses: ./.github/actions/create-check
+        with:
+          name: "Smoke Tests"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          sha: ${{ inputs.check-sha }}
       - name: Setup Node
         uses: actions/setup-node@v4
         id: node
@@ -171,10 +185,64 @@ jobs:
         run: node scripts/git-dirty.js
       - name: Reset Deps
         run: node scripts/resetdeps.js
-      - name: Run Smoke Tests
-        run: node . test -w smoke-tests --ignore-scripts
+      - name: Smoke Tests
+        run: ./scripts/smoke-tests.sh
+      - name: Conclude Check
+        uses: LouisBrunner/[email protected]
+        if: steps.create-check.outputs.check-id && always()
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          conclusion: ${{ job.status }}
+          check_id: ${{ steps.create-check.outputs.check-id }}
+
+  publish-dryrun:
+    # This cant be tested on Windows because our node_modules directory	
+    # checks in symlinks which are not supported there. This should be	
+    # fixed somehow, because this means some forms of local development	
+    # are likely broken on Windows as well.	
+    name: Publish Dry-Run
+    if: github.repository_owner == 'npm'
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.ref }}
+      - name: Setup Git User
+        run: |
+          git config --global user.email "[email protected]"
+          git config --global user.name "npm CLI robot"
+      - name: Create Check
+        id: create-check
+        if: ${{ inputs.check-sha }}
+        uses: ./.github/actions/create-check
+        with:
+          name: "Publish Dry-Run"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          sha: ${{ inputs.check-sha }}
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        id: node
+        with:
+          node-version: 22.x
+          check-latest: contains('22.x', '.x')
+          cache: npm
       - name: Check Git Status
         run: node scripts/git-dirty.js
+      - name: Reset Deps
+        run: node scripts/resetdeps.js
+      - name: Publish Dry-Run
+        run: node ./scripts/publish.js --pack-destination=$RUNNER_TEMP --smoke-publish=true
+      - name: Conclude Check
+        uses: LouisBrunner/[email protected]
+        if: steps.create-check.outputs.check-id && always()
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          conclusion: ${{ job.status }}
+          check_id: ${{ steps.create-check.outputs.check-id }}
 
   windows-shims:
     name: Windows Shims Tests

.github/workflows/node-integration.yml

@@ -80,7 +80,7 @@ jobs:
 
           echo "::group::extracting source from $nodeUrl"
           mkdir -p "$sourceDir"
-          curl -sSL "$nodeUrl" | tar xz -C "$sourceDir" --strip=1 
+          curl -sSL "$nodeUrl" | tar xz -C "$sourceDir" --strip=1
           echo "::endgroup::"
 
           echo "::group::cloning npm"

.github/workflows/release-integration.yml

@@ -22,8 +22,8 @@ jobs:
       fail-fast: false
       matrix:
         nodeVersion:
-          - 18
-          - 20
+          - 22
+          - 24
           - nightly
     uses: ./.github/workflows/node-integration.yml
     with:

.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
-  ".": "11.0.0",
+  ".": "11.1.0",
   "workspaces/arborist": "9.0.0",
   "workspaces/libnpmaccess": "10.0.0",
   "workspaces/libnpmdiff": "8.0.0",
@@ -11,5 +11,5 @@
   "workspaces/libnpmsearch": "9.0.0",
   "workspaces/libnpmteam": "8.0.0",
   "workspaces/libnpmversion": "8.0.0",
-  "workspaces/config": "10.0.0"
+  "workspaces/config": "10.0.1"
 }

AUTHORS

@@ -952,3 +952,4 @@ reggi <[email protected]>
 btea <[email protected]>
 Sander Aalbers <[email protected]>
 Chris Sidi <[email protected]>
+Maksim Koryukov <[email protected]>

CHANGELOG.md

@@ -1,5 +1,36 @@
 # Changelog
 
+## [11.1.0](https://github.com/npm/cli/compare/v11.0.0...v11.1.0) (2025-01-29)
+### Features
+* [`7f6c997`](https://github.com/npm/cli/commit/7f6c9973dc9a4dfebd76e52e060a9d8496b8bd98) [#8009](https://github.com/npm/cli/pull/8009) add dry-run to deprecate/undeprecate commands (@wraithgar)
+* [`1764a37`](https://github.com/npm/cli/commit/1764a37f1913b6a0811a85d89e029fc1dc79da54) [#8009](https://github.com/npm/cli/pull/8009) add npm undeprecate command (@wraithgar)
+### Bug Fixes
+* [`31455b2`](https://github.com/npm/cli/commit/31455b2e177b721292f3382726e3f5f3f2963b1d) [#8054](https://github.com/npm/cli/pull/8054) publish: honor force for no dist tag and registry version check (#8054) (@reggi)
+* [`dc31c1b`](https://github.com/npm/cli/commit/dc31c1bdc6658ab69554adcf2988ee99a615c409) [#8038](https://github.com/npm/cli/pull/8038) remove max-len linting bypasses (@wraithgar)
+* [`8a911ff`](https://github.com/npm/cli/commit/8a911ff895967678aa786595db3418fc28e6966a) [#8038](https://github.com/npm/cli/pull/8038) publish: disregard deprecated versions when calculating highest version (@wraithgar)
+* [`7f72944`](https://github.com/npm/cli/commit/7f72944e43f009cf4d55ff4fe24c459e07f588fd) [#8038](https://github.com/npm/cli/pull/8038) publish: accept publishConfig.tag to override highes semver check (@wraithgar)
+* [`ab9ddc0`](https://github.com/npm/cli/commit/ab9ddc0413374fbf4879da535f82e03bc4e62cf3) [#7992](https://github.com/npm/cli/pull/7992) sbom: deduplicate sbom dependencies (#7992) (@bdehamer)
+* [`f7da341`](https://github.com/npm/cli/commit/f7da341322c2f860156e8144b208583596504479) [#7980](https://github.com/npm/cli/pull/7980) search: properly display multiple search terms (#7980) (@wraithgar)
+### Documentation
+* [`3644e79`](https://github.com/npm/cli/commit/3644e79a73e511bc54d857bc2026b071fe18a6fe) [#8055](https://github.com/npm/cli/pull/8055) update readme for Node.js versions, remove badges (#8055) (@wraithgar)
+* [`f1af61f`](https://github.com/npm/cli/commit/f1af61f917e58a0a45d2b15d1e5600988b2c824f) [#8041](https://github.com/npm/cli/pull/8041) fix typos in "package-json" (#8041) (@maxkoryukov)
+* [`e90c6fe`](https://github.com/npm/cli/commit/e90c6feeacdf9ad010d4d73b65d7dd7d3b86efe2) [#8051](https://github.com/npm/cli/pull/8051) depth flag default value (#8051) (@milaninfy)
+* [`866b5ee`](https://github.com/npm/cli/commit/866b5ee3ae5ed508ecbe832d01f5ebd6b00f6789) [#8030](https://github.com/npm/cli/pull/8030) safer documentation urls, repos, packages (#8030) (@reggi)
+### Dependencies
+* [`7ddfbad`](https://github.com/npm/cli/commit/7ddfbadd1d51d07e68afbe1b91a36106d98c7bea) [#8053](https://github.com/npm/cli/pull/8053) `@npmcli/[email protected]`
+* [`9473a86`](https://github.com/npm/cli/commit/9473a8638257297c420136009de567c131d2f299) [#8053](https://github.com/npm/cli/pull/8053) `[email protected]`
+* [`a65e5ce`](https://github.com/npm/cli/commit/a65e5ceb15c4aad6bde1ffdbee7da6f685caf81e) [#8053](https://github.com/npm/cli/pull/8053) `@sigstore/[email protected]`
+* [`215ebe4`](https://github.com/npm/cli/commit/215ebe4d8f6c7f30d4b6a68fa11a3372c132929e) [#8053](https://github.com/npm/cli/pull/8053) `[email protected]`
+### Chores
+* [`61f00e3`](https://github.com/npm/cli/commit/61f00e3c23211d37c7980ebd6d1cf8d1dac49f18) [#8069](https://github.com/npm/cli/pull/8069) splits out smoke-tests from publish-dryrun tests (#8069) (@reggi)
+* [`6d0f46e`](https://github.com/npm/cli/commit/6d0f46e67e9673e8a2dc6edb92144a73f853950c) [#8058](https://github.com/npm/cli/pull/8058) stop publish smoke from check git clean (#8058) (@reggi)
+* [`9281ebf`](https://github.com/npm/cli/commit/9281ebf8e428d40450ad75ba61bc6f040b3bf896) [#8057](https://github.com/npm/cli/pull/8057) fix smoke tests prerelease needs separate string args (#8057) (@reggi)
+* [`aa202e9`](https://github.com/npm/cli/commit/aa202e9dac2f927bedcaaed4db0eef7b3415fc68) [#8056](https://github.com/npm/cli/pull/8056) smoke tests using a preid (#8056) (@reggi)
+* [`18e0449`](https://github.com/npm/cli/commit/18e0449ae41703a7980cee73bae69521db6fa53e) [#8053](https://github.com/npm/cli/pull/8053) dev dependency updates (@wraithgar)
+* [`859a71c`](https://github.com/npm/cli/commit/859a71c59ea5f91f21a8410db46585a2fc0a8126) [#8052](https://github.com/npm/cli/pull/8052) update node versions for release integration tests (#8052) (@wraithgar)
+* [`7e7961d`](https://github.com/npm/cli/commit/7e7961d8936e277f3dbc8e44f9e7b07daaeb36ca) [#8038](https://github.com/npm/cli/pull/8038) bump @npmcli/eslint-config to 5.1.0 (@wraithgar)
+* [workspace](https://github.com/npm/cli/releases/tag/config-v10.0.1): `@npmcli/[email protected]`
+
 ## [11.0.0](https://github.com/npm/cli/compare/v11.0.0-pre.1...v11.0.0) (2024-12-16)
 ### Documentation
 * [`8a911da`](https://github.com/npm/cli/commit/8a911da452b9785bcd051778570beeb2d8b27421) [#7963](https://github.com/npm/cli/pull/7963) ls: removed design change pending section note (#7963) (@milaninfy)

DEPENDENCIES.json

@@ -52,7 +52,6 @@
     "@npmcli/promise-spawn",
     "npm-install-checks",
     "npm-bundled",
-    "normalize-package-data",
     "@npmcli/fs",
     "unique-filename",
     "npm-packlist",
@@ -61,7 +60,8 @@
     "nopt",
     "parse-conflict-json",
     "read-package-json-fast",
-    "read"
+    "read",
+    "normalize-package-data"
   ],
   [
     "@npmcli/eslint-config",

DEPENDENCIES.md

@@ -218,7 +218,6 @@ graph LR;
   npmcli-mock-registry-->pacote;
   npmcli-package-json-->hosted-git-info;
   npmcli-package-json-->json-parse-even-better-errors;
-  npmcli-package-json-->normalize-package-data;
   npmcli-package-json-->npmcli-git["@npmcli/git"];
   npmcli-package-json-->proc-log;
   npmcli-package-json-->semver;
@@ -660,10 +659,10 @@ graph LR;
   npmcli-package-json-->glob;
   npmcli-package-json-->hosted-git-info;
   npmcli-package-json-->json-parse-even-better-errors;
-  npmcli-package-json-->normalize-package-data;
   npmcli-package-json-->npmcli-git["@npmcli/git"];
   npmcli-package-json-->proc-log;
   npmcli-package-json-->semver;
+  npmcli-package-json-->validate-npm-package-license;
   npmcli-promise-spawn-->which;
   npmcli-query-->postcss-selector-parser;
   npmcli-run-script-->node-gyp;
@@ -783,5 +782,5 @@ packages higher up the chain.
  - @npmcli/package-json, npm-registry-fetch
  - @npmcli/git, make-fetch-happen
  - @npmcli/smoke-tests, npm-pick-manifest, @npmcli/installed-package-contents, cacache, promzard
- - @npmcli/docs, npm-package-arg, @npmcli/promise-spawn, npm-install-checks, npm-bundled, normalize-package-data, @npmcli/fs, unique-filename, npm-packlist, @npmcli/mock-globals, bin-links, nopt, parse-conflict-json, read-package-json-fast, read
+ - @npmcli/docs, npm-package-arg, @npmcli/promise-spawn, npm-install-checks, npm-bundled, @npmcli/fs, unique-filename, npm-packlist, @npmcli/mock-globals, bin-links, nopt, parse-conflict-json, read-package-json-fast, read, normalize-package-data
  - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, hosted-git-info, proc-log, validate-npm-package-name, which, ini, npm-normalize-package-bin, json-parse-even-better-errors, @npmcli/node-gyp, ssri, unique-slug, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/name-from-folder, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate

README.md

@@ -1,16 +1,8 @@
 # npm - a JavaScript package manager
 
-[![npm version](https://img.shields.io/npm/v/npm.svg)](https://npm.im/npm)
-[![license](https://img.shields.io/npm/l/npm.svg)](https://npm.im/npm)
-[![CI - cli](https://github.com/npm/cli/actions/workflows/ci.yml/badge.svg)](https://github.com/npm/cli/actions/workflows/ci.yml)
-[![Benchmark Suite](https://github.com/npm/cli/actions/workflows/benchmark.yml/badge.svg)](https://github.com/npm/cli/actions/workflows/benchmark.yml)
-
 ### Requirements
 
-One of the following versions of [Node.js](https://nodejs.org/en/download/) must be installed to run **`npm`**:
-
-* `18.x.x` >= `18.17.0`
-* `20.5.0` or higher
+You should be running a currently supported version of [Node.js](https://nodejs.org/en/download/) to run **`npm`**.  For a list of which versions of Node.js are currently supported, please see the [Node.js releases](https://nodejs.org/en/about/previous-releases) page.
 
 ### Installation