Release/v8.5.0

AUTHORS

@@ -819,3 +819,5 @@ Tierney Cyren <[email protected]>
 Guillaume Grossetie <[email protected]>
 linkgoron <[email protected]>
 Quentin Barbe <[email protected]>
+dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
+Delapouite <[email protected]>

CHANGELOG.md

@@ -1,3 +1,71 @@
+## v8.5.0 (2022-02-10)
+
+### Features
+
+* [`0cc9d4c51`](https://github.com/npm/cli/commit/0cc9d4c51a337af0edd2e20c6fadb26807e5d09f)
+  [#4372](https://github.com/npm/cli/pull/4372)
+  feat(deps): `@npmcli/[email protected] - introduce automatic workspace roots`
+  ([@nlf](https://github.com/nlf))
+
+### Bug Fixes
+
+* [`fb6e2ddf9`](https://github.com/npm/cli/commit/fb6e2ddf942bacf5ae745d16c2d57f3836dce75a)
+  [#4386](https://github.com/npm/cli/pull/4386)
+  fix(log): pass in logger to more external modules
+  ([@wraithgar](https://github.com/wraithgar))
+* [`0e231d4a4`](https://github.com/npm/cli/commit/0e231d4a40526608411aca0a6e7cf27c750f2409)
+  [#4389](https://github.com/npm/cli/pull/4389)
+  fix(pack): let libnpmpack take care of file writes
+  ([@nlf](https://github.com/nlf))
+* [`e2f1f7b04`](https://github.com/npm/cli/commit/e2f1f7b045a3ae9840f431cb4266ba046831247b)
+  [#4389](https://github.com/npm/cli/pull/4389)
+  fix(publish): pass dryRun: true to libnpmpack so it doesnt write a tarball
+  ([@nlf](https://github.com/nlf))
+* [`2937b43d4`](https://github.com/npm/cli/commit/2937b43d4629225d83b6c71833df00743209f5ff)
+  [#4389](https://github.com/npm/cli/pull/4389)
+  fix(config): add pack-destination flattener
+  ([@nlf](https://github.com/nlf))
+
+### Documentation
+
+* [`b836d596f`](https://github.com/npm/cli/commit/b836d596f9d98cd7849882000cad11ad2a0b9a26)
+  [#4384](https://github.com/npm/cli/pull/4384)
+  docs: add cross-references between npx and npm exec
+  ([@Delapouite](https://github.com/Delapouite))
+* [`f3fbeea5a`](https://github.com/npm/cli/commit/f3fbeea5a173902ca7455c6c94a9e677591b0410)
+  [#4388](https://github.com/npm/cli/pull/4388)
+  docs: add --save-bundle to --save usage output
+  ([@wraithgar](https://github.com/wraithgar))
+
+### Dependencies
+
+* [`8732f393e`](https://github.com/npm/cli/commit/8732f393ee547e2eada4317613599517c1d8ec0a)
+  deps: `@npmcli/[email protected]`
+    * [`2ba09cc0d`](https://github.com/npm/cli/commit/2ba09cc0d7d56a064aa67bbb1881d381e6504888)
+      [#4371](https://github.com/npm/cli/pull/4371)
+      fix(arborist): check if a spec is a workspace before fetching a manifest, closes #3637
+      ([@nlf](https://github.com/nlf))
+    * [`e631faf7b`](https://github.com/npm/cli/commit/e631faf7b5f414c233d723ee11413264532b37de)
+      [#4387](https://github.com/npm/cli/pull/4387)
+      fix(arborist): save bundleDependencies to package.json when reifying
+      ([@wraithgar](https://github.com/wraithgar))
+* [`d3a7c15e1`](https://github.com/npm/cli/commit/d3a7c15e1e3d305a0bf781493406dfb1fdbaca35)
+  deps: `[email protected]`
+    * [`4884821f6`](https://github.com/npm/cli/commit/4884821f637ca1992b494fbdbd94d000e4428a40)
+      [#4389](https://github.com/npm/cli/pull/4389)
+      feat(libnpmpack): write tarball file when dryRun === false
+      ([@nlf](https://github.com/nlf))
+* [`ab926995e`](https://github.com/npm/cli/commit/ab926995e43ccdd048a6e1164b436fea1940f932)
+  [#4393](https://github.com/npm/cli/pull/4393)
+  deps: `[email protected]`
+* [`1c0d0699c`](https://github.com/npm/cli/commit/1c0d0699c13e1cb36a69f2ac4acdb78ea205aa3e)
+  [#4394](https://github.com/npm/cli/pull/4394)
+  deps: `[email protected]`
+    * changed notice color from blue to cyan for improved readability
+* [`3c33a5842`](https://github.com/npm/cli/commit/3c33a584213e4f2230f3b912fad2c2f5786906fb)
+  [#4400](https://github.com/npm/cli/pull/4400)
+  deps: `[email protected]`
+
 ## v8.4.1 (2022-02-03)
 
 ### Bug Fixes

docs/content/commands/npm-exec.md

@@ -388,3 +388,4 @@ project.
 * [npm stop](/commands/npm-stop)
 * [npm config](/commands/npm-config)
 * [npm workspaces](/using-npm/workspaces)
+* [npx](/commands/npx)

docs/content/commands/npx.md

@@ -175,3 +175,4 @@ This resulted in some shifts in its functionality:
 * [npm restart](/commands/npm-restart)
 * [npm stop](/commands/npm-stop)
 * [npm config](/commands/npm-config)
+* [npm exec](/commands/npm-exec)

docs/content/using-npm/config.md

@@ -1351,7 +1351,7 @@ If a package would be saved at install time by the use of `--save`,
 `--save-dev`, or `--save-optional`, then also put it in the
 `bundleDependencies` list.
 
-Ignore if `--save-peer` is set, since peerDependencies cannot be bundled.
+Ignored if `--save-peer` is set, since peerDependencies cannot be bundled.
 
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->

lib/commands/org.js

@@ -2,6 +2,7 @@ const liborg = require('libnpmorg')
 const otplease = require('../utils/otplease.js')
 const Table = require('cli-table3')
 const BaseCommand = require('../base-command.js')
+const log = require('../utils/log-shim.js')
 
 class Org extends BaseCommand {
   static description = 'Manage orgs'
@@ -32,7 +33,10 @@ class Org extends BaseCommand {
   }
 
   async exec ([cmd, orgname, username, role], cb) {
-    return otplease(this.npm.flatOptions, opts => {
+    return otplease({
+      ...this.npm.flatOptions,
+      log,
+    }, opts => {
       switch (cmd) {
         case 'add':
         case 'set':

lib/commands/pack.js

@@ -1,11 +1,8 @@
-const util = require('util')
 const pacote = require('pacote')
 const libpack = require('libnpmpack')
 const npa = require('npm-package-arg')
-const path = require('path')
 const log = require('../utils/log-shim')
 const { getContents, logTar } = require('../utils/tar.js')
-const writeFile = util.promisify(require('fs').writeFile)
 const BaseCommand = require('../base-command.js')
 
 class Pack extends BaseCommand {
@@ -28,7 +25,6 @@ class Pack extends BaseCommand {
     }
 
     const unicode = this.npm.config.get('unicode')
-    const dryRun = this.npm.config.get('dry-run')
     const json = this.npm.config.get('json')
 
     // Get the manifests and filenames first so we can bail early on manifest
@@ -40,24 +36,15 @@ class Pack extends BaseCommand {
       if (!manifest._id) {
         throw new Error('Invalid package, must have name and version')
       }
-
-      const filename = `${manifest.name}-${manifest.version}.tgz`
-        .replace(/^@/, '').replace(/\//, '-')
-      manifests.push({ arg, filename, manifest })
+      manifests.push({ arg, manifest })
     }
 
     // Load tarball names up for printing afterward to isolate from the
     // noise generated during packing
     const tarballs = []
-    for (const { arg, filename, manifest } of manifests) {
+    for (const { arg, manifest } of manifests) {
       const tarballData = await libpack(arg, this.npm.flatOptions)
       const pkgContents = await getContents(manifest, tarballData)
-      const tarballFilename = path.resolve(this.npm.config.get('pack-destination'), filename)
-
-      if (!dryRun) {
-        await writeFile(tarballFilename, tarballData)
-      }
-
       tarballs.push(pkgContents)
     }
 

lib/commands/publish.js

@@ -83,7 +83,8 @@ class Publish extends BaseCommand {
       })
     }
 
-    const tarballData = await pack(spec, opts)
+    // we pass dryRun: true to libnpmpack so it doesn't write the file to disk
+    const tarballData = await pack(spec, { ...opts, dryRun: true })
     const pkgContents = await getContents(manifest, tarballData)
 
     // The purpose of re-reading the manifest is in case it changed,

lib/commands/unpublish.js

@@ -84,7 +84,7 @@ class Unpublish extends BaseCommand {
       )
     }
 
-    const opts = this.npm.flatOptions
+    const opts = { ...this.npm.flatOptions, log }
     if (!spec || path.resolve(spec.name) === this.npm.localPrefix) {
       // if there's a package.json in the current folder, then
       // read the package name and version out of that.

lib/utils/config/definitions.js

@@ -1455,6 +1455,7 @@ define('pack-destination', {
   description: `
     Directory in which \`npm pack\` will save tarballs.
   `,
+  flatten,
 })
 
 define('parseable', {
@@ -1587,7 +1588,7 @@ define('save', {
   default: true,
   defaultDescription: `\`true\` unless when using \`npm update\` or
   \`npm dedupe\` where it defaults to \`false\``,
-  usage: '-S|--save|--no-save|--save-prod|--save-dev|--save-optional|--save-peer',
+  usage: '-S|--save|--no-save|--save-prod|--save-dev|--save-optional|--save-peer|--save-bundle',
   type: Boolean,
   short: 'S',
   description: `
@@ -1610,7 +1611,7 @@ define('save-bundle', {
     \`--save-dev\`, or \`--save-optional\`, then also put it in the
     \`bundleDependencies\` list.
 
-    Ignore if \`--save-peer\` is set, since peerDependencies cannot be bundled.
+    Ignored if \`--save-peer\` is set, since peerDependencies cannot be bundled.
   `,
   flatten (key, obj, flatOptions) {
     // XXX update arborist to just ignore it if resulting saveType is peer

node_modules/@npmcli/config/lib/env-replace.js

@@ -3,11 +3,12 @@
 const envExpr = /(\\*)\$\{([^}]+)\}/g
 
 module.exports = (f, env) => f.replace(envExpr, (orig, esc, name) => {
-  const val = env[name] !== undefined ? env[name] : `\$\{${name}\}`
+  const val = env[name] !== undefined ? env[name] : `$\{${name}}`
 
   // consume the escape chars that are relevant.
-  if (esc.length % 2)
+  if (esc.length % 2) {
     return orig.substr((esc.length + 1) / 2)
+  }
 
   return (esc.substr(esc.length / 2)) + val
 })