deps: upgrade npm to 7.0.11

PR-URL: #36112
Reviewed-By: Myles Borins <myles.borins@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>

deps/npm/AUTHORS

@@ -730,3 +730,6 @@ Michele Azzolari <michele@azzolari.it>
 foxxyz <foxxyz@gmail.com>
 Dr <dr@dr.run>
 Jan Tojnar <jtojnar@gmail.com>
+Jason Attwood <jason_attwood@hotmail.co.uk>
+Vlad GURDIGA <gurdiga@gmail.com>
+Sébastien Puech <s.puech@tricentis.com>

deps/npm/CHANGELOG.md

@@ -1,3 +1,115 @@
+## 7.0.11 (2020-11-13)
+
+### DEPENDENCIES
+
+* [`629a667a9`](https://github.com/npm/cli/commit/629a667a9b30b0b870075da965606979622a5e2e)
+  `eslint@7.13.0`
+* [`de9891bd2`](https://github.com/npm/cli/commit/de9891bd2a16fe890ff5cfb140c7b1209aeac0de)
+  `eslint-plugin-standard@4.1.0`
+* [`c3e7aa31c`](https://github.com/npm/cli/commit/c3e7aa31c565dfe21cd1f55a8433bfbcf58aa289)
+  [#2123](https://github.com/npm/cli/issues/2123)
+  [#1957](https://github.com/npm/cli/issues/1957)
+  `@npmcli/arborist@1.0.11`
+
+### BUG FIXES
+
+* [`a8aa38513`](https://github.com/npm/cli/commit/a8aa38513ad5c4ad44e6bb3e1499bfc40c31e213)
+  [#2134](https://github.com/npm/cli/issues/2134)
+  [#2156](https://github.com/npm/cli/issues/2156)
+  Fix `cannot read property length of undefined` in `ERESOLVE` explanation code
+  ([@isaacs](https://github.com/isaacs))
+* [`1dbf0f9bb`](https://github.com/npm/cli/commit/1dbf0f9bb26ba70f4c6d0a807701d7652c31d7d4)
+  [#2150](https://github.com/npm/cli/issues/2150)
+  [#2155](https://github.com/npm/cli/issues/2155)
+  send json errors to stderr, not stdout
+  ([@isaacs](https://github.com/isaacs))
+* [`fd1d7a21b`](https://github.com/npm/cli/commit/fd1d7a21b247bb35d112c51ff8d8a06fd83c8b44)
+  [#1927](https://github.com/npm/cli/issues/1927)
+  [#2154](https://github.com/npm/cli/issues/2154)
+  Set process.title a bit more usefully
+  ([@isaacs](https://github.com/isaacs))
+* [`2a80c67ef`](https://github.com/npm/cli/commit/2a80c67ef8c12c3d9d254f5be6293a6461067d99)
+  [#2008](https://github.com/npm/cli/issues/2008)
+  [#2153](https://github.com/npm/cli/issues/2153)
+  Support legacy auth tokens for registries that use them
+  ([@ruyadorno](https://github.com/ruyadorno))
+* [`786e36404`](https://github.com/npm/cli/commit/786e36404068fd51657ddac766e066a98754edbf)
+  [#2017](https://github.com/npm/cli/issues/2017)
+  [#2159](https://github.com/npm/cli/issues/2159)
+  pass all options to Arborist for `npm ci`
+  ([@darcyclarke](https://github.com/darcyclarke))
+* [`b47ada7d1`](https://github.com/npm/cli/commit/b47ada7d1623e9ee586ee0cf781ee3ac5ea3c223)
+  [#2161](https://github.com/npm/cli/issues/2161)
+  fixed typo
+  ([@scarabedore](https://github.com/scarabedore))
+
+## 7.0.10 (2020-11-10)
+
+### DOCUMENTATION
+
+* [`e48badb03`](https://github.com/npm/cli/commit/e48badb03058286a557584d7319db4143049cc6b)
+  [#2148](https://github.com/npm/cli/issues/2148)
+  Fix link in documentation
+  ([@gurdiga](https://github.com/gurdiga))
+
+### BUG FIXES
+
+* [`8edbbdc70`](https://github.com/npm/cli/commit/8edbbdc706694fa32f52d0991c76ae9f207b7bbc)
+  [#1972](https://github.com/npm/cli/issues/1972)
+  Support exec auto pick bin when all bin is alias
+  ([@dr-js](https://github.com/dr-js))
+
+### DEPENDENCIES
+
+* [`04a3e8c10`](https://github.com/npm/cli/commit/04a3e8c10c3f38e1c7a35976d77c2929bdc39868)
+  [#1962](https://github.com/npm/cli/issues/1962)
+  `@npmcli/arborist@1.0.10`:
+    * prevent self-assignment of parent/fsParent
+    * Support update options in global package space
+
+## 7.0.9 (2020-11-06)
+
+### BUG FIXES
+
+* [`96a0d2802`](https://github.com/npm/cli/commit/96a0d2802d3e619c6ea47290f5c460edfe94070a)
+  default the 'start' script when server.js present
+  ([@isaacs](https://github.com/isaacs))
+* [`7716e423e`](https://github.com/npm/cli/commit/7716e423ee92a81730c0dfe5b9ecb4bb41a3f947)
+  [#2075](https://github.com/npm/cli/issues/2075)
+  [#2071](https://github.com/npm/cli/issues/2071) print the registry when
+  using 'npm login' ([@Wicked7000](https://github.com/Wicked7000))
+* [`7046fe10c`](https://github.com/npm/cli/commit/7046fe10c5035ac57246a31ca8a6b09e3f5562bf)
+  [#2122](https://github.com/npm/cli/issues/2122) tests for `npm cache`
+  command ([@nlf](https://github.com/nlf))
+
+### DEPENDENCIES
+
+* [`74325f53b`](https://github.com/npm/cli/commit/74325f53b9d813b0e42203c037189418fad2f64a)
+  [#2124](https://github.com/npm/cli/issues/2124)
+  `@npmcli/run-script@1.7.5`:
+    * Export the `isServerPackage` method
+    * Proxy signals to and from foreground child processes
+* [`0e58e6f6b`](https://github.com/npm/cli/commit/0e58e6f6b8f0cd62294642a502c17561aaf46553)
+  [#1984](https://github.com/npm/cli/issues/1984)
+  [#2079](https://github.com/npm/cli/issues/2079)
+  [#1923](https://github.com/npm/cli/issues/1923)
+  [#606](https://github.com/npm/cli/issues/606)
+  [#2031](https://github.com/npm/cli/issues/2031) `@npmcli/arborist@1.0.9`:
+    * Process deps for all link nodes
+    * Use junctions instead of symlinks
+    * Use @npmcli/move-file instead of fs.rename
+* [`1dad328a1`](https://github.com/npm/cli/commit/1dad328a17d93def7799545596b4eba9833b35aa)
+  [#1865](https://github.com/npm/cli/issues/1865)
+  [#2106](https://github.com/npm/cli/issues/2106)
+  [#2084](https://github.com/npm/cli/issues/2084) `pacote@11.1.13`:
+    * Properly set the installation command for `prepare` scripts when
+      installing git/dir deps
+* [`e090d706c`](https://github.com/npm/cli/commit/e090d706ca637d4df96d28bff1660590aa3f3b62)
+  [#2097](https://github.com/npm/cli/issues/2097) `libnpmversion@1.0.7`:
+    * Do not crash when the package.json file lacks a 'version' field
+* [`8fa541a10`](https://github.com/npm/cli/commit/8fa541a10dbdc09376175db7a378cc9b33e8b17b)
+  `cmark-gfm@0.8.4`
+
 ## 7.0.8 (2020-11-03)
 
 ### DOCUMENTATION

deps/npm/docs/content/commands/npm-exec.md

@@ -54,7 +54,8 @@ the package specifier provided as the first positional argument according
 to the following heuristic:
 
 - If the package has a single entry in its `bin` field in `package.json`,
-  then that command will be used.
+  or if all entries are aliases of the same command, then that command
+  will be used.
 - If the package has multiple `bin` entries, and one of them matches the
   unscoped portion of the `name` field, then that command will be used.
 - If this does not result in exactly one option (either because there are

deps/npm/docs/content/commands/npx.md

@@ -8,9 +8,9 @@ description: Run a command from a local or remote npm package
 
 ```bash
 npm exec -- <pkg>[@<version>] [args...]
-npm exec -p <pkg>[@<version>] -- <cmd> [args...]
+npm exec --package=<pkg>[@<version>] -- <cmd> [args...]
 npm exec -c '<cmd> [args...]'
-npm exec -p foo -c '<cmd> [args...]'
+npm exec --package=foo -c '<cmd> [args...]'
 
 npx <pkg>[@<specifier>] [args...]
 npx -p <pkg>[@<specifier>] <cmd> [args...]
@@ -19,7 +19,8 @@ npx -p <pkg>[@<specifier>] -c '<cmd> [args...]'
 
 alias: npm x, npx
 
--p <pkg> --package=<pkg> (may be specified multiple times)
+--package=<pkg> (may be specified multiple times)
+-p is a shorthand for --package only when using npx executable
 -c <cmd> --call=<cmd> (may not be mixed with positional arguments)
 ```
 
@@ -29,9 +30,9 @@ This command allows you to run an arbitrary command from an npm package
 (either one installed locally, or fetched remotely), in a similar context
 as running it via `npm run`.
 
-Whatever packages are specified by the `--package` or `-p` option will be
+Whatever packages are specified by the `--package` option will be
 provided in the `PATH` of the executed command, along with any locally
-installed package executables.  The `--package` or `-p` option may be
+installed package executables.  The `--package` option may be
 specified multiple times, to execute the supplied command in an environment
 where all specified packages are available.
 
@@ -47,13 +48,14 @@ only be considered a match if they have the exact same name and version as
 the local dependency.
 
 If no `-c` or `--call` option is provided, then the positional arguments
-are used to generate the command string.  If no `-p` or `--package` options
+are used to generate the command string.  If no `--package` options
 are provided, then npm will attempt to determine the executable name from
 the package specifier provided as the first positional argument according
 to the following heuristic:
 
 - If the package has a single entry in its `bin` field in `package.json`,
-  then that command will be used.
+  or if all entries are aliases of the same command, then that command
+  will be used.
 - If the package has multiple `bin` entries, and one of them matches the
   unscoped portion of the `name` field, then that command will be used.
 - If this does not result in exactly one option (either because there are

deps/npm/docs/content/using-npm/developers.md

@@ -109,7 +109,7 @@ create an empty `.npmignore` file to override it. Like `git`, `npm` looks
 for `.npmignore` and `.gitignore` files in all subdirectories of your
 package, not only the root directory.
 
-`.npmignore` files follow the [same pattern rules](https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository#Ignoring-Files)
+`.npmignore` files follow the [same pattern rules](https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository#_ignoring)
 as `.gitignore` files:
 
 * Blank lines or lines starting with `#` are ignored.

deps/npm/docs/content/using-npm/scripts.md

@@ -6,7 +6,7 @@ description: How npm handles the "scripts" field
 
 ### Description
 
-The `"scripts"` property of of your `package.json` file supports a number of built-in scripts and their preset life cycle events as well as arbitrary scripts. These all can be executed by running `npm run-script <stage>` or `npm run <stage>` for short. *Pre* and *post* commands with matching names will be run for those as well (e.g. `premyscript`, `myscript`, `postmyscript`). Scripts from dependencies can be run with `npm explore <pkg> -- npm run <stage>`.
+The `"scripts"` property of your `package.json` file supports a number of built-in scripts and their preset life cycle events as well as arbitrary scripts. These all can be executed by running `npm run-script <stage>` or `npm run <stage>` for short. *Pre* and *post* commands with matching names will be run for those as well (e.g. `premyscript`, `myscript`, `postmyscript`). Scripts from dependencies can be run with `npm explore <pkg> -- npm run <stage>`.
 
 ### Pre & Post Scripts
 

deps/npm/docs/output/commands/npm-exec.html

@@ -186,7 +186,8 @@ <h3 id="description">Description</h3>
 to the following heuristic:</p>
 <ul>
 <li>If the package has a single entry in its <code>bin</code> field in <code>package.json</code>,
-then that command will be used.</li>
+or if all entries are aliases of the same command, then that command
+will be used.</li>
 <li>If the package has multiple <code>bin</code> entries, and one of them matches the
 unscoped portion of the <code>name</code> field, then that command will be used.</li>
 <li>If this does not result in exactly one option (either because there are

deps/npm/docs/output/commands/npm-ls.html

@@ -156,7 +156,7 @@ <h3 id="description">Description</h3>
 limit the results to only the paths to the packages named.  Note that
 nested packages will <em>also</em> show the paths to the specified packages.
 For example, running <code>npm ls promzard</code> in npm’s source tree will show:</p>
-<pre lang="bash"><code>    npm@7.0.8 /path/to/npm
+<pre lang="bash"><code>    npm@7.0.11 /path/to/npm
     └─┬ init-package-json@0.0.4
       └── promzard@0.1.5
 </code></pre>

deps/npm/docs/output/commands/npm.html

@@ -148,7 +148,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 <pre lang="bash"><code>npm &lt;command&gt; [args]
 </code></pre>
 <h3 id="version">Version</h3>
-<p>7.0.8</p>
+<p>7.0.11</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/docs/output/commands/npx.html

@@ -146,9 +146,9 @@ <h2 id="table-of-contents">Table of contents</h2>
 
 <div id="_content"><h3 id="synopsis">Synopsis</h3>
 <pre lang="bash"><code>npm exec -- &lt;pkg&gt;[@&lt;version&gt;] [args...]
-npm exec -p &lt;pkg&gt;[@&lt;version&gt;] -- &lt;cmd&gt; [args...]
+npm exec --package=&lt;pkg&gt;[@&lt;version&gt;] -- &lt;cmd&gt; [args...]
 npm exec -c '&lt;cmd&gt; [args...]'
-npm exec -p foo -c '&lt;cmd&gt; [args...]'
+npm exec --package=foo -c '&lt;cmd&gt; [args...]'
 
 npx &lt;pkg&gt;[@&lt;specifier&gt;] [args...]
 npx -p &lt;pkg&gt;[@&lt;specifier&gt;] &lt;cmd&gt; [args...]
@@ -157,16 +157,17 @@ <h2 id="table-of-contents">Table of contents</h2>
 
 alias: npm x, npx
 
--p &lt;pkg&gt; --package=&lt;pkg&gt; (may be specified multiple times)
+--package=&lt;pkg&gt; (may be specified multiple times)
+-p is a shorthand for --package only when using npx executable
 -c &lt;cmd&gt; --call=&lt;cmd&gt; (may not be mixed with positional arguments)
 </code></pre>
 <h3 id="description">Description</h3>
 <p>This command allows you to run an arbitrary command from an npm package
 (either one installed locally, or fetched remotely), in a similar context
 as running it via <code>npm run</code>.</p>
-<p>Whatever packages are specified by the <code>--package</code> or <code>-p</code> option will be
+<p>Whatever packages are specified by the <code>--package</code> option will be
 provided in the <code>PATH</code> of the executed command, along with any locally
-installed package executables.  The <code>--package</code> or <code>-p</code> option may be
+installed package executables.  The <code>--package</code> option may be
 specified multiple times, to execute the supplied command in an environment
 where all specified packages are available.</p>
 <p>If any requested packages are not present in the local project
@@ -179,13 +180,14 @@ <h3 id="description">Description</h3>
 only be considered a match if they have the exact same name and version as
 the local dependency.</p>
 <p>If no <code>-c</code> or <code>--call</code> option is provided, then the positional arguments
-are used to generate the command string.  If no <code>-p</code> or <code>--package</code> options
+are used to generate the command string.  If no <code>--package</code> options
 are provided, then npm will attempt to determine the executable name from
 the package specifier provided as the first positional argument according
 to the following heuristic:</p>
 <ul>
 <li>If the package has a single entry in its <code>bin</code> field in <code>package.json</code>,
-then that command will be used.</li>
+or if all entries are aliases of the same command, then that command
+will be used.</li>
 <li>If the package has multiple <code>bin</code> entries, and one of them matches the
 unscoped portion of the <code>name</code> field, then that command will be used.</li>
 <li>If this does not result in exactly one option (either because there are

deps/npm/docs/output/using-npm/developers.html

@@ -238,7 +238,7 @@ <h3 id="keeping-files-out-of-your-package">Keeping files <em>out</em> of your pa
 create an empty <code>.npmignore</code> file to override it. Like <code>git</code>, <code>npm</code> looks
 for <code>.npmignore</code> and <code>.gitignore</code> files in all subdirectories of your
 package, not only the root directory.</p>
-<p><code>.npmignore</code> files follow the <a href="https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository#Ignoring-Files">same pattern rules</a>
+<p><code>.npmignore</code> files follow the <a href="https://git-scm.com/book/en/v2/Git-Basics-Recording-Changes-to-the-Repository#_ignoring">same pattern rules</a>
 as <code>.gitignore</code> files:</p>
 <ul>
 <li>Blank lines or lines starting with <code>#</code> are ignored.</li>

deps/npm/docs/output/using-npm/scripts.html

@@ -145,7 +145,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 </section>
 
 <div id="_content"><h3 id="description">Description</h3>
-<p>The <code>"scripts"</code> property of of your <code>package.json</code> file supports a number of built-in scripts and their preset life cycle events as well as arbitrary scripts. These all can be executed by running <code>npm run-script &lt;stage&gt;</code> or <code>npm run &lt;stage&gt;</code> for short. <em>Pre</em> and <em>post</em> commands with matching names will be run for those as well (e.g. <code>premyscript</code>, <code>myscript</code>, <code>postmyscript</code>). Scripts from dependencies can be run with <code>npm explore &lt;pkg&gt; -- npm run &lt;stage&gt;</code>.</p>
+<p>The <code>"scripts"</code> property of your <code>package.json</code> file supports a number of built-in scripts and their preset life cycle events as well as arbitrary scripts. These all can be executed by running <code>npm run-script &lt;stage&gt;</code> or <code>npm run &lt;stage&gt;</code> for short. <em>Pre</em> and <em>post</em> commands with matching names will be run for those as well (e.g. <code>premyscript</code>, <code>myscript</code>, <code>postmyscript</code>). Scripts from dependencies can be run with <code>npm explore &lt;pkg&gt; -- npm run &lt;stage&gt;</code>.</p>
 <h3 id="pre--post-scripts">Pre &amp; Post Scripts</h3>
 <p>To create “pre” or “post” scripts for any scripts defined in the <code>"scripts"</code> section of the <code>package.json</code>, simply create another script <em>with a matching name</em> and add “pre” or “post” to the beginning of them.</p>
 <pre lang="json"><code>{

deps/npm/lib/adduser.js

@@ -4,6 +4,7 @@ const log = require('npmlog')
 const npm = require('./npm.js')
 const output = require('./utils/output.js')
 const usageUtil = require('./utils/usage.js')
+const replaceInfo = require('./utils/replace-info.js')
 const authTypes = {
   legacy: require('./auth/legacy.js'),
   oauth: require('./auth/oauth.js'),
@@ -57,6 +58,8 @@ const adduser = async (args) => {
 
   log.disableProgress()
 
+  log.notice('', `Log in on ${replaceInfo(registry)}`)
+
   const { message, newCreds } = await auth({
     creds,
     registry,

deps/npm/lib/cache.js

@@ -22,10 +22,11 @@ const usage = usageUtil('cache',
 const completion = (opts, cb) => {
   const argv = opts.conf.argv.remain
   if (argv.length === 2)
-    return cb(null, ['add', 'clean'])
+    return cb(null, ['add', 'clean', 'verify'])
 
   // TODO - eventually...
   switch (argv[2]) {
+    case 'verify':
     case 'clean':
     case 'add':
       return cb(null, [])
@@ -40,11 +41,11 @@ const cache = async (args) => {
     case 'rm': case 'clear': case 'clean':
       return await clean(args)
     case 'add':
-      return await add(args, npm.prefix)
+      return await add(args)
     case 'verify': case 'check':
       return await verify()
     default:
-      throw usage
+      throw Object.assign(new Error(usage), { code: 'EUSAGE' })
   }
 }
 
@@ -77,22 +78,21 @@ with --force.`)
 // npm cache add <pkg> <ver>
 // npm cache add <tarball>
 // npm cache add <folder>
-const add = async (args, where) => {
+const add = async (args) => {
   const usage = 'Usage:\n' +
     '    npm cache add <tarball-url>\n' +
     '    npm cache add <pkg>@<ver>\n' +
     '    npm cache add <tarball>\n' +
     '    npm cache add <folder>\n'
   log.silly('cache add', 'args', args)
-  const spec = args[0] +
+  const spec = args[0] && args[0] +
     (args[1] === undefined || args[1] === null ? '' : `@${args[1]}`)
 
-  log.verbose('cache add', 'spec', spec)
   if (!spec)
-    throw new Error(usage)
+    throw Object.assign(new Error(usage), { code: 'EUSAGE' })
 
-  log.silly('cache add', 'parsed spec', spec)
-  const opts = { ...npm.flatOptions, where }
+  log.silly('cache add', 'spec', spec)
+  const opts = { ...npm.flatOptions }
 
   // we ask pacote for the thing, and then just throw the data
   // away so that it tee-pipes it into the cache like it does
@@ -109,7 +109,7 @@ const verify = async () => {
     ? `~${cache.substr(process.env.HOME.length)}`
     : cache
   const stats = await cacache.verify(cache)
-  output(`Cache verified and compressed (${prefix}):`)
+  output(`Cache verified and compressed (${prefix})`)
   output(`Content verified: ${stats.verifiedContent} (${stats.keptSize} bytes)`)
   stats.badContentCount && output(`Corrupted content removed: ${stats.badContentCount}`)
   stats.reclaimedCount && output(`Content garbage-collected: ${stats.reclaimedCount} (${stats.reclaimedSize} bytes)`)

deps/npm/lib/ci.js

@@ -34,7 +34,7 @@ const ci = async () => {
     rimraf(`${where}/node_modules/*`, { glob: { dot: true, nosort: true, silent: true } }),
   ])
   // npm ci should never modify the lockfile or package.json
-  await arb.reify({ save: false })
+  await arb.reify({ ...npm.flatOptions, save: false })
   reifyOutput(arb)
 }
 

deps/npm/lib/cli.js

@@ -1,5 +1,7 @@
 // Separated out for easier unit testing
 module.exports = (process) => {
+  // set it here so that regardless of what happens later, we don't
+  // leak any private CLI configs to other programs
   process.title = 'npm'
 
   const {