Hi! This repository is no longer being used and has been archived for historical purposes.
CLI source code and pull requests now live at github.com/npm/cli instead of here!
Requests for help, diagnostics and other support questions go in the support category on npm.community.
Reports of bugs go in the bugs category.
Informal feature requests and ideas get discussed in the ideas category.
More complete and fully-formed feature requests should go through the formal npm RFC process.
For other concerns, such as package disputes or abuse reports, email email@example.com.
Help us keep the lights on
v6.2.0-next.1 - Jul 5, 2018
v6.2.0-next.0 - Jun 29, 2018
ce0793358#20750 You can now disable the update notifier entirely by using
--no-update-notifieror setting it in your config with
npm config set update-notifier false. (@travi)
npm run-script <script>fails due to a typo or missing script, npm will now do a "did you mean?..." for scripts that do exist. (@watilde)
8f033d72d#20948 Fix the regular expression matching in
node-gypto also handle version numbers with multiple-digit major versions which would otherwise break under use of XCode 10. (@Trott)
c8ba7573aStop trying to hoist/dedupe bundles dependencies. (@iarna)
cd698f068#20762 Add synopsis to brief help for
npm auditand suppress trailing newline. (@wyardley)
6808ee3bd#20881 Exclude /.github directory from npm tarball. (@styfle)
177cbb476#21105 Add suggestion to use a temporary cache instead of
npm cache clear --force. (@karanjthakkar)
7ba3fca00#20855 Direct people to npm.community instead of the GitHub issue tracker on error. (@zkat)
88efbf6b0#20859 Fix typo in registry docs. (@strugee)
61bf827ae#20947 Fixed a small grammar error in the README. (@bitsol)
f5230c90a#21018 Small typo fix in CONTRIBUTING.md. (@reggi)
833efe4b2#20986 Document current structure/expectations around package tarballs. (@Maximaximum)
9fc0dc4f5#21019 Clarify behavior of
npm link ../pathshorthand. (@davidgilbertson)
3924c72d0#21064 Add missing "if" (@roblourens)
We did some reshuffling and moving around of npm's own dependencies. This significantly reduces the total bundle size of the npm pack, from 8MB to 4.8MB for the distributed tarball! We also moved around what we actually commit to the repo as far as devDeps go.
0483f5c5dFlatten and dedupe our dependencies! (@iarna)
ef9fa1cebRemove unused direct dependency
0d14b0bc5Reshuffle ansi-regex for better deduping. (@iarna)
68a101859Reshuffle strip-ansi for better deduping. (@iarna)
0d5251f97Reshuffle is-fullwidth-code-point for better deduping. (@iarna)
2d0886632Add fake-registry, npm-registry-mock replacement. (@iarna)
v6.1.0 - May 24, 2018
Look at that! A feature bump!
npm@6 was super-exciting not just because it used a bigger number than ever before, but also because it included a super shiny new command:
npm audit. Well, we've kept working on it since then and have some really nice improvements for it. You can expect more of them, and the occasional fix, in the next few releases as more users start playing with it and we get more feedback about what y'all would like to see from something like this.
I, for one, have started running it (and the new subcommand...) in all my projects, and it's one of those things that I don't know how I ever functioned -without- it! This will make a world of difference to so many people as far as making the npm ecosystem a higher-quality, safer commons for all of us.
This is also a good time to remind y'all that we have a new RFCs repository, along with a new process for them. This repo is open to anyone's RFCs, and has already received some great ideas about where we can take the CLI (and, to a certain extent, the registry). It's a great place to get feedback, and completely replaces feature requests in the main repo, so we won't be accepting feature requests there at all anymore. Check it out if you have something you'd like to suggest, or if you want to keep track of what the future might look like!
npm audit fix
This is the biggie with this release!
npm audit fix does exactly what it says on the tin. It takes all the actionable reports from your
npm audit and runs the installs automatically for you, so you don't have to try to do all that mechanical work yourself!
Note that by default,
npm audit fix will stick to semver-compatible changes, so you should be able to safely run it on most projects and carry on with your day without having to track down what breaking changes were included. If you want your (toplevel) dependencies to accept semver-major bumps as well, you can use
npm audit fix --force and it'll toss those in, as well. Since it's running the npm installer under the hood, it also supports
--only=dev flags, as well as things like
--package-lock-only, if you want more control over what it does.
Give it a whirl and tell us what you think! See
npm help audit for full docs!
1854b1c7f#20568 Add support for
npm audit --jsonto print the report in JSON format. (@finnp)
85b86169d#20570 Include number of audited packages in
npm installsummary output. (@zkat)
firstname.lastname@example.org: Overhaul audit install and detail output format. The new format is terser and fits more closely into the visual style of the CLI, while still providing you with the important bits of information you need. They also include a bit more detail on the footer about what actions you can take! (@zkat)
NEW FEATURE: GIT DEPS AND
npm init <pkg>!
Another exciting change that came with
npm@6 was the new
npm init command that allows for community-authored generators. That means you can, for example, do
npm init react-app and it'll one-off download, install, and run
create-react-app for you, without requiring or keeping around any global installs. That is, it basically just calls out to
The first version of this command only really supported registry dependencies, but now, @jdalton went ahead and extended this feature so you can use hosted git dependencies, and their shorthands.
So go ahead and do
npm init facebook/create-react-app and it'll grab the package from the github repo now! Or you can use it with a private github repository to maintain your organizational scaffolding tools or whatnot. ✨
FIX WRITE AFTER END ERROR
First introduced in 5.8.0, this finally puts to bed errors where you would occasionally see
Error: write after end at MiniPass.write.
DETECT CHANGES IN GIT SPECIFIERS
0e1726c03We can now determine if the commitid of a git dependency in the lockfile is derived from the specifier in the package.json and if it isn't we now trigger an update for it. (@iarna)
631d30a34When requesting the update of a direct dependency that was also a transitive dependency to a version incompatible with the transitive requirement and you had a lock-file but did not have a
node_modulesfolder then npm would fail to provide a new copy of the transitive dependency, resulting in an invalid lock-file that could not self heal. (@iarna)
be5dd0f49#20715 Cleanup output of
npm cisummary report. (@legodude17)
98ffe4adbNode.js now has a test that scans for things that look like conflict markers in source code. This was triggering false positives on a fixture in a test of npm's ability to heal lockfiles with conflicts in them. (@iarna)
a41c0393c#20538 Make the new
npm viewwork when the license field is an object instead of a string. (@zkat)
eb7522073#20582 Add support for environments (like Docker) where the expected binary for opening external URLs is not available. (@bcoe)
212266529#20536 Fix a spurious colon in the new update notifier message and add support for the npm canary. (@zkat)
5ee1384d0#20597 Infer a version range when a
package.jsonhas a dist-tag instead of a version range in one of its dependency specs. Previously, this would cause dependencies to be flagged as invalid. (@zkat)
4fa68ae41#20585 Make sure scoped bundled deps are shown in the new publish preview, too. (@zkat)
email@example.com: Stop dropping
sizefrom metadata on
npm cache verify. (@jfmartinez)
91ef93691#20513 Fix nested command aliases. (@mmermerkaya)
firstname.lastname@example.org: Make sure different versions of the
Pathenv var on Windows all get
node_modules/.binprepended when running lifecycle scripts. (@laggingreflex)
a91d87072#20550 Update required node versions in README. (@legodude17)
bf3cfa7b8Pull in changelogs from the last
b2f14b14c#20629 Make tone in
publishConfigdocs more neutral. (@jeremyckahn)
npm audit fix, replace some transitive dependencies with security issues with versions that don't have any. (@iarna)
email@example.com: Dropping to 4.4.1 from 4.4.2 due to https://github.com/npm/node-tar/issues/183 (@zkat)
v6.1.0-next.0 - May 17, 2018
This release became 6.1.0
v5.10.0 - May 11, 2018
With this, likely the last release of the firstname.lastname@example.org series, we backport a number of features from 6.0.0. Contrary to Github at publication time, this is not the latest release. That honor belongs to 6.0.1, just below this. If you're using 6.0.1 there's nothing here you haven't seen before.
npm init SCAFFOLDING
Thanks to the wonderful efforts of @jdalton of lodash fame,
npm init can now be used to invoke custom scaffolding tools!
You can now do things like
npm init react-app or
npm init esm to scaffold an npm package by running
create-esm, respectively. This also adds an
npm create alias, to correspond to Yarn's
yarn create feature, which inspired this.
13adcbb52#20303 #20372 Add an
npm initfeature that calls out to
npxwhen invoked with positional arguments. (@jdalton)
This version of npm adds a new command,
npm audit, which will run a security audit of your project's dependency tree and notify you about any actions you may need to take.
The registry-side services required for this command to work will be available on the main npm registry in the coming weeks. Until then, you won't get much out of trying to use this on the CLI.
As part of this change, the npm CLI now sends scrubbed and cryptographically anonymized metadata about your dependency tree to your configured registry, to allow notifying you about the existence of critical security flaws. For details about how the CLI protects your privacy when it shares this metadata, see
npm help audit, or read the docs for
npm audit online. You can disable this altogether by doing
npm config set audit false, but will no longer benefit from the service.
43b20b204#20389 Add new
npm auditcommand. (@iarna)
49ddb3f56#20389 Temporarily suppress git metadata till there's an opt-in. (@iarna)
5f1129c4b#20389 Document the new command. (@iarna)
9a07b379d#20389 Default audit to off when running the npm test suite itself. (@iarna)
a6e2f1284Make sure we hide stream errors on background audit submissions. Previously some classes of error could end up being displayed (harmlessly) during installs. (@iarna)
aadbf3f46Include session and scope in requests (as we do in other requests to the registry). (@iarna)
7d43ddf63Exit with non-zero status when vulnerabilities are found. So you can have
npm auditas a test or prepublish step! (@iarna)
bc3fc55faVerify lockfile integrity before running. You'd get an error either way, but this way it's faster and can give you more concrete instructions on how to fix it. (@iarna)
2ac8edd42Refuse to run in global mode. Audits require a lockfile and globals don't have one. Yet. (@iarna)
3dcc240dbTimeout audit requests eventually. (@iarna)
CTRL-C OUT DURING PACKAGE EXTRACTION AS MUCH AS YOU WANT!
email@example.com: Switches to
signal-exitto detect abnormal exits and remove locks. (@Redsandro)
SHRONKWRAPS AND LACKFILES
If a published modules had legacy
npm-shrinkwrap.json we were saving ordinary registry dependencies (
name@version) to your
https:// URLs instead of versions.
36f998411When saving the lock-file compute how the dependency is being required instead of using
package.json. This fixes the bug that was converting registry dependencies into
113e1a3afWhen encountering a
https://URL in our lockfiles that point at our default registry, extract the version and use them as registry dependencies. This lets us heal
package-lock.jsonfiles produced by 6.0.0 (@iarna)
package-lock.json FORMAT CHANGES?!
fromfield back into package-lock for git dependencies. This will give npm the information it needs to figure out whether git deps are valid, specially when running with legacy install metadata or in
--package-lock-onlymode when there's no
node_modules. This should help remove a significant amount of git-related churn on the lock-file. (@zkat)
e0235ebb6#20384 Update the lock-file spec doc to mention that we now generate the from field for
git-type dependencies. (@watilde)
35de04676#20408 Describe what the colors in outdated mean. (@teameh)
npm it) will no longer generate
package-lock.jsonwhen running with
c12e61431#20390 Fix a scenario where a git dependency had a comittish associated with it that was not a complete commitid.
npmwould never consider that entry in the
package.jsonas matching the entry in the
package-lock.jsonand this resulted in inappropriate pruning or reinstallation of git dependencies. This has been addressed in two ways, first, the addition of the
fromfield as described in #20384 means we can exactly match the
package.json. Second, when that's missing (when working with older
package-lock.jsonfiles), we assume that the match is ok. (If it's not, we'll fix it up when a real installation is done.) (@iarna)
7b13bf5e3#20331 Fix broken link to 'private-modules' page. The redirect went away when the new npm website went up, but the new URL is better anyway. (@vipranarayan14)
1c4ffddce#20279 Document the
npm run-script. (@aleclarson)