Swiftpack.co - Package - npm/npm

npm(1) -- a JavaScript package manager

Build Status

SYNOPSIS

This is just enough info to get you up and running.

Much more info available via npm help once it's installed.

IMPORTANT

You need node v6 or higher to run this program.

To install an old and unsupported version of npm that works on node v5 and prior, clone the git repo and dig through the old tags and branches.

npm is configured to use npm, Inc.'s public package registry at https://registry.npmjs.org by default.

You can configure npm to use any compatible registry you like, and even run your own registry. Check out the doc on registries.

Use of someone else's registry may be governed by terms of use. The terms of use for the default public registry are available at https://www.npmjs.com.

Super Easy Install

npm is bundled with node.

Windows Computers

Get the MSI. npm is in it.

Apple Macintosh Computers

Get the pkg. npm is in it.

Other Sorts of Unices

Run make install. npm will be installed with node.

If you want a more fancy pants install (a different version, customized paths, etc.) then read on.

Fancy Install (Unix)

There's a pretty robust install script at https://www.npmjs.com/install.sh. You can download that and run it.

Here's an example using curl:

curl -L https://www.npmjs.com/install.sh | sh

Slightly Fancier

You can set any npm configuration params with that script:

npm_config_prefix=/some/path sh install.sh

Or, you can run it in uber-debuggery mode:

npm_debug=1 sh install.sh

Even Fancier

Get the code with git. Use make to build the docs and do other stuff. If you plan on hacking on npm, make link is your friend.

If you've got the npm source code, you can also semi-permanently set arbitrary config keys using the ./configure --key=val ..., and then run npm commands by doing node bin/npm-cli.js <command> <args>. (This is helpful for testing, or running stuff without actually installing npm itself.)

Windows Install or Upgrade

Many improvements for Windows users have been made in npm 3 - you will have a better experience if you run a recent version of npm. To upgrade, either use Microsoft's upgrade tool, download a new version of Node, or follow the Windows upgrade instructions in the npm Troubleshooting Guide.

If that's not fancy enough for you, then you can fetch the code with git, and mess with it directly.

Installing on Cygwin

No.

Uninstalling

So sad to see you go.

sudo npm uninstall npm -g

Or, if that fails,

sudo make uninstall

More Severe Uninstalling

Usually, the above instructions are sufficient. That will remove npm, but leave behind anything you've installed.

If you would like to remove all the packages that you have installed, then you can use the npm ls command to find them, and then npm rm to remove them.

To remove cruft left behind by npm 0.x, you can use the included clean-old.sh script file. You can run it conveniently like this:

npm explore npm -g -- sh scripts/clean-old.sh

npm uses two configuration files, one for per-user configs, and another for global (every-user) configs. You can view them by doing:

npm config get userconfig   # defaults to ~/.npmrc
npm config get globalconfig # defaults to /usr/local/etc/npmrc

Uninstalling npm does not remove configuration files by default. You must remove them yourself manually if you want them gone. Note that this means that future npm installs will not remember the settings that you have chosen.

More Docs

Check out the docs.

You can use the npm help command to read any of them.

If you're a developer, and you want to use npm to publish your program, you should read this.

BUGS

When you find issues, please report them:

Be sure to include all of the output from the npm command that didn't work as expected. The npm-debug.log file is also helpful to provide.

You can also find npm people in #npm on https://package.community/ or on Twitter. Whoever responds will no doubt tell you to put the output in a gist or email.

SEE ALSO

  • npm(1)
  • npm-help(1)
  • npm-index(7)

Github

link
Stars: 16769
Help us keep the lights on

Dependencies

Releases

v6.1.0 - May 24, 2018

Look at that! A feature bump! npm@6 was super-exciting not just because it used a bigger number than ever before, but also because it included a super shiny new command: npm audit. Well, we've kept working on it since then and have some really nice improvements for it. You can expect more of them, and the occasional fix, in the next few releases as more users start playing with it and we get more feedback about what y'all would like to see from something like this.

I, for one, have started running it (and the new subcommand...) in all my projects, and it's one of those things that I don't know how I ever functioned -without- it! This will make a world of difference to so many people as far as making the npm ecosystem a higher-quality, safer commons for all of us.

This is also a good time to remind y'all that we have a new RFCs repository, along with a new process for them. This repo is open to anyone's RFCs, and has already received some great ideas about where we can take the CLI (and, to a certain extent, the registry). It's a great place to get feedback, and completely replaces feature requests in the main repo, so we won't be accepting feature requests there at all anymore. Check it out if you have something you'd like to suggest, or if you want to keep track of what the future might look like!

NEW FEATURE: npm audit fix

This is the biggie with this release! npm audit fix does exactly what it says on the tin. It takes all the actionable reports from your npm audit and runs the installs automatically for you, so you don't have to try to do all that mechanical work yourself!

Note that by default, npm audit fix will stick to semver-compatible changes, so you should be able to safely run it on most projects and carry on with your day without having to track down what breaking changes were included. If you want your (toplevel) dependencies to accept semver-major bumps as well, you can use npm audit fix --force and it'll toss those in, as well. Since it's running the npm installer under the hood, it also supports --production and --only=dev flags, as well as things like --dry-run, --json, and --package-lock-only, if you want more control over what it does.

Give it a whirl and tell us what you think! See npm help audit for full docs!

  • 3800a660d Add npm audit fix subcommand to automatically fix detected vulnerabilities. (@zkat)

OTHER NEW audit FEATURES

  • 1854b1c7f #20568 Add support for npm audit --json to print the report in JSON format. (@finnp)
  • 85b86169d #20570 Include number of audited packages in npm install summary output. (@zkat)
  • 957cbe275 npm-audit-report@1.2.1: Overhaul audit install and detail output format. The new format is terser and fits more closely into the visual style of the CLI, while still providing you with the important bits of information you need. They also include a bit more detail on the footer about what actions you can take! (@zkat)

NEW FEATURE: GIT DEPS AND npm init <pkg>!

Another exciting change that came with npm@6 was the new npm init command that allows for community-authored generators. That means you can, for example, do npm init react-app and it'll one-off download, install, and run create-react-app for you, without requiring or keeping around any global installs. That is, it basically just calls out to npx.

The first version of this command only really supported registry dependencies, but now, @jdalton went ahead and extended this feature so you can use hosted git dependencies, and their shorthands.

So go ahead and do npm init facebook/create-react-app and it'll grab the package from the github repo now! Or you can use it with a private github repository to maintain your organizational scaffolding tools or whatnot. ✨

FIX WRITE AFTER END ERROR

First introduced in 5.8.0, this finally puts to bed errors where you would occasionally see Error: write after end at MiniPass.write.

DETECT CHANGES IN GIT SPECIFIERS

  • 0e1726c03 We can now determine if the commitid of a git dependency in the lockfile is derived from the specifier in the package.json and if it isn't we now trigger an update for it. (@iarna)

OTHER BUGFIXES

  • 442d2484f 2f0c88351 631d30a34 When requesting the update of a direct dependency that was also a transitive dependency to a version incompatible with the transitive requirement and you had a lock-file but did not have a node_modules folder then npm would fail to provide a new copy of the transitive dependency, resulting in an invalid lock-file that could not self heal. (@iarna)
  • be5dd0f49 #20715 Cleanup output of npm ci summary report. (@legodude17)
  • 98ffe4adb Node.js now has a test that scans for things that look like conflict markers in source code. This was triggering false positives on a fixture in a test of npm's ability to heal lockfiles with conflicts in them. (@iarna)
  • a41c0393c #20538 Make the new npm view work when the license field is an object instead of a string. (@zkat)
  • eb7522073 #20582 Add support for environments (like Docker) where the expected binary for opening external URLs is not available. (@bcoe)
  • 212266529 #20536 Fix a spurious colon in the new update notifier message and add support for the npm canary. (@zkat)
  • 5ee1384d0 #20597 Infer a version range when a package.json has a dist-tag instead of a version range in one of its dependency specs. Previously, this would cause dependencies to be flagged as invalid. (@zkat)
  • 4fa68ae41 #20585 Make sure scoped bundled deps are shown in the new publish preview, too. (@zkat)
  • 1f3ee6b7e cacache@11.0.2: Stop dropping size from metadata on npm cache verify. (@jfmartinez)
  • 91ef93691 #20513 Fix nested command aliases. (@mmermerkaya)
  • 18b2b3cf7 npm-lifecycle@2.0.3: Make sure different versions of the Path env var on Windows all get node_modules/.bin prepended when running lifecycle scripts. (@laggingreflex)

DOCUMENTATION

DEPENDENCY BUMPS

v6.1.0-next.0 - May 17, 2018

This release became 6.1.0

v5.10.0 - May 11, 2018

With this, likely the last release of the npm@5.x series, we backport a number of features from 6.0.0. Contrary to Github at publication time, this is not the latest release. That honor belongs to 6.0.1, just below this. If you're using 6.0.1 there's nothing here you haven't seen before.

EXTENDED npm init SCAFFOLDING

Thanks to the wonderful efforts of @jdalton of lodash fame, npm init can now be used to invoke custom scaffolding tools!

You can now do things like npm init react-app or npm init esm to scaffold an npm package by running create-react-app and create-esm, respectively. This also adds an npm create alias, to correspond to Yarn's yarn create feature, which inspired this.

DEPENDENCY AUDITING

This version of npm adds a new command, npm audit, which will run a security audit of your project's dependency tree and notify you about any actions you may need to take.

The registry-side services required for this command to work will be available on the main npm registry in the coming weeks. Until then, you won't get much out of trying to use this on the CLI.

As part of this change, the npm CLI now sends scrubbed and cryptographically anonymized metadata about your dependency tree to your configured registry, to allow notifying you about the existence of critical security flaws. For details about how the CLI protects your privacy when it shares this metadata, see npm help audit, or read the docs for npm audit online. You can disable this altogether by doing npm config set audit false, but will no longer benefit from the service.

  • c81dfb91b npm-registry-fetch@1.1.1 (@iarna)
  • b096f44a9 npm-audit-report@1.0.9 (@iarna)
  • 43b20b204 #20389 Add new npm audit command. (@iarna)
  • 49ddb3f56 #20389 Temporarily suppress git metadata till there's an opt-in. (@iarna)
  • 5f1129c4b #20389 Document the new command. (@iarna)
  • 9a07b379d #20389 Default audit to off when running the npm test suite itself. (@iarna)
  • a6e2f1284 Make sure we hide stream errors on background audit submissions. Previously some classes of error could end up being displayed (harmlessly) during installs. (@iarna)
  • aadbf3f46 Include session and scope in requests (as we do in other requests to the registry). (@iarna)
  • 7d43ddf63 Exit with non-zero status when vulnerabilities are found. So you can have npm audit as a test or prepublish step! (@iarna)
  • bc3fc55fa Verify lockfile integrity before running. You'd get an error either way, but this way it's faster and can give you more concrete instructions on how to fix it. (@iarna)
  • 2ac8edd42 Refuse to run in global mode. Audits require a lockfile and globals don't have one. Yet. (@iarna)
  • 3dcc240db Timeout audit requests eventually. (@iarna)

CTRL-C OUT DURING PACKAGE EXTRACTION AS MUCH AS YOU WANT!

SHRONKWRAPS AND LACKFILES

If a published modules had legacy npm-shrinkwrap.json we were saving ordinary registry dependencies (name@version) to your package-lock.json as https:// URLs instead of versions.

  • 36f998411 When saving the lock-file compute how the dependency is being required instead of using _resolved in the package.json. This fixes the bug that was converting registry dependencies into https:// dependencies. (@iarna)
  • 113e1a3af When encountering a https:// URL in our lockfiles that point at our default registry, extract the version and use them as registry dependencies. This lets us heal package-lock.json files produced by 6.0.0 (@iarna)

MORE package-lock.json FORMAT CHANGES?!

  • 074502916 #20384 Add from field back into package-lock for git dependencies. This will give npm the information it needs to figure out whether git deps are valid, specially when running with legacy install metadata or in --package-lock-only mode when there's no node_modules. This should help remove a significant amount of git-related churn on the lock-file. (@zkat)

DOCUMENTATION IMPROVEMENTS

BUGFIXES

  • 1b535cb9d #20358 npm install-test (aka npm it) will no longer generate package-lock.json when running with --no-package-lock or package-lock=false. (@raymondfeng)
  • 268f7ac50 5f84ebdb6 c12e61431 #20390 Fix a scenario where a git dependency had a comittish associated with it that was not a complete commitid. npm would never consider that entry in the package.json as matching the entry in the package-lock.json and this resulted in inappropriate pruning or reinstallation of git dependencies. This has been addressed in two ways, first, the addition of the from field as described in #20384 means we can exactly match the package.json. Second, when that's missing (when working with older package-lock.json files), we assume that the match is ok. (If it's not, we'll fix it up when a real installation is done.) (@iarna)

DOCS

DEPENDENCY UPDATES

v6.0.1 - May 10, 2018

CTRL-C OUT DURING PACKAGE EXTRACTION AS MUCH AS YOU WANT!

SHRONKWRAPS AND LACKFILES

If a published modules had legacy npm-shrinkwrap.json we were saving ordinary registry dependencies (name@version) to your package-lock.json as https:// URLs instead of versions.

  • 89102c0d9 When saving the lock-file compute how the dependency is being required instead of using _resolved in the package.json. This fixes the bug that was converting registry dependencies into https:// dependencies. (@iarna)
  • 676f1239a When encountering a https:// URL in our lockfiles that point at our default registry, extract the version and use them as registry dependencies. This lets us heal package-lock.json files produced by 6.0.0 (@iarna)

AUDIT AUDIT EVERYWHERE

You can't use it quite yet, but we do have a few last moment patches to npm audit to make it even better when it is turned on!

  • b2e4f48f5 Make sure we hide stream errors on background audit submissions. Previously some classes of error could end up being displayed (harmlessly) during installs. (@iarna)
  • 1fe0c7fea Include session and scope in requests (as we do in other requests to the registry). (@iarna)
  • d04656461 Exit with non-zero status when vulnerabilities are found. So you can have npm audit as a test or prepublish step! (@iarna)
  • fcdbcbacc Verify lockfile integrity before running. You'd get an error either way, but this way it's faster and can give you more concrete instructions on how to fix it. (@iarna)
  • 2ac8edd42 Refuse to run in global mode. Audits require a lockfile and globals don't have one. Yet. (@iarna)
  • 3dcc240db Timeout audit requests eventually. (@iarna)

Looking forward

We're still a way from having node@11, so now's a good time to ensure we don't warn about being used with it.

DOCUMENTATION IMPROVEMENTS

DEPENDENCY UPDATES

v5.10.0-next.1 - May 8, 2018

EXTENDED npm init SCAFFOLDING

Thanks to the wonderful efforts of @jdalton of lodash fame, npm init can now be used to invoke custom scaffolding tools!

You can now do things like npm init react-app or npm init esm to scaffold an npm package by running create-react-app and create-esm, respectively. This also adds an npm create alias, to correspond to Yarn's yarn create feature, which inspired this.

DEPENDENCY AUDITING

This version of npm adds a new command, npm audit, which will run a security audit of your project's dependency tree and notify you about any actions you may need to take.

The registry-side services required for this command to work will be available on the main npm registry in the coming weeks. Until then, you won't get much out of trying to use this on the CLI.

As part of this change, the npm CLI now sends scrubbed and cryptographically anonymized metadata about your dependency tree to your configured registry, to allow notifying you about the existence of critical security flaws. For details about how the CLI protects your privacy when it shares this metadata, see npm help audit, or read the docs for npm audit online. You can disable this altogether by doing npm config set audit false, but will no longer benefit from the service.

  • c81dfb91b npm-registry-fetch@1.1.1 (@iarna)
  • b096f44a9 npm-audit-report@1.0.9 (@iarna)
  • 43b20b204 #20389 Add new npm audit command. (@iarna)
  • 49ddb3f56 #20389 Temporarily suppress git metadata till there's an opt-in. (@iarna)
  • 5f1129c4b #20389 Document the new command. (@iarna)
  • 9a07b379d #20389 Default audit to off when running the npm test suite itself. (@iarna)
  • a6e2f1284 Make sure we hide stream errors on background audit submissions. Previously some classes of error could end up being displayed (harmlessly) during installs. (@iarna)
  • aadbf3f46 Include session and scope in requests (as we do in other requests to the registry). (@iarna)
  • 7d43ddf63 Exit with non-zero status when vulnerabilities are found. So you can have npm audit as a test or prepublish step! (@iarna)
  • bc3fc55fa Verify lockfile integrity before running. You'd get an error either way, but this way it's faster and can give you more concrete instructions on how to fix it. (@iarna)
  • 2ac8edd42 Refuse to run in global mode. Audits require a lockfile and globals don't have one. Yet. (@iarna)

CTRL-C OUT DURING PACKAGE EXTRACTION AS MUCH AS YOU WANT!

SHRONKWRAPS AND LACKFILES

If a published modules had legacy npm-shrinkwrap.json we were saving ordinary registry dependencies (name@version) to your package-lock.json as https:// URLs instead of versions.

  • 36f998411 When saving the lock-file compute how the dependency is being required instead of using _resolved in the package.json. This fixes the bug that was converting registry dependencies into https:// dependencies. (@iarna)
  • 113e1a3af When encountering a https:// URL in our lockfiles that point at our default registry, extract the version and use them as registry dependencies. This lets us heal package-lock.json files produced by 6.0.0 (@iarna)

MORE package-lock.json FORMAT CHANGES?!

  • 074502916 #20384 Add from field back into package-lock for git dependencies. This will give npm the information it needs to figure out whether git deps are valid, specially when running with legacy install metadata or in --package-lock-only mode when there's no node_modules. This should help remove a significant amount of git-related churn on the lock-file. (@zkat)

DOCUMENTATION IMPROVEMENTS

BUGFIXES

  • 1b535cb9d #20358 npm install-test (aka npm it) will no longer generate package-lock.json when running with --no-package-lock or package-lock=false. (@raymondfeng)
  • 268f7ac50 5f84ebdb6 c12e61431 #20390 Fix a scenario where a git dependency had a comittish associated with it that was not a complete commitid. npm would never consider that entry in the package.json as matching the entry in the package-lock.json and this resulted in inappropriate pruning or reinstallation of git dependencies. This has been addressed in two ways, first, the addition of the from field as described in #20384 means we can exactly match the package.json. Second, when that's missing (when working with older package-lock.json files), we assume that the match is ok. (If it's not, we'll fix it up when a real installation is done.) (@iarna)

DOCS

DEPENDENCY UPDATES