The npm blog has been discontinued.
32ec2f54b#20257 Add shasum and integrity to the new
npm viewoutput. (@zkat)
npm citcommand that’s equivalent of
npm ci && npm tthat’s equivalent of
npm it. (@SimenB)
089aeaf44Fix a bug where OTPs passed in via the commandline would have leading zeros deleted resulted in authentication failures. (@iarna)
6eaa860eaEliminate direct use of
npm. While the use of it in
npmwas safe, there are two other reasons for this change:
- Node 10 emits warnings about its use.
- Users who require npm as a library (which they definitely should not do)
can call the functions that call
new Bufferin unsafe ways, if they try really hard.
85900a294Starting with 5.8.0 the
requiressection of the lock-file saved version ranges instead of specific versions. Due to a bug, further actions on the same lock-file would result in the range being switched back to a version. This corrects that, keeping ranges when they appear. (@iarna)
59d080a22Restore the ability to bundle dependencies that are uninstallable from the registry. This also eliminates needless registry lookups for bundled dependencies.
Fixed a bug where attempting to install a dependency that is bundled inside another module without reinstalling that module would result in ENOENT errors. (@iarna)
db846c2d5#20029 Allow packages with non-registry specifiers to follow the fast path that the we use with the lock-file for registry specifiers. This will improve install time especially when operating only on the package-lock (
Fixes a bug where
npm i --only=prodcould remove development dependencies from lock-file. (@iarna)
3e12d2407#20122 Improve the update-notifier messaging (borrowing ideas from pnpm) and eliminate false positives. (@zkat)
f18be9b39#20154 Let version succeed when
package-lock.jsonis gitignored. (@nwoltman)
ced29253d#20212 Ensure that we only create an
etcdirectory if we are actually going to write files to it. (@buddydvd)
8e21b19a8#20140 Note in documentation that
package-lock.jsonversion gets touched by
npm version. (@srl295)
5d17c87d8#20032 Fix bug where unauthenticated errors would get reported as both 404s and 401s, i.e.
npm ERR! 404 Registry returned 401. In these cases the error message will now be much more informative. (@iarna)
05ff6c9b1#20082 Allow optional @ prefix on scope with
npm teamcommands for parity with other commands. (@bcoe)
6bef53891#19580 Improve messaging when two-factor authentication is required while publishing. (@jdeniau)
155dab2bdFix a bug where optional status of a dependency was not being saved to the package-lock on the initial install. (@iarna)
--no-optionaldoes not remove optional dependencies from the lock-file. (@iarna)
firstname.lastname@example.org: Detect binding.gyp for default install lifecycle. Let’s
npm ciwork on projects that have their own C code. (@caleblloyd)