Softpedia >Mac >Developer Tools >npm >  Changelog

npm Changelog

What's new in npm 5.7.0

Feb 22, 2018
  • PACKAGE-LOCK GIT MERGE CONFLICT RESOLUTION:
  • Allow npm install to fix package-lock.json and npm-shrinkwrap.json files that have merge conflicts in them without your having to edit them. It works in conjunction with npm-merge-driver to entirely eliminate package-lock merge conflicts.
  • e27674c22 Automatically resolve merge conflicts in lock-files. (@zkat)
  • NPM CI:
  • The new npm ci command installs from your lock-file ONLY. If your package.json and your lock-file are out of sync then it will report an error.
  • It works by throwing away your node_modules and recreating it from scratch.
  • Beyond guaranteeing you that you'll only get what is in your lock-file it's also much faster (2x-10x!) than npm install when you don't start with a node_modules.
  • As you may take from the name, we expect it to be a big boon to continuous integration environments. We also expect that folks who do production deploys from git tags will see major gains.
  • 5e4de9c99 Add new npm ci installer. (@zkat)
  • OTHER NEW FEATURES:
  • 4d418c21b #19817 Include contributor count in installation summary. (@kemitchell)
  • 17079c2a8 Require password to change email through npm profile. (@iarna)
  • e7c5d226a 4f5327c05 #19780 Add support for web-based logins. This is not yet available on the registry, however. (@isaacs)
  • BIG FIXES TO PRUNING:
  • 827951590 Handle running npm install package-name with a node_modules containing packages without sufficient metadata to verify their origin. The only way to get install packages like this is to use a non-npm package manager. Previously npm removed any packages that it couldn't verify. Now it will leave them untouched as long as you're not asking for a full install. On a full install they will be reinstalled (but the same versions will be maintained).
  • This will fix problems for folks who are using a third party package manager to install packages that have postinstall scripts that run npm install. (@iarna)
  • 3b305ee71 Only auto-prune on installs that will create a lock-file. This restores npm@4 compatible behavior when the lock-file is disabled. When using a lock-file npm will continue to remove anything in your node_modules that's not in your lock-file. (@iarna)
  • cec5be542 Fix bug where npm prune --production would remove dev deps from the lock file. It will now only remove them from node_modules not from your lock file. (@iarna)
  • 857dab03f Fix bug where git dependencies would be removed or reinstalled when installing other dependencies. (@iarna)
  • BUG FIXES TO TOKENS AND PROFILES:
  • a66e0cd03 For CIDR filtered tokens, allow comma separated CIDR ranges, as documented. Previously you could only pass in multiple cidr ranges with multiple --cidr command line options. (@iarna)
  • d259ab014 Fix token revocation when an OTP is required. Previously you had to pass it in via --otp. Now it will prompt you for an OTP like other npm token commands. (@iarna)
  • f8b1f6aec Update token and profile commands to support legacy (username/password) authentication. (The npm registry uses tokens, not username/password pairs, to authenticate commands.) (@iarna)
  • OTHER BUG FIXES:
  • 6954dfc19 Fix a bug where packages would get pushed deeper into the tree when upgrading without an existing copy on disk. Having packages deeper in the tree ordinarily is harmless but is not when peerDependencies are in play. (@iarna)
  • 1ca916a1e Fix bug where when switching from a linked module to a non-linked module, the dependencies of the module wouldn't be installed on the first run of npm install. (@iarna)
  • 8c120ebb2 Fix integrity matching to eliminate spurious EINTEGRITY errors. (@zkat)
  • 94227e15e More consistently make directories using perm and ownership preserving features. (@iarna)
  • DEPENDENCY UPDATES:
  • 364b23c7f f2049f9e7 [email protected] (@zkat)
  • d183d7675 [email protected]: (@iarna)
  • ffd6ea62c [email protected]
  • ee63b8a31 [email protected] (@isaacs)
  • 6f73f5509 [email protected] (@dominictarr)
  • 26cd64869 9bc6230cf [email protected] (@zkat)
  • 21a39be42 [email protected]:5 (@joshbruce)
  • dabdf57b2 [email protected]
  • 2594c5867 [email protected] (@iarna)
  • 8abb3f230 [email protected] (@isaacs)
  • 11a0b00bd [email protected] (@zkat)
  • 9b6bdb2c7 [email protected] (@sindresorhus)
  • d6d17d6b5 [email protected] (@mcollina)
  • 51370aad5 [email protected] (@isaacs)
  • 0db14bac7 81da938ab 9999e83f8 [email protected] (@zkat)
  • f526992ab [email protected] (@isaacs)
  • be096b409 dc3059522 [email protected]
  • 6b552daac [email protected] (@broofa)
  • 8c9011b72 [email protected] (@rvagg)

New in npm 4.6.1 Pre (Apr 22, 2017)

  • FEATURES:
  • d13c9b2f2 [email protected]: The name: prompt is now package name: to make this less ambiguous for new users.
  • The default package name is now a valid package name. For example: If your package directory has mixed case, the default package name will be all lower case.
  • f08c66323 #16213 Add --allow-same-version option to npm version so that you can use npm version to run your version lifecycles and tag your git repo without actually changing the version number in your package.json. (@lucastheisen)
  • f5e8becd0 Timing has been added throughout the install implementation. You can see it by running a command with --loglevel=timing. You can also run commands with --timing which will write an npm-debug.log even on success and add an entry to _timing.json in your cache with the timing information from that run. (@iarna)
  • BUG FIXES:
  • 9c860f2ed #16021 Fix a crash in npm doctor when used with a registry that does not support the ping API endpoint. (@watilde)
  • 65b9943e9 #16364 Shorten the ELIFECYCLE error message. The shorter error message should make it much easier to discern the actual cause of the error. (@j-f1)
  • a87a4a835 [email protected]: Fix flashing of the progress bar when your terminal is very narrow. (@iarna)
  • 41c10974f [email protected]: Wait for fsync to complete before considering our file written to disk. This will improve certain sorts of Windows diagnostic problems.
  • 2afa9240c #16336 Don't ham-it-up when expecting JSON. (@bdukes)
  • DOCUMENTATION FIXES:
  • 566f3eebe #16296 Use a single convention when referring to the you're running. (@desfero)
  • ccbb94934 #16267 Fix a missing space in the example package.json. (@famousgarkin)
  • DEPENDENCY UPDATES:
  • ebde4ea33 [email protected]
  • c46ad71bb [email protected]
  • d856d570d [email protected]
  • 4a2e14436 [email protected]
  • f0399138e [email protected]

New in npm 4.5.0 Pre (Mar 26, 2017)

  • Fixed issues:
  • 86dad0d74 Add support for filtered package metadata. (@iarna)
  • 41789cffa [email protected] (@iarna)
  • 4f5060eb3 #15969 Add support for skipping npm-shrinkwrap.json extraction when the registry can affirm that one doesn't exist. (@iarna)
  • 878aceb25 #16129 Better handle Ctrl-C while running scripts. npm will now no longer exit until the script it is running has exited. If you press Ctrl-C a second time it kill the script rather than just forwarding the Ctrl-C. (@jaridmargolin)
  • def75eebf [email protected]: Preserve case of the user name part of shortcut specifiers, previously they were lowercased. (@iarna)
  • eb3789fd1 [email protected]: Add support for VS2017 and Chakracore improvements. (@refack) (@kunalspathak)
  • 245e25315 [email protected] (@mcollina)
  • 30357ebc5 [email protected] (@isaacs)

New in npm 4.1.1 (Jan 20, 2017)

  • This fixes a bug in the metrics reporting where, if you had enabled it then installs would create a metrics reporting process, that would create a metrics reporting process, that would… well, you get the idea. Killing them was tricky because they constantly had new PIDs. There were a few tricks but the easiest was to just reboot.
  • Anyway, this is a quick release to fix that bug:
  • 51c393f #15237 Don't launch a metrics sender process if we're runnning from a metrics sender process. (@iarna)

New in npm 4.0.2 Pre (Nov 5, 2016)

  • PREPUBLISHONLY WHOOPS:
  • 8b32d67 #14502 Simplify lifecycle invocation and fix prepublishOnly. (@othiym23)
  • G'BYE NODE.JS 0.10, 0.12, and 5.X; HI THERE, NODE 7:
  • ab630c9 #14503 Node 6 is LTS; 5.x, 0.10, and 0.12 are unsupported. (@othiym23)
  • 731ae52 #14503 Update supported version expression. (@othiym23)
  • DISENTANGLING SCOPE:
  • 39358f7 #14477 Differentiate registry scope from project scope in configuration. (@zkat)
  • SMALLER CHANGES:
  • 7f41295 #14519 Document that as of [email protected], npm shrinkwrap now includes devDependencies unless instructed otherwise. (@iarna)
  • bdc2f9e #14501 The ENOSELF error message is tricky to word. It's also an error that normally bites new users. Clean it up in an effort to make it easier to understand what's going on. (@snopeks, @zkat)
  • DEPENDENCY UPGRADES:
  • afda66d isaacs/node-graceful-fs#97 [email protected]: Better backoff for EPERM on Windows. (@sam-github)
  • e0023c0 npm/inflight#3 [email protected]: Clean up even if / when a callback throws. (@phated)
  • 1d91594 [email protected] (@othiym23)
  • a52d0f0 [email protected]:
  • Handle files without associated perms on Windows.
  • Fix failing case with absolute option. (@isaacs, @phated)

New in npm 4.0.1 Pre (Oct 25, 2016)

  • BIG FIXES/CHANGES:
  • eff46dd #14374 Fully resolve the path for node executables in both $PATH and process.execPath to avoid issues with symlinked node. (@addaleax)
  • 964f2d3 #14375 Make including devDependencies in npm-shrinkwrap.json the default. This should help make the transition to npm@5 smoother in the future. (@iarna)
  • BUG FIXES:
  • a5b0a8d #14400 Recently, we've had some consistent timeout failures while running the test suite under Travis. This tweak to tests should take care of those issues and Travis should go back to being reliably green. (@iarna)
  • DOC PATCHES:
  • c5907b2 #14251 Update links to Node.js downloads. They previously pointed to 404 pages.😬 (@ArtskydJ)
  • 0c122f2 #14380 Add note and clarification on when prepare script is run. Make it more consistent with surrounding descriptions. (@SimenB)
  • 51a62ab #14359 Fixes typo in npm@4 changelog. (@kimroen)

New in npm 3.10.9 Pre (Oct 12, 2016)

  • LIFECYCLE FIXES:
  • d388f90 #13942 Fix current working directory while running shrinkwrap lifecycle scripts. Previously if you ran a shrinkwrap from another lifecycle script AND node_modules existed (and if you're running npm shrinkwrap it probably should) then npm would run the shrinkwrap lifecycle from the node_modules folder instead of the package folder. (@evocateur) (@iarna)
  • c3b6cdf #13964 Fix bug where the uninstall lifecycles weren't being run when you reinstalled/updated an existing module. (@iarna)
  • 72bb89c #13344 When running lifecycles use TMPDIR if it's writable and fall back to the current working directory if not. Previously we just assumed TMPDIR wouldn't be writable (as we might have been running as nobody and nobody on some systems can't write to TMPDIR). (@aaronjensen)
  • SHRINKWRAP GIT & TAGGED DEPENDENCY FIX:
  • 3b5eee0 #13941 Fix git and tagged dependency matching with shrinkwraps. Previously git and tag (ie foo@latest) dependencies installed from a shrinkwrap would always be flagged as invalid. (@iarna)
  • BUG FIXES:
  • bf3bd1e #14143 Fix bug in npm version where npm-shrinkwrap.json wouldn't be updated if you ran npm version from outside of your project root. (@lholmquist)
  • 1089878 #13613 Log 'skipping action' as 'verbose' instead of 'warn'. This removes a lot of clutter when there are links in your node_modules. The long term plan is to entirely blind npm to what's inside links, which will make this code go away entirely. (@timoxley)
  • 952f1e1 #13999 Fix a bug where setting bin to null in your package.json would result in npm crashing. (@IonicaBizau)
  • fcf8b11 #14032 When using npm view, if you specified a version that didn't exist it would previously print undefined (even if you asked for JSON output). It now prints nothing in this situation. This brings npm@3's behavior in line with npm@2. (@roblg)
  • 93c689f #14032 When using npm view --json with a version range that matches multiple versions we now return a list of all of the metadata for all of those versions. Previously we picked one and only returned that. This brings npm@3's behavior in line with npm@2. (@roblg)
  • 2411728 #14045 Fix a Windows-only bug in the git tests. The tests had rather particular ideas about what arguments would be passed to git and on Windows they got this wrong. (@watilde)
  • DOCUMENTATION & MISC:
  • 30772cc #13904 Update package.json example to include GitHub branches. (@stevokk)
  • f66876f #14010 Update the GitHub issue template to reflect Apple's change in name of its desktop operating system. (@AlexChesters)

New in npm 3.10.6 Pre (Jul 8, 2016)

  • SHRINKWRAP AND DEV DEPENDENCIES:
  • The rewrite in 3.10.0 triggered a bug where dependencies of devDependencies would be included in your shrinkwrap even if you didn't request devDependencies:
  • 2484529 #13308 Fix bug where deps of devDependencies would be incorrectly included in shrinkwraps. (@iarna)
  • BETTER PATH LIFECYCLE BEHAVIOR:
  • We've been around the details on this one a few times in recent months and hopefully this will bring is to where we want to be:
  • 81051a9 #12968 When running lifecycle scripts, only prepend directory containing the node binary to PATH if not already in PATH. (@segrey)
  • BETTER INTERACTIONS WITH THIRD PARTY REGISTRIES:
  • 071193c #10869 If the registry returns a list of versions some of which are invalid, skip those when picking a version to install. This can't happen with registry.npmjs.org as it will normalize versions published with it, but it can happen with other registries. (@gregersrygg)
  • ONE LAST TOO-MUCH-PROGRESS CORNER:
  • 1244cc1 #13305 Disable progress bar in npm edit and npm config edit. (@watilde)
  • HTML DOCS IMPROVEMENTS:
  • 58da923 #npm/npm Fix HTML character set declaration in generated HTML documentation. (@KenanY)
  • d1f0bf4 #13250 Optimize png images using zopflipng. (@PeterDaveHello)
  • DEPENDENCY UPDATES (THAT MATTER):
  • c7567e5 npm/npm-user-validate#9 [email protected]: Lower the username length limits to 214 from 576 to match registry.npmjs.org's limits. (@aredridel)
  • 22802c9 #isaacs/rimraf [email protected]: Fixes EPERM errors when running lstat on read-only directories. (@isaacs)
  • ce6406f [email protected]: Forces the use of minimatch to 3.0.2, which improved handling of long and complicated patterns. (@isaacs)

New in npm 3.10.5 Pre (Jul 6, 2016)

New in npm 3.10.3 Pre (Jun 24, 2016)

  • Fixed issues:
  • ca92ac4 npm/read-package-tree#6 [email protected]: Make bad symlinks be non-fatal errors when reading the tree off disk. (@watilde)
  • 6c3f7f0 [email protected]: Fix unicode detection on a number of Linux distributions. (@Darkhogg) (@gagern)
  • b9243ee #13127 Remove extra backtick from npm ls documentation. (@shvaikalesh)
  • e05c0c2 iarna/has-unicode#3 iarna/has-unicode#4 #13084 Correct changelog entry for shrinkwrap lifecycle order. (@SimenB)
  • 823994f #13080 Describe using npm pack to see a dry run of publication results in the npm publish documentation. (@laughinghan)
  • e44d2db [email protected]: Documentation updates and minor refactoring. (@iarna)

New in npm 3.10.2 (Jun 24, 2016)

  • Fixed issues:
  • fbefb86 7779e9f #13105 Disable progress bar in adduser and init.
  • 6a33b2c #13115 Ensure that errors reading the package tree for outdated does not result in crashs. (@iarna)

New in npm 3.10.2 Pre (Jun 21, 2016)

  • This is a quick hot-fix release with two small bug fixes. First, there was an issue where the new progress bar would overwrite interactive prompts, that is, those found in npm login and npm init. Second, if the directory you were running npm outdated on was a bad link or otherwise had unrecoverable errors then npm would crash instead of printing the error.
  • Fixed issues:
  • fbefb86 7779e9f #13105 Disable progress bar in adduser and init.
  • 6a33b2c #13115 Ensure that errors reading the package tree for outdated does not result in crashs. (@iarna)

New in npm 3.9.5 Pre (May 29, 2016)

  • f96aea0 #12878 Ignore .nyc_output to avoid an accidental publish or commit filled with code coverage data. (@TheAlphaNerd)

New in npm 3.9.4 Pre (May 27, 2016)

  • BUG FIX:
  • cac0038 #12845 Progress bar during tarball packing now prints pack:packagename instead of pack:[object Object]. (@iarna)
  • DOC UPDATES:
  • 0b81622 #12840 Remove sexualized language from comment in code. (@geek)
  • d6dff24 #12802 Small grammar fix in cli/npm.md. (@andresilveira)
  • cb38e0f #12782 Documents that NOTICE files started getting included after npm/fstream-npm#17. (@SimenB)
  • 70a3ae4 #12776 npm run-script used to have a argument that allowed you to target specific packages' scripts. This was removed as one of the breaking changes for npm@2. This patch removes a mention of that argument, which really doesn't exist anymore. (@fibo)
  • DEP UPDATES:
  • 4a4470d [email protected] (@iarna)
  • TEST IMPROVEMENTS:
  • So it turns out, t.comment in tap is actually pretty nice!
  • There's also a couple other test improvements by Rebecca landing here.
  • 9fd04dd #12851 Rewrite shrinkwrap-prod-dependency-also test to use common.npm (@iarna)
  • 3bc4a8e #12851 Clean up rm-linked test. (@iarna)
  • bf7f7f2 #12851 Clean up outdated-symlink test. (@iarna)
  • ca0baa4 #12851 Improve diagnostics for shrinkwrap-scoped-auth test. (@iarna)
  • fbec9fd #12851 Rewrite shrinkwrap-dev-dependency test to use common.npm. (@iarna)

New in npm 3.9.3 Pre (May 22, 2016)

  • FIXES:
  • 42d71be #12685 When using npm ls without a semver specifier, npm ls would skip any packages in your tree that matched by name, but had a prerelease version in their package.json. This patch fixes it so npm ls does a simple name match unless you use the npm ls @ format. (@zkat)
  • c698ae6 #12685 Added some tests for more basic npm ls functionality. (@zkat)
  • NOTABLE DEPENDENCY UPDATES:
  • 3a6fe23 npm/fstream-npm#17 [email protected]: fstream-npm always includes NOTICE files now. (@kemitchell)
  • df04e05 #10013 [email protected]: Fixes an issue where npm install would fail if your node_modules was symlinked. (@iarna)
  • 584676f npm/init-package-json#62 [email protected]: Stop using package for a variable, which defeats some bundlers and linters. (@adius)
  • 935a7e3 [email protected]: Node 6 build and buffer-related updates. (@calvinmetcalf)
  • OTHER DEPENDENCY UPDATES:
  • 4c4609e [email protected] (@zkat)
  • 7a3030d [email protected] (@zkat)
  • 5ed4b58 [email protected] (@isaacs)

New in npm 3.9.2 (May 22, 2016)

  • A quick patch release. The previous release, 3.9.1, introduced a bug where npm would crash given a combination of specific package tree on disk and a shrinkwrap.
  • cde367f #12724 Fix crasher when inflating shrinkwraps with packages on disk that were installed by older npm versions. (@iarna)

New in npm 3.9.1 Pre (May 13, 2016)

  • SHRINKWRAP FIX:
  • b894413 #12372 Changing a nested dependency in an npm-shrinkwrap.json and then running npm install would not get up the updated package. This corrects that. (@misterbyrne)
  • BUNDLED DEPENDENCIES FIX:
  • d0c6d19 #12476 Protects against a crasher when a bundled dep is missing a package.json. (@dflupu)
  • DOCS IMPROVEMENTS:
  • 6699aa5 #12585 Document that engineStrict is quite gone. Not "deprecated" so much as "extirpated". (@othiym23)
  • 7a41a84 #12636 Improve npm-scripts documentation regarding when node-gyp is used. (@reconbot)
  • 4c4b4ba #12586 Correct package.json documentation as to when node-gyp rebuild called. This now matches https://docs.npmjs.com/misc/scripts#default-values (@reconbot)
  • DEPENDENCY UPDATES:
  • cfa797f [email protected] (@jdalton)
  • ab6f180 [email protected] (@jdalton)
  • 4b8d8b6 [email protected] (@jdalton)
  • 46099d3 [email protected] (@jdalton)
  • fff89c6 [email protected] (@jdalton)

New in npm 3.9.0 Pre (May 6, 2016)

  • 111ae3e #8581 When a package is fetched from the cache which cannot satisfy the version requirements, an attempt to fetch it from the network is made. This is helpful for folks using high values for --cache-min who are willing to accept possibly not-the-most-recent modules in return for less network traffic. (@Zirak)
  • 60b9a05 #12475 Options can only start with ASCII dashes. Ordinarily this isn't a problem but many web documentation tools "helpfully" convert -- into an emdash (–), or - into an endash (–). If you copy and paste from this documentation your commands won't work the way you expect. This adds a warning that tries to be a little more descriptive about why your command is failing. (@iarna)
  • bb5d6cb #11444 Add AppVeyor to CI matrix. (@othiym23)
  • 044cbab #11444 Enable coverage reporting for every test run. (@othiym23)
  • 37c6a51 #12150 Ensure that 'npm cache ls' outputs real filenames. Previously it would sometimes double up the package name in the path it printed. (@isaacs)
  • d3ce0b2 #11444 Fix unbuilding bins for scoped modules. (@iarna)
  • e928a30 #11444 Make handling of local modules (eg npm install /path/to/my/module) more consistent when saved to a package.json. There were bugs previously where it wouldn't consistently resolve relative paths in the same way. (@iarna)
  • b820ed4 #11444 Under certain circumstances the paths produced for linking, either relative or absolute, would end up basing off the wrong virtual cwd. This resulted in failures for npm link in these situations. (@iarna)
  • 7380425 #11444 Scoped module names were not being correctly inferred from the path on Windows. (@zkat)
  • 91fc24f #11444 Explore with a command to run didn't work properly in Windows– it would pop open a new cmd window and leave it there. (@iarna)
  • f07e643 #11444 Move exec path escaping out to its own function. This turns out to be tricky to get right because how you escape commands to run on Windows via cmd is different then how you escape them at other times. Specifically, you HAVE to quote each directory segment that has a quote in it, that is: C:\"Program Files"\MyApp\MyApp.exe By contrast, if that were an argument to a command being run, you CAN'T DO quote it that way, instead you have to wrap the entire path in quotes, like so: "C:\Program Files\MyApp\MyApp.exe". (@iarna)
  • 2e01d29 #11444 Create a single function for detecting if we're running on Windows (and using a Windows shell like cmd) and use this instead of doing it one-off all over the place. (@iarna)
  • ef0dd74 #11444 The fruits of many weeks of labor, fix our tests to pass on Windows. (@zkat) (@iarna)
  • 8fccda8 #11444 [email protected]: Fix file URLs on Windows. (@zkat)
  • f53a154 [email protected]: When readable-stream is disabled, reuse result of require('stream') instead of calling it every time. (@calvinmetcalf)
  • 02841cf #11444 [email protected]: Resolve local package paths relative to package root, not cwd. (@zkat) (@iarna)
  • 247c1c5 #11444 [email protected]: Fix Windows file URIs with leading slashes. (@zkat)
  • 365c72b [email protected] (@isaacs)
  • e568caa [email protected] (@isaacs)
  • 304b974 #11444 [email protected] (@feross)

New in npm 3.8.9 Pre (Apr 29, 2016)

  • 60da618 #12347 Fix a bug that could result in shrinkwraps missing the resolved field, which is necessary in producing a fully reproducible build. (@sminnee)
  • 8597ba4 #12009 Fix a bug in npm view versions that resulted in bad output if you didn't also pass in --json. (@watilde)
  • 20125f1 a53feac 6cfbae4 #12485 Refactor how the help summaries for commands are produced, such that we only have one list of command aliases. (@watilde)

New in npm 3.8.8 Pre (Apr 22, 2016)

  • BAD JSON IS BAD:
  • 769e620 #12406 Failing to parse the top level package.json should be an error. (@watilde)
  • DOCUMENTATION:
  • 7d64301 #12415 Clarify that when configuring client-side certificates for authenticating to non-npm registries that cert and key are not filesystem paths and should actually include the certificate and key data. (@rvedotrc)
  • f8539b8 #12324 Describe how npm run sets NODE and PATH in more detail. Note that npm run changes PATH to include the current node interpreter’s directory. (@addaleax)
  • 2b57606 #11461 Clarify the documentation for the package.json homepage field. (@stevemao)
  • TESTS:
  • b5a0fbb #12329 Fix progress config testing to ignore local user configs. Previously, any local setting would cause the tests to fail as they were trying to test what the default values for the progress bar would be in different environments and any explicit setting overrides those defaults. (@iarna)
  • 3d195bc The lifecycle-signal test could crash on v0.8 due to its use of Number.parseInt, which isn't available in that version of node. Fortunately global.parseInt is, so we just use that instead. (@iarna)
  • DEPENDENCY UPDATES:
  • 05a28e3 [email protected]: Under some circumstances file:// URLs on Windows were not handled correctly.
  • Also, stop converting local module/tarballs into full paths in this module. We do already do that in realize-package-specifier, which is more appropriate as it knows what package we're installing relative to. (@zkat)
  • ada2e93 [email protected]: Require the new npm-package-arg, plus fix a case where specifiers that were maybe a tag, maybe a local filename were resolved differently than those that were definitely a local filename. (@zkat) (@iarna)
  • adc515b [email protected]: A fix for AIX where a non-empty directory can cause fs.rmDir to fail with EEXIST instead of ENOTEMPTY and three new tests (@richardlau)
  • Code cleanup, CI & dependency updates. (@othiym23)
  • ef53a46 [email protected] (@isaacs)
  • df1f2e4 [email protected]: Fix crashes when response headers indicate gzipped content but the body is empty. Add support for the deflate content encoding. (@simov)
  • 776c599 [email protected]: Adds READABLE_STREAM env var that, if set to disable, will make readable-stream use the local native node streams instead. (@calvinmetcalf)
  • 10d6d55 [email protected]: Add support git+file:// type URLs. (@zkat)
  • 75017ae [email protected] (@jdalton)

New in npm 3.8.7 Pre (Apr 8, 2016)

  • IMPROVED DIAGNOSTICS:
  • 38cf79f #12083 If you ignore-scripts to disable lifecycles, this makes npm report when it skips running a script. (@bfred-it)
  • IMPROVE AUTO-INCLUDES:
  • c615182 #11995 There were bugs where modules whose names matched the special files that npm always includes would be included, for example, the history package was always included.
  • With npm@3 such extraneously bundled modules would not be ordinarily used, as things in node_modules in packages are ignored entirely if the package isn't marked as bundling modules.
  • Because of this npm@3 behavior, the files-and-ignores test failed to catch this as it was testing install output not what got packed. That has also been fixed. (@glenjamin)
  • DOCUMENTATION UPDATES:
  • 823d9df #12107 In the command summary for adduser mention that login is an alias. (@gnerkus)
  • 7aaf47e #12244 Update the README to suggest npm@3 for Windows users. Also add a reference to Microsoft's npm upgrade tool. (@felixrieseberg)
  • DEPENDENCY UPDATES:
  • 486bbc0 [email protected] (@simov)
  • b1aff34 [email protected] (@jdalton)

New in npm 3.8.6 Pre (Apr 1, 2016)

  • FIXES:
  • f8fb4d8 #12079 Back in [email protected] we included a patch that made it so npm install pkg was basically npm install pkg@latest instead of pkg@* This is probably what most users expected, but it also ended up breaking npm deprecate when no version was provided for a package. In that case, we were using * to mean "deprecate all versions" and relying on the pkg -> pkg@* conversion. This patch fixes npm deprecate pkg to work as it used to by special casing that particular command's behavior. (@polm)
  • 458f773 #12146 Adds make doc-clean to prepublish script, to clear out previously built docs before publishing a new npm version (@watilde)
  • f0d1521 #12146 Adds doc-clean phony target to make publish. (@watilde)
  • DOC UPDATES:
  • ea92ffc #12147 Document that the current behavior of engines is just to warn if the node platform is incompatible. (@reconbot)
  • cd1ba44 #12143 Remove npm faq command, since the FAQ was removed. (@watilde)
  • 50a12cb #12143 Remove references to the FAQ from the docs, since it was removed. (@watilde)
  • 60051c2 #12093 Update bugs url in package.json to use the https URL for Github. (@watilde)
  • af30c37 #12075 Add the --ignore-scripts flag to the npm install docs. (@paulirish)
  • 632b214 #12063 Various minor fixes to the html docs homepage. (@watilde)
  • DEP BUMPS:
  • 3da0171 [email protected] (@jdalton)
  • 69ccf6d [email protected] (@jdalton)
  • b50c41a [email protected] (@jdalton)
  • 59c1ad7 [email protected] (@jdalton)
  • 2b4f797 [email protected] (@jdalton)

New in npm 3.8.5 Pre (Mar 25, 2016)

  • 0d4a0b1 #11442 Fail if the user asks us to make a link from a module back on to itself. (@antialias)
  • b271ed2 #11983 Exit early if no arguments were provided to search instead of trying to display all the modules, running out of memory, and then crashing. (@SimenB)
  • b8c7cd7 #12000 Stop depending on async-some as it's no longer used in npm. (@watilde)
  • fdd6b28 #11884 Include node_modules in the list of files and directories that npm won't include in packages ordinarily. (Modules listed in bundledDependencies and things that those modules rely on, ARE included of course.) (@Jameskmonger)
  • aac15eb #12006 Fix typo in npm-orgs documentation, where teams docs went to access docs and vice versa. (@yaelz)
  • 3e41360 #11987 Fix test that was inappropriately hitting the network (@yodeyer)

New in npm 3.8.3 Pre (Mar 18, 2016)

  • PERFORMANCE IMPROVEMENTS:
  • The updated are-we-there-yet changes how it tracks how complete things are to be much more efficient. The summary is that are-we-there-yet was refactored to remove an expensive tree walk.
  • The result for you should be faster installs when working with very large trees.
  • Previously are-we-there-yet computed this when you asked by passing the request down its tree of progress indicators, totaling up the results. In doing so, it had to walk the entire tree of progress indicators.
  • By contrast, are-we-there-yet now updates a running total when a change is made, bubbling that up the tree from whatever branch made progress. This bubbling was already going on so there was nearly no cost associated with taking advantage of it.
  • 32f2bd0 [email protected]: Bring in substantial performance improvements from are-we-there-yet. (@iarna)
  • DUCT TAPE FOR BUGS:
  • 473d324 #11947 Guard against bugs that could cause the installer to crash with errors like:
  • TypeError: Cannot read property 'target' of null
  • This doesn't fix the bugs, but it does at least make the installer less likely to explode. (@thefourtheye)
  • DOC FIXES:
  • ffa428a #11880 Fix typo in npm install documentation. (@watilde)
  • DEPENDENCY UPDATES:
  • 7537fe1 [email protected]: Create objects with {} instead of Object.create(null) to make the results strictly equal to what, say, parsed JSON would provide. (@domenic)
  • 8defb0f [email protected]: Fix sync write issue on 0.10. (@calvinmetcalf)
  • TEST FIXES FOR THE SELF TESTS:
  • c3edeab #11912 Change the self installation test to do its work in /tmp. Previously this was installing into a temp subdir in test/tap, which wouldn't catch the case where a module was installed in the local node_modules folder but not in dependencies, as node would look up the tree and use the copy from the version of npm being tested. (@iarna)

New in npm 3.8.2 Pre (Mar 11, 2016)

  • 634ecba [email protected]: Fix bug in builds for Android. (@bnoordhuis)
  • 460ed21 #10529 If you ran npm logout with a scope, while we did invalidate your auth token, we weren't removing the auth token from your config file. This patch causes the auth token to be removed. (@wyze)
  • d1d0233 #11003 Update help to only show command names and their shortcuts. Previously some typo corrections were shown, along with various alternate spellings. (@watilde)
  • 47928cd #11003 Remove "verison" typo from the help listing. (@doug-wade)
  • cf5fd40 #11472 Make npm config list include the per-project .npmrc in the output. (@mjomble)
  • 611070f #11495 Made npm ls --parseable honor the --depth=# option. (@zacdoe)
  • ff90382 #11781 Make the progress bars honor the unicode option. (@watilde)
  • 24ab70a #11808 Make npm view produce valid JSON when requested with --json. Previously npm view produced some sort of weird hybrid output, with multiple JSON docs. (@doug-wade)
  • 6fb0499 #11726 Previously we patched the npm update docs to suggest using --depth Infinity instead of --depth 9999, but that was a mistake. We forgot that npm outdated (on which npm update is built) has a special case where it treats Infinity as 0. This reverts that patch. (@GriffinSchneider)
  • f0bf684 #11748 Document all of the various aliases for commands in the documentation for those commands. (@watilde)
  • fe04443 #10968 The npm-scope document notes that scopes have been available on the public registry for a while. This adds that you'll need npm@2 or later to use them. (@doug-wade)
  • 3db37a5 #11820 The command npm link should be linking package from local folder to global, and npm link package-name should be from global to local. The description in the documentation was reversed and this fixes that. (@rhgb)
  • be55882 [email protected]: Fix a race condition and some windows edge cases. (@isaacs)

New in npm 3.8.1 Pre (Mar 4, 2016)

  • BETTER INSTALL SUMMARIES:
  • e40d457 #11699 Ensure that flags like --production passed to install don't result in the summary at the end being incorrectly filtered. That summary is produced by the same code as npm ls and therefore responds to flags the same way it does. This is undesirable when it's an install summary, however, as we don't want it to filter anything.
  • This fixes an issue where npm install --production would result in npm exiting with an error code. The --production flag would make npm ls filter out as it wasn't saved to the package.json and thus wans't a production dependency. The install report is limited to show just the modules installed, so with that filtered out nothing is available. With nothing available npm ls would set npm to exit with an error code. (@ixalon)
  • 99337b4 #11600 Make the report of installed modules really only show those modules that were installed. Previously it selected which modules from your tree to display based on name@version which worked great when your tree was deduped but would list things it hadn't touched when there were duplicates. (@iarna)
  • SCRIPTS BETTER FOLLOW THE LEADER:
  • 5454347 #10868 When running a lifecycle script, say through npm start, killing npm wouldn't forward that on to the children. It does now. (@daniel-pedersen)
  • SEARCHING SPECIFIC REGISTRIES:
  • 6020447 #11490 Add docs for using the --registry flag with search. (@plumlee)

New in npm 3.8.0 Pre (Feb 26, 2016)

  • LIMIT CONCURRENT REQUESTS:
  • 910f9ac f7be667 Add a new config option, maxsockets and [email protected] to take advantage of it. (@misterbyrne)
  • DOCUMENTATION IMPROVEMENTS:
  • b63de3c #11636 Document --save-bundle option in main install page. (@datyayu)
  • 3d26453 #11644 Add directories.test to the package.json documentation. (@lewiscowper)
  • b64d124 #11441 Add a link in documentation to the contribution guidelines. (@watilde)
  • 82fc548 #11441 Remove mentions of the long defunct Google group. (@watilde)
  • c6ad091 #11474 Correct invalid JSON in npm-update docs. (@robludwig)
  • 4906c90 Expand on the documentation for bundlededDependencies, explaining what they are and when you might want to use them. (@gnerkus)
  • DEPENDENCY UPDATES:
  • 93cdc25 [email protected]: Non-user visible tests & maintainer doc updates. (@jbnicolai)
  • 3b2ccef [email protected] (@jdalton)
  • 30e9eb9 [email protected] (@jdalton)

New in npm 3.7.5 Pre (Feb 23, 2016)

  • Fixed issues:
  • #11633 When updating the top level npm to glob@7, the subdeps that still depended on glob@6 got new versions installed but they weren't added to the commit. This adds them back in.

New in npm 3.7.4 Pre (Feb 21, 2016)

  • Fixed issues:
  • 53cdb96 #11362 Make npm update stop trying to update linked packages. (@rhendric)
  • 8d90d25 #11559 Only list runtime dependencies when doing npm ls --production. (@yibn2008)
  • b78b301 #11416 Logout docs were using a section copy-pasted from the adduser docs. (@wyze)
  • 649e28f #11414 Add colon for consistency. (@wyze)
  • f3c32bc #11528 [email protected]: Update to a more recent version that uses a version of npmlog compatible with npm itself. Also adds: AIX support, new gyp, --cafile command line option, and allows configuration of Node.js and io.js mirrors. (@rvagg)
  • 07f020a #11292 [email protected]: Add a package that provides a tool to generate fixtures from folders and, relatedly, a module that an create and tear down filesystem fixtures easily. (@iarna)
  • 0837346 #11292 Remove all the relatively cryptic legacy tests and creates new tap tests that check the same functionality. The legacy tests were tests that were originally a shell script that was ported to javascript early in npm's history. (@iarna) (@zkat)
  • 5a701e7 #11292 Test that we don't leak auth info into the environment. (@zkat)
  • 502d7d0 #11292 Test that env vars properly passed into scripts. (@zkat)
  • 420f267 #11292 Test that npm's distribution binary is complete and can be installed and used. (@iarna)
  • b7e99be #11292 Test that the package.json files section and .npmignore do what they're supposed to. (@zkat)
  • DEPENDENCY UPDATES:
  • 4611098 [email protected]: Use [email protected]. (@isaacs)
  • 41b2772 [email protected]: Raise error if options.cwd is specified, and not a directory. (@isaacs)
  • c14e74a [email protected]: Update to newer lodash versions, for a smaller tree. (@iarna)
  • d629363 [email protected] (@jdalton)
  • 3ea4c80 [email protected] (@jdalton)
  • 8ddcc8d [email protected] (@jdalton)
  • 2b656a6 [email protected] (@jdalton)
  • ac171f8 [email protected] (@jdalton)
  • bcccd90 [email protected] (@jdalton)
  • 8165bca [email protected] (@jdalton)

New in npm 3.7.3 Pre (Feb 12, 2016)

New in npm 3.7.1 Pre (Feb 2, 2016)

  • Fixed issue:
  • #11349 Revert last weeks change to use JSON clone instead of lodash.cloneDeep.

New in npm 3.7.0 Pre (Jan 29, 2016)

  • PERFORMANCE:
  • c680fa9 [email protected]: New are-we-there-yet with performance patches from @STRML. New gauge with timer churn performance patch. (@iarna)
  • 1d1ea7e #11306 Use JSON clone instead of lodash.cloneDeep. (@STRML)
  • NEW FEATURE: GIT SUBMODULE SUPPORT:
  • 39dea9c #1876 Add support for git submodules in git remotes. This is a fairly simple approach, which does not leverage the git caching mechanism to cache submodules. It also doesn't provide a means to disable automatic initialization, e.g. via a setting in the .gitmodules file. (@gagern)
  • ROBUSTNESS:
  • 5dec02a #10347 There is an obscure feature that lets you monkey-patch npm when it starts up. If the module being required with this feature failed, it would previously just make npm error out– this reduces that to a warning. (@evanlucas)
  • BUG FIXES:
  • 9ab8b8d #10820 Fix a bug with npm ls where if you asked for ONLY production dependencies in output it would exclude dependencies that were BOTH production AND development dependencies. (@davidvgalbraith)
  • 6803fed #8982 Fix a bug where, under some circumstances, if you had a path that contained the name of a package being installed somewhere in it, npm would incorrectly refuse to run lifecycle scripts. (@elvanja)
  • 3eae40b #9253 Fix a bug where, when running lifecycle scripts, if the Node.js binary you ran npm with wasn't in your PATH, npm wouldn't use it to run your scripts. (@segrey)
  • 61daa6a #11014 Fix a bug where running rimraf node_modules/ followed by npm rm --save would fail. npm now correctly removes the module from your package.json even though it doesn't exist on disk. (@davidvgalbraith)
  • a605586 #9679 Fix a bug where npm install --save git+https://… would save a https:// url to your package.json which was a problem because npm wouldn't then know that it was a git repo. (@gagern)
  • bbdc700 #10063 Fix a bug where npm would change the order of array properties in the package.json files of dependencies. npm adds a bunch of stuff to package.json files in your node_modules folder for debugging and bookkeeping purposes. As a part of this process it sorts the object to reduce file churn when it does updates. This fixes a bug where the arrays in the object were also getting sorted. This wasn't a problem for properties that npm itself maintains, but is a problem for properties used by other packages. (@substack)
  • DOCS IMPROVEMENTS:
  • 2609a29 #11273 Include an example of viewing package version history in the npm view documentation. (@vedatmahir)
  • 719ea9c #11272 Fix typographical issue in npm update documentation. (@jonathanp)
  • cb9df5a #11215 Do not call SEE LICENSE IN an SPDX expression, as it's not. (@kemitchell)
  • f427934 #11196 Correct the package.json examples in the npm update documentation to actually be valid JSON and not just JavaScript object literals. (@s100)
  • DEPENDENCY UPDATES:
  • a7b2407 [email protected]: New features and interface agnostic refactoring. (@tim-kos)
  • 220fc77 [email protected]: A bunch of small bug fixes and module updates. (@simov)
  • 9e5c84f [email protected]: Update isexe and fix bug in pathExt, in which files without extensions would sometimes be preferred to files with extensions on Windows, even though those without extensions aren't executable. pathExt is a list of extensions that are considered executable (exe, cmd, bat, com on Windows). (@isaacs)
  • 375b9c4 [email protected]: Minor doc formatting fixes. (@isaacs)
  • ef1971e [email protected]: Misc minor code cleanup. No functional changes. (@jdalton)

New in npm 3.6.0 Pre (Jan 22, 2016)

  • NEW FEATURE:
  • ff504d4 #8752 In npm outdated, report symlinked packages as having a wanted & latest version of linked. (@halhenke)
  • f44d8c9 #10775 Add a success message to adduser / login. (@ekmartin)
  • 3109303 #10043 Warn if you try to use npm run x if you don't have a node_modules folder, since whatever you're trying to do probably won't work. (@timkrins)
  • 9ed2849 e9f1ad8 f10d300 8b593d8 #10717 npm version can now take a from-git argument, which instructs npm to read the version from git and update your package.json to what it finds. This is in contrast to its normal use where npm tells git about your new version. (@ekmartin)
  • BETTER NODE PRE-RELEASE SUPPORT:
  • 6952f79 #11212 Engine check warnings are now issued along with any other warnings about your tree, instead of emitting in the middle of your install (and then disappearing behind the giant tree of stuff installed). (@iarna)
  • ee2ebe9 #11212 Suppress engine verification warnings about pre-release versions of Node.js. (@iarna)
  • 135b7e0 #11212 Explicitly warn, in only one place, if you are using a pre-release version of Node.js. (@iarna)
  • BUG FIXES:
  • ea331c8 #10938 When removing a package, sometimes the node_modules/.bin wouldn't be cleaned up entirely. This would result in package folders that contained only a node_modules/.bin directory. In turn, this would result in npm ls and other tools complaining about these broken directories. To fix this, the unbuild step now explicitly deletes the node_modules/.bin folder as its final step. (@chrisirhc)
  • 00720db #11158 On windows, the node-gyp wrapper would fail if your path to node-gyp contained spaces. This fixes that problem by quoting use of that path. (@orangemocha)
  • 69ac933 #11142 Fix a race condition when making directories in the cache, which could lead to ENOENT failures. (@Jimbly)
  • e982858 #9696 When replacing the package.json in the cache you sometimes see EPERM errors on Windows that you wouldn't on Unix-like operating systems. This ignores those errors and allows Windows to continue. Longer term, we'll be adding something to retry these errors, but ultimately fail if there really is an ongoing permissions issue. (@orangemocha)
  • DOC CHANGES:
  • 3666081 #11188 Add brief description to publish documentation of what's included in published tarballs. (@beaugunderson)
  • b463e34 #11150 In npm update docs, advise use of --depth Infinity instead of --depth 9999. (@halhenke)
  • 382e71a #11128 In the package.json docs, make the reference to the "Local Paths" section a link to it as well. (@orangejulius)
  • 5277e7f #11090 Fix the 3.5.4 release date in CHANGELOG.md. (@ashleygwilliams)
  • e6d238a #11130 Eliminate the "using npm programmatically" section from the README. The documentation for this was removed a while ago and is unsupported. (@ljharb)
  • DEPENDENCY UPDATES:
  • b0dde5c [email protected]: Update tests for most recent version of ini. (@dominictarr)
  • c62f414 [email protected]: Eliminated use of util._extend. (@isaacs)
  • 98a6779 [email protected]: Bug fixes, including the non-linear performance that was biting npm a while back. (@jdalton)
  • 0e8c4ce [email protected] (@jdalton)
  • 1fd19f5 [email protected] (@jdalton)
  • b7486c5 [email protected] (@jdalton)
  • 54bb591 [email protected] (@jdalton)
  • 26f7a7a [email protected] (@jdalton)
  • ed38bd3 [email protected] (@jdalton)

New in npm 3.5.4 Pre (Jan 8, 2016)

  • DOCUMENTATION IMPROVEMENTS:
  • 6b0031e #11044 Correct documentation regarding the defaults for the color config option. (@scottaddie)
  • c6ce69e #10990 Drop mentions in documentation of process.installPrefix, as it hasn't been a thing since Node.js 0.6 and we don't support that. (@jeffmcmahan)
  • dee92d1 #11037 Clarify the documentation on the max length of the name property in package.json files. (@scottaddie)
  • 4b9d7bb #10787 Make the formatting in the documentation for npm dist-tag more consistent with other docs. (@cvrebert)
  • 7f77a80 #10787 Add documentation to the npm dist-tag docs that explains in greater detail how latest is different than other tags. Further, improve the documentation with better examples. Add a discussion of common practice for using dist tags to manage alpha's and beta's. (@cvrebert)
  • 6db58dd 2ee6371 #10788 #10789 Improve documentation cross referencing. (@cvrebert)
  • 7ba629a #10790 Document more clearly that npm install foo means npm install foo@latest. (@cvrebert)
  • A FEW MODULE UPDATES:
  • fc2e8d5 [email protected]: Remove deprecated features and fix a bunch of bugs. (@isaacs)
  • 5b820c4 [email protected]: Change the default on windows to be false, as international windows installs often install to non-unicode codepages and there's no way to detect this short of a system call or a call to a command line program. (@iarna)
  • 238fe84 [email protected]: Fixed bugs with uid/gid checks and with quoted windows PATH parts. (@isaacs)
  • 5e510e1 [email protected]: Add ability to disable glob support / pass in options. (@isaacs)
  • 7558215 [email protected]: Minor performance improvements. (@calvinmetcalf)
  • 64e8499 [email protected]: Rewrite to use modern streams even on 0.8 plus a bunch of tests. (@iarna)
  • 74d92a0 [email protected]: Some bug fixes around large inputs. (@timoxley)
  • FIX NPM'S TESTS ON 0.8:
  • b14cdbb #10872 Rewrite tests using nock to use other alternatives. (@zkat)
  • 59ed01a #10872 Node.js 0.8 http streams have a bug, where if they're paused with data in their buffers when the socket closes, they call end before emptying those buffers, which results in the entire pipeline ending and thus the point that applied backpressure never being able to trigger a resume.

New in npm 3.5.3 Pre (Dec 11, 2015)

  • TWO HAPPY LITTLE BUG FIXES:
  • 71c9590 #10505 npm ls --json --depth=0 now respects the depth parameter, when it is zero and when it is not zero. (@MarkReeder)
  • 954fa67 #9099 I had always thought you could run npm version from subdirectories in your project, which is great, because now you can. I guess I was just ahead of my time. (@ekmartin)
  • NOW PAINT IN SOME NICE DOCS CHANGES:
  • b88c37c #10546 Goodbye, FAQ! You were cheeky and fun until you weren't! Don't worry: npm still loves everyone, especially you! (@ashleygwilliams)
  • 2d3afe9 #10570 Update documentation URLs to be HTTPS everywhere sensible. No HTTP shall be spared! (@rsp)
  • 6abd0e0 #10650 Correctly note that there are two lifecycle scripts run by an install phase in an example, instead of three. (@eymengunay)
  • a5e8df5 #10687 npm outdated's output can be a little puzzling sometimes. I've attempted to make it clearer, with some examples, of what's going on with "wanted" and "latest" in more cases. (@othiym23)
  • 8f52833 #10700 Hey, do you remember when search.npmjs.org was a thing? I think I do? The last time I used it was in like 2012, and it's gone now, so remove it from the docs. (@gagern)
  • b6a53b8 npm/docs#477 Continue to airbrush the CLI API docs out of history. (@verpixelt)
  • b835b72 [email protected]: Include BNF for SemVer expression grammar (which is also now included in npm help semver). (@isaacs)
  • LAND YOUR DEPENDENCY UPGRADES IN PAIRS SO EVERYONE HAS A FRIEND:
  • 95e99fa [email protected] (@simov)
  • b49199a isaacs/rimraf#89 [email protected] (@zerok)
  • 6632418 npm/nopt#51 [email protected] (@wbecker)
  • f0a3b3e isaacs/once#7 [email protected] (@floatdrop)

New in npm 3.5.2 Pre (Dec 4, 2015)

  • Fixed issues:
  • cb6d81b #10685 Fix npm public registry URL in notices. (@kemitchell)
  • f4385d8 #10655 Preserve destination node_modules when moving. (@iarna)
  • 19c626d #10655 Get rid of the remove commit phase– we could have it prune just the module being removed, but that isn't gaining us anything. (@iarna)
  • 641a93b #10655 Don't convert adds to moves with bundled deps. (@iarna)
  • a04ec04 #10655 Wrap rename so errors have stack traces. (@iarna)
  • 8ea142f #10655 Add silly logging so function is debuggable (@iarna)
  • f068b26 #10629 [email protected] (@iarna)
  • dba1b24 #10629 [email protected] (@othiym23)
  • 8347a30 #10629 [email protected] (@othiym23)
  • 9e2a2bb nodejs/node-gyp#831 [email protected]: Improved *BSD support. (@bnoordhuis)

New in npm 3.5.1 Pre (Nov 28, 2015)

  • Fixed issues:
  • 35a5dd5 #10532 Clarify that registry.npmjs.org is the default, but that you're free to use the npm CLI with whatever registry you wish. (@kemitchell)
  • fa6b013 #10532 Having semi-duplicate release information in README.md was confusing and potentially inaccurate, so remove it. (@kemitchell)
  • 09498e4 #10156 completion: enable on Windows in git bash (@jakub-g)
  • 20824a7 #10501 Only warn about replacing bundled dependencies when actually doing so. (@iarna)
  • 1d14d88 [email protected]: Support AIX, use which to find Python, updated to a newer version of gyp, and more! (@bnoordhuis)
  • 4659f1c #10244 In npm@3, npm dedupe doesn't take any arguments, so update documentation to reflect that. (@bengotow)
  • 625a7ee #10250 Correct order of org:team in npm team documentation. (@louislarry)
  • bea7f87 #10371 Remove broken / duplicate link to tag. (@WickyNilliams)
  • 0a25e29 #10419 Remove references to nonexistent npm-rm(1) documentation. (@KenanY)
  • 19b94e1 #10474 Clarify that install finds dependencies in package.json. (@sleekweasel)
  • b25efc8 #9948 Encourage users to file an issue, rather than emailing authors. (@trodrigues)
  • 24f4ced #10497 Clarify what a package is slightly. (@aredridel)
  • e8168d4 #10539 Remove an extra, spuriously capitalized letter. (@alexlukin-softgrad)

New in npm 3.5.0 Pre (Nov 20, 2015)

  • TEEN ORCS AT THE GATES:
  • This week heralds the general release of the primary npm registry's new support for private packages for organizations. For many potential users, it's the missing piece needed to make it easy for you to move your organization's private work onto npm. And now it's here! The functionality to support it has been in place in the CLI for a while now, thanks to @zkat's hard work.
  • During our final testing before the release, our ace support team member @snopeks noticed that there had been some drift between the CLI team's implementation and what npm was actually preparing to ship. In the interests of everyone having a smooth experience with this extremely useful new feature, we quickly made a few changes to square up the CLI and the web site experiences.
  • d7fb92d #9327 npm access no longer has problems when run in a directory that doesn't contain a package.json. (@othiym23)
  • 17df3b5 npm/npm-registry-client#126 [email protected]: Allow the CLI to grant, revoke, and list permissions on unscoped (public) packages on the primary registry. (@othiym23)
  • NON-OPTIONAL INSTALLS, DEFINITELY NON-OPTIONAL:
  • 180263b #10465 When a non-optional dep fails, we check to see if it's only required by ONLY optional dependencies. If it is, we make it fail all the deps in that chain (and roll them back). If it isn't then we give an error.
  • We do this by walking up through all of our ancestors until we either hit an optional dependency or the top of the tree. If we hit the top, we know to give the error.
  • If you installed a module by hand but didn't --save it, your module won't have the top of the tree as an anscestor and so this code was failing to abort the install with an error
  • This updates the logic so that hitting the top OR a module that was requested by the user will trigger the error message. (@iarna)
  • b726a0e #9204 Ideally we would like warnings about your install to come AFTER the output from your compile steps or the giant tree of installed modules.
  • To that end, we've moved warnings about failed optional deps to the show after your install completes. (@iarna)
  • OVERRIDING BUNDLING:
  • aed71fb #10482 We've been in our bundled modules code a lot lately, and our last go at this introduced a new bug, where if you had a module a that bundled a module b, which in turn required c, and the version of c that got bundled wasn't compatible with b's package.json, we would then install a compatible version of c, but also erase b at the same time.
  • This fixes that. It also reworks our bundled module support to be much closer to being in line with how we handle non-bundled modules and we're hopeful this will reduce any future errors around them. The new structure is hopefully much easier to reason about anyway. (@iarna)
  • A BRIEF NOTE ON NPM'S BACKWARDS COMPATIBILITY:
  • We don't often have much to say about the changes we make to our internal testing and tooling, but I'm going to take this opportunity to reiterate that npm tries hard to maintain compatibility with a wide variety of Node versions. As this change shows, we want to ensure that npm works the same across: Node.js 0.8, Node.js 0.10, Node.js 0.12, the latest io.js release, Node.js 4 LTS, Node.js 5
  • Contributors who send us pull requests often notice that it's very rare that our tests pass across all of those versions (ironically, almost entirely due to the packages we use for testing instead of any issues within npm itself). We're currently beginning an effort, lasting the rest of 2015, to clean up our test suite, and not only get it passing on all of the above versions of Node.js, but working solidly on Windows as well. This is a compounding form of technical debt that we're finally paying down, and our hope is that cleaning up the tests will produce a more robust CLI that's a lot easier to write patches for.
  • 791ec6b #10233 Update Node.js versions that Travis uses to test npm. (@iarna)
  • 0.8 + npm

New in npm 3.4.1 Pre (Nov 13, 2015)

  • BUGS:
  • bec4a84 #10338 Failed installs could result in more rollback (removal of just installed packages) than we intended. This bug was first introduced by 83975520. (@iarna)
  • 06c732f #10338 Updating a module could result in the module stealing some of its dependencies from the top level, potentially breaking other modules or resulting in many redundent installations. This bug was first introduced by 971fd47a. (@iarna)
  • 5653366 #9980 npm, when removing a module, would refuse to remove the symlinked binaries if the module itself was symlinked as well. npm goes to some effort to ensure that it doesn't remove things that aren't is, and this code was being too conservative. This code has been rewritten to be easier to follow and to be unit-testable. (@iarna)
  • LICENSE CLARIFICATION:
  • 80acf20 #10326 Update npm's licensing to more completely cover all of the various things that are npm. (@kemitchell)
  • CLOSER TO GREEN TRAVIS:
  • fc12da9 #10232 [email protected] Downgrade nock to a version that doesn't depend on streams2 in core so that more of our tests can pass in 0.8. (@iarna)

New in npm 3.4.0 (Nov 13, 2015)

  • BUG FIXES VIA DEPENDENCY UPDATES:
  • 31c0080 #8640 npm/normalize-package-data#69 [email protected]: Fix a bug where if you didn't specify the name of a scoped module's binary, it would install it such that it was impossible to call it. (@iarna)
  • 02b37bc npm/fstream-npm#14 [email protected]: Only filter config.gypi when it's in the build directory. (@mscdex)
  • accb9d2 npm/fstream-npm#15 [email protected]: Stop including directories that happened to have names matching whitelisted npm files in npm module tarballs. The most common cause was that if you had a README directory then everything in it would be included if wanted it or not. (@taion)
  • DOCUMENTATION FIXES:
  • 7cf6366 #10036 Fix typo / over-abbreviation. (@ifdattic)
  • d0ad8f4 #10176 Fix broken link, scopes => scope. (@ashleygwilliams)
  • d623783 #9460 Specifying the default command run by "npm start" and the fact that you can pass it arguments. (@JuanCaicedo)
  • DEPENDENCY UPDATES FOR THEIR OWN SAKE:
  • 0a4c29e npm/npmlog#19 [email protected]: Make it possible to emit log messages with error as the prefix. (@bengl)
  • 9463ce9 [email protected]: Minor cleanups. (@KenanY)

New in npm 3.3.12 Pre (Nov 3, 2015)

  • aedf7cf #10192 If a bundled module is going to be replacing a module that's currently on disk (for instance, when you upgrade a module that includes bundled dependencies) we want to select the version from the bundle in preference over the one that was there previously.

New in npm 3.3.10 (Oct 30, 2015)

  • UPDATED DEPS NOW MAKE MORE SENSE:
  • 971fd47 #9929 Make the tree more consistent by doing updates in place. This means that trees after a dependency version update will more often look the same as after a fresh install. (@iarna)
  • SHRINKWRAP + DEV DEPS NOW RESPECTED:
  • eb28a8c #9647 If a shrinkwrap already has dev deps, don't throw them away when someone later runs npm install --save. (@iarna)
  • FANTASTIC DOCUMENTATION UPDATES:
  • 291162c #10021 Improve wording in the FAQ to be more empathetic and less jokey. (@TaMe3971)
  • 9a28c54 #10020 Document the command to see the list of config defaults in the section on config defaults. (@lady3bean)
  • 8770b0a #7600 Add shortcuts to all command documentation. (@RichardLitt)
  • e9b7d0d #9950 On errors that can be caused by outdated node & npm, suggest updating as a part of the error message. (@ForbesLindesay)
  • NEW STANDARD HAS ALWAYS BEEN STANDARD:
  • 40c1b0f #9954 Update to standard@5 and reformat the source to work with it. (@cbas)

New in npm 3.3.11 Pre (Oct 30, 2015)

  • f0e2088 #10026 Eliminate some, if not many, of the EONENT errors npm@3 has seen over the past few months. This was happening when npm would, in its own mind, correct a bundled dependency, due to a package.json specifying an incompatible version. Then, when npm extracted the bundled version, what was on disk didn't match its mind and… well, when it tried to act on what was in its mind, we got an ENOENT because it didn't actually exist on disk. (@iarna)
  • 712fd9c #10153 Imagine that you have a module, let's call it fun-time, and it depends on two dependencies, need-fun@1 and need-time. Further, need-time requires need-fun@2.
  • We're ignoring the version check on things specified in the shrinkwrap so that you can override the version that will be installed. This is because you may want to use a different version than is specified by your dependencies' dependencies' package.json files.
  • To fix this, we now only allow overrides of a dependency version when that dependency is a child (in the tree) of the thing that requires it. This means that when we're looking for need-fun@2 we'll see need-fun@1 and reject it because, although it's from a shrinkwrap, it's parent is fun-time and the package doing the requiring is need-time.
  • 3de1463 #9187 If you were using a module with the bin field in your package.json set to a string on a non-npmjs registry then npm would crash, due to the our expectation that the bin field would be an object. We now pass all package.json data through a routine that normalizes the format, including the bin field. (This is the same routine that your package.json is passed through when read off of disk or sent to the registry for publication.) Doing this also ensures that older modules on npm's own registry will be treated exactly the same as new ones. (In the past we weren't always super careful about scrubbing package.json data on publish. And even when we were, those rules have subtly changed over time.) (@iarna)

New in npm 2.14.8 (Oct 23, 2015)

  • c3a7b61 #9804 Remove the readme file with weird casing. (@zkat)
  • f3f619e #9804 Add the readme file back in, with desired casing. (@zkat)
  • bd0b9ab #9827 Add node 4.0 and 4.1 to TravisCI (@JaKXz)

New in npm 3.3.9 Pre (Oct 16, 2015)

  • TRAVIS NODE 0.8 BUILDS REJOICE:
  • 25a234b #9668 Install npm@3's bundled dependencies with npm@2, so that the ancient npm that ships with node 0.8 can install npm@3 directly. (@othiym23)
  • SMALL ERROR MESSAGE IMPROVEMENT:
  • a332f61 #9927 Update error messages where we report a list of versions that you could have installed to show this as a comma separated list instead of as JSON. (@iarna)
  • DEPENDENCY UPDATES:
  • 4cd74b0 [email protected] (@pgte)
  • 9360976 [email protected] (@isaacs)
  • 1ead0a4 [email protected] (@isaacs)
  • 759f88a [email protected] (@iarna)

New in npm 3.3.8 Pre (Oct 13, 2015)

  • Revert "lifecycle: Swap out custom logic with add-to-path module" (@iarna)

New in npm 3.3.7 Pre (Oct 10, 2015)

  • OPTIONAL DEPS, MORE OPTIONAL:
  • 2289234 #9643 #9664 npm@3 was triggering npm@2's build mechanics when it was linking bin files into the tree. This was originally intended to trigger rebuilds of bundled modules, but npm@3's flat module structure confused it. This caused two seemingly unrelated issues. First, failing optional dependencies could under some circumstances (if they were built during this phase) trigger a full build failure. And second, rebuilds were being triggered of already installed modules, again, in some circumstances. Both of these are fixed by disabling the npm@2 mechanics and adding a special rebuild phase for the initial installation of bundled modules. (@iarna)
  • BAD NAME, NO CRASH:
  • b78fec9 #9766 Refactor all attempts to read the module name or package name to go via a single function, with appropriate guards unusual circumstances where they aren't where we expect them. This ultimately will ensure we don't see any more recurrences of the localeCompare error and related crashers. (@iarna)
  • MISCELLANEOUS BUG FIXES:
  • 22a3af0 #9553 Factor the lifecycle code to manage paths out into its own module and use that. (@kentcdodds)
  • 6a29fe3 #9677 Start testing our stuff in node 4 on travis (@fscherwi)
  • 508c6a4 #9669 Make recalculateMetadata more resilient to unexpectedly bogus dependency specifiers. (@tmct)
  • 3c44763 #9643 Update install --only to ignore the NODE_ENV var and just use the only value, if specified. (@watilde)
  • 87336c3 #9879 npm@3's shrinkwrap was refusing to shrinkwrap if an optional dependency was missing– patch it to allow this. (@mantoni)
  • DOCUMENTATION UPDATES:
  • 82659fd #9208 Correct the npm style guide around quote usage (@aaroncrows)
  • a69c83a #9645 Fix spelling error in README (@dkoleary88)
  • f2cf054 #9714 Fix typos in our documentation (@reggi)
  • 7224bef #9759 Fix typo in npm-team docs (@zkat)
  • 7e6e007 #9820 Correct documentation as to binding.gyp (@KenanY)

New in npm 3.3.3 Pre (Sep 11, 2015)

New in npm 3.3.2 Pre (Sep 5, 2015)

  • DEPENDENCY UPDATE:
  • bb5de34 [email protected]: Upgrade to a new, modernized version of json-pointer. (@mafintosh)

New in npm 3.3.1 Pre (Aug 28, 2015)

  • f130a00 #9095 npm update once again works! Previously, after selecting packages to update, it would then pick the wrong location to run the install from. (@iarna)
  • d088b7d #9227 Add some additional logging at the verbose and silly levels when running lifecycle scripts. Hopefully this will make debugging issues with them a bit easier! (@saper)
  • f4a5784 #9308 Make fetching metadata for local modules faster! This ALSO means that doing things like running npm repo won't build your module and maybe run prepublish. (@iarna)
  • 4468c92 #9205 Fix a bug where local modules would sometimes not resolve relative links using the correct base path. (@iarna)
  • d395a6b #8995 Certain combinations of packages could result in different install orders for their initial installation than for reinstalls run on the same folder. (@iarna)
  • d119ea6 #9113 Make extraneous packages always up in npm ls. Previously, if an extraneous package had a dependency that depended back on the original package this would result in the package not showing up in ls. (@iarna)
  • 02420dc #9113 Stop warning about missing top level package.json files. Errors in said files will still be reported. (@iarna)
  • 1ed1364 [email protected] (@isaacs) Added EPERM to delay/retry loop.
  • e7b8315 [email protected] Smaller distribution package, better metadata. (@isaacs)
  • b273bcc [email protected]
  • df6e225 [email protected]
  • 785f2ad [email protected]
  • 88170dd [email protected]
  • af5357b [email protected]
  • 337f96a [email protected]
  • 3dfd74d [email protected]

New in npm 2.14.0 (Aug 21, 2015)

  • 6424170 Added new npm team command and subcommands. (@zkat)
  • 52220d1 Added documentation for new npm team command. (@zkat)
  • 4e66830 Updated npm access to support teams and organizations. (@zkat)
  • ea3eb87 Gussied up docs for npm access with new commands. (@zkat)
  • 6e0b431 Fix up npm whoami to make the underlying API usable elsewhere. (@zkat)
  • f29c931 [email protected]: Upgrade npm-registry-client API to support team and access calls against the registry. (@zkat)
  • c977e12 [email protected]: Checks for some npm@3 metadata. (@iarna)
  • 5c8c9e5 [email protected]: Updated some dependencies. (@timoxley)
  • 5d56742 [email protected]: Tests, docs, and minor style nits. (@isaacs)
  • 846fcc7 #9200 Remove single quotes around semver range, thus making it valid semver. (@KenanY)

New in npm 3.3.0 Pre (Aug 15, 2015)

  • 3ab1eea #9024 Add support for --only, --also and deprecate --dev (@bengl)
  • b31812e #8996 When removing a module that has bin files, if one that we're going to remove is a symlink to a DIFFERENT module, leave it alone. This only happens when you have two modules that try to provide the same bin. (@iarna)
  • d2178a9 #9223 Close a bunch of infinite loops that could show up with symlink cycles in your dependencies. (@iarna)
  • 139dd92 #8716 npm init will now only pick up the modules you install, not everything else that got flattened with them. (@iarna)

New in npm 3.2.2 Pre (Aug 10, 2015)

  • BUG FIXES:
  • a8c8a13 #9050 Resolve peer deps relative to the parent of the requirer (@iarna)
  • 05f0226 #9077 Fix crash when saving git+ssh urls (@iarna)
  • e4a3808 #8951 Extend our patch to allow * to match something when a package only has prerelease versions to everything and not just the cache. (@iarna)
  • d135abf #8871 Don't warn about a missing package.json or missing fields in the global install directory. (@iarna)
  • DEP VERSION BUMPS:
  • 990ee4f [email protected] (@domenic)
  • 1f71ec0 [email protected] (@jdalton)
  • a091354 [email protected] (@chjj)
  • fc51f28 [email protected] (@isaacs)
  • 3569ec0 [email protected] (@pgte)
  • ad5f6fd [email protected] (@isaacs)

New in npm 2.13.1 (Jul 17, 2015)

  • 40981f2 #8862 Make the lifecycle's safety check work with scoped packages. (@tcort)
  • 5125856 #8855 Make dependency versions of "*" match "latest" when all versions are prerelease. (@iarna)
  • 22fdc1d Visually emphasize the correct way to write lifecycle scripts. (@josh-egan)
  • 413c3ac Use npm's 2.x branch for testing its 2.x branch. (@iarna)
  • 7602f64 Don't prompt for GnuPG passphrase in version lifecycle tests. (@othiym23)
  • d338668 #8796 [email protected]: When packing the package tarball, npm no longer crashes for packages with certain combinations of .npmignore entries, .gitignore entries, and lifecycle scripts. (@iarna)
  • dbe7c9c [email protected]: Add matching based on query strings. (@othiym23)
  • 06b6ca5 undeduplicate ansi-regex (@othiym23)
  • b168e33 undeduplicate strip-ansi (@othiym23)

New in npm 3.1.2 Pre (Jul 14, 2015)

  • Fix crash when installing local modules introduced by the fix for #8608

New in npm 3.1.1 Pre (Jul 10, 2015)

  • 9badfd6 #8608 Make global installs and uninstalls MUCH faster by only reading the directories of modules referred to by arguments. (@iarna
  • 075a5f0 #8660 Failed optional deps would still result in the optional deps own dependencies being installed. We now find them and fail them out of the tree. (@iarna
  • c9fbbb5 #8863 The "no compatible version found" error message was including only the version requested, not the name of the package we wanted. Ooops! (@iarna
  • 32e6bbd #8806 The "uninstall" lifecycle was being run after all of a module's dependencies has been removed. This reverses that order-- this means "uninstall" lifecycles can make use of the package's dependencies. (@iarna

New in npm 2.13.0 (Jul 10, 2015)

  • f1f7a85 Add ping command to CLI (@michaelnisi)
  • 8cec629 Add ping command to npm-registry-client (@michaelnisi)
  • 0c0c92d Fixed ping command issues (added docs, tests, fixed minor bugs, etc) (@zkat)
  • 582f170 #8620 version: Allow scripts to add files to the commit. (@jamestalmage)
  • 022691a [email protected]: Updated so we can monkey patch globally. (@isaacs)
  • c9fb0fd Globally monkey-patch graceful-fs. This should fix some errors when installing packages with lots of dependencies. (@isaacs)
  • 5587d0d Nice clarification for directories.bin (@ujane)
  • 20673c7 Hey, Windows folks! Check out nvm-windows (@ArtskydJ)
  • 5afa2d5 [email protected]: Documented package name rules in README (@zeusdeux)
  • 021f4d9 [email protected]: #74 Use async function for bin (to better handle Window's EBUSY) (@isaacs)
  • 5223432 [email protected]: Use os.homedir() polyfill for more reliable output. io.js added the function and the polyfill does a better job than the prior solution. (@sindresorhus)
  • 8ebbc90 [email protected]: Make sure different git references get different cache folders. This should prevent foo/bar#v1.0 and foo/bar#master from sharing the same cache folder. (@tomekwi)
  • 367b854 [email protected]: Minor test/typo changes (@isaacs)
  • 9fcae61 [email protected]: Tiny doc change + stop firing 'match' events for ignored items. (@isaacs)
  • 7827249 PeerDependencies errors now include the package version. (@NickHeiner)

New in npm 3.1.0 Pre (Jul 6, 2015)

  • 0030ade #8685 Windows would hang when trying to clone git repos (@euprogramador)
  • b259bcc #8786 Windows permissions checks would cause installations to fail under some circumstances. We're disabling the checks entirely for this release. I'm hoping to check back with this next week to get a Windows friendly fix in. (@iarna)
  • 0848698 #8686 Stop leaving progress bar cruft on the screen during publication (@ajcrites)
  • 57c3cea #8695 Remote packages with shrinkwraps made npm cause node + iojs to explode and catch fire. NO MORE. (@iarna)
  • 2875ba3 #8723 I uh, told you that engineStrict checking had gone away last week. TURNS OUT I LIED. So this is making that actually be true. (@iarna)
  • 28064e5 #3358 Consistently allow Unicode BOMs at the start of package.json files. Previously this was allowed some of time, like when you were installing modules, but not others, like running npm version or installing w/ --save. (@iarna)
  • 3cb6ad2 #8736 npm@3 wasn't running the "install" lifecycle in your current (toplevel) module. This broke modules that relied on C compilation. BOO. (@iarna)
  • 68da583 #8766 To my great shame, npm link package wasn't working AT ALL if you didn't have package already installed. (@iarna)
  • edd7448 [email protected] This update makes read-package-tree not explode when there's bad data in your node_modules folder. npm@2 silently ignores this sort of thing. (@iarna)
  • 0bb08c8 #8778 RELATEDLY, we now show any errors from your node_modules folder after your installation completes as warnings. We're also reporting these in npm ls now. (@iarna)
  • 6c248ff #8779 Hey, you know how we used to complain if your package.json was missing stuff? Well guess what, we are again. I know, I know, you can thank me later. (@iarna)
  • d6f7c98 So, when we were rolling back after errors we had untested code that tried to undo moves. Being untested it turns out it was very broken. I've removed it until we have time to do this right. (@iarna)

New in npm 2.12.1 Pre (Jun 26, 2015)

  • 7e5da23 When using the new, "fixed" cache directory creator, be extra-careful to not call process.getuid() on platforms that lack it. (@othiym23)
  • 94ca4a7 #8031 Even though git+ssh://[email protected]:org/repo.git isn't a URL, treat it like one for the purposes of npm. (@zkat)
  • e7f56e5 #8031 [email protected]: Handle git URLs (and URL-like remote refs) in a manner consistent with npm's docs. (@zkat)
  • 679bf47 #40 [email protected]: Handle prerelease versions in top-level dependencies not in package.json without marking those packages as invalid. (@benjamn)
  • 3a67410 [email protected] (@isaacs)
  • 151904a [email protected] (@isaacs)

New in npm 2.12.0 Pre (Jun 19, 2015)

  • 85d1a53 Set permissions on lock directory to the owner of the process. (@othiym23)
  • 4827fc7 #8557 [email protected]: Allow UNLICENSED and SEE LICENSE IN in "license" field of package.json. (@kemitchell)
  • 16a3dd5 #8557 Document the new accepted values for the "license" field. (@kemitchell)
  • 8155311 #8557 [email protected]: Support new "license" field values at init time. (@kemitchell)
  • 9d8cac9 #8548 Remove extraneous newline from npm view output, making it easier to use in shell scripts. (@eush77)
  • 765fd4b #8521 When checking for outdated packages, or updating packages, raise an error when the registry is unreachable instead of silently "succeeding". (@ryantemple)
  • 5018335 #8365 Add details about which git environment variables are whitelisted by npm. (@nmalaguti)
  • bed9edd #8554 Fix typo in version docs. (@rainyday)
  • 7ce2f06 [email protected]: Refactor tunneling logic, and use extend instead of abusing util._extend. (@simov)
  • e6c6195 [email protected]: Refined interception behavior. (@pgte)
  • 9583cc3 [email protected]: Ensure that main entry in package.json is always included in the bundled package tarball. (@coderhaoxin)
  • df89493 [email protected] (@isaacs)
  • 9744049 [email protected]: dezalgo should be usable in the browser, and can be now that asap has been upgraded to be browserifiable. (@mvayngrib)

New in npm 2.11.3 Pre (Jun 12, 2015)

  • 5b3b3c2 #8491 Updates a test to use only 0.8 compatible features (@watilde)
  • 9f439da [email protected]: License range updates (@kemitchell)[https://github.com/kemitchell]
  • 2dd055b [email protected]: Fixes a crashing bug when the package.json scripts property is not an object. (@iarna)[https://github.com/iarna]
  • e02e85d [email protected]: Switches to using the os-tmpdir module instead of os.tmpdir() for greate consistency in behavior between node versions. (@iarna)[https://github.com/iarna]
  • a6f0265 [email protected] (@isaacs)[https://github.com/isaacs]
  • 7395977 [email protected] (@isaacs)[https://github.com/isaacs]

New in npm 2.11.2 Pre (Jun 5, 2015)

  • QUALITY OF LIFE HAS NEVER BEEN BETTER:
  • 31aada4 #8401 npm outdated output is just that much nicer to consume now, due to sorting by name. @watilde
  • 458a919 #8469 Explicitly set cwd for preversion, version, and postversion scripts. This makes the scripts findable relative to the root dir. (@alexkwolfe)
  • 55d6d71 Ensure package name and version are included in display during npm version lifecycle execution. Gets rid of those little undefineds in the console. (@othiym23)
  • WORDS HAVE NEVER BEEN QUITE THIS READABLE:
  • 3901e49 #8462 English apparently requires correspondence between indefinite articles and attached nouns. (@Enet4)
  • 5a744e4 #8421 The effect of npm prune's --production flag and how to use it have been documented a bit better. (@foiseworth)
  • eada625 We've updated our .mailmap and AUTHORS files to make sure credit is given where credit is due. (@othiym23)
  • VERSION NUMBERS HAVE NEVER BEEN BIGGER:
  • c929fd1 [email protected]: Manually installed v1.1.13 (steams3) to make deduping more reliable on npm@

New in npm 2.11.1 Pre (May 29, 2015)

  • cf109a6 #8381 Documented a subtle gotcha with .npmrc, which is that it needs to have its permissions set such that only the owner can read or write the file. (@colakong)
  • 180da67 #8365 Git 2.3 adds support for GIT_SSH_COMMAND, which allows you to pass an explicit git command (with, for example, a specific identity passed in on the command line). (@nmalaguti)
  • b72de41 [email protected]: Use a newer version of gyp, and generally improve support for Visual Studios and Windows (@TooTallNate)
  • 8edbe21 [email protected]: Don't crash when Python's version doesn't parse as valid semver. (@TooTallNate)
  • ba0e0a8 [email protected]: Add coverage to tests. (@isaacs)
  • 7333701 [email protected]: Bug fixes and dependency upgrades. (@simov)

New in npm 2.11.0 Pre (May 22, 2015)

  • FEATURELETS:
  • b07f7c7 #7906 Add new scripts to allow you to run scripts before and after the npm version command has run. This makes it easy to, for instance, require that your test suite passes before bumping the version by just adding "preversion": "npm test" to the scripts section of your package.json. (@watilde)
  • 8a46136 #8185 When we get a "not found" error from the registry, we'll now check to see if the package name you specified is invalid and if so, give you a better error message. (@thefourtheye)
  • BUG FIXES:
  • 9bcf573 #8324 On Windows, when you've configured a custom node-gyp, run it with node itself instead of using the default open action (which is almost never what you want). (@bangbang93)
  • 1da9b04 #7195 #7260 [email protected]: (Re-)allow publication of existing mixed-case packages (part 1). (@smikes)
  • e926783 #7195 #7260 [email protected]: (Re-)allow publication of existing mixed-case packages (part 2). (@smikes)
  • DOCUMENTATION IMPROVEMENTS:
  • f62ee05 #8314 Update the README to warn folks away from using the CLI's internal API. For the love of glob, just use a child process to run the CLI! (@claycarpenter)
  • 1093921 #8279 Update the documentation to note that, yes, you can publish scoped packages to the public registry now! (@mantoni)
  • f87cde5 #8292 Fix typo in an example and grammar in the description in the shrinkwrap documentation. (@vshih)
  • d3526ce Improve the formatting in the shrinkwrap documentation. (@othiym23)
  • 19fe6d2 #8311 Update README.md to use syntax highlighting in its code samples and bits of shell scripts. (@SimenB)
  • DEPENDENCY UPDATES! ALWAYS AND FOREVER:
  • fc52160 #4700 #5044 [email protected]: Make entering an invalid version while running npm init give you an immediate error and prompt you to correct it. (@watilde)
  • 738853e #7763 [email protected]: Fix a bug where errors would not propagate, making error messages unhelpful. (@iarna)
  • 6d74a2d [email protected]: Fix tests on windows (@Bacra) and with more recent hosted-git-info. (@iarna)
  • 50f7178 [email protected]: Correct spelling in its documentation. (@iarna)
  • d7956ca [email protected]: Fix a bug where unusual error conditions could make further use of the module fail. (@isaacs)
  • 44f7d74 [email protected]: Update to the most recent tap to get a whole host of bug fixes and integration with coveralls. (@isaacs)
  • c21e8a8 [email protected] (@othiym23)
  • LICENSE FILES FOR THE LICENSE GOD:
  • Add missing ISC license file to package (@kasicka):
  • aa9908c [email protected]
  • 23a3b1a [email protected]
  • 8e04bba [email protected]
  • 50f7178 [email protected]
  • 6a54917 [email protected]
  • 971f92c [email protected]
  • 67b50b7 [email protected]
  • SPDX LICENSE UPDATES:
  • Switch license to BSD-2-Clause from plain "BSD" (@isaacs):
  • efdb733 [email protected]
  • e926783 [email protected]
  • Switch license to ISC from BSD (@isaacs):
  • c300956 [email protected]
  • 1de1253 [email protected]
  • 0d5698a [email protected]
  • 2e84921 [email protected]
  • 872fac9 [email protected]
  • 01eb7f6 [email protected]
  • 294336f [email protected]
  • ebdf6a1 [email protected]
  • Switch license to ISC from MIT (@isaacs):
  • e5d237f [email protected]
  • 79fef14 [email protected]
  • 22527da [email protected]
  • 882ac87 [email protected]
  • 9d9d015 [email protected]

New in npm 2.10.1 Pre (May 15, 2015)

  • BUG FIXES & DOCUMENTATION TWEAKS:
  • dc77520 When getting back a 404 from a request to a private registry that uses a registry path that extends past the root (http://registry.enterprise.co/path/to/registry), display the name of the nonexistent package, rather than the first element in the registry API path. Sorry, Artifactory users! (@hayes)
  • f70dea9 Make clearer that --registry can be used on a per-publish basis to push a package to a non-default registry. (@mischkl)
  • a3e26f5 Did you know that GitHub shortcuts can have commit-ishes included (org/repo#branch)? They can! (@iarna)
  • 0e2c091 Some errors from readPackage were being swallowed, potentially leading to invalid package trees on disk. (@smikes)
  • DEPENDENCY UPDATES:
  • 0b901ad [email protected]: Removed some cruft from the published package. (@isaacs)
  • d713e0b [email protected]: Made compliant with standard, dropped support for Node 0.6, added (Travis) support for Node 0.12 and io.js. (@isaacs)
  • a2d6578 [email protected]: Updated to use tap@1. (@isaacs)
  • 64cd1a5 fstream@ 1.0.6: Made compliant with standard (done by @othiym23, and then debugged and fixed by @iarna), and license changed to ISC. (@othiym23 / @iarna)
  • b527a7c [email protected]: Callers can pass in their own PATH instead of relying on process.env. (@isaacs)

New in npm 2.10.0 (May 11, 2015)

  • BUG FIXES:
  • 8669f7d #8179 Document how to use SPDX in license stanzas in package.json, including how to migrate from old busted license declaration arrays to fancy new compound-license clauses. (@kemitchell)
  • 98ad98c #8197 [email protected] Ensure that packages bootstrapped with npm init use an SPDX-compliant license expression. (@kemitchell)
  • 2ad3905 #8197 [email protected]: Warn when a package is missing a license declaration, or using a license expression that isn't valid SPDX. (@kemitchell)
  • 127bb73 #8197 [email protected]: Switch from BSD to ISC for license, where the latter is valid SPDX. (@othiym23)
  • e9a933a #8197 [email protected]: Switch from BSD to ISC for license, where the latter is valid SPDX. (@othiym23)
  • 412401f #8197 [email protected]: Switch from BSD to ISC for license, where the latter is valid SPDX. (@othiym23)
  • eb18245 Only warn on normalization errors for top-level dependencies. Transitive dependency validation warnings are logged at info level. (@othiym23)
  • e40e809 [email protected]: TAP: The Next Generation. Fix up many tests to they work properly with the new major version of node-tap. Look at all the colors! (@isaacs)
  • f9314e9 [email protected]: Minor tweaks and bug fixes. (@pgte)
  • 45c2b1a #8187 npm ls wasn't properly recognizing dependencies installed from GitHub repositories as git dependencies, and so wasn't displaying them as such. (@zornme)
  • 1ab57c3 In some cases, npm help was using something that looked like a regular expression where a glob pattern should be used, and vice versa. (@isaacs)

New in npm 2.9.1 Pre (May 1, 2015)

  • WOW! MORE GIT FIXES! YOU LOVE THOSE:
  • 178a6ad #7202 When caching git dependencies, do so by the whole URL, including the branch name, so that if a single application depends on multiple branches from the same repository (in practice, multiple version tags), every install is of the correct version, instead of reusing whichever branch the caching process happened to check out first. (@iarna)
  • 63b79cc #8084 Ensure that Bitbucket, GitHub, and Gitlab dependencies are installed the same way as non-hosted git dependencies, fixing npm install --link. (@laiso)
  • DOCUMENTATION FIXES AND TWEAKS:
  • ca478dc #8137 Somehow, we had failed to clearly document the full restrictions on package names. @linclark has now fixed that, although we will take with us to our graves the reasons why the maximum package name length is 214 characters (well, OK, it was that that was the longest name in the registry when we decided to put a cap on the name length). (@linclark)
  • b574076 #8079 Make the npm shrinkwrap documentation use code formatting for examples consistently. It would be great to do this for more commands HINT HINT. (@RichardLitt)
  • 1ff636e #8105 Document that the global npmrc goes in $PREFIX/etc/npmrc, instead of $PREFIX/npmrc. (@anttti)
  • c3f2f7c #8127 Document how to use npm run build directly (hint: it's different from npm build!). (@mikemaccana)
  • 873e467 #8069 Take the old, dead npm mailing list address out of package.json. It seems that people don't have much trouble figuring out how to report errors to npm. (@robertkowalski)
  • ENROBUSTIFICATIONMENT:
  • 5abfc9c #7973 npm run-script completion will only suggest run scripts, instead of including dependencies. If for some reason you still wanted it to suggest dependencies, let us know. (@mantoni)
  • 4b564f0 #8081 Use osenv to parse the environment's PATH in a platform-neutral way. (@watilde)
  • a4b6238 #8094 When we refactored the configuration code to split out checking for IPv4 local addresses, we inadvertently completely broke it by failing to return the values. In addition, just the call to os.getInterfaces() could throw on systems where querying the network configuration requires elevated privileges (e.g. Amazon Lambda). Add the return, and trap errors so they don't cause npm to explode. Thanks to @mhart for bringing this to our attention! (@othiym23)
  • DEPENDENCY UPDATES WAIT FOR NO SOPHONT:
  • 000cd8b [email protected]: More informative assertions on argument validation failure. (@isaacs)
  • 530a2e3 [email protected]: Revert to old key access-time behavior, as it was correct all along. (@isaacs)
  • d88958c [email protected]: Feature detection and test improvements. (@isaacs)
  • 3fa39e4 [email protected] (@pgte)

New in npm 2.9.0 (May 1, 2015)

  • NANOFEATURES:
  • 2799322 #7426 Include local modules in npm outdated and npm update. (@ArnaudRinquin)
  • 2114862 #8014 The prefix used before the version on version tags is now configurable via tag-version-prefix. Be careful with this one and read the docs before using it. (@kkragenbrink)
  • OTHER MINOR TWEAKS:
  • 18ce0ec #3032 npm unpublish will now use the registry set in package.json, just like npm publish. This only applies, for now, when unpublishing the entire package, as unpublishing a single version requires the name be included on the command line and therefore doesn't read from package.json. (@watilde)
  • 9ad2100 #8008 Once again, when considering what to install on npm install, include devDependencies. (@smikes)
  • 5466260 #8003 Clarify the documentation around scopes to make it easier to understand how they support private packages. (@smikes)
  • DEPENDENCIES WILL NOT STOP UNTIL YOU ARE VERY SLEEPY:
  • faf65a7 [email protected]: If there are multiple validation errors and warnings, ensure they all get displayed (includes a rad new way of testing init-package-json contributed by @michaelnisi). (@MisumiRize)
  • 7f10f38 [email protected]: 1.0.0 is literally more than 0.1.0 (no change aside from version number). (@substack)
  • 4979af3 #6805 [email protected]: Decode scoped package names sent by the registry so they look nicer. (@mmalecki)

New in npm 2.9.0 Pre (Apr 24, 2015)

  • NANOFEATURES:
  • 2799322 #7426 Include local modules in npm outdated and npm update. (@ArnaudRinquin)
  • 2114862 #8014 The prefix used before the version on version tags is now configurable via tag-version-prefix. Be careful with this one and read the docs before using it. (@kkragenbrink)
  • OTHER MINOR TWEAKS:
  • 18ce0ec #3032 npm unpublish will now use the registry set in package.json, just like npm publish. This only applies, for now, when unpublishing the entire package, as unpublishing a single version requires the name be included on the command line and therefore doesn't read from package.json. (@watilde)
  • 9ad2100 #8008 Once again, when considering what to install on npm install, include devDependencies. (@smikes)
  • 5466260 #8003 Clarify the documentation around scopes to make it easier to understand how they support private packages. (@smikes)
  • DEPENDENCIES WILL NOT STOP UNTIL YOU ARE VERY SLEEPY:
  • faf65a7 [email protected]: If there are multiple validation errors and warnings, ensure they all get displayed (includes a rad new way of testing init-package-json contributed by @michaelnisi). (@MisumiRize)
  • 7f10f38 [email protected]: 1.0.0 is literally more than 0.1.0 (no change aside from version number). (@substack)
  • 4979af3 #6805 [email protected]: Decode scoped package names sent by the registry so they look nicer. (@mmalecki)

New in npm 2.8.4 (Apr 24, 2015)

  • ee2bd77 #7983 [email protected]: Better error reporting in corrupted tar files, and add support for the fromBase flag (rescued from the dustbin of history by @deanmarano). (@othiym23)
  • d8eee6c [email protected]: Add support for a default author, and only add scope to a package name once. (@othiym23)
  • 4fc5d98 [email protected]: Small tweaks to cache value aging and entry counting that are irrelevant to npm. (@isaacs)
  • 1fe5840 #7946 Make npm init text friendlier. (@sandfox)

New in npm 2.8.4 Pre (Apr 17, 2015)

  • Fixed issues:
  • ee2bd77 #7983 [email protected]: Better error reporting in corrupted tar files, and add support for the fromBase flag (rescued from the dustbin of history by @deanmarano). (@othiym23)
  • d8eee6c [email protected]: Add support for a default author, and only add scope to a package name once. (@othiym23)
  • 4fc5d98 [email protected]: Small tweaks to cache value aging and entry counting that are irrelevant to npm. (@isaacs)
  • 1fe5840 #7946 Make npm init text friendlier. (@sandfox)

New in npm 2.8.3 (Apr 17, 2015)

  • Fixed issues:
  • 387f889 #7961 Ensure that hosted git SSH URLs always have a valid protocol when stored in resolved fields in npm-shrinkwrap.json. (@othiym23)
  • 394c2f5 Switch the order in which hosted Git providers are checked to git:, git+https:, then git+ssh: (from git:, git+ssh:, then git+https:) in an effort to go from most to least likely to succeed, to make for less confusing error message. (@othiym23)

New in npm 2.8.3 Pre (Apr 16, 2015)

  • This is the last of a set of releases intended to ensure npm's git support is robust enough that we can stop working on it for a while. These fixes are small, but prevent a common crasher and clear up one of the more confusing error messages coming out of npm when working with repositories hosted on git:
  • 387f889 #7961 Ensure that hosted git SSH URLs always have a valid protocol when stored in resolved fields in npm-shrinkwrap.json. (@othiym23)
  • 394c2f5 Switch the order in which hosted Git providers are checked to git:, git+https:, then git+ssh: (from git:, git+ssh:, then git+https:) in an effort to go from most to least likely to succeed, to make for less confusing error message. (@othiym23)

New in npm 2.8.2 Pre (Apr 15, 2015)

  • npm has been having an issue with CouchDB's web server since the release of io.js and Node.js 0.12.0 that has consumed a huge amount of my time to little visible effect. Sam Mikes picked up the thread from me, and after a lot of effort figured out that ultimately there are probably a couple problems with the new HTTP Agent keep-alive handling in new versions of Node. In addition, npm-registry-client was gratuitously sending a body along with a GET request which was triggering the bugs. Sam removed about 10 bytes from one file in npm-registry-client, and this problem, which has been bugging us for months, completely went away.
  • In conclusion, Sam Mikes is great, and anybody using a private registry hosted on CouchDB should thank him for his hard work. Also, thanks to the community at large for pitching in on this bug, which has been around for months now.
  • 431c3bf #7699 [email protected]: Don't send body with HTTP GET requests when logging in. (@smikes)

New in npm 2.8.1 Pre (Apr 14, 2015)

  • CORRECTION: NPM'S GIT INTEGRATION IS DOING OKAY:
  • 66377c6 #7872 [email protected]: Pass through credentials embedded in SSH and HTTPs git URLs. (@othiym23)
  • 15efe12 #7872 Use the new version of hosted-git-info to pass along credentials embedded in git URLs. Test it. Test it a lot. (@othiym23)
  • SCOPED DEPENDENCIES AND PEER DEPENDENCIES: NOT QUITE REESE'S:
  • b027319 #7920 Scoped packages with peerDependencies were installing the peerDependencies into the wrong directory. (@ewie)
  • 649e31a #7920 Test peerDependency installs involving scoped packages using npm-package-arg instead of simple path tests, for consistency. (@othiym23)
  • MAKING IT EASIER TO WRITE NPM TESTS, VERSION 0.0.1:
  • ed7e249 #7929 Eliminate fixture directories from test/tap, leaving each test self-contained. (@othiym23)
  • 4928d30 #7929 Move fixture files from test/tap/* to test/fixtures. (@othiym23)
  • e925deb #7929 Tweak the run scripts to stop slaughtering the CPU on doc rebuild. (@othiym23)
  • 65bf7cf #7923 Use an alias of scripts and run-scripts in npm run test-all (@watilde)
  • 756a3fb #7923 Sync timeout time of npm run-script test-all to be the same as test and tap scripts. (@watilde)
  • 8299b5f Set a timeout for tap tests for npm run-script test-all. (@othiym23)
  • THE EVER-BEATING DRUM OF DEPENDENCY UPDATES:
  • d90d0b9 #7924 Remove child-process-close, as it was included for Node 0.6 compatibility, and npm no longer supports 0.6. (@robertkowalski)
  • 16427c1 [email protected]: More accurate updating of expiry times when maxAge is set. (@isaacs)
  • 03cce83 [email protected]: Mocked network error handling. (@pgte)
  • f93b1f0 [email protected]: Use path-is-absolute polyfill, allowing newer Node.js and io.js versions to use path.isAbsolute(). (@sindresorhus)
  • a70d694 [email protected]: Bug fixes and simplification. (@simov)
  • 2aecc6f [email protected]: Switch to using babel from 6to5. (@timoxley)

New in npm 2.8.0 Pre (Apr 11, 2015)

  • Changes:
  • Instead of converting the GitHub shorthand syntax to a git+ssh:, git:, or git+https: URL and saving that, save the shorthand itself to package.json.
  • If presented with shortcuts, try cloning via the git protocol, SSH, and HTTPS (in that order).
  • No longer prompt for credentials -- it didn't work right with the spinner, and wasn't guaranteed to work anyway. We may experiment with doing this a better way in the future. Users can override this by setting GIT_ASKPASS in their environment if they want to experiment with interactive cloning, but should also set --no-spin on the npm command line (or run npm config set spin=false).
  • EXPERIMENTAL FEATURE: Add support for github:, gist:, bitbucket:, and gitlab: shorthand prefixes. GitHub shortcuts will continue to be normalized to org/repo instead of being saved as github:org/repo, but gitlab:, gist:, and bitbucket: prefixes will be used on the command line and from package.json. BE CAREFUL WITH THIS. package.json files published with the new shorthand syntax can only be read by [email protected] and later, and this feature is mostly meant for playing around with it. If you want to save git dependencies in a form that older versions of npm can read, use --save-exact, which will save the git URL and resolved commit hash of the head of the branch in a manner simiilar to the way that --save-exact pins versions for registry dependencies. This is documented (so check npm help install for details), but we're not going to make a lot of noise about it until it has a chance to bake in a little more
  • 6b0f588 #7867 Use git shorthand and git URLs as presented by user. Support new hosted-git-info shortcut syntax. Save shorthand in package.json. Try cloning via git:, git+ssh:, and git+https:, in that order, when supported by the underlying hosting provider. (@othiym23)
  • 75d4267 #7867 Document new GitHub, GitHub gist, Bitbucket, and GitLab shorthand syntax. (@othiym23)
  • 7d92c75 #7867 When --save-exact is used with git shorthand or URLs, save the fully-resolved URL, with branch name resolved to the exact hash for the commit checked out. (@othiym23)
  • 9220e59 #7867 Ensure that non-prefixed and non-normalized GitHub shortcuts are saved to package.json. (@othiym23)
  • dd398e9 #7867 [email protected]: Ensure that gist: shorthand survives being round-tripped through package.json. (@othiym23)
  • 33d1420 #7867 [email protected]: Add support for auth embedded directly in git URLs. (@othiym23)
  • 23a1d5a #7867 [email protected]: Make it possible to determine in which form a hosted git URL was passed. (@iarna)
  • eaf75ac #7867 [email protected]: Normalize GitHub specifiers so they pass through shortcut syntax and preserve explicit URLs. (@iarna)
  • 95e0535 #7867 [email protected]: Add git URL and shortcut to hosted git spec and use [email protected]. (@iarna)
  • a808926 #7867 [email protected]: Use [email protected] and test shortcut specifier behavior. (@iarna)
  • 6dd1e03 #7867 [email protected]: Allow dependency on [email protected]. (@iarna)
  • 63254bb #7867 [email protected]: Use [email protected]. (@iarna)
  • 254b887 #7867 [email protected]: Use [email protected]. (@iarna)
  • 0b9f8be #7867 [email protected]: Mark compatibility with [email protected] and [email protected]. (@iarna)
  • f40ecaa #7867 Extract a common method to use when cloning git repos for testing. (@othiym23)
  • TEST FIXES FOR NODE 0.8:
  • 26d36e9 #7842 When spawning child processes, map exit code 127 to ENOENT so Node 0.8 handles child process failures the same as later versions. (@SonicHedgehog)
  • 54cd895 #7842 Node 0.8 requires -e with -p when evaluating snippets; fix test. (@SonicHedgehog)
  • SMALL FIX AND DOC TWEAK:
  • 20e9003 [email protected]: Fix regression where relative symbolic links within an extraction root that pointed within an extraction root would get normalized to absolute symbolic links. (@isaacs)
  • 2ef8898 #7879 Better document that npm publish --tag=foo will not set latest to that version. (@linclark)

New in npm 2.7.6 Pre (Apr 3, 2015)

  • b747593 #7630 Don't automatically log all git failures as errors. maybeGithub needs to be able to fail without logging to support its fallback logic. (@othiym23)
  • cd67a0d #7829 When fetching a git remote URL, handle failures gracefully (without assuming standard output exists). (@othiym23)
  • 637c7d1 #7829 When fetching a git remote URL, handle failures gracefully (without assuming standard error exists). (@othiym23)
  • OTHER SIGNIFICANT FIXES:
  • 78005eb #7743 Always quote arguments passed to npm run-script. This allows build systems and the like to safely escape glob patterns passed as arguments to run-scripts with npm run-script -- . This is a tricky change to test, and may be reverted or moved to npm@3 if it turns out it breaks things for users. (@mantoni)
  • da015ee #7074 [email protected]: read-package-json no longer caches package.json files, which trades a very small performance loss for the elimination of a large class of really annoying race conditions. See #7074 for the grisly details. (@othiym23)
  • dd20f57 [email protected]: Only add the @ to scoped package names if it's not already there when reading from the filesystem (@watilde), and support inline validation of package names (@michaelnisi).
  • SMALL FIXES AND DEPENDENCY UPGRADES:
  • 1f380f6 #7820 [email protected]: Use readable-stream instead of built-in stream module to better support Node.js 0.8.x. (@SonicHedgehog)
  • d380188 [email protected]: Don't throw on semver.parse(null), and parse numeric version strings more robustly. (@isaacs)
  • 01d9964 [email protected]: This change may need to be rolled back, or rolled forward, because nock depends on setImmediate, which causes tests to fail when run with Node.js 0.8. (@othiym23)
  • 91f5cb1 #7791 Fix brackets in npmconf so that loaded is set correctly. (@charmander)
  • 1349e27 #7818 Update README.md to point out that the install script now lives on https://www.npmjs.com. (@weisjohn)

New in npm 2.7.5 (Mar 27, 2015)

  • BUG FIXES:
  • 5811468 #7713 Add a test for npm link and npm link . (@watilde)
  • 3cf3b0c #7713 Only use absolute symbolic links when npm linking. (@hokaccha)
  • f35aa93 #7443 Keep relative URLs when hitting search endpoint. (@othiym23)
  • eab6184 #7766 One last tweak to ensure that GitHub shortcuts work with private repositories. (@iarna)
  • 5d7f704 #7656 Don't try to load a deleted CA file, allowing the cafile config to be changed. (@KenanY)
  • a840a13 #7746 Only fix up URL paths when there are paths to fix up. (@othiym23)
  • DEPENDENCY UPDATES:
  • 300834e [email protected]: Normalize symbolic links that point to targets outside the extraction root. (@othiym23)
  • 0dc6875 [email protected]: Package versions can be no more than 256 characters long. (@isaacs)
  • 94df809 [email protected]: Fixes for Node.js 0.12 and io.js. (@simov)
  • 98a13ea [email protected]: Deal with start on Windows more conventionally. (@domenic)
  • c2417c7 [email protected]: Add installGlobally to bypass cleanups. (@iarna)
  • DOCUMENTATION FIXES:
  • f87c728 #7696 Months and minutes were swapped in doc-build.sh (@MeddahJ)
  • 4e216b2 #7752 Update string examples to be properly quoted. (@snuggs)
  • 402f52a #7635 Clarify Windows installation instructions. (@msikma)
  • c910399 small typo fix to CHANGELOG.md (@e-jigsaw)

New in npm 2.7.4 Pre (Mar 20, 2015)

  • BUG FIXES:
  • fe1bc38 #7672 [email protected]: Fix client-side certificate handling by correcting property name. (@atamon)
  • 3ce3cc2 #7635 [email protected]: Raise a more descriptive error when bundledDependencies isn't an array. (@KenanY)
  • 3a12723 #7661 Allow setting --registry on the command line to trump the mapped registry for --scope. (@othiym23)
  • 89ce829 #7630 [email protected]: Part 3 of ensuring that GitHub shorthand is handled consistently. (@othiym23)
  • 63313eb #7630 [email protected]: Part 2 of ensuring that GitHub shorthand is handled consistently. (@othiym23)
  • 3ed41bf #7630 [email protected]: Part 1 of ensuring that GitHub shorthand is handled consistently. (@othiym23)
  • DEPENDENCY UPDATES:
  • 6a498c6 [email protected]: Ensure that npm continues to work with new registry architecture. (@bcoe)
  • bd72c47 [email protected]: Updated to latest version. (@isaacs)
  • 4bfbaa2 [email protected]: Getting up to date with latest version (but not using any of the new features). (@othiym23)
  • A NEW REGRESSION TEST:
  • 3703b0b Add regression test for npm version to ensure message property in config continues to be honored. (@dannyfritz)

New in npm 2.7.3 Pre (Mar 17, 2015)

  • Fixed #7641: Due to 448efd0, running npm shrinkwrap --dev caused production dependencies to no longer be included in npm-shrinkwrap.json.

New in npm 2.7.2 (Mar 13, 2015)

  • NPM GASTROENTEROLOGY:
  • fb0ac26 #7579 Only block removing files and links when we're sure npm isn't responsible for them. This change is hard to summarize, because if things are working correctly you should never see it, but if you want more context, just go read the commit message, which lays it all out. (@othiym23)
  • 051c473 #7552 bundledDependencies are now properly included in the installation context. This is another fantastically hard-to-summarize bug, and once again, I encourage you to read the commit message if you're curious about the details. The snappy takeaway is that this unbreaks many use cases for ember-cli. (@othiym23)
  • LESS DRAMATIC CHANGES:
  • fcd9247 #7597 Awk varies pretty dramatically from platform to platform, so use Perl to generate the AUTHORS list instead. (@KenanY)
  • 721b17a #7598 npm install --save really isn't experimental anymore. (@RichardLitt)
  • DEPENDENCY REFRESH:
  • a91f2c7 #7559 [email protected] Switch node-gyp to use stdio instead of customFds so it stops printing a deprecation warning every time you build a native dependency. (@jeffbski)
  • 0c85db7 [email protected]: Globbing now deals with paths containing valid glob metacharacters better. (@isaacs)
  • d14588e [email protected]: Bug fixes. (@isaacs)
  • aa9952e [email protected]: Bug fixes. (@isaacs)

New in npm 2.7.1 (Mar 13, 2015)

  • GITSANITY:
  • 6823807 #7121 npm install --save for Git dependencies saves the URL passed in, instead of the temporary directory used to clone the remote repo. Fixes using Git dependencies when shrinkwwapping. In the process, rewrote the Git dependency caching code. Again. No more single-letter variable names, and a much clearer workflow. (@othiym23)
  • c8258f3 #7486 When installing Git remotes, the caching code was passing in the function gitEnv instead of the results of invoking it. (@functino)
  • c618eed #2556 Make it possible to install Git dependencies when using --link by not linking just the Git dependencies. (@smikes)
  • WHY DID THIS TAKE SO LONG:
  • abdd040 [email protected]: Provide more helpful error messages when JSON parse errors are encountered by using a more forgiving JSON parser than JSON.parse. (@smikes)
  • BUGS & TWEAKS:
  • c56cfcd #7525 npm dedupe handles scoped packages. (@KidkArolis)
  • 1b8ba74 #7531 npm stars and npm whoami will no longer send the registry the error text saying you need to log in as your username. (@othiym23)
  • 6de1e91 #6441 Prevent needless reinstalls by only updating packages when the current version isn't the same as the version returned as wanted by npm outdated. (@othiym23)
  • 2abc3ee Add npm upgrade as an alias for npm update. (@othiym23)
  • bcd4722 #7508 FreeBSD uses EAI_FAIL instead of ENOTFOUND. (@othiym23)
  • 21c1ac4 #7507 Update support URL in generic error handler to https: from http:. (@watilde)
  • b6bd99a #7492 On install, the package.json engineStrict deprecation only warns for the current package. (@othiym23)
  • 4ef1412 #7075 If you try to tag a release as a valid semver range, npm publish and npm tag will error early instead of proceeding. (@smikes)
  • ad53d0f Use rimraf in npm build script because Windows doesn't know what rm is. (@othiym23)
  • 8885c4d [email protected]: Better Windows support. (@isaacs)
  • 8885c4d [email protected]: Handle bad symlinks properly. (@isaacs)
  • TYPOS & CLARIFICATIONS:
  • 42c605c Fix typo in CHANGELOG.md (@adrianblynch)
  • c9bd58d Add note about node_modules/.bin being added to the path in npm run-script. (@quarterto)
  • 903bdd1 Matt Ranney confused the world when he renamed node-redis to redis. "The world" includes npm's documentation. (@RichardLitt)
  • dea9bb2 Fix typo in contributor link. (@watilde)
  • 1226ca9 Properly close code block in npm-install.md. (@olizilla)

New in npm 2.7.0 (Mar 7, 2015)

  • A SMALL FEATURE WITH BIG IMPLICATIONS:
  • 145af65 #4887 Replace calls to the node-gyp script bundled with npm by passing the --node-gyp=/path/to/node-gyp option to npm. Swap in pangyp or a version of node-gyp modified to work better with io.js without having to touch npm's code! (@ackalker)
  • @WATILDE'S NPM USABILITY CORNER:
  • 448efd0 #2853 Add support for --dev and --prod to npm ls, so that you can list only the trees of production or development dependencies, as desired. (@watilde)
  • a0a8777 #7463 Split the list printed by npm run-script into lifecycle scripts and scripts directly invoked via npm run-script. (@watilde)
  • a5edc17 #6749 [email protected]: Support for passing scopes to npm init so packages are initialized as part of that scope / organization / team. (@watilde)
  • SMALLER FEATURES AND FIXES:
  • f33e8b8 #7354 Add --if-present flag to allow e.g. CI systems to call (semi-) standard build tasks defined in package.json, but don't raise an error if no such script is defined. (@jussi-kalliokoski)
  • 7bf85cc #4005 #6248 Globally unlink a package when npm rm / npm unlink is called with no arguments. (@isaacs)
  • a2e04bd #7294 Ensure that when depending on git+ URLs, npm doesn't keep tacking additional git+ prefixes onto the front. (@twhid)
  • 0f87f5e #6422 When depending on GitHub private repositories, make sure we construct the Git URLS correctly. (@othiym23)
  • 50f461d #4595 Support finding compressed manpages. It's still up to the system to figure out how to display them, though. (@pshevtsov)
  • 44da664 #7465 When calling git, log the full command, with all arguments, on error. (@thriqon)
  • 9748d5c Add parent to error on ETARGET error. (@davglass)
  • 37038d7 #4663 Remove hackaround for Linux tests, as it's evidently no longer necessary. (@mmalecki)
  • d7b7853 #2612 Add support for path completion on npm install, which narrows completion to only directories containing package.json files. (@deestan)
  • 628fcdb Remove all command completion calls to -/short, because it's been removed from the primary registry for quite some time, and is generally a poor idea on any registry with more than a few hundred packages. (@othiym23)
  • 3f6061d #6659 Instead of removing zsh completion global, make it a local instead. (@othiym23)
  • DOCUMENTATION TWEAKS:
  • 5bc70e6 #7417 Provide concrete examples of how the new npm update defaults work in practice, tied to actual test cases. Everyone interested in using npm update -g now that it's been fixed should read these documents, as should anyone interested in writing documentation for npm. (@smikes)
  • 8ac6f21 #6543 Clarify npm-scripts warnings to de-emphasize dangers of using install scripts. (@zeke)
  • ebe3b37 #6711 Note that git tagging of versions can be disabled via --no-git-tag-verson. (@smikes)
  • 2ef5771 #6711 Document git-tag-version configuration option. (@KenanY)
  • 95e59b2 Document that NODE_ENV=production behaves analogously to --production on npm install. (@stefaneg)
  • 687117a #7463 Document the new script grouping behavior in the man page for npm run-script. (@othiym23)
  • 536b2b6 Rescue one of the the disabled tests and make it work properly. (@smikes)
  • DEPENDENCY UPDATES:
  • 89fc6a4 [email protected]: Test for being run as root, as well as the current user. (@isaacs)
  • 5d0612f [email protected]: Better error message to explain why calling sync glob with a callback results in an error. (@isaacs)
  • 64b07f6 [email protected]: More accurate counts of pending & skipped tests. (@rmg)
  • 8fda451 [email protected]: Make official the fact that node-semver has moved from @isaacs's organization to @npm's. (@isaacs)

New in npm 2.7.0 Pre (Feb 28, 2015)

  • A SMALL FEATURE WITH BIG IMPLICATIONS:
  • 145af65 #4887 Replace calls to the node-gyp script bundled with npm by passing the --node-gyp=/path/to/node-gyp option to npm. Swap in pangyp or a version of node-gyp modified to work better with io.js without having to touch npm's code! (@ackalker)
  • @WATILDE'S NPM USABILITY CORNER:
  • 448efd0 #2853 Add support for --dev and --prod to npm ls, so that you can list only the trees of production or development dependencies, as desired. (@watilde)
  • a0a8777 #7463 Split the list printed by npm run-script into lifecycle scripts and scripts directly invoked via npm run-script. (@watilde)
  • a5edc17 #6749 [email protected]: Support for passing scopes to npm init so packages are initialized as part of that scope / organization / team. (@watilde)
  • SMALLER FEATURES AND FIXES:
  • f33e8b8 #7354 Add --if-present flag to allow e.g. CI systems to call (semi-) standard build tasks defined in package.json, but don't raise an error if no such script is defined. (@jussi-kalliokoski)
  • 7bf85cc #4005 #6248 Globally unlink a package when npm rm / npm unlink is called with no arguments. (@isaacs)
  • a2e04bd #7294 Ensure that when depending on git+ URLs, npm doesn't keep tacking additional git+ prefixes onto the front. (@twhid)
  • 0f87f5e #6422 When depending on GitHub private repositories, make sure we construct the Git URLS correctly. (@othiym23)
  • 50f461d #4595 Support finding compressed manpages. It's still up to the system to figure out how to display them, though. (@pshevtsov)
  • 44da664 #7465 When calling git, log the full command, with all arguments, on error. (@thriqon)
  • 9748d5c Add parent to error on ETARGET error. (@davglass)
  • 37038d7 #4663 Remove hackaround for Linux tests, as it's evidently no longer necessary. (@mmalecki)
  • d7b7853 #2612 Add support for path completion on npm install, which narrows completion to only directories containing package.json files. (@deestan)
  • 628fcdb Remove all command completion calls to -/short, because it's been removed from the primary registry for quite some time, and is generally a poor idea on any registry with more than a few hundred packages. (@othiym23)
  • 3f6061d #6659 Instead of removing zsh completion global, make it a local instead. (@othiym23)
  • DOCUMENTATION TWEAKS:
  • 5bc70e6 #7417 Provide concrete examples of how the new npm update defaults work in practice, tied to actual test cases. Everyone interested in using npm update -g now that it's been fixed should read these documents, as should anyone interested in writing documentation for npm. (@smikes)
  • 8ac6f21 #6543 Clarify npm-scripts warnings to de-emphasize dangers of using install scripts. (@zeke)
  • ebe3b37 #6711 Note that git tagging of versions can be disabled via --no-git-tag-verson. (@smikes)
  • 2ef5771 #6711 Document git-tag-version configuration option. (@KenanY)
  • 95e59b2 Document that NODE_ENV=production behaves analogously to --production on npm install. (@stefaneg)
  • 687117a #7463 Document the new script grouping behavior in the man page for npm run-script. (@othiym23)
  • 536b2b6 Rescue one of the the disabled tests and make it work properly. (@smikes)
  • DEPENDENCY UPDATES:
  • 89fc6a4 [email protected]: Test for being run as root, as well as the current user. (@isaacs)
  • 5d0612f [email protected]: Better error message to explain why calling sync glob with a callback results in an error. (@isaacs)
  • 64b07f6 [email protected]: More accurate counts of pending & skipped tests. (@rmg)
  • 8fda451 [email protected]: Make official the fact that node-semver has moved from @isaacs's organization to @npm's. (@isaacs)

New in npm 2.6.1 (Feb 28, 2015)

  • 8b98f0e #4471 npm outdated (and only npm outdated) now defaults to --depth=0. See the docs for --depth for the mildly confusing details. (@smikes)
  • aa79194 #6565 Tweak peerDependency deprecation warning to include which peer dependency on which package is going to need to change. (@othiym23)
  • 5fa067f #7171 Tweak engineStrict deprecation warning to include which package.json is using it. (@othiym23)
  • 0fe0caa [email protected]: Glob patterns can now ignore matches. (@isaacs)

New in npm 2.6.0 Pre (Feb 13, 2015)

  • A LONG-AWAITED GUEST:
  • 38c4825 #5068 Add new logout command, and make it do something useful on both bearer-based and basic-based authed clients. (@othiym23)
  • 4bf0f5d [email protected]: Support new logout endpoint to invalidate token for sessions. (@othiym23)
  • DEPRECATIONS:
  • c8e08e6 #6565 Warn that peerDependency behavior is changing and add a note to the docs. (@othiym23)
  • 7c81a5f #7171 Warn that engineStrict in package.json will be going away in the next major version of npm (coming soon!) (@othiym23)
  • BUG FIXES & TWEAKS:
  • add5890 #4668 [email protected]: Warn when a bin symbolic link is a dangling reference. (@nicks)
  • 4b42071 [email protected]: Add functions to extract parts of the version triple, fix a typo. (@isaacs)
  • a9aff38 Use full path for man pages as the symbolic link source, instead of just the file name. (@bengl)
  • 6fd0fbd #7233 Ensure globalconfig path exists before trying to edit it. (@ljharb)
  • a0a2620 [email protected]: Allow embedded, quoted equals signs in ini field names. (@isaacs)

New in npm 2.5.1 Pre (Feb 6, 2015)

  • [email protected]:
  • 0e8d473 #7281 [email protected]: Clean up API, set connection: close. (@robertkowalski)
  • 4707bba Further update tests to work with [email protected]. (@othiym23)
  • 41a0f89 Got rid of completely gratuitous global config manipulation in tests. (@othiym23)
  • MINOR DEPENDENCY TWEAK:
  • a4c7af9 [email protected]: Tweaks to tunneling proxy behavior. (@nylen)

New in npm 2.5.0 Pre (Jan 30, 2015)

  • SMALL FEATURE ALREADY USED TO MAINTAIN NPM ITSELF:
  • 9d61e96 npm outdated --long now includes a column showing the type of dependency. (@watilde)
  • BUG FIXES & TWEAKS:
  • fec4c96 Allow --no-proxy to override HTTP_PROXY setting in environment. (@othiym23)
  • 589acb9 Only set access when publshing when it's explicitly set. (@othiym23)
  • 1027087 Add script and Makefile stanza to update AUTHORS. (@KenanY)
  • eeff04d Add NPMOPTS to top-level install in Makefile to override userconfig. (@aredridel)
  • 0d17328 [email protected]: Run chown only when necessary. (@silkentrance)
  • 9aa4622 [email protected]: ES6ified! (@timoxley)
  • 51b2fd1 Update default version in docs/npm-config.md. (@lucthev)
  • [email protected]:
  • f9313a0 #7226 Ensure that all request settings are copied onto the agent. (@othiym23)
  • e186f6e Only set access on publish when it differs from the norm. (@othiym23)
  • f9313a0 Allow overriding request's environment-based proxy handling. (@othiym23)
  • f9313a0 Properly handle retry failures on fetch. (@othiym23)

New in npm 2.4.1 (Jan 30, 2015)

  • Let's accentuate the positive: the dist-tag endpoints for npm dist-tag {add,rm,ls} are now live on the public npm registry.
  • f70272b [email protected]: Properly escape JSON tag version strings and filter _etag from CouchDB docs. (@othiym23)

New in npm 2.4.1 Pre (Jan 24, 2015)

  • The dist-tag endpoints for npm dist-tag {add,rm,ls} are now live on the public npm registry:
  • f70272b [email protected]: Properly escape JSON tag version strings and filter _etag from CouchDB docs. (@othiym23)

New in npm 2.3.0 Pre (Jan 16, 2015)

  • REGISTRY 2: OH MY STARS! WHO AM I:
  • e662a60 The new whoami endpoint might not return a value. (@othiym23)
  • c2cccd4 [email protected]: Includes the following fine changes (@othiym23)
  • ba6b73e #92 BREAKING CHANGE: Move /whoami endpoint out of the package namespace (to /-/whoami). (@othiym23)
  • 3b174b7 #93 Registries based on token-based auth can now offer starring. (@bcoe)
  • 4701a29 Fix HTTP[S] connection keep-alive on Node 0.11 / io.js 1.0. (@fengmk2)
  • BETTER REGISTRY METADATA CACHING:
  • 98e1e10 #6791 Add caching based on Last-Modified / If-Modified-Since headers. Includes this [email protected] change (@lxe)
  • 07bc335 #86 Add Last-Modified / If-Modified-Since cache header handling. (@lxe)
  • HOW MUCH IS THAT WINDOWS IN THE DOGGY:
  • 706d49a #7107 getCacheStat passes a stub stat on Windows. (@rmg)
  • 5fce278 #5267 Use %COMSPEC% when set on Windows. (@edmorley)
  • cc2e099 #7083 Ensure Git cache prefix exists before repo clone on Windows. (@othiym23)
  • THRILLING BUG FIXES:
  • c6fb430 #4197 Report umask as a 0-padded octal literal. (@smikes)
  • 209713e #4197 [email protected]: Properly handle umasks (i.e. not decimal numbers). (@smikes)
  • 9eac0a1 Make the example for bin links non-destructive. (@KevinSheedy)
  • 6338bcf [email protected]: " -> ', for some reason. (@isaacs)

New in npm 2.2.0 Pre (Jan 9, 2015)

  • New feature:
  • acf287d #6999 npm run-script env: add a new default script that will print out environment values. (@gcb)
  • The rest (especial thanks to @smikes for all his hard, and ongoing, work on npm):
  • 88c531d #7056 version doesn't need a package.json. (@othiym23)
  • 2656c19 #7095 Link to npm website instead of registry. (@konklone)
  • c76b801 #7067 Obfuscate secrets, including nerfed URLs. (@smikes)
  • 17f66ce #6849 Explain the tag workflow more clearly. (@smikes)
  • e309df6 #7096 Really, npm update -g is almost always a terrible idea. (@smikes)
  • 560c009 #6745 Document npm update --dev. (@smikes)
  • 226a677 #7046 We have never been the Node package manager. (@linclark)
  • 38eef22 [email protected]: Compatibility with npmlog@^1. (@iarna)

New in npm 2.1.18 (Jan 9, 2015)

  • bf8640b #7044 Document .npmignore syntax. (@zeke)

New in npm 2.1.17 (Jan 3, 2015)

  • bdf1c84 #7006 Only chown template and top-level Git cache directories. (@othiym23)
  • 581a72d #7006 Map Git remote inflighting to clone paths rather than Git URLs. (@othiym23)
  • 1c48d08 #7009 [email protected]: Normalize Git URLs while caching. (@othiym23)
  • 5423cf0 #7009 Pack tarballs to their final locations atomically. (@othiym23)
  • 7f6557f #7009 Inflight local directory packing, just to be safe. (@othiym23)
  • 1c491e6 #6991 npm version: fix regression in dirty-checking behavior (@rlidwka)
  • 55ceb2b #1991 modify docs to reflect actual npm restart behavior (@smikes)
  • fb8e31b #6982 when doing registry operations, ensure registry URL always ends with / (@othiym23)
  • 5bcba65 pull whitelisted Git environment variables out into a named constant (@othiym23)
  • be04bbd #7000 No longer install badly-named manpage files, and log an error when trying to uninstall them. (@othiym23)
  • 6b7c5ec #7011 Send auth for tarball fetches for packages in npm-shrinkwrap.json from private registries. (@othiym23)
  • 9b9de06 [email protected]: Better handling of trailing slashes. (@isaacs)
  • 030f3c7 [email protected]: Diffing between version strings. (@isaacs)

New in npm 2.1.16 (Dec 27, 2014)

  • a4e4e33 #6987 [email protected]: fixed a regression where a new / empty package would cause read-installed to throw. (@othiym23 / @pgilad)

New in npm 2.1.17 Pre (Dec 27, 2014)

  • Changes:
  • bdf1c84 #7006 Only chown template and top-level Git cache directories. (@othiym23)
  • 581a72d #7006 Map Git remote inflighting to clone paths rather than Git URLs. (@othiym23)
  • 1c48d08 #7009 [email protected]: Normalize Git URLs while caching. (@othiym23)
  • 5423cf0 #7009 Pack tarballs to their final locations atomically. (@othiym23)
  • 7f6557f #7009 Inflight local directory packing, just to be safe. (@othiym23)
  • 1c491e6 #6991 npm version: fix regression in dirty-checking behavior (@rlidwka)
  • 55ceb2b #1991 modify docs to reflect actual npm restart behavior (@smikes)
  • fb8e31b #6982 when doing registry operations, ensure registry URL always ends with / (@othiym23)
  • 5bcba65 pull whitelisted Git environment variables out into a named constant (@othiym23)
  • be04bbd #7000 No longer install badly-named manpage files, and log an error when trying to uninstall them. (@othiym23)
  • 6b7c5ec #7011 Send auth for tarball fetches for packages in npm-shrinkwrap.json from private registries. (@othiym23)
  • 9b9de06 [email protected]: Better handling of trailing slashes. (@isaacs)
  • 030f3c7 [email protected]: Diffing between version strings. (@isaacs)

New in npm 2.1.14 (Dec 20, 2014)

  • Fixed issue:
  • cf7aeae #6923 Overaggressive link update for new website broke node-gyp. (@othiym23)

New in npm 2.1.15 Pre (Dec 20, 2014)

  • e5a2dee #6951 [email protected]: Use path-is-inside for better Windows normalization. (@othiym23)
  • ac6167c #6955 Call path.normalize in lib/utils/gently-rm.js for better Windows normalization. (@ben-page)
  • c625d71 #6964 Clarify CA configuration docs. (@jeffjo)
  • 58b8cb5 #6950 Fix documentation typos. (@martinvd)
  • 7c1299d #6909 Remove confusing mention of rubygems ~> semver operator. (@mjtko)
  • 7dfdcc6 #6909 [email protected]: Synchronize documentation with PR #6909 (@othiym23)
  • adfddf3 #6925 Correct typo in doc/api/npm-ls.md (@oddurs)
  • f5c534b #6920 Remove recommendation to run as root from README.md. (@robertkowalski)
  • 3ef4459 #6920 [email protected] has gone the way of all things. That means it's gone. (@robertkowalski)

New in npm 2.1.13 Pre (Dec 18, 2014)

  • Fixed issues:
  • cbb890e #6897 npm is a nice package manager that runs server-side JavaScript. (@othiym23)
  • d9043c3 #6893 Remove erroneous docs about preupdate / update / postupdate lifecycle scripts, which have never existed. (@devTristan)
  • c5df4d0 #6884 Update npmjs.org to npmjs.com in docs. (@linclark)
  • cb6ff8d #6879 npm version: Update shrinkwrap post-check. (@othiym23)
  • 2a340bd #6868 Use magic numbers instead of regexps to distinguish tarballs from other things. (@daxxog)
  • f1c8bdb #6861 [email protected]: Distinguish between error properties that are part of the response and error strings that should be returned to the user. (@disrvptor)
  • d3a1b63 #6762 Make npm outdated ignore private packages. (@KenanY)
  • 16d8542 install.sh: Drop support for node < 0.8, remove engines bits. (@isaacs)
  • b9c6046 [email protected]: @terinstock noticed that init.license configuration doesn't stick. Make sure that dashed defaults don't trump dotted parameters. (@othiym23)
  • b6d6acf [email protected]: No longer use graceful-fs for some reason. (@isaacs)
  • d39f673 [email protected]: Incorporate bug fixes. (@nylen)
  • c7ad727 [email protected]: Incorporate bug fixes. (@timoxley)

New in npm 2.1.12 (Dec 18, 2014)

New in npm 2.1.11 Pre (Nov 28, 2014)

  • 4861d28 [email protected]: License update. (@isaacs)
  • 30a2ea8 [email protected]: License update. (@isaacs)
  • 6a4ea05 [email protected]: Propagate error events to downstream streams. (@gfxmonk)
  • a558695 [email protected]: Don't extract broken files, propagate drain event. (@gfxmonk)
  • 989624e #6767 Actually pass parameters when adding git repo to cach under Windows. (@othiym23)
  • 657af73 #6774 When verifying paths on unbuild, resolve both source and target as symlinks. (@hokaccha)
  • fd19c40 #6713 [email protected]: Make it so that npm install foo@1 work when a file named 1 exists. (@iarna)
  • c8ac37a [email protected]: Fix regression in failed fetch retries. (@othiym23)

New in npm 2.1.10 Pre (Nov 26, 2014)

  • 756f3d4 #6735 Log "already built" messages at info, not error. (@smikes)
  • 1b7330d #6729 [email protected]: GitHub won't redirect you through an HTML page to a compressed tarball if you don't tell it you accept JSON responses. (@KenanY)
  • d9c7857 #6506 [email protected]: Use graceful-fs so the whole dependency tree gets read, even in case of EMFILE. (@sakana)
  • 3a085be Grammar fix in docs. (@icylace)
  • 3f8e2ff Did you know that npm has a Code of Conduct? Add a link to it to CONTRIBUTING.md. (@isaacs)
  • 319ccf6 [email protected]: Performance tuning. (@isaacs)
  • 835f046 [email protected]: Bug fixes. (@rvagg)
  • a34c38d [email protected]: Bug fixes. (@nylen)

New in npm 2.1.9 (Nov 26, 2014)

  • eed9f61 #6542 npm owner add / remove now works properly with scoped packages (@othiym23)
  • cd25973 #6548 using sudo won't leave the cache's git directories with bad permissions (@othiym23)
  • 56930ab fixed irregular npm cache ls output (yes, that's a thing) (@othiym23)
  • 740f483 legacy tests no longer poison user's own cache (@othiym23)
  • ce37f14 #6169 add terse output similar to npm publish / unpublish for npm owner add / remove (@KenanY)
  • bf2b8a6 #6680 pass auth credentials to registry when downloading search index (@terinjokes)
  • 00ecb61 #6400 .npmignore is respected for git repos on cache / pack / publish (@othiym23)
  • d1b3a9e #6311 npm ls -l --depth=0 no longer prints phantom duplicate children (@othiym23)
  • 07c5f34 #6690 [email protected]: clarify confusing names in error-handling code (@isaacs)
  • 1ac9be9 #6684 npm init: don't report write if canceled (@smikes)
  • 7bb207d #5754 never remove app directories on failed install (@othiym23)
  • 705ce60 #5754 [email protected]: don't throw when another fs task writes to a directory being vacuumed (@othiym23)
  • 1b650f4 #6255 ensure that order credentials are used from .npmrc doesn't regress (@othiym23)
  • 9bb2c34 #6644 warn rather than info on fetch failure (@othiym23)
  • e34a7b6 #6524 [email protected]: proxy via request more transparently (@othiym23)
  • 40afd6a #6524 push proxy settings into request (@tauren)

New in npm 2.1.6 Pre (Oct 24, 2014)

  • 681b398 #6523 fix default logelevel doc (@KenanY)
  • 80b368f #6528 npm version should work in a git directory without git (@terinjokes)
  • 5f5f9e4 #6483 [email protected]: Properly pick up default values from environment variables. (@othiym23)
  • a114870 perl 5.18.x doesn't like -pi without filenames (@othiym23)
  • de5ba00 [email protected]: Tests and cleanup. (@othiym23)
  • 76933f1 [email protected]: Always include LICENSE[.*], LICENCE[.*], CHANGES[.*], CHANGELOG[.*], and HISTORY[.*]. (@jonathanong)

New in npm 2.1.4 Pre (Oct 10, 2014)

  • 3aeb440 #6442 proxying git needs GIT_SSL_CAINFO (@wmertens)
  • a8da8d6 #6413 write builtin config on any global npm install (@isaacs)
  • 9e4d632 #6343 don't pass run arguments to pre & post scripts (@TheLudd)
  • d831b1f #6399 race condition: inflight installs, prevent peerDependency problems (@othiym23)
  • 82b775d #6384 race condition: inflight caching by URL rather than semver range (@othiym23)
  • 7bee042 [email protected]: callback can take arbitrary number of parameters (@othiym23)
  • 3bff494 #5195 fixed regex color regression for npm search (@chrismeyersfsu)
  • 33ba2d5 #6387 allow npm view global if package is specified (@evanlucas)
  • 99c4cfc #6388 npm-publish → npm-developers(7) (@kennydude)
  • TEST CLEANUP EXTRAVAGANZA:
  • 8d6bfcb tap tests run with no system-wide side effects (@chrismeyersfsu)
  • 7a1472f added npm cache cleanup script (@chrismeyersfsu)
  • 0ce6a37 stripped out dead test code (@othiym23)
  • replace spawn with common.npm (@chrismeyersfsu):
  • 0dcd614 test/tap/cache-shasum-fork.js
  • 97f861c test/tap/false_name.js
  • d01b3de test/tap/git-cache-locking.js
  • 7b63016 test/tap/pack-scoped.js
  • c877553 test/tap/scripts-whitespace-windows.js
  • df98525 test/tap/prepublish.js
  • 99c4cfc test/tap/prune.js

New in npm 2.1.3 Pre (Oct 3, 2014)

  • BREAKING CHANGE FOR THE SQRT(i) PEOPLE ACTUALLY USING npm submodule:
  • 1e64473 rm -rf npm submodule command, which has been broken since the Carter Administration (@isaacs)
  • BREAKING CHANGE IF YOU ARE FOR SOME REASON STILL USING NODE 0.6 AND YOU SHOULD NOT BE DOING THAT CAN YOU NOT:
  • 3e431f9 joyent/node#8492 bye bye customFds, hello stdio (@othiym23)
  • Other changes:
  • ea607a8 #6372 noisily error (without aborting) on multi-{install,build} (@othiym23)
  • 3ee2799 #6372 only make cache creation requests in flight (@othiym23)
  • 1a90ec2 #6372 wait to put Git URLs in flight until normalized (@othiym23)
  • 664795b #6372 log what is and isn't in flight (@othiym23)
  • 00ef580 [email protected]: fix largely theoretical race condition, because we really really hate race conditions (@isaacs)
  • 1cde465 #6363 [email protected]: handle local dependencies better (@iarna)
  • 86f084c [email protected]: dependency realization! in its own module! (@iarna)
  • 553d830 [email protected]: simplified semver, better tests (@iarna)
  • bec9b61 [email protected]: for some reason (@rvagg)
  • ff08ec5 [email protected]: use wrappy for instrumentability (@isaacs)

New in npm 2.1.2 Pre (Oct 3, 2014)

  • a1aa20e #6282 [email protected]: don't prune bundledDependencies (@isaacs)
  • a1f5fe1 move locks back into cache, now path-aware (@othiym23)
  • a432c4b convert lib/utils/tar.js to use atomic streams (@othiym23)
  • b8c3c74 [email protected]: Now works with streams1 fs.WriteStreams. (@isaacs)
  • c7ab76f logging cleanup (@othiym23)
  • 4b2d95d #6329 efficiently validate tmp tarballs safely (@othiym23)

New in npm 2.1.1 Pre (Sep 27, 2014)

  • 563225d #6318 clean up locking; prefix lockfile with "." (@othiym23)
  • c7f30e4 #6318 remove locking code around tarball packing and unpacking (@othiym23)

New in npm 2.1.0 Pre (Sep 26, 2014)

  • New feature
  • 3635601 #5520 Add 'npm view .'. (@evanlucas)
  • Other changes:
  • f24b552 #6294 Lock cache → lock cache target. (@othiym23)
  • ad54450 #6296 Ensure that npm-debug.log file is created when rollbacks are done. (@isaacs)
  • 6810071 docs: Default loglevel "http" → "warn". (@othiym23)
  • 35ac89a Skip installation of installed scoped packages. (@timoxley)
  • e468527 Ensure cleanup executes for scripts-whitespace-windows test. (@timoxley)
  • ef9101b Ensure cleanup executes for packed-scope test. (@timoxley)
  • 69b4d18 [email protected]: Fix a race condition in our race-condition fixer. (@isaacs)
  • 26b17ff #6272 npmconf decides what the default prefix is. (@othiym23)
  • 846faca Fix development dependency is preferred over dependency. (@andersjanmyr)
  • 9d1a9db #3265 Re-apply a71615a. Fixes #3265 again, with a test! (@glasser)
  • 1d41db0 [email protected]: Fixes formatting of synopsis blocks in man docs. (@kapouer)
  • a623da0 #5867 Specify dummy git template dir when cloning to prevent copying hooks. (@boneskull)

New in npm 2.0.2 Pre (Sep 24, 2014)

  • 42c872b #5920 [email protected] (@isaacs)
  • 6784767 #5920 make all write streams atomic (@isaacs)
  • f6fac00 #5920 barf on 0-length cached tarballs (@isaacs)
  • 3b37592 [email protected]: use graceful-fs (@iarna)

New in npm 2.0.0 (Sep 24, 2014)

  • BREAKING CHANGES:
  • 4378a17 [email protected]: prerelease versions no longer show up in ranges; ^0.x.y behaves the way it did in semver@2 rather than semver@3; docs have been reorganized for comprehensibility (@isaacs)
  • c6ddb64 npm now assumes that node is newer than 0.6 (@isaacs)
  • Other changes:
  • ea515c3 #6043 [email protected]: wait until all callbacks have finished before proceeding (@othiym23)
  • 0b0a59d #6043 defer rollbacks until just before the CLI exits (@isaacs)
  • a11c88b #6175 pack scoped packages correctly (@othiym23)
  • e4e48e0 #6121 [email protected]: don't mark linked dev dependencies as extraneous (@isaacs)
  • d673e41 [email protected]: depend on graceful-fs directly (@ForbesLindesay)
  • 9d54d45 [email protected]: make tests more reliable on Travis (@iarna)
  • 673d738 ensure permissions are set correctly in cache when running as root (@isaacs)
  • 6e6a5fb prepare for upgrade to [email protected] (@isaacs)
  • ab8dd87 swap out ronn for [email protected] (@isaacs)
  • 803da54 [email protected]: prepare for [email protected] and include more error information (@isaacs)
  • 4af0e71 make default error display less scary (@isaacs)
  • 4fd9e79 [email protected]: handle errors returned by the registry much, much better (@othiym23)
  • ca791e2 restore a long (always?) missing pass for deduping (@othiym23)
  • ca0ef0e correctly interpret relative paths for local dependencies (@othiym23)
  • 5eb8db2 [email protected]: support git+file:// URLs for local bare repos (@othiym23)
  • 860a185 tweak docs to no longer advocate checking in node_modules (@hunterloftis)
  • 80e9033 add links to nodejs.org downloads to docs (@meetar)

New in npm 2.0.1 Pre (Sep 22, 2014)

  • 42c872b #5920 [email protected] (@isaacs)
  • 6784767 #5920 make all write streams atomic (@isaacs)
  • f6fac00 #5920 barf on 0-length cached tarballs (@isaacs)
  • 3b37592 [email protected]: use graceful-fs (@iarna)

New in npm 2.0.1 Pre (Sep 22, 2014)

  • 74c5ab0 #6201 [email protected]: scope always-auth to registry URI (@othiym23)
  • 774b127 #6201 [email protected]: use scoped always-auth settings (@othiym23)
  • f2d2190 #6201 support saving --always-auth when logging in (@othiym23)
  • 17c941a #6163 use write-file-atomic instead of fs.writeFile() (@fiws)
  • fb5724f #5925 npm init -f: allow npm init to run without prompting (@michaelnisi)
  • b706d63 #3059 disable prepublish when running npm install --production (@jussi-kalliokoski)
  • 119f068 attach the node version used when publishing a package to its registry metadata (@othiym23)
  • 8fe0081 seriously, don't use npm -g update npm (@thomblake)
  • ea5b3d4 [email protected] (@othiym23)

New in npm 2.0.0 Pre (Sep 15, 2014)

  • BREAKING CHANGES:
  • 4378a17 [email protected]: prerelease versions no longer show up in ranges; ^0.x.y behaves the way it did in semver@2 rather than semver@3; docs have been reorganized for comprehensibility (@isaacs)
  • c6ddb64 npm now assumes that node is newer than 0.6 (@isaacs)
  • Other changes:
  • ea515c3 #6043 [email protected]: wait until all callbacks have finished before proceeding (@othiym23)
  • 0b0a59d #6043 defer rollbacks until just before the CLI exits (@isaacs)
  • a11c88b #6175 pack scoped packages correctly (@othiym23)
  • e4e48e0 #6121 [email protected]: don't mark linked dev dependencies as extraneous (@isaacs)
  • d673e41 [email protected]: depend on graceful-fs directly (@ForbesLindesay)
  • 9d54d45 [email protected]: make tests more reliable on Travis (@iarna)
  • 673d738 ensure permissions are set correctly in cache when running as root (@isaacs)
  • 6e6a5fb prepare for upgrade to [email protected] (@isaacs)
  • ab8dd87 swap out ronn for [email protected] (@isaacs)
  • 803da54 [email protected]: prepare for [email protected] and include more error information (@isaacs)
  • 4af0e71 make default error display less scary (@isaacs)
  • 4fd9e79 [email protected]: handle errors returned by the registry much, much better (@othiym23)
  • ca791e2 restore a long (always?) missing pass for deduping (@othiym23)
  • ca0ef0e correctly interpret relative paths for local dependencies (@othiym23)
  • 5eb8db2 [email protected]: support git+file:// URLs for local bare repos (@othiym23)
  • 860a185 tweak docs to no longer advocate checking in node_modules (@hunterloftis)
  • 80e9033 add links to nodejs.org downloads to docs (@meetar)

New in npm 2.0.0 Beta 3 (Sep 5, 2014)

  • fa79413 #6119 fall back to registry installs if package.json is missing in a local directory (@iarna)
  • 16073e2 [email protected]: support file URIs as local specs (@othiym23)
  • 9164acb [email protected]: don't match strings that are already URIs (@othiym23)
  • 4067d6b #5629 support saving of local packages in package.json (@dylang)
  • 1b2ffdf #6097 document scoped packages (@seldo)
  • 0a67d53 #6007 [email protected]: properly set headers on proxy requests (@isaacs)
  • 9bac6b8 [email protected]: disallow semver ranges in tag configuration (@isaacs)
  • d2d4d7c #6082 don't allow tagging with a semver range as the tag name (@isaacs)

New in npm 1.4.26 (Sep 2, 2014)

New in npm 2.0.0 Beta 2 (Sep 2, 2014)

  • ed207e8 [email protected]: Clean up auth logic and improve logging around auth decisions. Also error on trying to change a user document without writing to it. (@othiym23)
  • 66c7423 [email protected]: support -C as an alias for --prefix (@isaacs)
  • 0dc6a07 #6059 run commands in prefix, not cwd (@isaacs)
  • 65d2179 [email protected]: part 3 handle slashes in branch names (@robertkowalski)
  • e8d75d0 #6057 [email protected]: properly handle extraneous dev dependencies of required dependencies (@othiym23)
  • 0602f70 #6064 ls: do not show deps of extraneous deps (@isaacs)

New in npm 2.0.0 Alpha 5 (Aug 8, 2014)

  • This release bumps up to 2.0 because of this breaking change, which could potentially affect how your package's scripts are run:
  • df4b0e7 #5518 BREAKING CHANGE: support passing arguments to run scripts (Benjamin Coe)
  • Other changes:
  • cd422c9 #5748 link binaries for scoped packages (Forrest L Norvell)
  • 4c3c778 #5758 npm link includes scope when linking scoped package (fengmk2)
  • f9f58dd #5707 document generic pre- / post-commands (sudodoki)
  • ac7a480 #5406 npm cache displays usage when called without arguments (Michael Nisi)
  • f4554e9 Test fixes for Windows (Isaac Schlueter)
  • update dependencies (Forrest L Norvell)

New in npm 1.5.0 Alpha 4 (Jul 19, 2014)

  • fall back to _auth config as default auth when using default registry (izs)
  • support for 'init.version' for those who don't want to deal with semver 0.0.x oddities (Rod Vagg)
  • be06213 remove residual support for win log level (Andrew Terris)

New in npm 1.5.0 Alpha 3 (Jul 17, 2014)

  • a3a85dd --save scoped packages correctly (Forrest L Norvell)
  • 18a3385 [email protected] (Forrest L Norvell)
  • 375988b invalid package names are an early error for optional deps (Forrest L Norvell)
  • consistently use node-package-arg instead of arbitrary package spec splitting (Forrest L Norvell)

New in npm 1.4.21 (Jul 15, 2014)

New in npm 1.4.12 (May 24, 2014)

  • remove normalize-package-data from top level, de-^-ify inflight dep (isaacs)
  • Always sort saved bundleDependencies (isaacs)
  • add inflight to bundledDependencies (Forrest L Norvell)

New in npm 1.4.11 (May 24, 2014)

  • fix npm ls labeling issue
  • [email protected]
  • default repository to https:// instead of git://
  • addLocalTarball: Remove extraneous unpack (isaacs)
  • Massive cache folder refactor (Forrest L Norvell and isaacs)
  • Busy Spinner, no http noise (isaacs)
  • Per-project .npmrc file support (isaacs)
  • [email protected], Refactor config/uid/prefix loading process (isaacs)
  • Allow once-disallowed characters in passwords (isaacs)
  • Send npm version as 'version' header (isaacs)
  • fix cygwin encoding issue (Karsten Tinnefeld)
  • Allow non-github repositories with npm repo (Evan Lucas)
  • Allow peer deps to be satisfied by grandparent
  • Stop optional deps moving into deps on update --save (Tim Oxley)
  • Ensure only matching deps update with update --save* (Tim Oxley)
  • Add support for prerelease, preminor, prepatch to npm version

New in npm 1.4.10 (May 6, 2014)

  • Don't set referer if already set
  • fetch: Send referer and npm-session headers
  • run-script: Support --parseable and --json
  • list runnable scripts (Evan Lucas)
  • Use marked instead of ronn for html docs

New in npm 1.4.9 (May 2, 2014)

  • Send referer header (with any potentially private stuff redacted)
  • Fix critical typo bug in previous npm release

New in npm 1.4.8 (May 2, 2014)

  • Check SHA before using files from cache
  • adduser: allow change of the saved password
  • Make npm install respect config.unicode
  • Fix lifecycle to pass Infinity for config env value
  • Don't return 0 exit code on invalid command
  • cache: Handle 404s and other HTTP errors as errors
  • test: simplify common.run() to common.npm()
  • bump tap dep, make tests stderr a bit quieter
  • Resolve ~ in path configs to env.HOME
  • Include npm version in default user-agent conf
  • npm init: Use ISC as default license, use save-prefix for deps
  • Many test and doc fixes

New in npm 1.4.4 (Mar 17, 2014)

  • Add npm t as an alias for npm test (which is itself an alias for npm run test, or even npm run-script test). We like making running your tests easy. (14e650b, @isaacs)

New in npm 1.4.3 (Mar 17, 2014)

  • Add back npm prune --production, which was removed in 1.3.24. (acc4d02, @davglass)
  • Default npm install --save and its counterparts to use the ^ version specifier, instead of ~. (0a3151c, @mikolalysenko)
  • Make npm shrinkwrap output dependencies in a sorted order, so that diffs between shrinkwrap files should be saner now. (059b2bf, @Raynos)
  • Fix npm dedupe not correctly respecting dependency constraints. (86028e9, @rafeca)
  • Fix npm ls giving spurious warnings when you used "latest" as a version specifier. (npm/read-installed@d295640, @bajtos)
  • Fixed a bug where using npm link on packages without a name value could cause npm to delete itself. (401a642, @isaacs)
  • Fixed npm install ./[email protected] to actually install the directory at [email protected]; before it would try to find version 1.2.3 of the package ./pkg in the npm registry. (46d8768, @rlidwka; see also f851b79)
  • Fix npm outdated to respect the color configuration option. (d4f6f3f, @timoxley)
  • Fix npm outdated --parseable. (9575a23, @yhpark)
  • Fix a lockfile-related errors when using certain Git URLs. (164b97e, @nigelzor)

New in npm 1.4.2 (Mar 17, 2014)

  • Fixed an issue related to mid-publish GET requests made against the registry. (npm/npm-registry-client@acbec48, @isaacs)

New in npm 1.4.1 (Mar 17, 2014)

  • Fix npm shrinkwrap forgetting to shrinkwrap dependencies that were also development dependencies. (9c575c5, @diwu1989)
  • Fixed publishing of pre-existing packages with uppercase characters in their name. (npm/npm-registry-client@9345d3b, @isaacs)

New in npm 1.4.0 (Feb 17, 2014)

  • Remove npm publish --force. See npm/npmjs.org#148. (@isaacs, npm/npm-registry-client@2c8dba9)
  • Other changes to the registry client related to saved configs and couch logins. (@isaacs; npm/npm-registry-client@25e2b01, npm/npm-registry-client@9e41e91, npm/npm-registry-client@2c8dba9)
  • Show an error to the user when doing npm update and the package.json specifies a version that does not exist. (@evanlucas, 027a33a)
  • Fix some issues with cache ownership in certain installation configurations. (@outcoldman, a132690)
  • Fix issues where GitHub shorthand dependencies user/repo were not always treated the same as full Git URLs. (@robertkowalski, meryn/normalize-package-data@005d0b6)

New in npm 1.3.24 (Jan 20, 2014)

  • b9b4248 adduser: All defaults are empty strings if unfound (isaacs)
  • 909cccf [email protected] (isaacs)
  • a3891b6 [email protected] (isaacs)
  • 1101b6a Revert "prune: --production option to unbuild devDependencies" (isaacs)
  • ac6efbc [email protected] (isaacs)
  • dd30038 [email protected] (isaacs)
  • 0a03e90 Change the way how tests fail on stderr output. (Denis Gladkikh)
  • c8c3ebe [email protected] (isaacs)
  • 4315286 [email protected] (isaacs)
  • 80282ed npm-run: fix commands with whitespaces on windows (Robert Kowalski)
  • 823010b Support multiple packagenames in npm docs. (Tim Oxley)
  • 93fc364 Fix updating Git URLs with credentials in them (Daniel Santiago)
  • 3a6942d Add --long doc for search output in doc/misc (Tim Oxley)
  • 20439b2 Tidy search output via columnify. (Tim Oxley)
  • f0756e5 Clean up ignore-install-link test. (Domenic Denicola)
  • f126bb2 Fix outdated-json test on Windows. (Domenic Denicola)
  • af9bbd9 Fix #3767 (npm install overwrites npm link) (Evan Lucas)

New in npm 1.3.23 (Jan 8, 2014)

  • Properly handle installations that contained a certain class of circular dependencies. (5dc93e8, @substack)

New in npm 1.3.22 (Jan 8, 2014)

  • Fix a critical bug in npm adduser that would manifest in the error message "Error: default value must be string or number." (fba4bd2, @isaacs)
  • Allow npm bugs in the current directory to open the current package's bugs URL. (d04cf64, @evanlucas)
  • Several fixes to various error messages to include more useful or updated information. (1e6f2a7, ff46366, 8b4bb48; @rlidwka, @evanlucas)

New in npm 1.3.21 (Jan 8, 2014)

  • Fix a critical bug that prevented publishing due to incorrect hash calculation. (npm/npm-registry-client@4ca4a2c, @dominictarr)

New in npm 1.3.20 (Dec 18, 2013)

  • Fixes a critical bug in v1.3.19. Thankfully, due to that bug, no one could install npm v1.3.19.

New in npm 1.3.19 (Dec 17, 2013)

  • This adds atomic PUTs for publishing packages, which should result in far fewer requests and less room for replication errors on the server-side.

New in npm 1.3.18 (Dec 17, 2013)

  • Added an --ignore-scripts option, which will prevent package.json scripts from being run. Most notably, this will work on npm install, so e.g. npm install --ignore-scripts will not run preinstall and prepublish scripts. (d7e67bf, @sqs)
  • Fixed a bug introduced in 1.3.16 that would manifest with certain cache configurations, by causing spurious errors saying "Adding a cache directory to the cache will make the world implode." (966373f, @domenic)
  • Re-fixed the multiple download of URL dependencies, whose fix was reverted in 1.3.17. (a362c3f, @spmason)

New in npm 1.0.13 (Jun 18, 2011)

  • Greatly simplified folder structure
  • Install locally (bundle by default)
  • Drastic rearchitecture