deps: upgrade npm to 7.4.0

PR-URL: https://github.com/nodejs/node/pull/36829 Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Rich Trott <rtrott@gmail.com> Reviewed-By: Myles Borins <myles.borins@gmail.com> Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
2026-10-28 10:15:07 +08:00 · 2021-01-11 12:47:18 +01:00
1 parent 307b79d2be
commit 7809c4ff80
@@ -741,3 +741,8 @@ Daniel Fischer <daniel@d-fischer.dev>
 Yash-Singh1 <saiansh2525@gmail.com>
 Edu93Jer <mailing_93@hotmail.com>
 Tieg Zaharia <tieg@tidelift.com>
+Aki <71239005+AkiaCode@users.noreply.github.com>
+fuhao.xu <fuhao.xu@yitu-inc.com>
+marsonya <16393876+marsonya@users.noreply.github.com>
+Jeff Griffiths <jeff@eko-recordings.ca>
+Michael Garvin <gar+gh@danger.computer>
@@ -1,3 +1,49 @@
+## v7.4.0 (2021-01-07)
+
+### FEATURES
+
+* [`47ed2dfd8`](https://github.com/npm/cli/commit/47ed2dfd865566643bc1d39e8a4f98d2e1add99a)
+  [#2456](https://github.com/npm/cli/issues/2456) add
+  `--foreground-scripts` option ([@isaacs](https://github.com/isaacs))
+
+### BUG FIXES
+
+* [`d01746a5a`](https://github.com/npm/cli/commit/d01746a5a6dde115ee6a600cdf54c9b35afcab3f)
+  [#2444](https://github.com/npm/cli/issues/2444)
+  [#1103](https://github.com/npm/cli/issues/1103) Remove deprecated
+  `process.umask()` ([@isaacs](https://github.com/isaacs))
+* [`b2e2edf8a`](https://github.com/npm/cli/commit/b2e2edf8aee57347c96a61209c7a10139a0cc85a)
+  [#2422](https://github.com/npm/cli/issues/2422) npm publish --dry-run
+  should not check login status ([@buyan302](https://github.com/buyan302))
+* [`99156df80`](https://github.com/npm/cli/commit/99156df8099f55bc69dfa99d7ddcf8d1d569016e)
+  [#2448](https://github.com/npm/cli/issues/2448)
+  [#2425](https://github.com/npm/cli/issues/2425) pass extra arguments
+  directly to run-script as an array ([@nlf](https://github.com/nlf))
+* [`907b34b2e`](https://github.com/npm/cli/commit/907b34b2ecc34ac376d989f824f7492064e43ef4)
+  [#2455](https://github.com/npm/cli/issues/2455) fix(ci): pay attention to
+  --ignore-scripts ([@wraithgar](https://github.com/wraithgar))
+
+### DEPENDENCIES
+
+* [`7a49fd4af`](https://github.com/npm/cli/commit/7a49fd4afc8cd24db40aee008031ea648583d0bc)
+  `tar@6.1.0`, `pacote@11.1.14`
+* [`54a7bd16c`](https://github.com/npm/cli/commit/54a7bd16c130525ade71ec9894af71c2825d8584)
+  `@npmcli/arborist@2.0.3`
+
+### DOCUMENTATION
+
+* [`a390d7456`](https://github.com/npm/cli/commit/a390d74561b72f0b13cba65844ce60c379198087)
+  [#2440](https://github.com/npm/cli/issues/2440) Updated the url for RFC
+  19 so that it isn't a 404.
+  ([@therealjeffg](https://github.com/therealjeffg))
+* [`e02b46ad7`](https://github.com/npm/cli/commit/e02b46ad7acdeb9fbb63f782e546c2f8db94ae6e)
+  [#2436](https://github.com/npm/cli/issues/2436) Grammatical Fix in npm-ls
+  Documentation 'Therefore' is spelled 'Therefor'
+  ([@marsonya](https://github.com/marsonya))
+* [`0fed44dea`](https://github.com/npm/cli/commit/0fed44dea12f125b639b5e3575adcea74a86d3a0)
+  [#2417](https://github.com/npm/cli/issues/2417) Fix npm bug reporting url
+  ([@AkiaCode](https://github.com/AkiaCode))
+
 ## 7.3.0 (2020-12-18)

 ### FEATURES
@@ -150,7 +150,7 @@ you should [read this](https://docs.npmjs.com/misc/developers).
 When you find issues, please report them:

 * web:
-  <https://github.com/npm/npm/issues>
+  <https://github.com/npm/cli/issues>
 * archived web:
  <https://npm.community/c/bugs>

@@ -62,7 +62,7 @@ this gets even more curious, as `peerDependencies` are logically
 physically at or above their location on disk.

 Also, in the years since npm got an `ls` command (in version 0.0.2!),
-dependency graphs have gotten much larger as a general rule.  Therefor, in
+dependency graphs have gotten much larger as a general rule.  Therefore, in
 order to avoid dumping an excessive amount of content to the terminal, `npm
 ls` now only shows the _top_ level dependencies, unless `--all` is
 provided.
@@ -419,6 +419,18 @@ mistakes, unnecessary performance degradation, and malicious input.
 If you don't have a clear idea of what you want to do, it is strongly
 recommended that you do not use this option!

+#### foreground-scripts
+
+* Default: false
+* Type: Boolean
+
+Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)
+scripts for installed packages in the foreground process, sharing standard
+input, output, and error with the main npm process.
+
+Note that this will generally make installs run slower, and be much
+noisier, but can be useful for debugging.
+
 #### format-package-lock

 * Default: true
@@ -159,7 +159,7 @@ tree at all, use <a href="../commands/npm-explain.html"><code>npm explain</code>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm’s source tree will show:</p>
-<pre lang="bash"><code>npm@7.3.0 /path/to/npm
+<pre lang="bash"><code>npm@7.4.0 /path/to/npm
 └─┬ init-package-json@0.0.4
  └── promzard@0.1.5
 </code></pre>
@@ -185,7 +185,7 @@ this gets even more curious, as <code>peerDependencies</code> are logically
 “underneath” their dependents in the dependency graph, but are always
 physically at or above their location on disk.</p>
 <p>Also, in the years since npm got an <code>ls</code> command (in version 0.0.2!),
-dependency graphs have gotten much larger as a general rule.  Therefor, in
+dependency graphs have gotten much larger as a general rule.  Therefore, in
 order to avoid dumping an excessive amount of content to the terminal, <code>npm ls</code> now only shows the <em>top</em> level dependencies, unless <code>--all</code> is
 provided.</p>
 <p>A thorough re-examination of the use cases, intention, behavior, and output
@@ -148,7 +148,7 @@ npm command-line interface
 <pre lang="bash"><code>npm &lt;command&gt; [args]
 </code></pre>
 <h3 id="version">Version</h3>
-<p>7.3.0</p>
+<p>7.4.0</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency
@@ -141,7 +141,7 @@ npm command-line interface

 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><ul><li><a href="#command-line-flags">Command Line Flags</a></li><li><a href="#environment-variables">Environment Variables</a></li><li><a href="#npmrc-files">npmrc Files</a></li><li><a href="#default-configs">Default Configs</a></li></ul><li><a href="#shorthands-and-other-cli-niceties">Shorthands and Other CLI Niceties</a></li><li><a href="#config-settings">Config Settings</a></li><ul><li><a href="#access">access</a></li><li><a href="#all">all</a></li><li><a href="#allow-same-version">allow-same-version</a></li><li><a href="#always-auth">always-auth</a></li><li><a href="#also">also</a></li><li><a href="#audit">audit</a></li><li><a href="#audit-level">audit-level</a></li><li><a href="#auth-type">auth-type</a></li><li><a href="#before">before</a></li><li><a href="#bin-links">bin-links</a></li><li><a href="#browser">browser</a></li><li><a href="#ca">ca</a></li><li><a href="#cafile">cafile</a></li><li><a href="#cache">cache</a></li><li><a href="#cache-lock-stale">cache-lock-stale</a></li><li><a href="#cache-lock-retries">cache-lock-retries</a></li><li><a href="#cache-lock-wait">cache-lock-wait</a></li><li><a href="#cache-max">cache-max</a></li><li><a href="#cache-min">cache-min</a></li><li><a href="#call">call</a></li><li><a href="#cert">cert</a></li><li><a href="#cidr">cidr</a></li><li><a href="#commit-hooks">commit-hooks</a></li><li><a href="#color">color</a></li><li><a href="#depth">depth</a></li><li><a href="#description2">description</a></li><li><a href="#dev">dev</a></li><li><a href="#dry-run">dry-run</a></li><li><a href="#editor">editor</a></li><li><a href="#engine-strict">engine-strict</a></li><li><a href="#force">force</a></li><li><a href="#format-package-lock">format-package-lock</a></li><li><a href="#fund">fund</a></li><li><a href="#fetch-retries">fetch-retries</a></li><li><a href="#fetch-retry-factor">fetch-retry-factor</a></li><li><a href="#fetch-retry-mintimeout">fetch-retry-mintimeout</a></li><li><a href="#fetch-retry-maxtimeout">fetch-retry-maxtimeout</a></li><li><a href="#fetch-timeout">fetch-timeout</a></li><li><a href="#git">git</a></li><li><a href="#git-tag-version">git-tag-version</a></li><li><a href="#global">global</a></li><li><a href="#globalconfig">globalconfig</a></li><li><a href="#global-style">global-style</a></li><li><a href="#heading">heading</a></li><li><a href="#https-proxy">https-proxy</a></li><li><a href="#if-present">if-present</a></li><li><a href="#ignore-prepublish">ignore-prepublish</a></li><li><a href="#ignore-scripts">ignore-scripts</a></li><li><a href="#include">include</a></li><li><a href="#init-module">init-module</a></li><li><a href="#init-author-name">init-author-name</a></li><li><a href="#init-author-email">init-author-email</a></li><li><a href="#init-author-url">init-author-url</a></li><li><a href="#init-license">init-license</a></li><li><a href="#init-version">init-version</a></li><li><a href="#json">json</a></li><li><a href="#key">key</a></li><li><a href="#legacy-bundling">legacy-bundling</a></li><li><a href="#legacy-peer-deps">legacy-peer-deps</a></li><li><a href="#link">link</a></li><li><a href="#local-address">local-address</a></li><li><a href="#loglevel">loglevel</a></li><li><a href="#logs-max">logs-max</a></li><li><a href="#long">long</a></li><li><a href="#maxsockets">maxsockets</a></li><li><a href="#message">message</a></li><li><a href="#node-options">node-options</a></li><li><a href="#node-version">node-version</a></li><li><a href="#noproxy">noproxy</a></li><li><a href="#offline">offline</a></li><li><a href="#only">only</a></li><li><a href="#optional">optional</a></li><li><a href="#otp">otp</a></li><li><a href="#package-lock">package-lock</a></li><li><a href="#package-lock-only">package-lock-only</a></li><li><a href="#parseable">parseable</a></li><li><a href="#prefer-offline">prefer-offline</a></li><li><a href="#prefer-online">prefer-online</a></li><li><a href="#prefix">prefix</a></li><li><a href="#preid">preid</a></li><li><a href="#production">production</a></li><li><a href="#progress">progress</a></li><li><a href="#proxy">proxy</a></li><li><a href="#read-only">read-only</a></li><li><a href="#rebuild-bundle">rebuild-bundle</a></li><li><a href="#registry">registry</a></li><li><a href="#rollback">rollback</a></li><li><a href="#save">save</a></li><li><a href="#save-bundle">save-bundle</a></li><li><a href="#save-prod">save-prod</a></li><li><a href="#save-dev">save-dev</a></li><li><a href="#save-exact">save-exact</a></li><li><a href="#save-optional">save-optional</a></li><li><a href="#save-prefix">save-prefix</a></li><li><a href="#scope">scope</a></li><li><a href="#script-shell">script-shell</a></li><li><a href="#scripts-prepend-node-path">scripts-prepend-node-path</a></li><li><a href="#searchexclude">searchexclude</a></li><li><a href="#searchopts">searchopts</a></li><li><a href="#searchlimit">searchlimit</a></li><li><a href="#searchstaleness">searchstaleness</a></li><li><a href=Line truncated
+<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><ul><li><a href="#command-line-flags">Command Line Flags</a></li><li><a href="#environment-variables">Environment Variables</a></li><li><a href="#npmrc-files">npmrc Files</a></li><li><a href="#default-configs">Default Configs</a></li></ul><li><a href="#shorthands-and-other-cli-niceties">Shorthands and Other CLI Niceties</a></li><li><a href="#config-settings">Config Settings</a></li><ul><li><a href="#access">access</a></li><li><a href="#all">all</a></li><li><a href="#allow-same-version">allow-same-version</a></li><li><a href="#always-auth">always-auth</a></li><li><a href="#also">also</a></li><li><a href="#audit">audit</a></li><li><a href="#audit-level">audit-level</a></li><li><a href="#auth-type">auth-type</a></li><li><a href="#before">before</a></li><li><a href="#bin-links">bin-links</a></li><li><a href="#browser">browser</a></li><li><a href="#ca">ca</a></li><li><a href="#cafile">cafile</a></li><li><a href="#cache">cache</a></li><li><a href="#cache-lock-stale">cache-lock-stale</a></li><li><a href="#cache-lock-retries">cache-lock-retries</a></li><li><a href="#cache-lock-wait">cache-lock-wait</a></li><li><a href="#cache-max">cache-max</a></li><li><a href="#cache-min">cache-min</a></li><li><a href="#call">call</a></li><li><a href="#cert">cert</a></li><li><a href="#cidr">cidr</a></li><li><a href="#commit-hooks">commit-hooks</a></li><li><a href="#color">color</a></li><li><a href="#depth">depth</a></li><li><a href="#description2">description</a></li><li><a href="#dev">dev</a></li><li><a href="#dry-run">dry-run</a></li><li><a href="#editor">editor</a></li><li><a href="#engine-strict">engine-strict</a></li><li><a href="#force">force</a></li><li><a href="#foreground-scripts">foreground-scripts</a></li><li><a href="#format-package-lock">format-package-lock</a></li><li><a href="#fund">fund</a></li><li><a href="#fetch-retries">fetch-retries</a></li><li><a href="#fetch-retry-factor">fetch-retry-factor</a></li><li><a href="#fetch-retry-mintimeout">fetch-retry-mintimeout</a></li><li><a href="#fetch-retry-maxtimeout">fetch-retry-maxtimeout</a></li><li><a href="#fetch-timeout">fetch-timeout</a></li><li><a href="#git">git</a></li><li><a href="#git-tag-version">git-tag-version</a></li><li><a href="#global">global</a></li><li><a href="#globalconfig">globalconfig</a></li><li><a href="#global-style">global-style</a></li><li><a href="#heading">heading</a></li><li><a href="#https-proxy">https-proxy</a></li><li><a href="#if-present">if-present</a></li><li><a href="#ignore-prepublish">ignore-prepublish</a></li><li><a href="#ignore-scripts">ignore-scripts</a></li><li><a href="#include">include</a></li><li><a href="#init-module">init-module</a></li><li><a href="#init-author-name">init-author-name</a></li><li><a href="#init-author-email">init-author-email</a></li><li><a href="#init-author-url">init-author-url</a></li><li><a href="#init-license">init-license</a></li><li><a href="#init-version">init-version</a></li><li><a href="#json">json</a></li><li><a href="#key">key</a></li><li><a href="#legacy-bundling">legacy-bundling</a></li><li><a href="#legacy-peer-deps">legacy-peer-deps</a></li><li><a href="#link">link</a></li><li><a href="#local-address">local-address</a></li><li><a href="#loglevel">loglevel</a></li><li><a href="#logs-max">logs-max</a></li><li><a href="#long">long</a></li><li><a href="#maxsockets">maxsockets</a></li><li><a href="#message">message</a></li><li><a href="#node-options">node-options</a></li><li><a href="#node-version">node-version</a></li><li><a href="#noproxy">noproxy</a></li><li><a href="#offline">offline</a></li><li><a href="#only">only</a></li><li><a href="#optional">optional</a></li><li><a href="#otp">otp</a></li><li><a href="#package-lock">package-lock</a></li><li><a href="#package-lock-only">package-lock-only</a></li><li><a href="#parseable">parseable</a></li><li><a href="#prefer-offline">prefer-offline</a></li><li><a href="#prefer-online">prefer-online</a></li><li><a href="#prefix">prefix</a></li><li><a href="#preid">preid</a></li><li><a href="#production">production</a></li><li><a href="#progress">progress</a></li><li><a href="#proxy">proxy</a></li><li><a href="#read-only">read-only</a></li><li><a href="#rebuild-bundle">rebuild-bundle</a></li><li><a href="#registry">registry</a></li><li><a href="#rollback">rollback</a></li><li><a href="#save">save</a></li><li><a href="#save-bundle">save-bundle</a></li><li><a href="#save-prod">save-prod</a></li><li><a href="#save-dev">save-dev</a></li><li><a href="#save-exact">save-exact</a></li><li><a href="#save-optional">save-optional</a></li><li><a href="#save-prefix">save-prefix</a></li><li><a href="#scope">scope</a></li><li><a href="#script-shell">script-shell</a></li><li><a href="#scripts-prepend-node-path">scripts-prepend-node-path</a></li><li><a href="#searchexclude">searchexclude</a></li><li><a href="#searchopts">searchopts</a></li><li><a href="#searchlimit">searchlimit</a></li><li><aLine truncated
 </section>

 <div id="_content"><h3 id="description">Description</h3>
@@ -488,6 +488,16 @@ range (including SemVer-major changes).</li>
 </ul>
 <p>If you don’t have a clear idea of what you want to do, it is strongly
 recommended that you do not use this option!</p>
+<h4 id="foreground-scripts">foreground-scripts</h4>
+<ul>
+<li>Default: false</li>
+<li>Type: Boolean</li>
+</ul>
+<p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)
+scripts for installed packages in the foreground process, sharing standard
+input, output, and error with the main npm process.</p>
+<p>Note that this will generally make installs run slower, and be much
+noisier, but can be useful for debugging.</p>
 <h4 id="format-package-lock">format-package-lock</h4>
 <ul>
 <li>Default: true</li>
@@ -21,7 +21,7 @@ const ci = async () => {
  }

  const where = npm.prefix
-  const { scriptShell } = npm.flatOptions
+  const { scriptShell, ignoreScripts } = npm.flatOptions
  const arb = new Arborist({ ...npm.flatOptions, path: where })

  await Promise.all([
@@ -39,24 +39,26 @@ const ci = async () => {
  await arb.reify({ ...npm.flatOptions, save: false })

  // run the same set of scripts that `npm install` runs.
-  const scripts = [
-    'preinstall',
-    'install',
-    'postinstall',
-    'prepublish', // XXX should we remove this finally??
-    'preprepare',
-    'prepare',
-    'postprepare',
-  ]
-  for (const event of scripts) {
-    await runScript({
-      path: where,
-      args: [],
-      scriptShell,
-      stdio: 'inherit',
-      stdioString: true,
-      event,
-    })
+  if (!ignoreScripts) {
+    const scripts = [
+      'preinstall',
+      'install',
+      'postinstall',
+      'prepublish', // XXX should we remove this finally??
+      'preprepare',
+      'prepare',
+      'postprepare',
+    ]
+    for (const event of scripts) {
+      await runScript({
+        path: where,
+        args: [],
+        scriptShell,
+        stdio: 'inherit',
+        stdioString: true,
+        event,
+      })
+    }
  }
  await reifyFinish(arb)
 }
@@ -67,7 +67,7 @@ const cmd = (args, cb) => exec(args).then(() => cb()).catch(cb)

 const run = async ({ args, call, pathArr, shell }) => {
  // turn list of args into command string
-  const script = call || args.join(' ').trim() || shell
+  const script = call || args.shift() || shell

  // do the fakey runScript dance
  // still should work if no package.json in cwd
@@ -98,6 +98,7 @@ const run = async ({ args, call, pathArr, shell }) => {
      path: process.cwd(),
      stdioString: true,
      event: 'npx',
+      args,
      env: {
        PATH: pathArr.join(delimiter),
      },
@@ -144,7 +145,7 @@ const exec = async args => {
    if (binExists) {
      return await run({
        args,
-        call: [args[0], ...args.slice(1)].join(' ').trim(),
+        call,
        pathArr,
        shell,
      })
@@ -43,11 +43,13 @@ const publish = async args => {
    })
  }

-  const creds = npm.config.getCredentialsByURI(registry)
-  if (!creds.token && !creds.username) {
-    throw Object.assign(new Error('This command requires you to be logged in.'), {
-      code: 'ENEEDAUTH',
-    })
+  if (!opts.dryRun) {
+    const creds = npm.config.getCredentialsByURI(registry)
+    if (!creds.token && !creds.username) {
+      throw Object.assign(new Error('This command requires you to be logged in.'), {
+        code: 'ENEEDAUTH',
+      })
+    }
  }

  if (semver.validRange(defaultTag))
@@ -24,7 +24,7 @@ const update = async args => {

  if (npm.flatOptions.depth) {
    log.warn('update', 'The --depth option no longer has any effect. See RFC0019.\n' +
-      'https://github.com/npm/rfcs/blob/latest/accepted/0019-remove-update-depth-option.md')
+      'https://github.com/npm/rfcs/blob/latest/implemented/0019-remove-update-depth-option.md')
  }

  const arb = new Arborist({
@@ -83,6 +83,7 @@ const defaults = {
  'fetch-retry-mintimeout': 10000,
  'fetch-timeout': 5 * 60 * 1000,
  force: false,
+  'foreground-script': false,
  'format-package-lock': true,
  fund: true,
  git: 'git',
@@ -170,7 +171,7 @@ const defaults = {
  'tag-version-prefix': 'v',
  timing: false,
  tmp: tmpdir(),
-  umask: process.umask ? process.umask() : 0o22,
+  umask: 0,
  unicode,
  'update-notifier': true,
  usage: false,
@@ -224,6 +225,7 @@ const types = {
  'fetch-retry-mintimeout': Number,
  'fetch-timeout': Number,
  force: Boolean,
+  'foreground-script': Boolean,
  'format-package-lock': Boolean,
  fund: Boolean,
  git: String,
@@ -133,6 +133,7 @@ const flatten = obj => ({
  packageLockOnly: obj['package-lock-only'],
  globalStyle: obj['global-style'],
  legacyBundling: obj['legacy-bundling'],
+  foregroundScripts: !!obj['foreground-scripts'],
  scriptShell: obj['script-shell'] || undefined,
  shell: obj.shell,
  omit: buildOmitList(obj),
@@ -1,4 +1,4 @@
-.TH "NPM\-ACCESS" "1" "December 2020" "" ""
+.TH "NPM\-ACCESS" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-access\fR \- Set access level on published packages
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-ADDUSER" "1" "December 2020" "" ""
+.TH "NPM\-ADDUSER" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-adduser\fR \- Add a registry user account
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-AUDIT" "1" "December 2020" "" ""
+.TH "NPM\-AUDIT" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-audit\fR \- Run a security audit
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-BIN" "1" "December 2020" "" ""
+.TH "NPM\-BIN" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-bin\fR \- Display npm bin folder
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-BUGS" "1" "December 2020" "" ""
+.TH "NPM\-BUGS" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-bugs\fR \- Report bugs for a package in a web browser
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-CACHE" "1" "December 2020" "" ""
+.TH "NPM\-CACHE" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-cache\fR \- Manipulates packages cache
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-CI" "1" "December 2020" "" ""
+.TH "NPM\-CI" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-ci\fR \- Install a project with a clean slate
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-COMPLETION" "1" "December 2020" "" ""
+.TH "NPM\-COMPLETION" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-completion\fR \- Tab Completion for npm
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-CONFIG" "1" "December 2020" "" ""
+.TH "NPM\-CONFIG" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-config\fR \- Manage the npm configuration files
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-DEDUPE" "1" "December 2020" "" ""
+.TH "NPM\-DEDUPE" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-dedupe\fR \- Reduce duplication
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-DEPRECATE" "1" "December 2020" "" ""
+.TH "NPM\-DEPRECATE" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-deprecate\fR \- Deprecate a version of a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-DIST\-TAG" "1" "December 2020" "" ""
+.TH "NPM\-DIST\-TAG" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-dist-tag\fR \- Modify package distribution tags
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-DOCS" "1" "December 2020" "" ""
+.TH "NPM\-DOCS" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-docs\fR \- Open documentation for a package in a web browser
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-DOCTOR" "1" "December 2020" "" ""
+.TH "NPM\-DOCTOR" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-doctor\fR \- Check your npm environment
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-EDIT" "1" "December 2020" "" ""
+.TH "NPM\-EDIT" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-edit\fR \- Edit an installed package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-EXEC" "1" "December 2020" "" ""
+.TH "NPM\-EXEC" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-exec\fR \- Run a command from a local or remote npm package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-EXPLAIN" "1" "December 2020" "" ""
+.TH "NPM\-EXPLAIN" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-explain\fR \- Explain installed packages
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-EXPLORE" "1" "December 2020" "" ""
+.TH "NPM\-EXPLORE" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-explore\fR \- Browse an installed package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-FUND" "1" "December 2020" "" ""
+.TH "NPM\-FUND" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-fund\fR \- Retrieve funding information
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-HELP\-SEARCH" "1" "December 2020" "" ""
+.TH "NPM\-HELP\-SEARCH" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-help-search\fR \- Search npm help documentation
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-HELP" "1" "December 2020" "" ""
+.TH "NPM\-HELP" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-help\fR \- Get help on npm
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-HOOK" "1" "December 2020" "" ""
+.TH "NPM\-HOOK" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-hook\fR \- Manage registry hooks
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-INIT" "1" "December 2020" "" ""
+.TH "NPM\-INIT" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-init\fR \- create a package\.json file
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-INSTALL\-CI\-TEST" "1" "December 2020" "" ""
+.TH "NPM\-INSTALL\-CI\-TEST" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-install-ci-test\fR \- Install a project with a clean slate and run tests
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-INSTALL\-TEST" "1" "December 2020" "" ""
+.TH "NPM\-INSTALL\-TEST" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-install-test\fR \- Install package(s) and run tests
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-INSTALL" "1" "December 2020" "" ""
+.TH "NPM\-INSTALL" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-install\fR \- Install a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-LINK" "1" "December 2020" "" ""
+.TH "NPM\-LINK" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-link\fR \- Symlink a package folder
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-LOGOUT" "1" "December 2020" "" ""
+.TH "NPM\-LOGOUT" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-logout\fR \- Log out of the registry
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-LS" "1" "December 2020" "" ""
+.TH "NPM\-LS" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-ls\fR \- List installed packages
 .SS Synopsis
@@ -26,7 +26,7 @@ example, running \fBnpm ls promzard\fP in npm's source tree will show:
 .P
 .RS 2
 .nf
-npm@7\.3\.0 /path/to/npm
+npm@7\.4\.0 /path/to/npm
 └─┬ init\-package\-json@0\.0\.4
  └── promzard@0\.1\.5
 .fi
@@ -61,7 +61,7 @@ this gets even more curious, as \fBpeerDependencies\fP are logically
 physically at or above their location on disk\.
 .P
 Also, in the years since npm got an \fBls\fP command (in version 0\.0\.2!),
-dependency graphs have gotten much larger as a general rule\.  Therefor, in
+dependency graphs have gotten much larger as a general rule\.  Therefore, in
 order to avoid dumping an excessive amount of content to the terminal, \fBnpm
 ls\fP now only shows the \fItop\fR level dependencies, unless \fB\-\-all\fP is
 provided\.
@@ -1,4 +1,4 @@
-.TH "NPM\-ORG" "1" "December 2020" "" ""
+.TH "NPM\-ORG" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-org\fR \- Manage orgs
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-OUTDATED" "1" "December 2020" "" ""
+.TH "NPM\-OUTDATED" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-outdated\fR \- Check for outdated packages
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-OWNER" "1" "December 2020" "" ""
+.TH "NPM\-OWNER" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-owner\fR \- Manage package owners
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-PACK" "1" "December 2020" "" ""
+.TH "NPM\-PACK" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-pack\fR \- Create a tarball from a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-PING" "1" "December 2020" "" ""
+.TH "NPM\-PING" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-ping\fR \- Ping npm registry
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-PREFIX" "1" "December 2020" "" ""
+.TH "NPM\-PREFIX" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-prefix\fR \- Display prefix
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-PROFILE" "1" "December 2020" "" ""
+.TH "NPM\-PROFILE" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-profile\fR \- Change settings on your registry profile
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-PRUNE" "1" "December 2020" "" ""
+.TH "NPM\-PRUNE" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-prune\fR \- Remove extraneous packages
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-PUBLISH" "1" "December 2020" "" ""
+.TH "NPM\-PUBLISH" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-publish\fR \- Publish a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-REBUILD" "1" "December 2020" "" ""
+.TH "NPM\-REBUILD" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-rebuild\fR \- Rebuild a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-REPO" "1" "December 2020" "" ""
+.TH "NPM\-REPO" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-repo\fR \- Open package repository page in the browser
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-RESTART" "1" "December 2020" "" ""
+.TH "NPM\-RESTART" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-restart\fR \- Restart a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-ROOT" "1" "December 2020" "" ""
+.TH "NPM\-ROOT" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-root\fR \- Display npm root
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-RUN\-SCRIPT" "1" "December 2020" "" ""
+.TH "NPM\-RUN\-SCRIPT" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-run-script\fR \- Run arbitrary package scripts
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-SEARCH" "1" "December 2020" "" ""
+.TH "NPM\-SEARCH" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-search\fR \- Search for packages
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-SET\-SCRIPT" "1" "December 2020" "" ""
+.TH "NPM\-SET\-SCRIPT" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-set-script\fR \- Set tasks in the scripts section of package\.json
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-SHRINKWRAP" "1" "December 2020" "" ""
+.TH "NPM\-SHRINKWRAP" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-shrinkwrap\fR \- Lock down dependency versions for publication
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-STAR" "1" "December 2020" "" ""
+.TH "NPM\-STAR" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-star\fR \- Mark your favorite packages
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-STARS" "1" "December 2020" "" ""
+.TH "NPM\-STARS" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-stars\fR \- View packages marked as favorites
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-START" "1" "December 2020" "" ""
+.TH "NPM\-START" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-start\fR \- Start a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-STOP" "1" "December 2020" "" ""
+.TH "NPM\-STOP" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-stop\fR \- Stop a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-TEAM" "1" "December 2020" "" ""
+.TH "NPM\-TEAM" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-team\fR \- Manage organization teams and team memberships
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-TEST" "1" "December 2020" "" ""
+.TH "NPM\-TEST" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-test\fR \- Test a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-TOKEN" "1" "December 2020" "" ""
+.TH "NPM\-TOKEN" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-token\fR \- Manage your authentication tokens
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-UNINSTALL" "1" "December 2020" "" ""
+.TH "NPM\-UNINSTALL" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-uninstall\fR \- Remove a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-UNPUBLISH" "1" "December 2020" "" ""
+.TH "NPM\-UNPUBLISH" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-unpublish\fR \- Remove a package from the registry
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-UNSTAR" "1" "December 2020" "" ""
+.TH "NPM\-UNSTAR" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-unstar\fR \- Remove an item from your favorite packages
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-UPDATE" "1" "December 2020" "" ""
+.TH "NPM\-UPDATE" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-update\fR \- Update a package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-VERSION" "1" "December 2020" "" ""
+.TH "NPM\-VERSION" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-version\fR \- Bump a package version
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-VIEW" "1" "December 2020" "" ""
+.TH "NPM\-VIEW" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-view\fR \- View registry info
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM\-WHOAMI" "1" "December 2020" "" ""
+.TH "NPM\-WHOAMI" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm-whoami\fR \- Display npm username
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "NPM" "1" "December 2020" "" ""
+.TH "NPM" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpm\fR \- javascript package manager
 .SS Synopsis
@@ -10,7 +10,7 @@ npm <command> [args]
 .RE
 .SS Version
 .P
-7\.3\.0
+7\.4\.0
 .SS Description
 .P
 npm is the package manager for the Node JavaScript platform\.  It puts
@@ -1,4 +1,4 @@
-.TH "NPX" "1" "December 2020" "" ""
+.TH "NPX" "1" "January 2021" "" ""
 .SH "NAME"
 \fBnpx\fR \- Run a command from a local or remote npm package
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "December 2020" "" ""
+.TH "FOLDERS" "5" "January 2021" "" ""
 .SH "NAME"
 \fBfolders\fR \- Folder Structures Used by npm
 .SS Description
@@ -1,4 +1,4 @@
-.TH "INSTALL" "5" "December 2020" "" ""
+.TH "INSTALL" "5" "January 2021" "" ""
 .SH "NAME"
 \fBinstall\fR \- Download and install node and npm
 .SS Description
@@ -1,4 +1,4 @@
-.TH "NPMRC" "5" "December 2020" "" ""
+.TH "NPMRC" "5" "January 2021" "" ""
 .SH "NAME"
 \fBnpmrc\fR \- The npm config files
 .SS Description
@@ -1,4 +1,4 @@
-.TH "PACKAGE\.JSON" "5" "December 2020" "" ""
+.TH "PACKAGE\.JSON" "5" "January 2021" "" ""
 .SH "NAME"
 \fBpackage.json\fR \- Specifics of npm's package\.json handling
 .SS Description
@@ -1,4 +1,4 @@
-.TH "PACKAGE\-LOCK\.JSON" "5" "December 2020" "" ""
+.TH "PACKAGE\-LOCK\.JSON" "5" "January 2021" "" ""
 .SH "NAME"
 \fBpackage-lock.json\fR \- A manifestation of the manifest
 .SS Description
@@ -1,4 +1,4 @@
-.TH "PACKAGE\-LOCKS" "5" "December 2020" "" ""
+.TH "PACKAGE\-LOCKS" "5" "January 2021" "" ""
 .SH "NAME"
 \fBpackage-locks\fR \- An explanation of npm lockfiles
 .SS Description
@@ -1,4 +1,4 @@
-.TH "SHRINKWRAP\.JSON" "5" "December 2020" "" ""
+.TH "SHRINKWRAP\.JSON" "5" "January 2021" "" ""
 .SH "NAME"
 \fBshrinkwrap.json\fR \- A publishable lockfile
 .SS Description
@@ -1,4 +1,4 @@
-.TH "CONFIG" "7" "December 2020" "" ""
+.TH "CONFIG" "7" "January 2021" "" ""
 .SH "NAME"
 \fBconfig\fR \- More than you probably want to know about npm configuration
 .SS Description
@@ -557,6 +557,21 @@ Allow unpublishing all versions of a published package\.
 .P
 If you don't have a clear idea of what you want to do, it is strongly
 recommended that you do not use this option!
+.SS foreground\-scripts
+.RS 0
+.IP \(bu 2
+Default: false
+.IP \(bu 2
+Type: Boolean
+
+.RE
+.P
+Run all build scripts (ie, \fBpreinstall\fP, \fBinstall\fP, and \fBpostinstall\fP)
+scripts for installed packages in the foreground process, sharing standard
+input, output, and error with the main npm process\.
+.P
+Note that this will generally make installs run slower, and be much
+noisier, but can be useful for debugging\.
 .SS format\-package\-lock
 .RS 0
 .IP \(bu 2
@@ -1,4 +1,4 @@
-.TH "DEVELOPERS" "7" "December 2020" "" ""
+.TH "DEVELOPERS" "7" "January 2021" "" ""
 .SH "NAME"
 \fBdevelopers\fR \- Developer Guide
 .SS Description
@@ -1,4 +1,4 @@
-.TH "DISPUTES" "7" "December 2020" "" ""
+.TH "DISPUTES" "7" "January 2021" "" ""
 .SH "NAME"
 \fBdisputes\fR \- Handling Module Name Disputes
 .P
@@ -1,4 +1,4 @@
-.TH "ORGS" "7" "December 2020" "" ""
+.TH "ORGS" "7" "January 2021" "" ""
 .SH "NAME"
 \fBorgs\fR \- Working with Teams & Orgs
 .SS Description
@@ -1,4 +1,4 @@
-.TH "REGISTRY" "7" "December 2020" "" ""
+.TH "REGISTRY" "7" "January 2021" "" ""
 .SH "NAME"
 \fBregistry\fR \- The JavaScript Package Registry
 .SS Description
@@ -1,4 +1,4 @@
-.TH "REMOVAL" "7" "December 2020" "" ""
+.TH "REMOVAL" "7" "January 2021" "" ""
 .SH "NAME"
 \fBremoval\fR \- Cleaning the Slate
 .SS Synopsis
@@ -1,4 +1,4 @@
-.TH "SCOPE" "7" "December 2020" "" ""
+.TH "SCOPE" "7" "January 2021" "" ""
 .SH "NAME"
 \fBscope\fR \- Scoped packages
 .SS Description
@@ -1,4 +1,4 @@
-.TH "SCRIPTS" "7" "December 2020" "" ""
+.TH "SCRIPTS" "7" "January 2021" "" ""
 .SH "NAME"
 \fBscripts\fR \- How npm handles the "scripts" field
 .SS Description
@@ -1,4 +1,4 @@
-.TH "SEMVER" "7" "December 2020" "" ""
+.TH "SEMVER" "7" "January 2021" "" ""
 .SH "NAME"
 \fBsemver\fR \- The semantic versioner for npm
 .SH Install
@@ -1,4 +1,4 @@
-.TH "WORKSPACES" "7" "December 2020" "" ""
+.TH "WORKSPACES" "7" "January 2021" "" ""
 .SH "NAME"
 \fBworkspaces\fR \- Working with workspaces
 .SS Description
@@ -49,6 +49,7 @@ module.exports = cls => class Builder extends cls {
      rebuildBundle = true,
    } = options

+    this.scriptsRun = new Set()
    this[_binLinks] = binLinks
    this[_ignoreScripts] = !!ignoreScripts
    this[_scriptShell] = scriptShell
@@ -241,6 +242,8 @@ module.exports = cls => class Builder extends cls {
      return

    process.emit('time', `build:run:${event}`)
+    const stdio = this.options.foregroundScripts ? 'inherit' : 'pipe'
+    const limit = this.options.foregroundScripts ? 1 : undefined
    await promiseCallLimit(queue.map(node => async () => {
      const {
        path,
@@ -261,27 +264,41 @@ module.exports = cls => class Builder extends cls {
      const timer = `build:run:${event}:${location}`
      process.emit('time', timer)
      this.log.info('run', pkg._id, event, location, pkg.scripts[event])
-      const p = runScript({
+      const env = {
+        npm_package_resolved: resolved,
+        npm_package_integrity: integrity,
+        npm_package_json: resolve(path, 'package.json'),
+        npm_package_optional: boolEnv(optional),
+        npm_package_dev: boolEnv(dev),
+        npm_package_peer: boolEnv(peer),
+        npm_package_dev_optional:
+          boolEnv(devOptional && !dev && !optional),
+      }
+      const runOpts = {
        event,
        path,
        pkg,
        stdioString: true,
-        env: {
-          npm_package_resolved: resolved,
-          npm_package_integrity: integrity,
-          npm_package_json: resolve(path, 'package.json'),
-          npm_package_optional: boolEnv(optional),
-          npm_package_dev: boolEnv(dev),
-          npm_package_peer: boolEnv(peer),
-          npm_package_dev_optional:
-            boolEnv(devOptional && !dev && !optional),
-        },
+        stdio,
+        env,
        scriptShell: this[_scriptShell],
-      }).catch(er => {
+      }
+      const p = runScript(runOpts).catch(er => {
        const { code, signal } = er
        this.log.info('run', pkg._id, event, {code, signal})
        throw er
-      }).then(({code, signal}) => {
+      }).then(({args, code, signal, stdout, stderr}) => {
+        this.scriptsRun.add({
+          pkg,
+          path,
+          event,
+          cmd: args && args[args.length - 1],
+          env,
+          code,
+          signal,
+          stdout,
+          stderr,
+        })
        this.log.info('run', pkg._id, event, {code, signal})
      })

@@ -290,7 +307,7 @@ module.exports = cls => class Builder extends cls {
        : p)

      process.emit('timeEnd', timer)
-    }))
+    }), limit)
    process.emit('timeEnd', `build:run:${event}`)
  }

@@ -66,6 +66,7 @@ const _copyIdealToActual = Symbol('copyIdealToActual')
 const _addOmitsToTrashList = Symbol('addOmitsToTrashList')
 const _packageLockOnly = Symbol('packageLockOnly')
 const _dryRun = Symbol('dryRun')
+const _validatePath = Symbol('validatePath')
 const _reifyPackages = Symbol('reifyPackages')

 const _omitDev = Symbol('omitDev')
@@ -120,7 +121,8 @@ module.exports = cls => class Reifier extends cls {
    // start tracker block
    this.addTracker('reify')
    process.emit('time', 'reify')
-    await this[_loadTrees](options)
+    await this[_validatePath]()
+      .then(() => this[_loadTrees](options))
      .then(() => this[_diffTrees]())
      .then(() => this[_reifyPackages]())
      .then(() => this[_saveIdealTree](options))
@@ -132,6 +134,14 @@ module.exports = cls => class Reifier extends cls {
    return treeCheck(this.actualTree)
  }

+  async [_validatePath] () {
+    // don't create missing dirs on dry runs
+    if (this[_packageLockOnly] || this[_dryRun] || this[_global])
+      return
+
+    await mkdirp(resolve(this.path))
+  }
+
  async [_reifyPackages] () {
    // we don't submit the audit report or write to disk on dry runs
    if (this[_dryRun])
@@ -1,6 +1,6 @@
 {
  "name": "@npmcli/arborist",
-  "version": "2.0.2",
+  "version": "2.0.3",
  "description": "Manage node_modules trees",
  "dependencies": {
    "@npmcli/installed-package-contents": "^1.0.5",
@@ -19,13 +19,14 @@
    "npm-install-checks": "^4.0.0",
    "npm-package-arg": "^8.1.0",
    "npm-pick-manifest": "^6.1.0",
-    "pacote": "^11.1.13",
+    "pacote": "^11.1.14",
    "parse-conflict-json": "^1.1.1",
    "promise-all-reject-late": "^1.0.0",
    "promise-call-limit": "^1.0.1",
    "read-package-json-fast": "^1.2.1",
    "readdir-scoped-modules": "^1.1.0",
    "semver": "^7.3.4",
+    "tar": "^6.1.0",
    "treeverse": "^1.0.4",
    "walk-up-path": "^1.0.0"
  },
@@ -75,7 +75,12 @@ class FetcherBase {
    this.type = this.constructor.name
    this.fmode = opts.fmode || 0o666
    this.dmode = opts.dmode || 0o777
-    this.umask = opts.umask || 0o022
+    // we don't need a default umask, because we don't chmod files coming
+    // out of package tarballs.  they're forced to have a mode that is
+    // valid, regardless of what's in the tarball entry, and then we let
+    // the process's umask setting do its job.  but if configured, we do
+    // respect it.
+    this.umask = opts.umask || 0
    this.log = opts.log || procLog

    this.preferOnline = !!opts.preferOnline
@@ -290,7 +295,7 @@ class FetcherBase {
    return cacache.rm.content(this.cache, this.integrity, this.opts)
  }

-  [_chown] (path, uid, gid) {
+  async [_chown] (path, uid, gid) {
    return selfOwner && (selfOwner.gid !== gid || selfOwner.uid !== uid)
      ? chownr(path, uid, gid)
      : /* istanbul ignore next - we don't test in root-owned folders */ null
@@ -388,13 +393,15 @@ class FetcherBase {

    // make sure package bins are executable
    const exe = isPackageBin(this.package, path) ? 0o111 : 0
-    return ((mode | m) & ~this.umask) | exe
+    // always ensure that files are read/writable by the owner
+    return ((mode | m) & ~this.umask) | exe | 0o600
  }

  [_tarxOptions] ({ cwd, uid, gid }) {
    const sawIgnores = new Set()
    return {
      cwd,
+      noChmod: true,
      filter: (name, entry) => {
        if (/Link$/.test(entry.type))
          return false
@@ -1,6 +1,6 @@
 {
  "name": "pacote",
-  "version": "11.1.13",
+  "version": "11.1.14",
  "description": "JavaScript package downloader",
  "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",
  "bin": {
@@ -54,7 +54,7 @@
    "read-package-json-fast": "^1.1.3",
    "rimraf": "^3.0.2",
    "ssri": "^8.0.0",
-    "tar": "^6.0.1"
+    "tar": "^6.1.0"
  },
  "engines": {
    "node": ">=10"
@@ -1,7 +1,5 @@
 # node-tar

-[![Build Status](https://travis-ci.org/npm/node-tar.svg?branch=master)](https://travis-ci.org/npm/node-tar)
-
 [Fast](./benchmarks) and full-featured Tar for Node.js

 The API is designed to mimic the behavior of `tar(1)` on unix systems.
@@ -304,7 +302,6 @@ The following options are supported:
 - `mtime` Set to a `Date` object to force a specific `mtime` for
  everything added to the archive.  Overridden by `noMtime`.

-
 The following options are mostly internal, but can be modified in some
 advanced use cases, such as re-using caches between runs.

@@ -398,6 +395,13 @@ The following options are supported:
  the `filter` option described above.)
 - `onentry` A function that gets called with `(entry)` for each entry
  that passes the filter.
+- `onwarn` A function that will get called with `(code, message, data)` for
+  any warnings encountered.  (See "Warnings and Errors")
+- `noChmod` Set to true to omit calling `fs.chmod()` to ensure that the
+  extracted file matches the entry mode.  This also suppresses the call to
+  `process.umask()` to determine the default umask value, since tar will
+  extract with whatever mode is provided, and let the process `umask` apply
+  normally.

 The following options are mostly internal, but can be modified in some
 advanced use cases, such as re-using caches between runs.
@@ -453,6 +457,8 @@ The following options are supported:
  the call to `onentry`.  Set `noResume: true` to suppress this
  behavior.  Note that by opting into this, the stream will never
  complete until the entry data is consumed.
+- `onwarn` A function that will get called with `(code, message, data)` for
+  any warnings encountered.  (See "Warnings and Errors")

 ### tar.u(options, fileList, callback) [alias: tar.update]

@@ -710,6 +716,11 @@ Most unpack errors will cause a `warn` event to be emitted.  If the
  that passes the filter.
 - `onwarn` A function that will get called with `(code, message, data)` for
  any warnings encountered.  (See "Warnings and Errors")
+- `noChmod` Set to true to omit calling `fs.chmod()` to ensure that the
+  extracted file matches the entry mode.  This also suppresses the call to
+  `process.umask()` to determine the default umask value, since tar will
+  extract with whatever mode is provided, and let the process `umask` apply
+  normally.

 ### class tar.Unpack.Sync

@@ -4,12 +4,11 @@
 const hlo = require('./high-level-opt.js')

 const Pack = require('./pack.js')
-const fs = require('fs')
 const fsm = require('fs-minipass')
 const t = require('./list.js')
 const path = require('path')

-const c = module.exports = (opt_, files, cb) => {
+module.exports = (opt_, files, cb) => {
  if (typeof files === 'function')
    cb = files

@@ -38,7 +37,7 @@ const c = module.exports = (opt_, files, cb) => {
 const createFileSync = (opt, files) => {
  const p = new Pack.Sync(opt)
  const stream = new fsm.WriteStreamSync(opt.file, {
-    mode: opt.mode || 0o666
+    mode: opt.mode || 0o666,
  })
  p.pipe(stream)
  addFilesSync(p, files)
@@ -47,7 +46,7 @@ const createFileSync = (opt, files) => {
 const createFile = (opt, files, cb) => {
  const p = new Pack(opt)
  const stream = new fsm.WriteStream(opt.file, {
-    mode: opt.mode || 0o666
+    mode: opt.mode || 0o666,
  })
  p.pipe(stream)

@@ -64,14 +63,14 @@ const createFile = (opt, files, cb) => {

 const addFilesSync = (p, files) => {
  files.forEach(file => {
-    if (file.charAt(0) === '@')
+    if (file.charAt(0) === '@') {
      t({
        file: path.resolve(p.cwd, file.substr(1)),
        sync: true,
        noResume: true,
-        onentry: entry => p.add(entry)
+        onentry: entry => p.add(entry),
      })
-    else
+    } else
      p.add(file)
  })
  p.end()
@@ -80,13 +79,13 @@ const addFilesSync = (p, files) => {
 const addFilesAsync = (p, files) => {
  while (files.length) {
    const file = files.shift()
-    if (file.charAt(0) === '@')
+    if (file.charAt(0) === '@') {
      return t({
        file: path.resolve(p.cwd, file.substr(1)),
        noResume: true,
-        onentry: entry => p.add(entry)
+        onentry: entry => p.add(entry),
      }).then(_ => addFilesAsync(p, files))
-    else
+    } else
      p.add(file)
  }
  p.end()