deps: upgrade npm to 10.5.0

PR-URL: https://github.com/nodejs/node/pull/51913
Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com>
Reviewed-By: Richard Lau <rlau@redhat.com>

deps/npm/docs/content/commands/npm-audit.md

@@ -374,7 +374,8 @@ the order in which omit/include are specified on the command-line.
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm-ci.md

@@ -169,7 +169,8 @@ this warning is treated as a failure.
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm-config.md

@@ -44,7 +44,8 @@ npm config set key=value [key=value...]
 npm set key=value [key=value...]
 ```
 
-Sets each of the config keys to the value provided.
+Sets each of the config keys to the value provided. Modifies the user configuration
+file unless [`location`](/commands/npm-config#location) is passed.
 
 If value is omitted, the key will be removed from your config file entirely.
 

deps/npm/docs/content/commands/npm-install-ci-test.md

@@ -115,7 +115,8 @@ this warning is treated as a failure.
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm-install-test.md

@@ -192,7 +192,8 @@ For `list` this means the output will be based on the tree described by the
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm-install.md

@@ -582,7 +582,8 @@ For `list` this means the output will be based on the tree described by the
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm-ls.md

@@ -27,7 +27,7 @@ packages will *also* show the paths to the specified packages.  For
 example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@10.3.0 /path/to/npm
+npm@10.5.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```

deps/npm/docs/content/commands/npm-prune.md

@@ -99,7 +99,8 @@ Not supported by all npm commands.
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm-query.md

@@ -135,19 +135,32 @@ npm query ":type(git)" | jq 'map(.name)' | xargs -I {} npm why {}
   },
   ...
 ```
-### Package lock only mode
 
-If package-lock-only is enabled, only the information in the package
-lock (or shrinkwrap) is loaded.  This means that information from the
-package.json files of your dependencies will not be included in the
-result set (e.g. description, homepage, engines).
+### Expecting a certain number of results
+
+One common use of `npm query` is to make sure there is only one version of
+a certain dependency in your tree.  This is especially common for
+ecosystems like that rely on `typescript` where having state split
+across two different but identically-named packages causes bugs.  You
+can use the `--expect-results` or `--expect-result-count` in your setup
+to ensure that npm will exit with an exit code if your tree doesn't look
+like you want it to.
+
+
+```sh
+$ npm query '#react' --expect-result-count=1
+```
+
+Perhaps you want to quickly check if there are any production
+dependencies that could be updated:
+
+```sh
+$ npm query ':root>:outdated(in-range).prod' --no-expect-results
+```
 
 ### Package lock only mode
 
-If package-lock-only is enabled, only the information in the package
-lock (or shrinkwrap) is loaded.  This means that information from the
-package.json files of your dependencies will not be included in the
-result set (e.g. description, homepage, engines).
+If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded.  This means that information from the package.json files of your dependencies will not be included in the result set (e.g. description, homepage, engines).
 
 ### Configuration
 
@@ -235,6 +248,25 @@ For `list` this means the output will be based on the tree described by the
 `package-lock.json`, rather than the contents of `node_modules`.
 
 
+
+#### `expect-results`
+
+* Default: null
+* Type: null or Boolean
+
+Tells npm whether or not to expect results from the command. Can be either
+true (expect some results) or false (expect no results).
+
+This config can not be used with: `expect-result-count`
+
+#### `expect-result-count`
+
+* Default: null
+* Type: null or Number
+
+Tells to expect a specific number of results from the command.
+
+This config can not be used with: `expect-results`
 ## See Also
 
 * [dependency selectors](/using-npm/dependency-selectors)

deps/npm/docs/content/commands/npm-rebuild.md

@@ -72,7 +72,8 @@ systems.
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm-run-script.md

@@ -220,7 +220,8 @@ will *not* run any pre- or post-scripts.
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm-update.md

@@ -28,7 +28,7 @@ If no package name is specified, all packages in the specified location (global
 or local) will be updated.
 
 Note that by default `npm update` will not update the semver values of direct
-dependencies in your project `package.json`, if you want to also update
+dependencies in your project `package.json`. If you want to also update
 values in `package.json` you can run: `npm update --save` (or add the
 `save=true` option to a [configuration file](/configuring-npm/npmrc)
 to make that the default behavior).
@@ -80,7 +80,7 @@ However, if `app`'s `package.json` contains:
 ```
 
 In this case, running `npm update` will install `dep1@1.1.2`.  Even though the
-`latest` tag points to `1.2.2`, this version do not satisfy `~1.1.1`, which is
+`latest` tag points to `1.2.2`, this version does not satisfy `~1.1.1`, which is
 equivalent to `>=1.1.1 <1.2.0`.  So the highest-sorting version that satisfies
 `~1.1.1` is used, which is `1.1.2`.
 
@@ -94,8 +94,7 @@ Suppose `app` has a caret dependency on a version below `1.0.0`, for example:
 }
 ```
 
-`npm update` will install `dep1@0.2.0`, because there are no other
-versions which satisfy `^0.2.0`.
+`npm update` will install `dep1@0.2.0`.
 
 If the dependence were on `^0.4.0`:
 
@@ -294,7 +293,8 @@ will also prevent _writing_ `package-lock.json` if `save` is true.
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-10.3.0
+10.5.0
 
 ### Description
 

deps/npm/docs/content/configuring-npm/package-json.md

@@ -726,7 +726,7 @@ in which case they will be normalized to a relative path and added to your
 
 This feature is helpful for local offline development and creating tests
 that require npm installing where you don't want to hit an external server,
-but should not be used when publishing packages to the public registry.
+but should not be used when publishing your package to the public registry.
 
 *note*: Packages linked by local path will not have their own
 dependencies installed when `npm install` is ran in this case.  You must

deps/npm/docs/content/using-npm/config.md

@@ -6,6 +6,9 @@ description: More than you probably want to know about npm configuration
 
 ### Description
 
+This article details npm configuration in general. To learn about the `config` command,
+see [`npm config`](/commands/npm-config).
+
 npm gets its configuration values from the following sources, sorted by priority:
 
 #### Command Line Flags
@@ -489,6 +492,25 @@ This can be overridden by setting the `--force` flag.
 
 
 
+#### `expect-result-count`
+
+* Default: null
+* Type: null or Number
+
+Tells to expect a specific number of results from the command.
+
+This config can not be used with: `expect-results`
+
+#### `expect-results`
+
+* Default: null
+* Type: null or Boolean
+
+Tells npm whether or not to expect results from the command. Can be either
+true (expect some results) or false (expect no results).
+
+This config can not be used with: `expect-result-count`
+
 #### `fetch-retries`
 
 * Default: 2
@@ -570,7 +592,8 @@ recommended that you do not use this option!
 
 #### `foreground-scripts`
 
-* Default: false
+* Default: `false` unless when using `npm pack` or `npm publish` where it
+  defaults to `true`
 * Type: Boolean
 
 Run all build scripts (ie, `preinstall`, `install`, and `postinstall`)

deps/npm/docs/content/using-npm/dependency-selectors.md

@@ -13,7 +13,7 @@ The [`npm query`](/commands/npm-query) command exposes a new dependency selector
 - Unlocks the ability to answer complex, multi-faceted questions about dependencies, their relationships & associative metadata
 - Consolidates redundant logic of similar query commands in `npm` (ex. `npm fund`, `npm ls`, `npm outdated`, `npm audit` ...)
 
-### Dependency Selector Syntax `v1.0.0`
+### Dependency Selector Syntax
 
 #### Overview:
 
@@ -62,6 +62,7 @@ The [`npm query`](/commands/npm-query) command exposes a new dependency selector
 - `:path(<path>)` [glob](https://www.npmjs.com/package/glob) matching based on dependencies path relative to the project
 - `:type(<type>)` [based on currently recognized types](https://github.com/npm/npm-package-arg#result-object)
 - `:outdated(<type>)` when a dependency is outdated
+- `:vuln(<selector>)` when a dependency has a known vulnerability
 
 ##### `:semver(<spec>, [selector], [function])`
 
@@ -84,8 +85,8 @@ Some examples:
 The `:outdated` pseudo selector retrieves data from the registry and returns information about which of your dependencies are outdated. The type parameter may be one of the following:
 
 - `any` (default) a version exists that is greater than the current one
-- `in-range` a version exists that is greater than the current one, and satisfies at least one if its dependents
-- `out-of-range` a version exists that is greater than the current one, does not satisfy at least one of its dependents
+- `in-range` a version exists that is greater than the current one, and satisfies at least one if its parent's dependencies
+- `out-of-range` a version exists that is greater than the current one, does not satisfy at least one of its parent's dependencies
 - `major` a version exists that is a semver major greater than the current one
 - `minor` a version exists that is a semver minor greater than the current one
 - `patch` a version exists that is a semver patch greater than the current one
@@ -99,14 +100,29 @@ In addition to the filtering performed by the pseudo selector, some extra data i
 Some examples:
 
 - `:root > :outdated(major)` returns every direct dependency that has a new semver major release
-- `.prod:outdated(in-range)` returns production dependencies that have a new release that satisfies at least one of its edges in
+- `.prod:outdated(in-range)` returns production dependencies that have a new release that satisfies at least one of its parent's dependencies
+
+##### `:vuln`
+
+The `:vuln` pseudo selector retrieves data from the registry and returns information about which if your dependencies has a known vulnerability.  Only dependencies whose current version matches a vulnerability will be returned.  For example if you have `semver@7.6.0` in your tree, a vulnerability for `semver` which affects versions `<=6.3.1` will not match.
+
+You can also filter results by certain attributes in advisories.  Currently that includes `severity` and `cwe`.  Note that severity filtering is done per severity, it does not include severities "higher" or "lower" than the one specified.
+
+In addition to the filtering performed by the pseudo selector, info about each relevant advisory will be added to the `queryContext` attribute of each node under the `advisories` attribute.
+
+Some examples:
+
+- `:root > .prod:vuln` returns direct production dependencies with any known vulnerability
+- `:vuln([severity=high])` returns only dependencies with a vulnerability with a `high` severity.
+- `:vuln([severity=high],[severity=moderate])` returns only dependencies with a vulnerability with a `high`  or `moderate` severity.
+- `:vuln([cwe=1333])` returns only dependencies with a vulnerability that includes CWE-1333 (ReDoS)
 
 #### [Attribute Selectors](https://developer.mozilla.org/en-US/docs/Web/CSS/Attribute_selectors)
 
 The attribute selector evaluates the key/value pairs in `package.json` if they are `String`s.
 
 - `[]` attribute selector (ie. existence of attribute)
-- `[attribute=value]` attribute value is equivalant...
+- `[attribute=value]` attribute value is equivalent...
 - `[attribute~=value]` attribute value contains word...
 - `[attribute*=value]` attribute value contains string...
 - `[attribute|=value]` attribute value is equal to or starts with...

deps/npm/docs/content/using-npm/scope.md

@@ -127,7 +127,7 @@ host multiple scopes, but a scope only ever points to one registry.
 You can also associate a scope with a registry using `npm config`:
 
 ```bash
-npm config set @myco:registry http://reg.example.com
+npm config set @myco:registry=http://reg.example.com
 ```
 
 Once a scope is associated with a registry, any `npm install` for a package

deps/npm/docs/content/using-npm/scripts.md

@@ -294,18 +294,15 @@ For example, if your package.json contains this:
 {
   "scripts" : {
     "install" : "scripts/install.js",
-    "postinstall" : "scripts/install.js",
-    "uninstall" : "scripts/uninstall.js"
+    "postinstall" : "scripts/install.js"
   }
 }
 ```
 
-then `scripts/install.js` will be called for the install
-and post-install stages of the lifecycle, and `scripts/uninstall.js`
-will be called when the package is uninstalled.  Since
-`scripts/install.js` is running for two different phases, it would
-be wise in this case to look at the `npm_lifecycle_event` environment
-variable.
+then `scripts/install.js` will be called for the install and post-install
+stages of the lifecycle.  Since `scripts/install.js` is running for two
+different phases, it would be wise in this case to look at the
+`npm_lifecycle_event` environment variable.
 
 If you want to run a make command, you can do so.  This works just
 fine:
@@ -334,10 +331,8 @@ file.
 ### Best Practices
 
 * Don't exit with a non-zero error code unless you *really* mean it.
-  Except for uninstall scripts, this will cause the npm action to
-  fail, and potentially be rolled back.  If the failure is minor or
-  only will prevent some optional features, then it's better to just
-  print a warning and exit successfully.
+  If the failure is minor or only will prevent some optional features, then
+  it's better to just print a warning and exit successfully.
 * Try not to use scripts to do what npm can do for you.  Read through
   [`package.json`](/configuring-npm/package-json) to see all the things that you can specify and enable
   by simply describing your package appropriately.  In general, this

deps/npm/docs/content/using-npm/workspaces.md

@@ -7,12 +7,12 @@ description: Working with workspaces
 ### Description
 
 **Workspaces** is a generic term that refers to the set of features in the
-npm cli that provides support to managing multiple packages from your local
+npm cli that provides support for managing multiple packages from your local
 file system from within a singular top-level, root package.
 
 This set of features makes up for a much more streamlined workflow handling
-linked packages from the local file system. Automating the linking process
-as part of `npm install` and avoiding manually having to use `npm link` in
+linked packages from the local file system. It automates the linking process
+as part of `npm install` and removes the need to manually use `npm link` in
 order to add references to packages that should be symlinked into the current
 `node_modules` folder.
 
@@ -110,7 +110,7 @@ respect the provided `workspace` configuration.
 
 ### Using workspaces
 
-Given the [specifities of how Node.js handles module resolution](https://nodejs.org/dist/latest-v14.x/docs/api/modules.html#modules_all_together) it's possible to consume any defined workspace
+Given the [specifics of how Node.js handles module resolution](https://nodejs.org/dist/latest-v14.x/docs/api/modules.html#modules_all_together) it's possible to consume any defined workspace
 by its declared `package.json` `name`. Continuing from the example defined
 above, let's also create a Node.js script that will require the workspace `a`
 example module, e.g:

deps/npm/docs/output/commands/npm-audit.html

@@ -410,7 +410,8 @@ variable will be set to <code>'production'</code> for all lifecycle scripts.</p>
 the order in which omit/include are specified on the command-line.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm-ci.html

@@ -268,7 +268,8 @@ conflict and the packages involved. If <code>--strict-peer-deps</code> is set, t
 this warning is treated as a failure.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm-config.html

@@ -171,7 +171,8 @@ of the user and global npmrc files.</p>
 <pre><code class="language-bash">npm config set key=value [key=value...]
 npm set key=value [key=value...]
 </code></pre>
-<p>Sets each of the config keys to the value provided.</p>
+<p>Sets each of the config keys to the value provided. Modifies the user configuration
+file unless <a href="../commands/npm-config#location.html"><code>location</code></a> is passed.</p>
 <p>If value is omitted, the key will be removed from your config file entirely.</p>
 <p>Note: for backwards compatibility, <code>npm config set key value</code> is supported
 as an alias for <code>npm config set key=value</code>.</p>

deps/npm/docs/output/commands/npm-install-ci-test.html

@@ -225,7 +225,8 @@ conflict and the packages involved. If <code>--strict-peer-deps</code> is set, t
 this warning is treated as a failure.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm-install-test.html

@@ -281,7 +281,8 @@ instead of checking <code>node_modules</code> and downloading dependencies.</p>
 <code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm-install.html

@@ -607,7 +607,8 @@ instead of checking <code>node_modules</code> and downloading dependencies.</p>
 <code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm-ls.html

@@ -160,7 +160,7 @@ tree at all, use <a href="../commands/npm-explain.html"><code>npm explain</code>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">npm@10.3.0 /path/to/npm
+<pre><code class="language-bash">npm@10.5.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>

deps/npm/docs/output/commands/npm-prune.html

@@ -211,7 +211,8 @@ saving them to your <code>package.json</code>.</li>
 <p>Not supported by all npm commands.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm-query.html

@@ -264,16 +264,22 @@ npm query ":type(git)" | jq 'map(.name)' | xargs -I {} npm why {}
   },
   ...
 </code></pre>
+<h3 id="expecting-a-certain-number-of-results">Expecting a certain number of results</h3>
+<p>One common use of <code>npm query</code> is to make sure there is only one version of
+a certain dependency in your tree.  This is especially common for
+ecosystems like that rely on <code>typescript</code> where having state split
+across two different but identically-named packages causes bugs.  You
+can use the <code>--expect-results</code> or <code>--expect-result-count</code> in your setup
+to ensure that npm will exit with an exit code if your tree doesn't look
+like you want it to.</p>
+<pre><code class="language-sh">$ npm query '#react' --expect-result-count=1
+</code></pre>
+<p>Perhaps you want to quickly check if there are any production
+dependencies that could be updated:</p>
+<pre><code class="language-sh">$ npm query ':root&gt;:outdated(in-range).prod' --no-expect-results
+</code></pre>
 <h3 id="package-lock-only-mode">Package lock only mode</h3>
-<p>If package-lock-only is enabled, only the information in the package
-lock (or shrinkwrap) is loaded.  This means that information from the
-package.json files of your dependencies will not be included in the
-result set (e.g. description, homepage, engines).</p>
-<h3 id="package-lock-only-mode2">Package lock only mode</h3>
-<p>If package-lock-only is enabled, only the information in the package
-lock (or shrinkwrap) is loaded.  This means that information from the
-package.json files of your dependencies will not be included in the
-result set (e.g. description, homepage, engines).</p>
+<p>If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded.  This means that information from the package.json files of your dependencies will not be included in the result set (e.g. description, homepage, engines).</p>
 <h3 id="configuration">Configuration</h3>
 <h4 id="global"><code>global</code></h4>
 <ul>
@@ -345,6 +351,21 @@ ignoring <code>node_modules</code>.</p>
 instead of checking <code>node_modules</code> and downloading dependencies.</p>
 <p>For <code>list</code> this means the output will be based on the tree described by the
 <code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
+<h4 id="expect-results"><code>expect-results</code></h4>
+<ul>
+<li>Default: null</li>
+<li>Type: null or Boolean</li>
+</ul>
+<p>Tells npm whether or not to expect results from the command. Can be either
+true (expect some results) or false (expect no results).</p>
+<p>This config can not be used with: <code>expect-result-count</code></p>
+<h4 id="expect-result-count"><code>expect-result-count</code></h4>
+<ul>
+<li>Default: null</li>
+<li>Type: null or Number</li>
+</ul>
+<p>Tells to expect a specific number of results from the command.</p>
+<p>This config can not be used with: <code>expect-results</code></p>
 <h2 id="see-also">See Also</h2>
 <ul>
 <li><a href="../using-npm/dependency-selectors.html">dependency selectors</a></li>

deps/npm/docs/output/commands/npm-rebuild.html

@@ -196,7 +196,8 @@ fact that some file systems don't support symlinks, even on ostensibly Unix
 systems.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm-run-script.html

@@ -305,7 +305,8 @@ will still run their intended script if <code>ignore-scripts</code> is set, but
 will <em>not</em> run any pre- or post-scripts.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm-update.html

@@ -161,7 +161,7 @@ packages.</p>
 <p>If no package name is specified, all packages in the specified location (global
 or local) will be updated.</p>
 <p>Note that by default <code>npm update</code> will not update the semver values of direct
-dependencies in your project <code>package.json</code>, if you want to also update
+dependencies in your project <code>package.json</code>. If you want to also update
 values in <code>package.json</code> you can run: <code>npm update --save</code> (or add the
 <code>save=true</code> option to a <a href="../configuring-npm/npmrc.html">configuration file</a>
 to make that the default behavior).</p>
@@ -199,7 +199,7 @@ are:</p>
 }
 </code></pre>
 <p>In this case, running <code>npm update</code> will install <code>dep1@1.1.2</code>.  Even though the
-<code>latest</code> tag points to <code>1.2.2</code>, this version do not satisfy <code>~1.1.1</code>, which is
+<code>latest</code> tag points to <code>1.2.2</code>, this version does not satisfy <code>~1.1.1</code>, which is
 equivalent to <code>&gt;=1.1.1 &lt;1.2.0</code>.  So the highest-sorting version that satisfies
 <code>~1.1.1</code> is used, which is <code>1.1.2</code>.</p>
 <h4 id="caret-dependencies-below-100">Caret Dependencies below 1.0.0</h4>
@@ -208,8 +208,7 @@ equivalent to <code>&gt;=1.1.1 &lt;1.2.0</code>.  So the highest-sorting version
   "dep1": "^0.2.0"
 }
 </code></pre>
-<p><code>npm update</code> will install <code>dep1@0.2.0</code>, because there are no other
-versions which satisfy <code>^0.2.0</code>.</p>
+<p><code>npm update</code> will install <code>dep1@0.2.0</code>.</p>
 <p>If the dependence were on <code>^0.4.0</code>:</p>
 <pre><code class="language-json">"dependencies": {
   "dep1": "^0.4.0"
@@ -353,7 +352,8 @@ this warning is treated as a failure.</p>
 will also prevent <em>writing</em> <code>package-lock.json</code> if <code>save</code> is true.</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/commands/npm.html

@@ -150,7 +150,7 @@ npm command-line interface
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>10.3.0</p>
+<p>10.5.0</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/docs/output/configuring-npm/package-json.html

@@ -698,7 +698,7 @@ contains a package. Local paths can be saved using <code>npm install -S</code> o
 </code></pre>
 <p>This feature is helpful for local offline development and creating tests
 that require npm installing where you don't want to hit an external server,
-but should not be used when publishing packages to the public registry.</p>
+but should not be used when publishing your package to the public registry.</p>
 <p><em>note</em>: Packages linked by local path will not have their own
 dependencies installed when <code>npm install</code> is ran in this case.  You must
 run <code>npm install</code> from inside the local path itself.</p>

deps/npm/docs/output/using-npm/config.html

@@ -142,10 +142,12 @@ npm command-line interface
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><ul><li><a href="#command-line-flags">Command Line Flags</a></li><li><a href="#environment-variables">Environment Variables</a></li><li><a href="#npmrc-files">npmrc Files</a></li><li><a href="#default-configs">Default Configs</a></li></ul><li><a href="#shorthands-and-other-cli-niceties">Shorthands and Other CLI Niceties</a></li><li><a href="#config-settings">Config Settings</a></li><ul><li><a href="#auth"><code>_auth</code></a></li><li><a href="#access"><code>access</code></a></li><li><a href="#all"><code>all</code></a></li><li><a href="#allow-same-version"><code>allow-same-version</code></a></li><li><a href="#audit"><code>audit</code></a></li><li><a href="#audit-level"><code>audit-level</code></a></li><li><a href="#auth-type"><code>auth-type</code></a></li><li><a href="#before"><code>before</code></a></li><li><a href="#bin-links"><code>bin-links</code></a></li><li><a href="#browser"><code>browser</code></a></li><li><a href="#ca"><code>ca</code></a></li><li><a href="#cache"><code>cache</code></a></li><li><a href="#cafile"><code>cafile</code></a></li><li><a href="#call"><code>call</code></a></li><li><a href="#cidr"><code>cidr</code></a></li><li><a href="#color"><code>color</code></a></li><li><a href="#commit-hooks"><code>commit-hooks</code></a></li><li><a href="#cpu"><code>cpu</code></a></li><li><a href="#depth"><code>depth</code></a></li><li><a href="#description2"><code>description</code></a></li><li><a href="#diff"><code>diff</code></a></li><li><a href="#diff-dst-prefix"><code>diff-dst-prefix</code></a></li><li><a href="#diff-ignore-all-space"><code>diff-ignore-all-space</code></a></li><li><a href="#diff-name-only"><code>diff-name-only</code></a></li><li><a href="#diff-no-prefix"><code>diff-no-prefix</code></a></li><li><a href="#diff-src-prefix"><code>diff-src-prefix</code></a></li><li><a href="#diff-text"><code>diff-text</code></a></li><li><a href="#diff-unified"><code>diff-unified</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#editor"><code>editor</code></a></li><li><a href="#engine-strict"><code>engine-strict</code></a></li><li><a href="#fetch-retries"><code>fetch-retries</code></a></li><li><a href="#fetch-retry-factor"><code>fetch-retry-factor</code></a></li><li><a href="#fetch-retry-maxtimeout"><code>fetch-retry-maxtimeout</code></a></li><li><a href="#fetch-retry-mintimeout"><code>fetch-retry-mintimeout</code></a></li><li><a href="#fetch-timeout"><code>fetch-timeout</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#foreground-scripts"><code>foreground-scripts</code></a></li><li><a href="#format-package-lock"><code>format-package-lock</code></a></li><li><a href="#fund"><code>fund</code></a></li><li><a href="#git"><code>git</code></a></li><li><a href="#git-tag-version"><code>git-tag-version</code></a></li><li><a href="#global"><code>global</code></a></li><li><a href="#globalconfig"><code>globalconfig</code></a></li><li><a href="#heading"><code>heading</code></a></li><li><a href="#https-proxy"><code>https-proxy</code></a></li><li><a href="#if-present"><code>if-present</code></a></li><li><a href="#ignore-scripts"><code>ignore-scripts</code></a></li><li><a href="#include"><code>include</code></a></li><li><a href="#include-staged"><code>include-staged</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li><li><a href="#init-author-email"><code>init-author-email</code></a></li><li><a href="#init-author-name"><code>init-author-name</code></a></li><li><a href="#init-author-url"><code>init-author-url</code></a></li><li><a href="#init-license"><code>init-license</code></a></li><li><a href="#init-module"><code>init-module</code></a></li><li><a href="#init-version"><code>init-version</code></a></li><li><a href="#install-links"><code>install-links</code></a></li><li><a href="#install-strategy"><code>install-strategy</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#legacy-peer-deps"><code>legacy-peer-deps</code></a></li><li><a href="#libc"><code>libc</code></a></li><li><a href="#link"><code>link</code></a></li><li><a href="#local-address"><code>local-address</code></a></li><li><a href="#location"><code>location</code></a></li><li><a href="#lockfile-version"><code>lockfile-version</code></a></li><li><a href="#loglevel"><code>loglevel</code></a></li><li><a href="#logs-dir"><code>logs-dir</code></a></li><li><a href="#logs-max"><code>logs-max</code></a></li><li><a href="#long"><code>long</code></a></li><li><a href="#maxsockets"><code>maxsockets</code></a></li><li><a href="#message"><code>message</code></a></li><li><a href="#node-options"><code>node-options</code></a></li><li><a href="#noproxy"><code>noproxy</code></a></li><li><a href="#offline"><code>offline</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#omit-lockfile-registry-resolved"><code>omit-lockfile-registry-resolved</code></a><Line truncated
+<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><ul><li><a href="#command-line-flags">Command Line Flags</a></li><li><a href="#environment-variables">Environment Variables</a></li><li><a href="#npmrc-files">npmrc Files</a></li><li><a href="#default-configs">Default Configs</a></li></ul><li><a href="#shorthands-and-other-cli-niceties">Shorthands and Other CLI Niceties</a></li><li><a href="#config-settings">Config Settings</a></li><ul><li><a href="#auth"><code>_auth</code></a></li><li><a href="#access"><code>access</code></a></li><li><a href="#all"><code>all</code></a></li><li><a href="#allow-same-version"><code>allow-same-version</code></a></li><li><a href="#audit"><code>audit</code></a></li><li><a href="#audit-level"><code>audit-level</code></a></li><li><a href="#auth-type"><code>auth-type</code></a></li><li><a href="#before"><code>before</code></a></li><li><a href="#bin-links"><code>bin-links</code></a></li><li><a href="#browser"><code>browser</code></a></li><li><a href="#ca"><code>ca</code></a></li><li><a href="#cache"><code>cache</code></a></li><li><a href="#cafile"><code>cafile</code></a></li><li><a href="#call"><code>call</code></a></li><li><a href="#cidr"><code>cidr</code></a></li><li><a href="#color"><code>color</code></a></li><li><a href="#commit-hooks"><code>commit-hooks</code></a></li><li><a href="#cpu"><code>cpu</code></a></li><li><a href="#depth"><code>depth</code></a></li><li><a href="#description2"><code>description</code></a></li><li><a href="#diff"><code>diff</code></a></li><li><a href="#diff-dst-prefix"><code>diff-dst-prefix</code></a></li><li><a href="#diff-ignore-all-space"><code>diff-ignore-all-space</code></a></li><li><a href="#diff-name-only"><code>diff-name-only</code></a></li><li><a href="#diff-no-prefix"><code>diff-no-prefix</code></a></li><li><a href="#diff-src-prefix"><code>diff-src-prefix</code></a></li><li><a href="#diff-text"><code>diff-text</code></a></li><li><a href="#diff-unified"><code>diff-unified</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#editor"><code>editor</code></a></li><li><a href="#engine-strict"><code>engine-strict</code></a></li><li><a href="#expect-result-count"><code>expect-result-count</code></a></li><li><a href="#expect-results"><code>expect-results</code></a></li><li><a href="#fetch-retries"><code>fetch-retries</code></a></li><li><a href="#fetch-retry-factor"><code>fetch-retry-factor</code></a></li><li><a href="#fetch-retry-maxtimeout"><code>fetch-retry-maxtimeout</code></a></li><li><a href="#fetch-retry-mintimeout"><code>fetch-retry-mintimeout</code></a></li><li><a href="#fetch-timeout"><code>fetch-timeout</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#foreground-scripts"><code>foreground-scripts</code></a></li><li><a href="#format-package-lock"><code>format-package-lock</code></a></li><li><a href="#fund"><code>fund</code></a></li><li><a href="#git"><code>git</code></a></li><li><a href="#git-tag-version"><code>git-tag-version</code></a></li><li><a href="#global"><code>global</code></a></li><li><a href="#globalconfig"><code>globalconfig</code></a></li><li><a href="#heading"><code>heading</code></a></li><li><a href="#https-proxy"><code>https-proxy</code></a></li><li><a href="#if-present"><code>if-present</code></a></li><li><a href="#ignore-scripts"><code>ignore-scripts</code></a></li><li><a href="#include"><code>include</code></a></li><li><a href="#include-staged"><code>include-staged</code></a></li><li><a href="#include-workspace-root"><code>include-workspace-root</code></a></li><li><a href="#init-author-email"><code>init-author-email</code></a></li><li><a href="#init-author-name"><code>init-author-name</code></a></li><li><a href="#init-author-url"><code>init-author-url</code></a></li><li><a href="#init-license"><code>init-license</code></a></li><li><a href="#init-module"><code>init-module</code></a></li><li><a href="#init-version"><code>init-version</code></a></li><li><a href="#install-links"><code>install-links</code></a></li><li><a href="#install-strategy"><code>install-strategy</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#legacy-peer-deps"><code>legacy-peer-deps</code></a></li><li><a href="#libc"><code>libc</code></a></li><li><a href="#link"><code>link</code></a></li><li><a href="#local-address"><code>local-address</code></a></li><li><a href="#location"><code>location</code></a></li><li><a href="#lockfile-version"><code>lockfile-version</code></a></li><li><a href="#loglevel"><code>loglevel</code></a></li><li><a href="#logs-dir"><code>logs-dir</code></a></li><li><a href="#logs-max"><code>logs-max</code></a></li><li><a href="#long"><code>long</code></a></li><li><a href="#maxsockets"><code>maxsockets</code></a></li><li><a href="#message"><code>message</code></a></li><li><a href="#node-options"><code>node-options</code></a></li><li><a href="#noproxy"><code>noproxy</code></a></li><li><a href="#offline"><code>offline</code></a></li>Line truncated
 </section>
 
 <div id="_content"><h3 id="description">Description</h3>
+<p>This article details npm configuration in general. To learn about the <code>config</code> command,
+see <a href="../commands/npm-config.html"><code>npm config</code></a>.</p>
 <p>npm gets its configuration values from the following sources, sorted by priority:</p>
 <h4 id="command-line-flags">Command Line Flags</h4>
 <p>Putting <code>--foo bar</code> on the command line sets the <code>foo</code> configuration
@@ -496,6 +498,21 @@ commands that modify your local installation, eg, <code>install</code>, <code>up
 installing) any package that claims to not be compatible with the current
 Node.js version.</p>
 <p>This can be overridden by setting the <code>--force</code> flag.</p>
+<h4 id="expect-result-count"><code>expect-result-count</code></h4>
+<ul>
+<li>Default: null</li>
+<li>Type: null or Number</li>
+</ul>
+<p>Tells to expect a specific number of results from the command.</p>
+<p>This config can not be used with: <code>expect-results</code></p>
+<h4 id="expect-results"><code>expect-results</code></h4>
+<ul>
+<li>Default: null</li>
+<li>Type: null or Boolean</li>
+</ul>
+<p>Tells npm whether or not to expect results from the command. Can be either
+true (expect some results) or false (expect no results).</p>
+<p>This config can not be used with: <code>expect-result-count</code></p>
 <h4 id="fetch-retries"><code>fetch-retries</code></h4>
 <ul>
 <li>Default: 2</li>
@@ -558,7 +575,8 @@ range (including SemVer-major changes).</li>
 recommended that you do not use this option!</p>
 <h4 id="foreground-scripts"><code>foreground-scripts</code></h4>
 <ul>
-<li>Default: false</li>
+<li>Default: <code>false</code> unless when using <code>npm pack</code> or <code>npm publish</code> where it
+defaults to <code>true</code></li>
 <li>Type: Boolean</li>
 </ul>
 <p>Run all build scripts (ie, <code>preinstall</code>, <code>install</code>, and <code>postinstall</code>)

deps/npm/docs/output/using-npm/dependency-selectors.html

@@ -153,7 +153,7 @@ npm command-line interface
 <li>Unlocks the ability to answer complex, multi-faceted questions about dependencies, their relationships &amp; associative metadata</li>
 <li>Consolidates redundant logic of similar query commands in <code>npm</code> (ex. <code>npm fund</code>, <code>npm ls</code>, <code>npm outdated</code>, <code>npm audit</code> ...)</li>
 </ul>
-<h3 id="dependency-selector-syntax-v100">Dependency Selector Syntax <code>v1.0.0</code></h3>
+<h3 id="dependency-selector-syntax">Dependency Selector Syntax</h3>
 <h4 id="overview">Overview:</h4>
 <ul>
 <li>there is no "type" or "tag" selectors (ex. <code>div, h1, a</code>) as a dependency/target is the only type of <code>Node</code> that can be queried</li>
@@ -202,6 +202,7 @@ npm command-line interface
 <li><code>:path(&lt;path&gt;)</code> <a href="https://www.npmjs.com/package/glob">glob</a> matching based on dependencies path relative to the project</li>
 <li><code>:type(&lt;type&gt;)</code> <a href="https://github.com/npm/npm-package-arg#result-object">based on currently recognized types</a></li>
 <li><code>:outdated(&lt;type&gt;)</code> when a dependency is outdated</li>
+<li><code>:vuln(&lt;selector&gt;)</code> when a dependency has a known vulnerability</li>
 </ul>
 <h5 id="semverspec-selector-function"><code>:semver(&lt;spec&gt;, [selector], [function])</code></h5>
 <p>The <code>:semver()</code> pseudo selector allows comparing fields from each node's <code>package.json</code> using <a href="https://github.com/npm/node-semver#readme">semver</a> methods. It accepts up to 3 parameters, all but the first of which are optional.</p>
@@ -221,8 +222,8 @@ npm command-line interface
 <p>The <code>:outdated</code> pseudo selector retrieves data from the registry and returns information about which of your dependencies are outdated. The type parameter may be one of the following:</p>
 <ul>
 <li><code>any</code> (default) a version exists that is greater than the current one</li>
-<li><code>in-range</code> a version exists that is greater than the current one, and satisfies at least one if its dependents</li>
-<li><code>out-of-range</code> a version exists that is greater than the current one, does not satisfy at least one of its dependents</li>
+<li><code>in-range</code> a version exists that is greater than the current one, and satisfies at least one if its parent's dependencies</li>
+<li><code>out-of-range</code> a version exists that is greater than the current one, does not satisfy at least one of its parent's dependencies</li>
 <li><code>major</code> a version exists that is a semver major greater than the current one</li>
 <li><code>minor</code> a version exists that is a semver minor greater than the current one</li>
 <li><code>patch</code> a version exists that is a semver patch greater than the current one</li>
@@ -236,13 +237,24 @@ npm command-line interface
 <p>Some examples:</p>
 <ul>
 <li><code>:root &gt; :outdated(major)</code> returns every direct dependency that has a new semver major release</li>
-<li><code>.prod:outdated(in-range)</code> returns production dependencies that have a new release that satisfies at least one of its edges in</li>
+<li><code>.prod:outdated(in-range)</code> returns production dependencies that have a new release that satisfies at least one of its parent's dependencies</li>
+</ul>
+<h5 id="vuln"><code>:vuln</code></h5>
+<p>The <code>:vuln</code> pseudo selector retrieves data from the registry and returns information about which if your dependencies has a known vulnerability.  Only dependencies whose current version matches a vulnerability will be returned.  For example if you have <code>semver@7.6.0</code> in your tree, a vulnerability for <code>semver</code> which affects versions <code>&lt;=6.3.1</code> will not match.</p>
+<p>You can also filter results by certain attributes in advisories.  Currently that includes <code>severity</code> and <code>cwe</code>.  Note that severity filtering is done per severity, it does not include severities "higher" or "lower" than the one specified.</p>
+<p>In addition to the filtering performed by the pseudo selector, info about each relevant advisory will be added to the <code>queryContext</code> attribute of each node under the <code>advisories</code> attribute.</p>
+<p>Some examples:</p>
+<ul>
+<li><code>:root &gt; .prod:vuln</code> returns direct production dependencies with any known vulnerability</li>
+<li><code>:vuln([severity=high])</code> returns only dependencies with a vulnerability with a <code>high</code> severity.</li>
+<li><code>:vuln([severity=high],[severity=moderate])</code> returns only dependencies with a vulnerability with a <code>high</code>  or <code>moderate</code> severity.</li>
+<li><code>:vuln([cwe=1333])</code> returns only dependencies with a vulnerability that includes CWE-1333 (ReDoS)</li>
 </ul>
 <h4 id="attribute-selectors"><a href="https://developer.mozilla.org/en-US/docs/Web/CSS/Attribute_selectors">Attribute Selectors</a></h4>
 <p>The attribute selector evaluates the key/value pairs in <code>package.json</code> if they are <code>String</code>s.</p>
 <ul>
 <li><code>[]</code> attribute selector (ie. existence of attribute)</li>
-<li><code>[attribute=value]</code> attribute value is equivalant...</li>
+<li><code>[attribute=value]</code> attribute value is equivalent...</li>
 <li><code>[attribute~=value]</code> attribute value contains word...</li>
 <li><code>[attribute*=value]</code> attribute value contains string...</li>
 <li><code>[attribute|=value]</code> attribute value is equal to or starts with...</li>

deps/npm/docs/output/using-npm/scope.html

@@ -228,7 +228,7 @@ project.</p>
 <p>Scopes have a many-to-one relationship with registries: one registry can
 host multiple scopes, but a scope only ever points to one registry.</p>
 <p>You can also associate a scope with a registry using <code>npm config</code>:</p>
-<pre><code class="language-bash">npm config set @myco:registry http://reg.example.com
+<pre><code class="language-bash">npm config set @myco:registry=http://reg.example.com
 </code></pre>
 <p>Once a scope is associated with a registry, any <code>npm install</code> for a package
 with that scope will request packages from that registry instead. Any

deps/npm/docs/output/using-npm/scripts.html

@@ -402,17 +402,14 @@ see this in the script:</p>
 <pre><code class="language-json">{
   "scripts" : {
     "install" : "scripts/install.js",
-    "postinstall" : "scripts/install.js",
-    "uninstall" : "scripts/uninstall.js"
+    "postinstall" : "scripts/install.js"
   }
 }
 </code></pre>
-<p>then <code>scripts/install.js</code> will be called for the install
-and post-install stages of the lifecycle, and <code>scripts/uninstall.js</code>
-will be called when the package is uninstalled.  Since
-<code>scripts/install.js</code> is running for two different phases, it would
-be wise in this case to look at the <code>npm_lifecycle_event</code> environment
-variable.</p>
+<p>then <code>scripts/install.js</code> will be called for the install and post-install
+stages of the lifecycle.  Since <code>scripts/install.js</code> is running for two
+different phases, it would be wise in this case to look at the
+<code>npm_lifecycle_event</code> environment variable.</p>
 <p>If you want to run a make command, you can do so.  This works just
 fine:</p>
 <pre><code class="language-json">{
@@ -433,10 +430,8 @@ file.</p>
 <h3 id="best-practices">Best Practices</h3>
 <ul>
 <li>Don't exit with a non-zero error code unless you <em>really</em> mean it.
-Except for uninstall scripts, this will cause the npm action to
-fail, and potentially be rolled back.  If the failure is minor or
-only will prevent some optional features, then it's better to just
-print a warning and exit successfully.</li>
+If the failure is minor or only will prevent some optional features, then
+it's better to just print a warning and exit successfully.</li>
 <li>Try not to use scripts to do what npm can do for you.  Read through
 <a href="../configuring-npm/package-json.html"><code>package.json</code></a> to see all the things that you can specify and enable
 by simply describing your package appropriately.  In general, this

deps/npm/docs/output/using-npm/workspaces.html

@@ -147,11 +147,11 @@ npm command-line interface
 
 <div id="_content"><h3 id="description">Description</h3>
 <p><strong>Workspaces</strong> is a generic term that refers to the set of features in the
-npm cli that provides support to managing multiple packages from your local
+npm cli that provides support for managing multiple packages from your local
 file system from within a singular top-level, root package.</p>
 <p>This set of features makes up for a much more streamlined workflow handling
-linked packages from the local file system. Automating the linking process
-as part of <code>npm install</code> and avoiding manually having to use <code>npm link</code> in
+linked packages from the local file system. It automates the linking process
+as part of <code>npm install</code> and removes the need to manually use <code>npm link</code> in
 order to add references to packages that should be symlinked into the current
 <code>node_modules</code> folder.</p>
 <p>We also refer to these packages being auto-symlinked during <code>npm install</code> as a
@@ -221,7 +221,7 @@ workspace:</p>
 <p>Note: other installing commands such as <code>uninstall</code>, <code>ci</code>, etc will also
 respect the provided <code>workspace</code> configuration.</p>
 <h3 id="using-workspaces">Using workspaces</h3>
-<p>Given the <a href="https://nodejs.org/dist/latest-v14.x/docs/api/modules.html#modules_all_together">specifities of how Node.js handles module resolution</a> it's possible to consume any defined workspace
+<p>Given the <a href="https://nodejs.org/dist/latest-v14.x/docs/api/modules.html#modules_all_together">specifics of how Node.js handles module resolution</a> it's possible to consume any defined workspace
 by its declared <code>package.json</code> <code>name</code>. Continuing from the example defined
 above, let's also create a Node.js script that will require the workspace <code>a</code>
 example module, e.g:</p>

deps/npm/lib/base-command.js

@@ -5,6 +5,7 @@ const { relative } = require('path')
 const { definitions } = require('@npmcli/config/lib/definitions')
 const getWorkspaces = require('./workspaces/get-workspaces.js')
 const { aliases: cmdAliases } = require('./utils/cmd-list')
+const log = require('./utils/log-shim.js')
 
 class BaseCommand {
   static workspaces = false
@@ -142,6 +143,24 @@ class BaseCommand {
     return this.exec(args)
   }
 
+  // Compare the number of entries with what was expected
+  checkExpected (entries) {
+    if (!this.npm.config.isDefault('expect-results')) {
+      const expected = this.npm.config.get('expect-results')
+      if (!!entries !== !!expected) {
+        log.warn(this.name, `Expected ${expected ? '' : 'no '}results, got ${entries}`)
+        process.exitCode = 1
+      }
+    } else if (!this.npm.config.isDefault('expect-result-count')) {
+      const expected = this.npm.config.get('expect-result-count')
+      if (expected !== entries) {
+        /* eslint-disable-next-line max-len */
+        log.warn(this.name, `Expected ${expected} result${expected === 1 ? '' : 's'}, got ${entries}`)
+        process.exitCode = 1
+      }
+    }
+  }
+
   async setWorkspaces () {
     const includeWorkspaceRoot = this.isArboristCmd
       ? false

deps/npm/lib/commands/dist-tag.js

@@ -89,6 +89,9 @@ class DistTag extends BaseCommand {
 
     log.verbose('dist-tag add', defaultTag, 'to', spec.name + '@' + version)
 
+    // make sure new spec with tag is valid, this will throw if invalid
+    npa(`${spec.name}@${defaultTag}`)
+
     if (!spec.name || !version || !defaultTag) {
       throw this.usageError('must provide a spec with a name and version, and a tag to add')
     }

deps/npm/lib/commands/outdated.js

@@ -1,5 +1,6 @@
-const os = require('os')
-const { resolve } = require('path')
+const os = require('node:os')
+const { resolve } = require('node:path')
+const { stripVTControlCharacters } = require('node:util')
 const pacote = require('pacote')
 const table = require('text-table')
 const npa = require('npm-package-arg')
@@ -22,7 +23,6 @@ class Outdated extends ArboristWorkspaceCmd {
   ]
 
   async exec (args) {
-    const { default: stripAnsi } = await import('strip-ansi')
     const global = resolve(this.npm.globalDir, '..')
     const where = this.npm.global
       ? global
@@ -106,7 +106,7 @@ class Outdated extends ArboristWorkspaceCmd {
 
       const tableOpts = {
         align: ['l', 'r', 'r', 'r', 'l'],
-        stringLength: s => stripAnsi(s).length,
+        stringLength: s => stripVTControlCharacters(s).length,
       }
       this.npm.output(table(outTable, tableOpts))
     }

deps/npm/lib/commands/pack.js

@@ -47,6 +47,9 @@ class Pack extends BaseCommand {
     for (const { arg, manifest } of manifests) {
       const tarballData = await libpack(arg, {
         ...this.npm.flatOptions,
+        foregroundScripts: this.npm.config.isDefault('foreground-scripts')
+          ? true
+          : this.npm.config.get('foreground-scripts'),
         prefix: this.npm.localPrefix,
         workspaces: this.workspacePaths,
       })

deps/npm/lib/commands/publish.js

@@ -80,6 +80,9 @@ class Publish extends BaseCommand {
     // we pass dryRun: true to libnpmpack so it doesn't write the file to disk
     const tarballData = await pack(spec, {
       ...opts,
+      foregroundScripts: this.npm.config.isDefault('foreground-scripts')
+        ? true
+        : this.npm.config.get('foreground-scripts'),
       dryRun: true,
       prefix: this.npm.localPrefix,
       workspaces: this.workspacePaths,

deps/npm/lib/commands/query.js

@@ -50,6 +50,7 @@ class Query extends BaseCommand {
     'workspaces',
     'include-workspace-root',
     'package-lock-only',
+    'expect-results',
   ]
 
   get parsedResponse () {
@@ -81,6 +82,7 @@ class Query extends BaseCommand {
     const items = await tree.querySelectorAll(args[0], this.npm.flatOptions)
     this.buildResponse(items)
 
+    this.checkExpected(this.#response.length)
     this.npm.output(this.parsedResponse)
   }
 
@@ -104,6 +106,7 @@ class Query extends BaseCommand {
       }
       this.buildResponse(items)
     }
+    this.checkExpected(this.#response.length)
     this.npm.output(this.parsedResponse)
   }
 

deps/npm/lib/commands/search.js

@@ -81,12 +81,11 @@ class Search extends BaseCommand {
 
     const filterStream = new FilterStream()
 
-    const { default: stripAnsi } = await import('strip-ansi')
     // Grab a configured output stream that will spit out packages in the desired format.
     const outputStream = await formatSearchStream({
       args, // --searchinclude options are not highlighted
       ...opts,
-    }, stripAnsi)
+    })
 
     log.silly('search', 'searching packages')
     const p = new Pipeline(

deps/npm/lib/commands/view.js

@@ -211,7 +211,13 @@ class View extends BaseCommand {
 
     const data = []
     const versions = pckmnt.versions || {}
-    pckmnt.versions = Object.keys(versions).sort(semver.compareLoose)
+    pckmnt.versions = Object.keys(versions).filter(v => {
+      if (semver.valid(v)) {
+        return true
+      }
+      log.info('view', `Ignoring invalid version: ${v}`)
+      return false
+    }).sort(semver.compareLoose)
 
     // remove readme unless we asked for it
     if (args.indexOf('readme') === -1) {

deps/npm/lib/utils/format-search-stream.js

@@ -1,3 +1,4 @@
+const { stripVTControlCharacters } = require('node:util')
 const { Minipass } = require('minipass')
 const columnify = require('columnify')
 
@@ -15,8 +16,8 @@ const columnify = require('columnify')
 // The returned stream will format this package data
 // into a byte stream of formatted, displayable output.
 
-module.exports = async (opts, clean) => {
-  return opts.json ? new JSONOutputStream() : new TextOutputStream(opts, clean)
+module.exports = async (opts) => {
+  return opts.json ? new JSONOutputStream() : new TextOutputStream(opts)
 }
 
 class JSONOutputStream extends Minipass {
@@ -40,13 +41,11 @@ class JSONOutputStream extends Minipass {
 }
 
 class TextOutputStream extends Minipass {
-  #clean
   #opts
   #line = 0
 
-  constructor (opts, clean) {
+  constructor (opts) {
     super()
-    this.#clean = clean
     this.#opts = opts
   }
 
@@ -56,17 +55,17 @@ class TextOutputStream extends Minipass {
 
   #prettify (data) {
     const pkg = {
-      author: data.maintainers.map((m) => `=${this.#clean(m.username)}`).join(' '),
+      author: data.maintainers.map((m) => `=${stripVTControlCharacters(m.username)}`).join(' '),
       date: 'prehistoric',
-      description: this.#clean(data.description ?? ''),
+      description: stripVTControlCharacters(data.description ?? ''),
       keywords: '',
-      name: this.#clean(data.name),
+      name: stripVTControlCharacters(data.name),
       version: data.version,
     }
     if (Array.isArray(data.keywords)) {
-      pkg.keywords = data.keywords.map((k) => this.#clean(k)).join(' ')
+      pkg.keywords = data.keywords.map((k) => stripVTControlCharacters(k)).join(' ')
     } else if (typeof data.keywords === 'string') {
-      pkg.keywords = this.#clean(data.keywords.replace(/[,\s]+/, ' '))
+      pkg.keywords = stripVTControlCharacters(data.keywords.replace(/[,\s]+/, ' '))
     }
     if (data.date) {
       pkg.date = data.date.toISOString().split('T')[0] // remove time

deps/npm/lib/utils/reify-output.js

@@ -15,6 +15,7 @@ const ms = require('ms')
 const npmAuditReport = require('npm-audit-report')
 const { readTree: getFundingInfo } = require('libnpmfund')
 const auditError = require('./audit-error.js')
+const Table = require('cli-table3')
 
 // TODO: output JSON if flatOptions.json is true
 const reifyOutput = (npm, arb) => {
@@ -41,17 +42,51 @@ const reifyOutput = (npm, arb) => {
   }
 
   if (diff) {
+    let diffTable
+    if (npm.config.get('dry-run') || npm.config.get('long')) {
+      diffTable = new Table({
+        chars: {
+          top: '',
+          'top-mid': '',
+          'top-left': '',
+          'top-right': '',
+          bottom: '',
+          'bottom-mid': '',
+          'bottom-left': '',
+          'bottom-right': '',
+          left: '',
+          'left-mid': '',
+          mid: '',
+          'mid-mid': '',
+          right: '',
+          'right-mid': '',
+          middle: '  ',
+        },
+        style: {
+          'padding-left': 0,
+          'padding-right': 0,
+          border: 0,
+        },
+      })
+    }
+
     depth({
       tree: diff,
       visit: d => {
         switch (d.action) {
           case 'REMOVE':
+            diffTable?.push(['remove', d.actual.name, d.actual.package.version])
             summary.removed++
             break
           case 'ADD':
+            diffTable?.push(['add', d.ideal.name, d.ideal.package.version])
             actualTree.inventory.has(d.ideal) && summary.added++
             break
           case 'CHANGE':
+            diffTable?.push(['change',
+              d.actual.name,
+              d.actual.package.version + ' -> ' + d.ideal.package.version,
+            ])
             summary.changed++
             break
           default:
@@ -62,6 +97,10 @@ const reifyOutput = (npm, arb) => {
       },
       getChildren: d => d.children,
     })
+
+    if (diffTable) {
+      npm.output('\n' + diffTable.toString())
+    }
   }
 
   if (npm.flatOptions.fund) {

deps/npm/lib/utils/update-notifier.js

@@ -98,11 +98,16 @@ const updateNotifier = async (npm, spec = 'latest') => {
     return null
   }
 
+  // intentional.  do not await this.  it's a best-effort update.  if this
+  // fails, it's ok.  might be using /dev/null as the cache or something weird
+  // like that.
+  writeFile(lastCheckedFile(npm), '').catch(() => {})
+
   return updateCheck(npm, spec, version, current)
 }
 
 // only update the notification timeout if we actually finished checking
-module.exports = async npm => {
+module.exports = npm => {
   if (
     // opted out
     !npm.config.get('update-notifier')
@@ -113,14 +118,8 @@ module.exports = async npm => {
     // CI
     || ciInfo.isCI
   ) {
-    return null
+    return Promise.resolve(null)
   }
 
-  const notification = await updateNotifier(npm)
-
-  // intentional.  do not await this.  it's a best-effort update.  if this
-  // fails, it's ok.  might be using /dev/null as the cache or something weird
-  // like that.
-  writeFile(lastCheckedFile(npm), '').catch(() => {})
-  return notification
+  return updateNotifier(npm)
 }

deps/npm/man/man1/npm-access.1

@@ -1,4 +1,4 @@
-.TH "NPM-ACCESS" "1" "January 2024" "" ""
+.TH "NPM-ACCESS" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-access\fR - Set access level on published packages
 .SS "Synopsis"

deps/npm/man/man1/npm-adduser.1

@@ -1,4 +1,4 @@
-.TH "NPM-ADDUSER" "1" "January 2024" "" ""
+.TH "NPM-ADDUSER" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-adduser\fR - Add a registry user account
 .SS "Synopsis"

deps/npm/man/man1/npm-audit.1

@@ -1,4 +1,4 @@
-.TH "NPM-AUDIT" "1" "January 2024" "" ""
+.TH "NPM-AUDIT" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-audit\fR - Run a security audit
 .SS "Synopsis"
@@ -348,7 +348,7 @@ Dependency types specified in \fB--include\fR will not be omitted, regardless of
 .SS "\fBforeground-scripts\fR"
 .RS 0
 .IP \(bu 4
-Default: false
+Default: \fBfalse\fR unless when using \fBnpm pack\fR or \fBnpm publish\fR where it defaults to \fBtrue\fR
 .IP \(bu 4
 Type: Boolean
 .RE 0

deps/npm/man/man1/npm-bugs.1

@@ -1,4 +1,4 @@
-.TH "NPM-BUGS" "1" "January 2024" "" ""
+.TH "NPM-BUGS" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-bugs\fR - Report bugs for a package in a web browser
 .SS "Synopsis"

deps/npm/man/man1/npm-cache.1

@@ -1,4 +1,4 @@
-.TH "NPM-CACHE" "1" "January 2024" "" ""
+.TH "NPM-CACHE" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-cache\fR - Manipulates packages cache
 .SS "Synopsis"

deps/npm/man/man1/npm-ci.1

@@ -1,4 +1,4 @@
-.TH "NPM-CI" "1" "January 2024" "" ""
+.TH "NPM-CI" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-ci\fR - Clean install a project
 .SS "Synopsis"
@@ -147,7 +147,7 @@ When such an override is performed, a warning is printed, explaining the conflic
 .SS "\fBforeground-scripts\fR"
 .RS 0
 .IP \(bu 4
-Default: false
+Default: \fBfalse\fR unless when using \fBnpm pack\fR or \fBnpm publish\fR where it defaults to \fBtrue\fR
 .IP \(bu 4
 Type: Boolean
 .RE 0

deps/npm/man/man1/npm-completion.1

@@ -1,4 +1,4 @@
-.TH "NPM-COMPLETION" "1" "January 2024" "" ""
+.TH "NPM-COMPLETION" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-completion\fR - Tab Completion for npm
 .SS "Synopsis"

deps/npm/man/man1/npm-config.1

@@ -1,4 +1,4 @@
-.TH "NPM-CONFIG" "1" "January 2024" "" ""
+.TH "NPM-CONFIG" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-config\fR - Manage the npm configuration files
 .SS "Synopsis"
@@ -38,7 +38,7 @@ npm set key=value \[lB]key=value...\[rB]
 .fi
 .RE
 .P
-Sets each of the config keys to the value provided.
+Sets each of the config keys to the value provided. Modifies the user configuration file unless \fB\fBlocation\fR\fR \fI\(la/commands/npm-config#location\(ra\fR is passed.
 .P
 If value is omitted, the key will be removed from your config file entirely.
 .P

deps/npm/man/man1/npm-dedupe.1

@@ -1,4 +1,4 @@
-.TH "NPM-DEDUPE" "1" "January 2024" "" ""
+.TH "NPM-DEDUPE" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-dedupe\fR - Reduce duplication in the package tree
 .SS "Synopsis"

deps/npm/man/man1/npm-deprecate.1

@@ -1,4 +1,4 @@
-.TH "NPM-DEPRECATE" "1" "January 2024" "" ""
+.TH "NPM-DEPRECATE" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-deprecate\fR - Deprecate a version of a package
 .SS "Synopsis"

deps/npm/man/man1/npm-diff.1

@@ -1,4 +1,4 @@
-.TH "NPM-DIFF" "1" "January 2024" "" ""
+.TH "NPM-DIFF" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-diff\fR - The registry diff command
 .SS "Synopsis"

deps/npm/man/man1/npm-dist-tag.1

@@ -1,4 +1,4 @@
-.TH "NPM-DIST-TAG" "1" "January 2024" "" ""
+.TH "NPM-DIST-TAG" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-dist-tag\fR - Modify package distribution tags
 .SS "Synopsis"

deps/npm/man/man1/npm-docs.1

@@ -1,4 +1,4 @@
-.TH "NPM-DOCS" "1" "January 2024" "" ""
+.TH "NPM-DOCS" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-docs\fR - Open documentation for a package in a web browser
 .SS "Synopsis"

deps/npm/man/man1/npm-doctor.1

@@ -1,4 +1,4 @@
-.TH "NPM-DOCTOR" "1" "January 2024" "" ""
+.TH "NPM-DOCTOR" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-doctor\fR - Check the health of your npm environment
 .SS "Synopsis"

deps/npm/man/man1/npm-edit.1

@@ -1,4 +1,4 @@
-.TH "NPM-EDIT" "1" "January 2024" "" ""
+.TH "NPM-EDIT" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-edit\fR - Edit an installed package
 .SS "Synopsis"

deps/npm/man/man1/npm-exec.1

@@ -1,4 +1,4 @@
-.TH "NPM-EXEC" "1" "January 2024" "" ""
+.TH "NPM-EXEC" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-exec\fR - Run a command from a local or remote npm package
 .SS "Synopsis"

deps/npm/man/man1/npm-explain.1

@@ -1,4 +1,4 @@
-.TH "NPM-EXPLAIN" "1" "January 2024" "" ""
+.TH "NPM-EXPLAIN" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-explain\fR - Explain installed packages
 .SS "Synopsis"

deps/npm/man/man1/npm-explore.1

@@ -1,4 +1,4 @@
-.TH "NPM-EXPLORE" "1" "January 2024" "" ""
+.TH "NPM-EXPLORE" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-explore\fR - Browse an installed package
 .SS "Synopsis"

deps/npm/man/man1/npm-find-dupes.1

@@ -1,4 +1,4 @@
-.TH "NPM-FIND-DUPES" "1" "January 2024" "" ""
+.TH "NPM-FIND-DUPES" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-find-dupes\fR - Find duplication in the package tree
 .SS "Synopsis"

deps/npm/man/man1/npm-fund.1

@@ -1,4 +1,4 @@
-.TH "NPM-FUND" "1" "January 2024" "" ""
+.TH "NPM-FUND" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-fund\fR - Retrieve funding information
 .SS "Synopsis"

deps/npm/man/man1/npm-help-search.1

@@ -1,4 +1,4 @@
-.TH "NPM-HELP-SEARCH" "1" "January 2024" "" ""
+.TH "NPM-HELP-SEARCH" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-help-search\fR - Search npm help documentation
 .SS "Synopsis"

deps/npm/man/man1/npm-help.1

@@ -1,4 +1,4 @@
-.TH "NPM-HELP" "1" "January 2024" "" ""
+.TH "NPM-HELP" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-help\fR - Get help on npm
 .SS "Synopsis"

deps/npm/man/man1/npm-hook.1

@@ -1,4 +1,4 @@
-.TH "NPM-HOOK" "1" "January 2024" "" ""
+.TH "NPM-HOOK" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-hook\fR - Manage registry hooks
 .SS "Synopsis"

deps/npm/man/man1/npm-init.1

@@ -1,4 +1,4 @@
-.TH "NPM-INIT" "1" "January 2024" "" ""
+.TH "NPM-INIT" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-init\fR - Create a package.json file
 .SS "Synopsis"

deps/npm/man/man1/npm-install-ci-test.1

@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-CI-TEST" "1" "January 2024" "" ""
+.TH "NPM-INSTALL-CI-TEST" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-install-ci-test\fR - Install a project with a clean slate and run tests
 .SS "Synopsis"
@@ -95,7 +95,7 @@ When such an override is performed, a warning is printed, explaining the conflic
 .SS "\fBforeground-scripts\fR"
 .RS 0
 .IP \(bu 4
-Default: false
+Default: \fBfalse\fR unless when using \fBnpm pack\fR or \fBnpm publish\fR where it defaults to \fBtrue\fR
 .IP \(bu 4
 Type: Boolean
 .RE 0

deps/npm/man/man1/npm-install-test.1

@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-TEST" "1" "January 2024" "" ""
+.TH "NPM-INSTALL-TEST" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-install-test\fR - Install package(s) and run tests
 .SS "Synopsis"
@@ -172,7 +172,7 @@ For \fBlist\fR this means the output will be based on the tree described by the
 .SS "\fBforeground-scripts\fR"
 .RS 0
 .IP \(bu 4
-Default: false
+Default: \fBfalse\fR unless when using \fBnpm pack\fR or \fBnpm publish\fR where it defaults to \fBtrue\fR
 .IP \(bu 4
 Type: Boolean
 .RE 0

deps/npm/man/man1/npm-install.1

@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL" "1" "January 2024" "" ""
+.TH "NPM-INSTALL" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-install\fR - Install a package
 .SS "Synopsis"
@@ -534,7 +534,7 @@ For \fBlist\fR this means the output will be based on the tree described by the
 .SS "\fBforeground-scripts\fR"
 .RS 0
 .IP \(bu 4
-Default: false
+Default: \fBfalse\fR unless when using \fBnpm pack\fR or \fBnpm publish\fR where it defaults to \fBtrue\fR
 .IP \(bu 4
 Type: Boolean
 .RE 0

deps/npm/man/man1/npm-link.1

@@ -1,4 +1,4 @@
-.TH "NPM-LINK" "1" "January 2024" "" ""
+.TH "NPM-LINK" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-link\fR - Symlink a package folder
 .SS "Synopsis"

deps/npm/man/man1/npm-login.1

@@ -1,4 +1,4 @@
-.TH "NPM-LOGIN" "1" "January 2024" "" ""
+.TH "NPM-LOGIN" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-login\fR - Login to a registry user account
 .SS "Synopsis"

deps/npm/man/man1/npm-logout.1

@@ -1,4 +1,4 @@
-.TH "NPM-LOGOUT" "1" "January 2024" "" ""
+.TH "NPM-LOGOUT" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-logout\fR - Log out of the registry
 .SS "Synopsis"

deps/npm/man/man1/npm-ls.1

@@ -1,4 +1,4 @@
-.TH "NPM-LS" "1" "January 2024" "" ""
+.TH "NPM-LS" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-ls\fR - List installed packages
 .SS "Synopsis"
@@ -20,7 +20,7 @@ Positional arguments are \fBname@version-range\fR identifiers, which will limit
 .P
 .RS 2
 .nf
-npm@10.3.0 /path/to/npm
+npm@10.5.0 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 .fi

deps/npm/man/man1/npm-org.1

@@ -1,4 +1,4 @@
-.TH "NPM-ORG" "1" "January 2024" "" ""
+.TH "NPM-ORG" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-org\fR - Manage orgs
 .SS "Synopsis"

deps/npm/man/man1/npm-outdated.1

@@ -1,4 +1,4 @@
-.TH "NPM-OUTDATED" "1" "January 2024" "" ""
+.TH "NPM-OUTDATED" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-outdated\fR - Check for outdated packages
 .SS "Synopsis"

deps/npm/man/man1/npm-owner.1

@@ -1,4 +1,4 @@
-.TH "NPM-OWNER" "1" "January 2024" "" ""
+.TH "NPM-OWNER" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-owner\fR - Manage package owners
 .SS "Synopsis"

deps/npm/man/man1/npm-pack.1

@@ -1,4 +1,4 @@
-.TH "NPM-PACK" "1" "January 2024" "" ""
+.TH "NPM-PACK" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-pack\fR - Create a tarball from a package
 .SS "Synopsis"

deps/npm/man/man1/npm-ping.1

@@ -1,4 +1,4 @@
-.TH "NPM-PING" "1" "January 2024" "" ""
+.TH "NPM-PING" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-ping\fR - Ping npm registry
 .SS "Synopsis"

deps/npm/man/man1/npm-pkg.1

@@ -1,4 +1,4 @@
-.TH "NPM-PKG" "1" "January 2024" "" ""
+.TH "NPM-PKG" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-pkg\fR - Manages your package.json
 .SS "Synopsis"

deps/npm/man/man1/npm-prefix.1

@@ -1,4 +1,4 @@
-.TH "NPM-PREFIX" "1" "January 2024" "" ""
+.TH "NPM-PREFIX" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-prefix\fR - Display prefix
 .SS "Synopsis"

deps/npm/man/man1/npm-profile.1

@@ -1,4 +1,4 @@
-.TH "NPM-PROFILE" "1" "January 2024" "" ""
+.TH "NPM-PROFILE" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-profile\fR - Change settings on your registry profile
 .SS "Synopsis"

deps/npm/man/man1/npm-prune.1

@@ -1,4 +1,4 @@
-.TH "NPM-PRUNE" "1" "January 2024" "" ""
+.TH "NPM-PRUNE" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-prune\fR - Remove extraneous packages
 .SS "Synopsis"
@@ -84,7 +84,7 @@ Not supported by all npm commands.
 .SS "\fBforeground-scripts\fR"
 .RS 0
 .IP \(bu 4
-Default: false
+Default: \fBfalse\fR unless when using \fBnpm pack\fR or \fBnpm publish\fR where it defaults to \fBtrue\fR
 .IP \(bu 4
 Type: Boolean
 .RE 0

deps/npm/man/man1/npm-publish.1

@@ -1,4 +1,4 @@
-.TH "NPM-PUBLISH" "1" "January 2024" "" ""
+.TH "NPM-PUBLISH" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-publish\fR - Publish a package
 .SS "Synopsis"

deps/npm/man/man1/npm-query.1

@@ -1,4 +1,4 @@
-.TH "NPM-QUERY" "1" "January 2024" "" ""
+.TH "NPM-QUERY" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-query\fR - Dependency selector query
 .SS "Synopsis"
@@ -138,9 +138,23 @@ an array of dependency objects is returned which can contain multiple copies of
   ...
 .fi
 .RE
-.SS "Package lock only mode"
+.SS "Expecting a certain number of results"
 .P
-If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded. This means that information from the package.json files of your dependencies will not be included in the result set (e.g. description, homepage, engines).
+One common use of \fBnpm query\fR is to make sure there is only one version of a certain dependency in your tree. This is especially common for ecosystems like that rely on \fBtypescript\fR where having state split across two different but identically-named packages causes bugs. You can use the \fB--expect-results\fR or \fB--expect-result-count\fR in your setup to ensure that npm will exit with an exit code if your tree doesn't look like you want it to.
+.P
+.RS 2
+.nf
+$ npm query '#react' --expect-result-count=1
+.fi
+.RE
+.P
+Perhaps you want to quickly check if there are any production dependencies that could be updated:
+.P
+.RS 2
+.nf
+$ npm query ':root>:outdated(in-range).prod' --no-expect-results
+.fi
+.RE
 .SS "Package lock only mode"
 .P
 If package-lock-only is enabled, only the information in the package lock (or shrinkwrap) is loaded. This means that information from the package.json files of your dependencies will not be included in the result set (e.g. description, homepage, engines).
@@ -236,6 +250,30 @@ If set to true, the current operation will only use the \fBpackage-lock.json\fR,
 For \fBupdate\fR this means only the \fBpackage-lock.json\fR will be updated, instead of checking \fBnode_modules\fR and downloading dependencies.
 .P
 For \fBlist\fR this means the output will be based on the tree described by the \fBpackage-lock.json\fR, rather than the contents of \fBnode_modules\fR.
+.SS "\fBexpect-results\fR"
+.RS 0
+.IP \(bu 4
+Default: null
+.IP \(bu 4
+Type: null or Boolean
+.RE 0
+
+.P
+Tells npm whether or not to expect results from the command. Can be either true (expect some results) or false (expect no results).
+.P
+This config can not be used with: \fBexpect-result-count\fR
+.SS "\fBexpect-result-count\fR"
+.RS 0
+.IP \(bu 4
+Default: null
+.IP \(bu 4
+Type: null or Number
+.RE 0
+
+.P
+Tells to expect a specific number of results from the command.
+.P
+This config can not be used with: \fBexpect-results\fR
 .SH "SEE ALSO"
 .RS 0
 .IP \(bu 4

deps/npm/man/man1/npm-rebuild.1

@@ -1,4 +1,4 @@
-.TH "NPM-REBUILD" "1" "January 2024" "" ""
+.TH "NPM-REBUILD" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-rebuild\fR - Rebuild a package
 .SS "Synopsis"
@@ -80,7 +80,7 @@ Set to false to have it not do this. This can be used to work around the fact th
 .SS "\fBforeground-scripts\fR"
 .RS 0
 .IP \(bu 4
-Default: false
+Default: \fBfalse\fR unless when using \fBnpm pack\fR or \fBnpm publish\fR where it defaults to \fBtrue\fR
 .IP \(bu 4
 Type: Boolean
 .RE 0

deps/npm/man/man1/npm-repo.1

@@ -1,4 +1,4 @@
-.TH "NPM-REPO" "1" "January 2024" "" ""
+.TH "NPM-REPO" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-repo\fR - Open package repository page in the browser
 .SS "Synopsis"

deps/npm/man/man1/npm-restart.1

@@ -1,4 +1,4 @@
-.TH "NPM-RESTART" "1" "January 2024" "" ""
+.TH "NPM-RESTART" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-restart\fR - Restart a package
 .SS "Synopsis"

deps/npm/man/man1/npm-root.1

@@ -1,4 +1,4 @@
-.TH "NPM-ROOT" "1" "January 2024" "" ""
+.TH "NPM-ROOT" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-root\fR - Display npm root
 .SS "Synopsis"

deps/npm/man/man1/npm-run-script.1

@@ -1,4 +1,4 @@
-.TH "NPM-RUN-SCRIPT" "1" "January 2024" "" ""
+.TH "NPM-RUN-SCRIPT" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-run-script\fR - Run arbitrary package scripts
 .SS "Synopsis"
@@ -195,7 +195,7 @@ Note that commands explicitly intended to run a particular script, such as \fBnp
 .SS "\fBforeground-scripts\fR"
 .RS 0
 .IP \(bu 4
-Default: false
+Default: \fBfalse\fR unless when using \fBnpm pack\fR or \fBnpm publish\fR where it defaults to \fBtrue\fR
 .IP \(bu 4
 Type: Boolean
 .RE 0

deps/npm/man/man1/npm-sbom.1

@@ -1,4 +1,4 @@
-.TH "NPM-SBOM" "1" "January 2024" "" ""
+.TH "NPM-SBOM" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-sbom\fR - Generate a Software Bill of Materials (SBOM)
 .SS "Synopsis"

deps/npm/man/man1/npm-search.1

@@ -1,4 +1,4 @@
-.TH "NPM-SEARCH" "1" "January 2024" "" ""
+.TH "NPM-SEARCH" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-search\fR - Search for packages
 .SS "Synopsis"

deps/npm/man/man1/npm-shrinkwrap.1

@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP" "1" "January 2024" "" ""
+.TH "NPM-SHRINKWRAP" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-shrinkwrap\fR - Lock down dependency versions for publication
 .SS "Synopsis"

deps/npm/man/man1/npm-star.1

@@ -1,4 +1,4 @@
-.TH "NPM-STAR" "1" "January 2024" "" ""
+.TH "NPM-STAR" "1" "February 2024" "" ""
 .SH "NAME"
 \fBnpm-star\fR - Mark your favorite packages
 .SS "Synopsis"