github npm/cli v9.0.0

latest releases: libnpmpack-v6.0.1, libnpmfund-v4.1.1, libnpmexec-v7.0.1...
11 months ago

9.0.0 (2022-10-19)


  • npm is now compatible with the following semver range for node: ^14.17.0 || ^16.13.0 || >=18.0.0
  • npm will no longer attempt to modify ownership of files it creates
  • the presence of auth related settings that are not scoped to a specific registry found in a config file is no longer supported and will throw errors
  • login, adduser, and auth-type changes
    • legacy auth types sso, saml & legacy have been consolidated into "legacy"
    • auth-type defaults to "web"
    • login and adduser are now separate commands that send different data to
      the registry.
    • auth-type config values web and legacy only try
      their respective methods, npm no longer tries them all and waits to see
      which one doesn't fail.
  • npm pack now follows a strict order of operations when applying ignore rules. If a files array is present in the package.json, then rules in .gitignore and .npmignore files from the root will be ignored.
  • links generated from git urls will now use HEAD instead of master as the default ref
  • timing and loglevel changes
    • timing has been removed as a value for --loglevel
    • --timing will show timing information regardless of
      --loglevel, except when --silent
  • --timing file changes:
    • When run with the --timing flag, npm now writes timing data to a
      file alongside the debug log data, respecting the logs-dir option and
      falling back to <CACHE>/_logs/ dir, instead of directly inside the
      cache directory.
    • The timing file data is no longer newline delimited JSON, and instead
      each run will create a uniquely named <ID>-timing.json file, with the
      <ID> portion being the same as the debug log.
    • Finally, the data inside the file now has three top level keys,
      metadata, timers, and unfinishedTimers instead of everything being
      a top level key.
  • npm now outputs some json errors on stdout. Previously npm would output all json formatted errors on stderr, making it difficult to parse as the stderr stream usually has logs already written to it. In the future, npm will differentiate between errors and crashes. Errors, such as E404 and ERESOLVE, will be handled and will continue to be output on stdout. In the case of a crash, npm will log the error as usual but will not attempt to display it as json, even in --json mode. Moving a case from the category of an error to a crash will not be considered a breaking change. For more information see npm/rfcs#482.
  • deprecate boolean install flags in favor of --install-strategy
    • deprecate --global-style, --global now sets --install-strategy=shallow
    • deprecate --legacy-bundling, now sets --install-strategy=nested
  • npm config set will no longer accept deprecated or invalid config options
  • install-links config defaults to "true"
  • node-version config has been removed
  • npm-version config has been removed
  • npm access subcommands have been renamed
  • npm birthday has been removed
  • npm set-script has been removed
  • npm bin has been removed (use npx or npm exec to execute binaries)


Bug Fixes



df77a1f #5707 Update Major Versions of Dependencies


  • @npmcli/config@6.0.1
  • @npmcli/disparity-colors@3.0.0
  • @npmcli/git@4.0.1
  • @npmcli/installed-package-contents@2.0.0
  • @npmcli/map-workspaces@3.0.0
  • @npmcli/metavuln-calculator@5.0.0
  • @npmcli/move-file@3.0.0
  • @npmcli/node-gyp@3.0.0
  • @npmcli/package-json@3.0.0
  • @npmcli/promise-spawn@4.0.0
  • @npmcli/query@3.0.0
  • @npmcli/run-script@5.0.0
  • bin-links@4.0.1
  • cacache@17.0.1
  • ignore-walk@6.0.0
  • init-package-json@4.0.1
  • json-parse-even-better-errors@3.0.0
  • make-fetch-happen@11.0.1
  • normalize-package-data@5.0.0
  • npm-audit-report@4.0.0
  • npm-install-checks@6.0.0
  • npm-packlist@7.0.1
  • npm-pick-manifest@8.0.1
  • npm-profile@7.0.1
  • npm-registry-fetch@14.0.2
  • npmlog@7.0.0
  • pacote@15.0.1
  • parse-conflict-json@3.0.0
  • proc-log@3.0.0
  • read-package-json-fast@3.0.1
  • read-package-json@6.0.0
  • ssri@10.0.0
  • treeverse@3.0.0
  • validate-npm-package-name@5.0.0
  • write-file-atomic@5.0.0


  • @npmcli/fs

Don't miss a new cli release

NewReleases is sending notifications on new releases.