replace npm-registry-client with npm-registry-fetch

.licensee.json

@@ -0,0 +1,9 @@
+{
+  "license": "(MIT OR BSD-2-Clause OR BSD-3-Clause OR Apache-2.0 OR ISC OR Unlicense OR CC-BY-3.0 OR CC0-1.0 OR Artistic-2.0)",
+  "whitelist": {
+    "config-chain": "1.1.12",
+    "cyclist": "0.2.2",
+    "json-schema": "0.2.3",
+    "qrcode-terminal": "0.12.0"
+  }
+}

.travis.yml

@@ -33,3 +33,4 @@ install:
   - "node . install"
 script:
   - "node . run tap -- \"test/tap/*.js\" \"test/broken-under-nyc/*.js\""
+  - "node . run licenses"

AUTHORS

@@ -601,3 +601,14 @@ SneakyFish5 <[email protected]>
 Nikki Everett <[email protected]>
 Erik Price <[email protected]>
 Lars Willighagen <[email protected]>
+Kevin Gibbons <[email protected]>
+Maarten Balliauw <[email protected]>
+Mehdy Dara <[email protected]>
+Robert Kielty <[email protected]>
+Scott Trinh <[email protected]>
+Hugo <[email protected]>
+Jacob <[email protected]>
+Joe Bottigliero <[email protected]>
+Nikolai Vavilov <[email protected]>
+Kelvin Jin <[email protected]>
+乱序 <[email protected]>

CHANGELOG.md

@@ -1,3 +1,134 @@
+## v6.5.0 (2018-11-28):
+
+### NEW FEATURES
+
+* [`fc1a8d185`](https://github.com/npm/cli/commit/fc1a8d185fc678cdf3784d9df9eef9094e0b2dec)
+  Backronym `npm ci` to `npm clean-install`.
+  ([@zkat](https://github.com/zkat))
+* [`4be51a9cc`](https://github.com/npm/cli/commit/4be51a9cc65635bb26fa4ce62233f26e0104bc20)
+  [#81](https://github.com/npm/cli/pull/81)
+  Adds 'Homepage' to outdated --long output.
+  ([@jbottigliero](https://github.com/jbottigliero))
+
+### BUGFIXES
+
+* [`89652cb9b`](https://github.com/npm/cli/commit/89652cb9b810f929f5586fc90cc6794d076603fb)
+  [npm.community#1661](https://npm.community/t/https://npm.community/t/1661)
+  Fix sign-git-commit options. They were previously totally wrong.
+  ([@zkat](https://github.com/zkat))
+* [`414f2d1a1`](https://github.com/npm/cli/commit/414f2d1a1bdffc02ed31ebb48a43216f284c21d4)
+  [npm.community#1742](https://npm.community/t/npm-audit-making-non-rfc-compliant-requests-to-server-resulting-in-400-bad-request-pr-with-fix/1742)
+  Set lowercase headers for npm audit requests.
+  ([@maartenba](https://github.com/maartenba))
+* [`a34246baf`](https://github.com/npm/cli/commit/a34246bafe73218dc9e3090df9ee800451db2c7d)
+  [#75](https://github.com/npm/cli/pull/75)
+  Fix `npm edit` handling of scoped packages.
+  ([@larsgw](https://github.com/larsgw))
+* [`d3e8a7c72`](https://github.com/npm/cli/commit/d3e8a7c7240dd25379a5bcad324a367c58733c73)
+  [npm.community#2303](https://npm.community/t/npm-ci-logs-success-to-stderr/2303)
+  Make summary output for `npm ci` go to `stdout`, not `stderr`.
+  ([@alopezsanchez](https://github.com/alopezsanchez))
+* [`71d8fb4a9`](https://github.com/npm/cli/commit/71d8fb4a94d65e1855f6d0c5f2ad2b7c3202e3c4)
+  [npm.community#1377](https://npm.community/t/unhelpful-error-message-when-publishing-without-logging-in-error-eperm-operation-not-permitted-unlink/1377/3)
+  Close the file descriptor during publish if exiting upload via an error. This
+  will prevent strange error messages when the upload fails and make sure
+  cleanup happens correctly.
+  ([@macdja38](https://github.com/macdja38))
+
+### DOCS UPDATES
+
+* [`b1a8729c8`](https://github.com/npm/cli/commit/b1a8729c80175243fbbeecd164e9ddd378a09a50)
+  [#60](https://github.com/npm/cli/pull/60)
+  Mention --otp flag when prompting for OTP.
+  ([@bakkot](https://github.com/bakkot))
+* [`bcae4ea81`](https://github.com/npm/cli/commit/bcae4ea8173e489a76cc226bbd30dd9eabe21ec6)
+  [#64](https://github.com/npm/cli/pull/64)
+  Clarify that git dependencies use the default branch, not just `master`.
+  ([@zckrs](https://github.com/zckrs))
+* [`15da82690`](https://github.com/npm/cli/commit/15da8269032bf509ade3252978e934f2a61d4499)
+  [#72](https://github.com/npm/cli/pull/72)
+  `bash_completion.d` dir is sometimes found in `/etc` not `/usr/local`.
+  ([@RobertKielty](https://github.com/RobertKielty))
+* [`8a6ecc793`](https://github.com/npm/cli/commit/8a6ecc7936dae2f51638397ff5a1d35cccda5495)
+  [#74](https://github.com/npm/cli/pull/74)
+  Update OTP documentation for `dist-tag add` to clarify `--otp` is needed right
+  now.
+  ([@scotttrinh](https://github.com/scotttrinh))
+* [`dcc03ec85`](https://github.com/npm/cli/commit/dcc03ec858bddd7aa2173b5a86b55c1c2385a2a3)
+  [#82](https://github.com/npm/cli/pull/82)
+  Note that `prepare` runs when installing git dependencies.
+  ([@seishun](https://github.com/seishun))
+* [`a91a470b7`](https://github.com/npm/cli/commit/a91a470b71e08ccf6a75d4fb8c9937789fa8d067)
+  [#83](https://github.com/npm/cli/pull/83)
+  Specify that --dry-run isn't available in older versions of npm publish.
+  ([@kjin](https://github.com/kjin))
+* [`1b2fabcce`](https://github.com/npm/cli/commit/1b2fabccede37242233755961434c52536224de5)
+  [#96](https://github.com/npm/cli/pull/96)
+  Fix inline code tag issue in docs.
+  ([@midare](https://github.com/midare))
+* [`6cc70cc19`](https://github.com/npm/cli/commit/6cc70cc1977e58a3e1ea48e660ffc6b46b390e59)
+  [#68](https://github.com/npm/cli/pull/68)
+  Add semver link and a note on empty string format to `deprecate` doc.
+  ([@neverett](https://github.com/neverett))
+* [`61dbbb7c3`](https://github.com/npm/cli/commit/61dbbb7c3474834031bce88c423850047e8131dc)
+  Fix semver docs after version update.
+  ([@zkat](https://github.com/zkat))
+* [`4acd45a3d`](https://github.com/npm/cli/commit/4acd45a3d0ce92f9999446226fe7dfb89a90ba2e)
+  [#78](https://github.com/npm/cli/pull/78)
+  Correct spelling across various docs.
+  ([@hugovk](https://github.com/hugovk))
+
+### DEPENDENCIES
+
+* [`4f761283e`](https://github.com/npm/cli/commit/4f761283e8896d0ceb5934779005646463a030e8)
+  `[email protected]`
+  ([@zkat](https://github.com/zkat))
+* [`3706db0bc`](https://github.com/npm/cli/commit/3706db0bcbc306d167bb902362e7f6962f2fe1a1)
+  [npm.community#1764](https://npm.community/t/crash-invalid-config-key-requested-error/1764)
+  `[email protected]`
+  ([@zkat](https://github.com/zkat))
+* [`83c2b117d`](https://github.com/npm/cli/commit/83c2b117d0b760d0ea8d667e5e4bdfa6a7a7a8f6)
+  `[email protected]`
+  ([@petkaantonov](https://github.com/petkaantonov))
+* [`2702f46bd`](https://github.com/npm/cli/commit/2702f46bd7284fb303ca2119d23c52536811d705)
+  `[email protected]`
+  ([@watson](https://github.com/watson))
+* [`4db6c3898`](https://github.com/npm/cli/commit/4db6c3898b07100e3a324e4aae50c2fab4b93a04)
+  `[email protected]`:2
+  ([@dawsbot](https://github.com/dawbot))
+* [`70bee4f69`](https://github.com/npm/cli/commit/70bee4f69bb4ce4e18c48582fe2b48d8b4aba566)
+  `[email protected]`
+  ([@isaacs](https://github.com/isaacs))
+* [`e469fd6be`](https://github.com/npm/cli/commit/e469fd6be95333dcaa7cf377ca3620994ca8d0de)
+  `[email protected]`:
+  Fix browser opening under Windows Subsystem for Linux (WSL).
+  ([@thijsputman](https://github.com/thijsputman))
+* [`03840dced`](https://github.com/npm/cli/commit/03840dced865abdca6e6449ea030962e5b19db0c)
+  `[email protected]`
+  ([@iarna](https://github.com/iarna))
+* [`161dc0b41`](https://github.com/npm/cli/commit/161dc0b4177e76306a0e3b8660b3b496cc3db83b)
+  `[email protected]`
+  ([@petkaantonov](https://github.com/petkaantonov))
+* [`bb6f94395`](https://github.com/npm/cli/commit/bb6f94395491576ec42996ff6665df225f6b4377)
+  `[email protected]`:5
+  ([@isaacs](https://github.com/isaacs))
+* [`43b1f4c91`](https://github.com/npm/cli/commit/43b1f4c91fa1d7b3ebb6aa2d960085e5f3ac7607)
+  `[email protected]`
+  ([@isaacs](https://github.com/isaacs))
+* [`ab62afcc4`](https://github.com/npm/cli/commit/ab62afcc472de82c479bf91f560a0bbd6a233c80)
+  `[email protected]`:2
+  ([@isaacs](https://github.com/isaacs))
+* [`027f06be3`](https://github.com/npm/cli/commit/027f06be35bb09f390e46fcd2b8182539939d1f7)
+  `[email protected]`
+  ([@watson](https://github.com/watson))
+
+### MISCELLANEOUS
+
+* [`27217dae8`](https://github.com/npm/cli/commit/27217dae8adbc577ee9cb323b7cfe9c6b2493aca)
+  [#70](https://github.com/npm/cli/pull/70)
+  Automatically audit dependency licenses for npm itself.
+  ([@kemitchell](https://github.com/kemitchell))
+
 ## v6.4.1 (2018-08-22):
 
 ### BUGFIXES
@@ -220,7 +351,7 @@ bumped due to bugs that had been around for a while.
   ([@zkat](https://github.com/zkat))
 * [`21cf0ab68`](https://github.com/npm/cli/commit/21cf0ab68cf528d5244ae664133ef400bdcfbdb6)
   [npm/cli#24](https://github.com/npm/cli/pull/24)
-  Use the defaut OTP explanation everywhere except when the context is
+  Use the default OTP explanation everywhere except when the context is
   "OTP-aware" (like when setting double-authentication). This improves the
   overall CLI messaging when prompting for an OTP code.
   ([@jdeniau](https://github.com/jdeniau))

changelogs/CHANGELOG-2.md

@@ -1,7 +1,7 @@
 ### v2.15.12 (2017-03-24):
 
 This version brings the latest `node-gyp` to a soon to be released Node.js
-4.x.  The `node-gyp` update is paticularly important to Windows folks due to
+4.x.  The `node-gyp` update is particularly important to Windows folks due to
 its addition of Visual Studio 2017 support.
 
 * [`cdd60e733`](https://github.com/npm/npm/commit/cdd60e733905a9994e1d6d832996bfdd12abeaee)
@@ -372,7 +372,7 @@ Node.js 0.10 and 0.12, it's unlikely that patches that rely on ES 2015
 functionality will land anytime soon.
 
 Looking forward, the team's current plan is to drop support for Node.js 0.10
-when its LTS maintenace window expires in October, 2016, and 0.12 when its
+when its LTS maintenance window expires in October, 2016, and 0.12 when its
 maintenance / LTS window ends at the end of 2016. We will also drop support for
 Node.js 5.x when Node.js 6 becomes LTS and Node.js 7 is released, also in the
 October-December 2016 timeframe.
@@ -1507,7 +1507,7 @@ change makes it do.
 
 We _think_ this is what everyone wants, but if this causes problems for you, we
 want to know! If it proves problematic for people we will consider reverting it
-(preferrably before this becomes `npm@latest`).
+(preferably before this becomes `npm@latest`).
 
 Previously, when you ran `npm install foo` we would act as if you typed `npm
 install foo@*`. Now, like any range-type specifier, in addition to matching the
@@ -2742,7 +2742,7 @@ NodeConf Adventure!
   ([@iarna](https://github.com/iarna))
 * [`e02e85d`](https://github.com/npm/npm/commit/e02e85d)
   `[email protected]`: Switches to using the `os-tmpdir` module instead of
-  `os.tmpdir()` for greate consistency in behavior between node versions.
+  `os.tmpdir()` for greater consistency in behavior between node versions.
   ([@iarna](https://github.com/iarna))
 * [`a6f0265`](https://github.com/npm/npm/commit/a6f0265)
   `[email protected]` ([@isaacs](https://github.com/isaacs))
@@ -4588,7 +4588,7 @@ Other changes:
   ([@gfxmonk](https://github.com/gfxmonk))
 * [`989624e`](https://github.com/npm/npm/commit/989624e8321f87734c1b1272fc2f646e7af1f81c)
   [#6767](https://github.com/npm/npm/issues/6767) Actually pass parameters when
-  adding git repo to cach under Windows.
+  adding git repo to cache under Windows.
   ([@othiym23](https://github.com/othiym23))
 * [`657af73`](https://github.com/npm/npm/commit/657af7308f7d6cd2f81389fcf0d762252acaf1ce)
   [#6774](https://github.com/npm/npm/issues/6774) When verifying paths on

changelogs/CHANGELOG-3.md

@@ -2143,7 +2143,7 @@ This release includes an updated `node-gyp` with fixes for Android.
   ([@watilde](https://github.com/watilde))
 * [`47928cd`](https://github.com/npm/npm/commit/47928cd6264e1d6d0ef67435b71c66d01bea664a)
   [#11003](https://github.com/npm/npm/issues/11003)
-  Remove "verison" typo from the help listing.
+  Remove "version" typo from the help listing.
   ([@doug-wade](https://github.com/doug-wade))
 
 #### MORE COMPLETE CONFIG LISTINGS
@@ -3473,7 +3473,7 @@ Hey, you found the feature we added!
   folder with the same layout as global modules.  Only your direct
   dependencies will show in `node_modules` and everything they depend on
   will be flattened in their `node_modules` folders.  This obviously will
-  elminate some deduping.
+  eliminate some deduping.
   ([@iarna](https://github.com/iarna))
 
 #### TYPOS IN THE LICENSE, OH MY
@@ -3492,7 +3492,7 @@ this change makes it do.
 
 We _think_ this is what everyone wants, but if this causes problems for
 you, we want to know! If it proves problematic for people we will consider
-reverting it (preferrably before this becomes `npm@latest`).
+reverting it (preferably before this becomes `npm@latest`).
 
 Previously, when you ran `npm install foo` we would act as if you typed
 `npm install foo@*`. Now, like any range-type specifier, in addition to
@@ -4070,7 +4070,7 @@ in line with `npm@2`.
 
 * [`95ee92c`](https://github.com/npm/npm/commit/95ee92c)
   [#9433](https://github.com/npm/npm/issues/9433)
-  Give better error messages for invalid URLs in the dependecy
+  Give better error messages for invalid URLs in the dependency
   list.
   ([@jamietre](https://github.com/jamietre))
 

changelogs/CHANGELOG-4.md

@@ -296,7 +296,7 @@ Also there's maybe a bit of an easter egg in this release. 'Cause those are fun
 ### v4.4.1 (2017-03-06):
 
 This is a quick little patch release to forgo the update notification
-checker if you're on an unsuported (but not otherwise broken) version of
+checker if you're on an unsupported (but not otherwise broken) version of
 Node.js.  Right now that means 0.10 or 0.12.
 
 * [`56ac249`](https://github.com/npm/npm/commit/56ac249ef8ede1021f1bc62a0e4fe1e9ba556af2)
@@ -1434,7 +1434,7 @@ install`, and `prepublishOnly` will be removed, leaving `prepare` and
 
 * [`9b4a227`](https://github.com/npm/npm/commit/9b4a2278cee0a410a107c8ea4d11614731e0a943) [`bc32078`](https://github.com/npm/npm/commit/bc32078fa798acef0e036414cb448645f135b570)
   [#14290](https://github.com/npm/npm/pull/14290)
-  Add `prepare` and `prepublishOnly` lifecyle events.
+  Add `prepare` and `prepublishOnly` lifecycle events.
   ([@othiym23](https://github.com/othiym23))
 * [`52fdefd`](https://github.com/npm/npm/commit/52fdefddb48f0c39c6e8eb4c118eb306c9436117)
   [#14290](https://github.com/npm/npm/pull/14290)

changelogs/CHANGELOG-5.md

@@ -1285,7 +1285,7 @@ had been held by 1.3.16 since _December of 2013_.
 If you can't get enough of the bleeding edge, I encourage you to check out
 our canary release of npm. Get it with `npm install -g npmc`. It's going to
 be seeing some exciting stuff in the next couple of weeks, starting with a
-rewriten `npm dedupe`, but moving on to… well, you'll just have to wait and
+rewritten `npm dedupe`, but moving on to… well, you'll just have to wait and
 find out.
 
 ### PERFORMANCE
@@ -1911,7 +1911,7 @@ right? Here's what's bumping that number for us this time:
   ([@KennethKinLum](https://github.com/KennethKinLum))
 * [`c9b534a14`](https://github.com/npm/npm/commit/c9b534a148818d1a97787c0dfdba5f64ce3618a6)
   [#17074](https://github.com/npm/npm/pull/17074)
-  Clarify config documention with multiple boolean flags.
+  Clarify config documentation with multiple boolean flags.
   ([@KennethKinLum](https://github.com/KennethKinLum))
 * [`e111b0a40`](https://github.com/npm/npm/commit/e111b0a40c4bc6691d7b8d67ddce5419e67bfd27)
   [#16768](https://github.com/npm/npm/pull/16768)
@@ -2117,7 +2117,7 @@ added 234 packages in .005ms
   Fix a crash while installing with `--no-shrinkwrap`.
   ([@jacknagel](https://github.com/jacknagel))
 
-### DOC UPATES
+### DOC UPDATES
 
 * [`89e0cb816`](https://github.com/npm/npm/commit/89e0cb8165dd9c3c7ac74d531617f367099608f4)
   [#16818](https://github.com/npm/npm/pull/16818)

doc/cli/npm-access.md

@@ -9,6 +9,9 @@ npm-access(1) -- Set access level on published packages
     npm access grant <read-only|read-write> <scope:team> [<package>]
     npm access revoke <scope:team> [<package>]
 
+    npm access 2fa-required [<package>]
+    npm access 2fa-not-required [<package>]
+
     npm access ls-packages [<user>|<scope>|<scope:team>]
     npm access ls-collaborators [<package> [<user>]]
     npm access edit [<package>]
@@ -28,6 +31,10 @@ subcommand.
   Add or remove the ability of users and teams to have read-only or read-write
   access to a package.
 
+* 2fa-required / 2fa-not-required:
+  Configure whether a package requires that anyone publishing it have two-factor
+  authentication enabled on their account.
+
 * ls-packages:
   Show all of the packages a user or a team is able to access, along with the
   access level, except for read-only public packages (it won't print the whole
@@ -70,6 +77,7 @@ Management of teams and team memberships is done with the `npm team` command.
 
 ## SEE ALSO
 
+* [`libnpmaccess`](https://npm.im/libnpmaccess)
 * npm-team(1)
 * npm-publish(1)
 * npm-config(7)

doc/cli/npm-ci.md

@@ -39,9 +39,10 @@ cache:
 
 This command is similar to `npm-install(1)`, except it's meant to be used in
 automated environments such as test platforms, continuous integration, and
-deployment. It can be significantly faster than a regular npm install by
-skipping certain user-oriented features. It is also more strict than a regular
-install, which can help catch errors or inconsistencies caused by the
+deployment -- or any situation where you want to make sure you're doing a clean
+install of your dependencies. It can be significantly faster than a regular npm
+install by skipping certain user-oriented features. It is also more strict than
+a regular install, which can help catch errors or inconsistencies caused by the
 incrementally-installed local environments of most npm users.
 
 In short, the main differences between using `npm install` and `npm ci` are:

doc/cli/npm-completion.md

@@ -17,9 +17,10 @@ everywhere:
     npm completion >> ~/.bashrc
     npm completion >> ~/.zshrc
 
-You may of course also pipe the output of npm completion to a file
-such as `/usr/local/etc/bash_completion.d/npm` if you have a system
-that will read that file for you.
+You may of course also pipe the output of `npm completion` to a file
+such as `/usr/local/etc/bash_completion.d/npm` or 
+`/etc/bash_completion.d/npm` if you have a system that will read 
+that file for you.
 
 When `COMP_CWORD`, `COMP_LINE`, and `COMP_POINT` are defined in the
 environment, `npm completion` acts in "plumbing mode", and outputs

doc/cli/npm-deprecate.md

@@ -10,15 +10,17 @@ npm-deprecate(1) -- Deprecate a version of a package
 This command will update the npm registry entry for a package, providing
 a deprecation warning to all who attempt to install it.
 
-It works on version ranges as well as specific versions, so you can do
-something like this:
+It works on [version ranges](https://semver.npmjs.com/) as well as specific 
+versions, so you can do something like this:
 
     npm deprecate my-thing@"< 0.2.3" "critical bug fixed in v0.2.3"
 
 Note that you must be the package owner to deprecate something.  See the
 `owner` and `adduser` help topics.
 
-To un-deprecate a package, specify an empty string (`""`) for the `message` argument.
+To un-deprecate a package, specify an empty string (`""`) for the `message` 
+argument. Note that you must use double quotes with no space between them to 
+format an empty string.
 
 ## SEE ALSO
 

doc/cli/npm-dist-tag.md

@@ -15,9 +15,9 @@ Add, remove, and enumerate distribution tags on a package:
 
 * add:
   Tags the specified version of the package with the specified tag, or the
-  `--tag` config if not specified. If the tag you're adding is `latest` and you
-  have two-factor authentication on auth-and-writes then you'll need to include
-  an otp on the command line with `--otp`.
+  `--tag` config if not specified. If you have two-factor authentication on
+  auth-and-writes then you’ll need to include a one-time password on the
+  command line with `--otp <one-time password>`.
 
 * rm:
   Clear a tag that is no longer in use from the package.