|
| 1 | +### v2.15.8 (2016-06-17): |
| 2 | + |
| 3 | +There's a very important bug fix and a long-awaited (and signifcant!) |
| 4 | +deprecation in this hotfix release. [Hold on.](http://butt.holdings/) |
| 5 | + |
| 6 | +#### *WHOA* |
| 7 | + |
| 8 | +When Node.js 6.0.0 was released, the CLI team noticed an alarming upsurge in |
| 9 | +bugs related to important files (like `README.md`) not being included in |
| 10 | +published packages. The new bugs looked much like |
| 11 | +[#5082](https://github.com/npm/npm/issues/5082), which had been around in one |
| 12 | +form or another since April, 2014. #5082 used to be a very rare (and obnoxious) |
| 13 | +bug that the CLI team hadn't had much luck reproducing, and we'd basically |
| 14 | +marked it down as a race condition that arose on machines using slow and / or |
| 15 | +rotating-media-based hard drives. |
| 16 | + |
| 17 | +Under 6.0.0, the behavior was reliable enough to be nearly deterministic, and |
| 18 | +made it very difficult for publishers using `.npmignore` files in combination |
| 19 | +with `"files"` stanzas in `package.json` to get their packages onto the |
| 20 | +registry without one or more files missing from the packed tarball. The entire |
| 21 | +saga is contained within [the issue](https://github.com/npm/npm/issues/5082), |
| 22 | +but the summary is that an improvement to the performance of |
| 23 | +[`fs.realpath()`](https://nodejs.org/api/fs.html#fs_fs_realpath_path_options_callback) |
| 24 | +made it much more likely that the packing code would lose the race. |
| 25 | + |
| 26 | +Fixing this has proven to be very difficult, in part because the code used by |
| 27 | +npm to produce package tarballs is more complicated than, strictly speaking, it |
| 28 | +needs to be. [**@evanlucas**](https://github.com/evanlucas) contributed [a |
| 29 | +patch](https://github.com/npm/fstream/pull/50) that passed the tests in a |
| 30 | +[special test suite](https://github.com/othiym23/eliminate-5082) that I |
| 31 | +([**@othiym23**](https://github.com/othiym23)) created (with help from |
| 32 | +[**@addaleax**](https://github.com/addaleax)), but only _after_ we'd released |
| 33 | +the fixed version of that package did we learn that it actually made the |
| 34 | +problem _worse_ in other situations in npm proper. Eventually, |
| 35 | +[**@rvagg**](https://github.com/rvagg) put together a more durable fix that |
| 36 | +appears to completely address the errant behavior under Node.js 6.0.0. That's |
| 37 | +the patch included in this release. Everybody should chip in for redback |
| 38 | +insurance for Rod and his family; he's done the community a huge favor. |
| 39 | + |
| 40 | +Does this mean the long (2+ year) saga of #5082 is now over? At this point, I'm |
| 41 | +going to quote from my latest summary on the issue: |
| 42 | + |
| 43 | +> The CLI team (mostly me, with input from the rest of the team) has decided that |
| 44 | +> the overall complexity of the interaction between `fstream`, `fstream-ignore`, |
| 45 | +> `fstream-npm`, and `node-tar` has grown more convoluted than the team is |
| 46 | +> comfortable (maybe even capable of) supporting. |
| 47 | +> |
| 48 | +> - While I believe that @rvagg's (very targeted) fix addresses _this_ issue, I |
| 49 | +> would be shocked if there aren't other race conditions in npm's packing |
| 50 | +> logic. I've already identified a couple other places in the code that are |
| 51 | +> most likely race conditions, even if they're harder to trigger than the |
| 52 | +> current one. |
| 53 | +> - The way that dependency bundling is integrated leads to a situation in |
| 54 | +> which a bunch of logic is duplicated between `fstream-npm` and |
| 55 | +> `lib/utils/tar.js` in npm itself, and the way `fstream`'s extension |
| 56 | +> mechanism works makes this difficult to clean up. This caused a nasty |
| 57 | +> regression ([#13088](https://github.com/npm/fstream/pull/50), see below) as |
| 58 | +> of ~`npm@3.8.7` where the dependencies of `bundledDependencies` were no |
| 59 | +> longer being included in the built package tarballs. |
| 60 | +> - The interaction between `.npmignore`, `.gitignore`, and `files` is hopelessly |
| 61 | +> complicated, scattered in many places throughout the code. We've been |
| 62 | +> discussing [making the ignores and includes logic clearer and more |
| 63 | +> predictable](https://github.com/npm/npm/wiki/Files-and-Ignores), and the |
| 64 | +> current code fights our efforts to clean that up. |
| 65 | +> |
| 66 | +> So, our intention is still to replace `fstream`, `fstream-ignore`, and |
| 67 | +> `fstream-npm` with something much simpler and purpose-built. There's no real |
| 68 | +> reason to have a stream abstraction here when a simple recursive-descent |
| 69 | +> filesystem visitor and a synchronous function that can answer whether a given |
| 70 | +> path should be included in the packed tarball would do the job adequately. |
| 71 | +> |
| 72 | +> What's not yet clear is whether we'll need to replace `node-tar` in the |
| 73 | +> process. `node-tar` is a very robust implementation of tar (it handles, like, |
| 74 | +> everything), and it also includes some very important tweaks to prevent several |
| 75 | +> classes of security exploits involving maliciously crafted packages. However, |
| 76 | +> its packing API involves passing in an `fstream` instance, so we'd either need |
| 77 | +> to produce something that follows enough of `fstream`'s contract for `node-tar` |
| 78 | +> to keep working, or swap `node-tar` out for something like `tar-stream` (and |
| 79 | +> then ensuring that our use of `tar-stream` is secure, which could involve |
| 80 | +> security patches for either npm or `tar-stream`). |
| 81 | +
|
| 82 | +The testing and review of `fstream@1.0.10` that the team has done leads us to |
| 83 | +believe that this bug is fixed, but I'm feeling more than a little paranoid |
| 84 | +about fstream now, so it's important that people keep a close eye on their |
| 85 | +publishes for a while and let us know immediately if they notice any |
| 86 | +irregularities. |
| 87 | + |
| 88 | +* [`2c49265`](https://github.com/npm/npm/commit/2c49265c6746d29ae0cd5f3532d28c5950f9847e) |
| 89 | + [#5082](https://github.com/npm/npm/issues/5082) `fstream@1.0.10`: Ensure that |
| 90 | + entries are collected after a paused stream resumes. |
| 91 | + ([@rvagg](https://github.com/rvagg)) |
| 92 | +* [`92e4344`](https://github.com/npm/npm/commit/92e43444d9204f749f83512aeab5d5e0a2d085a7) |
| 93 | + [#5082](https://github.com/npm/npm/issues/5082) Remove the warning introduced |
| 94 | + in `npm@3.10.0`, because it should no longer be necessary. |
| 95 | + ([@othiym23](https://github.com/othiym23)) |
| 96 | + |
| 97 | +#### GOODBYE, FAITHFUL FRIEND |
| 98 | + |
| 99 | +At NodeConf Adventure 2016 (RIP in peace, Mikeal Rogers's NodeConf!), the CLI |
| 100 | +team had an opportunity to talk to representatives from some of the larger |
| 101 | +companies that we knew were still using Node.js 0.8 in production. After asking |
| 102 | +them whether they were still using 0.8, we got back blank stares and questions |
| 103 | +like, "0.8? You mean, from four years ago?" After establishing that being able |
| 104 | +to run npm in their legacy environments was no longer necessary, the CLI team |
| 105 | +made the decision to drop support for 0.8. (Faithful observers of our [team |
| 106 | +meetings](https://github.com/npm/npm/issues?utf8=%E2%9C%93&q=is%3Aissue+npm+cli+team+meeting+) |
| 107 | +will have known this was the plan for NodeConf since the beginning of 2016.) |
| 108 | + |
| 109 | +In practice, this means only what's in the commit below: we've removed 0.8 from |
| 110 | +our continuous integration test matrix below, and will no longer be habitually |
| 111 | +testing changes under Node 0.8. We may also give ourselves permission to use |
| 112 | +`setImmediate()` in test code. However, since the project still supports |
| 113 | +Node.js 0.10 and 0.12, it's unlikely that patches that rely on ES 2015 |
| 114 | +functionality will land anytime soon. |
| 115 | + |
| 116 | +Looking forward, the team's current plan is to drop support for Node.js 0.10 |
| 117 | +when its LTS maintenace window expires in October, 2016, and 0.12 when its |
| 118 | +maintenance / LTS window ends at the end of 2016. We will also drop support for |
| 119 | +Node.js 5.x when Node.js 6 becomes LTS and Node.js 7 is released, also in the |
| 120 | +October-December 2016 timeframe. |
| 121 | + |
| 122 | +(Confused about Node.js's LTS policy? [Don't |
| 123 | +be!](https://github.com/nodejs/LTS) If you look at [this |
| 124 | +diagram](https://github.com/nodejs/LTS/blob/ce364a94b0e0619eba570cd57be396573e1ef889/schedule.png), |
| 125 | +it should make all of the preceding clear.) |
| 126 | + |
| 127 | +If, in practice, this doesn't work with distribution packagers or other |
| 128 | +community stakeholders responsible for packaging and distributing Node.js and |
| 129 | +npm, please reach out to us. Aligning the npm CLI's LTS policy with Node's |
| 130 | +helps everybody minimize the amount of work they need to do, and since all of |
| 131 | +our teams are small and very busy, this is somewhere between a necessity and |
| 132 | +non-negotiable. |
| 133 | + |
| 134 | +* [`4a1ecc0`](https://github.com/npm/npm/commit/4a1ecc068fb2660bd9bc3e2e2372aa0176d2193b) |
| 135 | + Remove 0.8 from the Node.js testing matrix, and reorder to match real-world |
| 136 | + priority, with comments. ([@othiym23](https://github.com/othiym23)) |
| 137 | + |
| 138 | +### v2.15.7 (2016-06-16): |
| 139 | + |
| 140 | +It pains me greatly that we haven't been able to fix |
| 141 | +[#5082](https://github.com/npm/npm/issues/5082) yet, but warning you away from |
| 142 | +potentially publishing incomplete packages takes priority over feeling cheesy |
| 143 | +about landing a warning to help keep y'all out of trouble, so here you go |
| 144 | +(_please read this next bit_ (_please clap_)): |
| 145 | + |
| 146 | +#### DANGER: PUBLISHING ON NODE 6.0.0 |
| 147 | + |
| 148 | +Publishing and packing are buggy under Node versions greater than 6.0.0. |
| 149 | +Please use Node.js LTS (4.4.x) to publish packages. See |
| 150 | +[#5082](https://github.com/npm/npm/issues/5082) for details and current |
| 151 | +status. |
| 152 | + |
| 153 | +* [`dff00ce`](https://github.com/npm/npm/commit/dff00cedd56b9c04370f840299a7e657a7a835c6) |
| 154 | + [#13077](https://github.com/npm/npm/pull/13077) |
| 155 | + Warn when using Node 6+. |
| 156 | + ([@othiym23](https://github.com/othiym23)) |
| 157 | + |
| 158 | +#### PACKAGING CHANGES |
| 159 | + |
| 160 | +* [`1877171`](https://github.com/npm/npm/commit/1877171648e20595a82de34073b643f7e01a339f) |
| 161 | + [#12873](https://github.com/npm/npm/issues/12873) |
| 162 | + Ignore `.nyc_output`. This will help avoid an accidental publish or commit filled with |
| 163 | + code coverage data. |
| 164 | + ([@TheAlphaNerd](https://github.com/TheAlphaNerd)) |
| 165 | + |
| 166 | +#### DOCUMENTATION CHANGES |
| 167 | + |
| 168 | +* [`470ae86`](https://github.com/npm/npm/commit/470ae86e052ae2f29ebec15b7547230b6240042e) |
| 169 | + [#12983](https://github.com/npm/npm/pull/12983) |
| 170 | + Describe how to run the lifecycle scripts of dependencies. How you do |
| 171 | + this changed with `npm` v2. |
| 172 | + ([@Tapppi](https://github.com/Tapppi)) |
| 173 | +* [`9cedf37`](https://github.com/npm/npm/commit/9cedf37e5a3e26d0ffd6351af8cac974e3e011c2) |
| 174 | + [#12776](https://github.com/npm/npm/pull/12776) |
| 175 | + Remove mention of `<pkg>` arg for `run-script`. |
| 176 | + ([@fibo](https://github.com/fibo)) |
| 177 | +* [`55b8424`](https://github.com/npm/npm/commit/55b8424d7229f2021cac55f0b03de72403e7c0ff) |
| 178 | + [#12840](https://github.com/npm/npm/pull/12840) |
| 179 | + Remove sexualized language from comment. |
| 180 | + ([@geek](https://github.com/geek)) |
| 181 | +* [`d6bf0c3`](https://github.com/npm/npm/commit/d6bf0c393788a6398bf80b41c57956f2dbcf3b39) |
| 182 | + [#12802](https://github.com/npm/npm/pull/12802) |
| 183 | + Small grammar fix in `doc/cli/npm.md`. |
| 184 | + ([@andresilveira](https://github.com/andresilveira)) |
| 185 | + |
| 186 | +#### DEPENDENCY UPDATES |
| 187 | + |
| 188 | +* [`2c2c568`](https://github.com/npm/npm/commit/2c2c56857ff801d5fe1b6d3157870cd16e65891b) |
| 189 | + `readable-stream@2.1.4`: Brought up to date with Node 6.1.0's streams implementation. |
| 190 | + ([@calvinmetcalf](https://github.com/calvinmetcalf)) |
| 191 | +* [`d682e64`](https://github.com/npm/npm/commit/d682e6445845b0a2584935d5e2942409c43f6916) |
| 192 | + [npm/npm-user-validate#8](https://github.com/npm/npm-user-validate/pull/8) |
| 193 | + `npm-user-validate@0.1.4`: Add a maximum length limit for usernames based on |
| 194 | + the (arbitrary) limit imposed by the primary npm registry. |
| 195 | + ([@aredridel](https://github.com/aredridel)) |
| 196 | +* [`448b65b`](https://github.com/npm/npm/commit/448b65b48cda3b782b714057fb4b8311cc1fa36a) |
| 197 | + `which@1.2.10`: Remove unused dependency `is-absolute`, bug fixes. |
| 198 | + ([@isaacs](https://github.com/isaacs)) |
| 199 | +* [`7d15434`](https://github.com/npm/npm/commit/7d15434f0b0af8e70b119835b21968217224664f) |
| 200 | + `require-inject@1.4.0`: Add `requireInject.withEmptyCache` and |
| 201 | + `requireInject.installGlobally.andClearCache` to support loading modules to be |
| 202 | + injected with an empty cache. |
| 203 | + ([@iarna](https://github.com/iarna)) |
| 204 | +* [`31845c0`](https://github.com/npm/npm/commit/31845c081bc6f3f8a2f3d83a3c792dccffbaa2a8) |
| 205 | + `init-package-json@1.9.4`: |
| 206 | + Replace use of reserved identifier `package` in, uh, the package. |
| 207 | + ([@adius](https://github.com/adius)) |
| 208 | +* [`d73ef3e`](https://github.com/npm/npm/commit/d73ef3e6b18d4905de668c5115bc6042905a02d9) |
| 209 | + `glob@7.0.4`: Use userland `fs.realpath` implementation to get glob working under Node 6. |
| 210 | + ([@isaacs](https://github.com/isaacs)) |
| 211 | +* [`b47da85`](https://github.com/npm/npm/commit/b47da85cf83b946f2c8d29ab612c92028f31f6b0) |
| 212 | + `inflight@1.0.5`: Correct link to package repository, add `"files"` stanza. |
| 213 | + ([@iarna](https://github.com/iarna), [@jamestalmage](https://github.com/jamestalmage)) |
| 214 | +* [`04815e4`](https://github.com/npm/npm/commit/04815e436035de785279fd000cdbc821cc1f3447) |
| 215 | + [npm/npmlog#32](https://github.com/npm/npmlog/pull/32) |
| 216 | + `npmlog@2.0.4`: Add `"files"` stanza to `package.json`. |
| 217 | + ([@jamestalmage](https://github.com/jamestalmage)) |
| 218 | +* [`9e29ad2`](https://github.com/npm/npm/commit/9e29ad227300bb970e7bcd21029944d4733e40db) |
| 219 | + `wrappy@1.0.2`: Add `"files"` stanza to `package.json`. |
| 220 | + ([@jamestalmage](https://github.com/jamestalmage)) |
| 221 | +* [`44af4d4`](https://github.com/npm/npm/commit/44af4d475ac65bdce6d088173273ce4a4f74a49e) |
| 222 | + `abbrev@1.0.9` ([@jorrit](https://github.com/jorrit)) |
| 223 | +* [`6c977c0`](https://github.com/npm/npm/commit/6c977c0031d074479a26c7bec6ec83fd6c6526b2) |
| 224 | + `npm-registry-client@7.1.2`: Add support for newer versions of `npmlog`. |
| 225 | + ([@iarna](https://github.com/iarna)) |
| 226 | + |
| 227 | +### v2.15.6 (2016-05-12): |
| 228 | + |
| 229 | +I have a couple of doc fixes and a shrinkwrap fix for you all this week. |
| 230 | + |
| 231 | +#### PEER DEPENDENCIES AND SHRINKWRAPS |
| 232 | + |
| 233 | +* [`55c998a`](https://github.com/npm/npm/commit/55c998a098a306b90a84beef163a8890f9a616b1) |
| 234 | + [#5135](https://github.com/npm/npm/issues/5135) |
| 235 | + Fix a bug where peerDependencies & shrinkwraps didn't play nice together. (Where |
| 236 | + the peerDependency resolver would end up installing its dep when it wasn't needed.) |
| 237 | + ([@majgis](https://github.com/majgis)) |
| 238 | + |
| 239 | +#### NPM AND `node-gyp` DOCS IMPROVEMENTS |
| 240 | + |
| 241 | +* [`1826908`](https://github.com/npm/npm/commit/1826908b991510d8fbc71a0d0f2c01ff24fd83c2) |
| 242 | + [#12636](https://github.com/npm/npm/pull/12636) |
| 243 | + Improve `npm-scripts` documentation regarding when `node-gyp` is used. |
| 244 | + ([@reconbot](https://github.com/reconbot)) |
| 245 | +* [`f9ff7f3`](https://github.com/npm/npm/commit/f9ff7f36cc2c2c3fbb4f6eef91491b589d049d5f) |
| 246 | + [#12586](https://github.com/npm/npm/pull/12586) |
| 247 | + Correct `package.json` documentation as to when `node-gyp rebuild` called. |
| 248 | + This now matches https://docs.npmjs.com/misc/scripts#default-values |
| 249 | + ([@reconbot](https://github.com/reconbot)) |
| 250 | + |
1 | 251 | ### v2.15.5 (2016-05-05): |
2 | 252 |
|
3 | 253 | This is a minor LTS release, bringing dependencies up to date and updating |
|
0 commit comments