deps: upgrade npm to 5.8.0

PR-URL: https://github.com/nodejs/node/pull/19560
Fixes: https://github.com/nodejs/node/issues/19271
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

5 files changed, 44 insertions, 4 deletions

diff --git a/deps/npm/doc/misc/npm-coding-style.md b/deps/npm/doc/misc/npm-coding-style.md
index e6837bfbf3..1199f63fcc 100644
--- a/deps/npm/doc/misc/npm-coding-style.md
+++ b/deps/npm/doc/misc/npm-coding-style.md
@@ -115,7 +115,7 @@ Good:
 
 ## Whitespace
 
-Put a single space in front of ( for anything other than a function call.
+Put a single space in front of `(` for anything other than a function call.
 Also use a single space wherever it makes things more readable.
 
 Don't leave trailing whitespace at the end of lines.  Don't indent empty
diff --git a/deps/npm/doc/misc/npm-config.md b/deps/npm/doc/misc/npm-config.md
index 0ab0418918..8ff052bc97 100644
--- a/deps/npm/doc/misc/npm-config.md
+++ b/deps/npm/doc/misc/npm-config.md
@@ -284,6 +284,9 @@ This is a list of CIDR address to be used when configuring limited access tokens
 If false, never shows colors.  If `"always"` then always shows colors.
 If true, then only prints color codes for tty file descriptors.
 
+This option can also be changed using the environment: colors are
+disabled when the environment variable `NO_COLOR` is set to any value.
+
 ### depth
 
 * Default: Infinity
@@ -672,6 +675,13 @@ impact how lifecycle scripts are called.
 
 The node version to use when checking a package's `engines` map.
 
+### no-proxy
+
+* Default: null
+* Type: String or Array
+
+A comma-separated string or an array of domain extensions that a proxy should not be used for.
+
 ### offline
 
 * Default: false
@@ -731,6 +741,10 @@ when publishing or changing package permissions with `npm access`.
 If set to false, then ignore `package-lock.json` files when installing. This
 will also prevent _writing_ `package-lock.json` if `save` is true.
 
+When package package-locks are disabled, automatic pruning of extraneous
+modules will also be disabled.  To remove extraneous modules with
+package-locks disabled use `npm prune`.
+
 This option is an alias for `--shrinkwrap`.
 
 ### package-lock-only
@@ -738,7 +752,7 @@ This option is an alias for `--shrinkwrap`.
 * Default: false
 * Type: Boolean
 
-If set to true, it will update only the `package-json`,
+If set to true, it will update only the `package-lock.json`,
 instead of checking `node_modules` and downloading dependencies.
 
 ### parseable
@@ -835,7 +849,7 @@ Remove failed installs.
 
 ### save
 
-* Default: false
+* Default: true
 * Type: Boolean
 
 Save installed packages to a package.json file as dependencies.
diff --git a/deps/npm/doc/misc/npm-developers.md b/deps/npm/doc/misc/npm-developers.md
index 2f54b98fb9..55c8d9b08d 100644
--- a/deps/npm/doc/misc/npm-developers.md
+++ b/deps/npm/doc/misc/npm-developers.md
@@ -57,7 +57,7 @@ least, you need:
   use the name to specify that it runs on node, or is in JavaScript.
   You can use the "engines" field to explicitly state the versions of
   node (or whatever else) that your program requires, and it's pretty
-  well assumed that it's javascript.
+  well assumed that it's JavaScript.
 
   It does not necessarily need to match your github repository name.
 
diff --git a/deps/npm/doc/misc/npm-index.md b/deps/npm/doc/misc/npm-index.md
index 64fb25de2e..1656836709 100644
--- a/deps/npm/doc/misc/npm-index.md
+++ b/deps/npm/doc/misc/npm-index.md
@@ -41,6 +41,10 @@ REMOVED
 
 Manipulates packages cache
 
+### npm-ci(1)
+
+Install a project with a clean slate
+
 ### npm-completion(1)
 
 Tab Completion for npm
diff --git a/deps/npm/doc/misc/semver.md b/deps/npm/doc/misc/semver.md
index 993621a6fd..ab6f72c13e 100644
--- a/deps/npm/doc/misc/semver.md
+++ b/deps/npm/doc/misc/semver.md
@@ -20,6 +20,8 @@ semver.clean('  =v1.2.3   ') // '1.2.3'
 semver.satisfies('1.2.3', '1.x || >=2.5.0 || 5.0.0 - 7.2.3') // true
 semver.gt('1.2.3', '9.8.7') // false
 semver.lt('1.2.3', '9.8.7') // true
+semver.valid(semver.coerce('v2')) // '2.0.0'
+semver.valid(semver.coerce('42.6.7.9.3-alpha')) // '42.6.7'
 ```
 
 As a command-line utility:
@@ -52,6 +54,10 @@ Options:
 -l --loose
         Interpret versions and ranges loosely
 
+-c --coerce
+        Coerce a string into SemVer if possible
+        (does not imply --loose)
+
 Program exits successfully if any valid version satisfies
 all supplied ranges, and prints all satisfying versions.
 
@@ -364,3 +370,19 @@ satisfy the range.
 
 If you want to know if a version satisfies or does not satisfy a
 range, use the `satisfies(version, range)` function.
+
+### Coercion
+
+* `coerce(version)`: Coerces a string to semver if possible
+
+This aims to provide a very forgiving translation of a non-semver
+string to semver. It looks for the first digit in a string, and
+consumes all remaining characters which satisfy at least a partial semver
+(e.g., `1`, `1.2`, `1.2.3`) up to the max permitted length (256 characters).
+Longer versions are simply truncated (`4.6.3.9.2-alpha2` becomes `4.6.3`).
+All surrounding text is simply ignored (`v3.4 replaces v3.3.1` becomes `3.4.0`).
+Only text which lacks digits will fail coercion (`version one` is not valid).
+The maximum  length for any semver component considered for coercion is 16 characters;
+longer components will be ignored (`10000000000000000.4.7.4` becomes `4.7.4`).
+The maximum value for any semver component is `Integer.MAX_SAFE_INTEGER || (2**53 - 1)`;
+higher value components are invalid (`9999999999999999.4.7.4` is likely invalid).