deps: upgrade npm to 3.6.0

PR-URL: https://github.com/nodejs/node/pull/4958
Reviewed-By: Myles Borins <mborins@us.ibm.com>
Reviewed-By: Kat Marchán <kzm@sykosomatic.org>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Jeremiah Senkpiel <fishrock123@rocketmail.com>

44 files changed, 2081 insertions, 363 deletions

diff --git a/deps/npm/test/common-tap.js b/deps/npm/test/common-tap.js
index 915910a9cf..d7e9c8f7d0 100644
--- a/deps/npm/test/common-tap.js
+++ b/deps/npm/test/common-tap.js
@@ -12,12 +12,17 @@ var path = require('path')
 var port = exports.port = 1337
 exports.registry = 'http://localhost:' + port
 process.env.npm_config_loglevel = 'error'
+process.env.npm_config_progress = 'false'
 
 var npm_config_cache = path.resolve(__dirname, 'npm_cache')
 process.env.npm_config_cache = exports.npm_config_cache = npm_config_cache
 process.env.npm_config_userconfig = exports.npm_config_userconfig = path.join(__dirname, 'fixtures', 'config', 'userconfig')
 process.env.npm_config_globalconfig = exports.npm_config_globalconfig = path.join(__dirname, 'fixtures', 'config', 'globalconfig')
+process.env.npm_config_global_style = 'false'
+process.env.npm_config_legacy_bundling = 'false'
 process.env.random_env_var = 'foo'
+// suppress warnings about using a prerelease version of node
+process.env.npm_config_node_version = process.version.replace(/-.*$/, '')
 
 var bin = exports.bin = require.resolve('../bin/npm-cli.js')
 var chain = require('slide').chain
diff --git a/deps/npm/test/packages/npm-test-bundled-git/minimatch-expected.json b/deps/npm/test/packages/npm-test-bundled-git/minimatch-expected.json
index 62b20d698e..3cb08daaa4 100644
--- a/deps/npm/test/packages/npm-test-bundled-git/minimatch-expected.json
+++ b/deps/npm/test/packages/npm-test-bundled-git/minimatch-expected.json
@@ -1,5 +1,4 @@
 {
-  "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
   "name": "minimatch",
   "description": "a glob matcher in javascript",
   "version": "0.2.1",
diff --git a/deps/npm/test/packages/npm-test-bundled-git/test.js b/deps/npm/test/packages/npm-test-bundled-git/test.js
index 793cc55a88..1901ac448d 100644
--- a/deps/npm/test/packages/npm-test-bundled-git/test.js
+++ b/deps/npm/test/packages/npm-test-bundled-git/test.js
@@ -1,4 +1,6 @@
 var a = require('./node_modules/glob/node_modules/minimatch/package.json')
 var e = require('./minimatch-expected.json')
 var assert = require('assert')
-assert.deepEqual(a, e, "didn't get expected minimatch/package.json")
+Object.keys(e).forEach(function (key) {
+  assert.deepEqual(a[key], e[key], "didn't get expected minimatch/package.json")
+})
diff --git a/deps/npm/test/tap/00-config-setup.js b/deps/npm/test/tap/00-config-setup.js
index 0d267851eb..0310f48d5c 100644
--- a/deps/npm/test/tap/00-config-setup.js
+++ b/deps/npm/test/tap/00-config-setup.js
@@ -61,7 +61,11 @@ try {
   fs.statSync(projectConf)
 } catch (er) {
   // project conf not found, probably working with packed npm
-  fs.writeFileSync(projectConf, 'save-prefix = ~\nproprietary-attribs = false\n')
+  fs.writeFileSync(projectConf, function () {/*
+save-prefix = ~
+proprietary-attribs = false
+legacy-bundling = true
+  */}.toString().split('\n').slice(1, -1).join('\n'))
 }
 
 var projectRc = path.join(__dirname, '..', 'fixtures', 'config', '.npmrc')
diff --git a/deps/npm/test/tap/404-private-registry-scoped.js b/deps/npm/test/tap/404-private-registry-scoped.js
index 681fff05e8..84251b113c 100644
--- a/deps/npm/test/tap/404-private-registry-scoped.js
+++ b/deps/npm/test/tap/404-private-registry-scoped.js
@@ -1,22 +1,38 @@
-var nock = require('nock')
 var test = require('tap').test
-var npm = require('../../')
-var addNamed = require('../../lib/cache/add-named')
+var common = require('../common-tap.js')
+var mr = require('npm-registry-mock')
+var server
 
-test('scoped package names not mangled on error with non-root registry', function test404 (t) {
-  nock('http://localhost:1337')
-    .get('/registry/@scope%2ffoo')
-    .reply(404, {
-      error: 'not_found',
-      reason: 'document not found'
-    })
+test('setup', function (t) {
+  mr({port: common.port, throwOnUnmatched: true}, function (err, s) {
+    t.ifError(err, 'registry mocked successfully')
+    server = s
+    t.end()
+  })
+})
 
-  npm.load({registry: 'http://localhost:1337/registry', global: true}, function () {
-    addNamed('@scope/foo', '*', null, function checkError (err) {
-      t.ok(err, 'should error')
-      t.equal(err.message, '404 Not Found: @scope/foo', 'should have package name in error')
-      t.equal(err.pkgid, '@scope/foo', 'err.pkgid should match package name')
+test('scoped package names not mangled on error with non-root registry', function (t) {
+  common.npm(
+    [
+      'cache',
+      'add',
+      '@scope/foo@*',
+      '--force'
+    ],
+    {},
+    function (er, code, stdout, stderr) {
+      t.ifError(er, 'correctly handled 404')
+      t.equal(code, 1, 'exited with error')
+      t.match(stderr, /404 Not found/, 'should notify the sort of error as a 404')
+      t.match(stderr, /@scope\/foo/, 'should have package name in error')
       t.end()
-    })
-  })
+    }
+  )
+})
+
+test('cleanup', function (t) {
+  t.pass('cleaned up')
+  server.done()
+  server.close()
+  t.end()
 })
diff --git a/deps/npm/test/tap/404-private-registry.js b/deps/npm/test/tap/404-private-registry.js
index dfe893eb1c..a30f61432a 100644
--- a/deps/npm/test/tap/404-private-registry.js
+++ b/deps/npm/test/tap/404-private-registry.js
@@ -1,25 +1,40 @@
-var nock = require('nock')
+require('../common-tap')
 var test = require('tap').test
 var path = require('path')
-var npm = require('../../')
-var addNamed = require('../../lib/cache/add-named')
+var common = require('../common-tap.js')
+var mr = require('npm-registry-mock')
+var server
 
 var packageName = path.basename(__filename, '.js')
 
-test('package names not mangled on error with non-root registry', function test404 (t) {
-  nock('http://localhost:1337')
-    .get('/registry/' + packageName)
-    .reply(404, {
-      error: 'not_found',
-      reason: 'document not found'
-    })
+test('setup', function (t) {
+  mr({port: common.port, throwOnUnmatched: true}, function (err, s) {
+    t.ifError(err, 'registry mocked successfully')
+    server = s
+    t.end()
+  })
+})
 
-  npm.load({registry: 'http://localhost:1337/registry', global: true}, function () {
-    addNamed(packageName, '*', null, function checkError (err) {
-      t.ok(err, 'should error')
-      t.equal(err.message, '404 Not Found: ' + packageName, 'should have package name in error')
-      t.equal(err.pkgid, packageName, 'err.pkgid should match package name')
+test('package names not mangled on error with non-root registry', function (t) {
+  common.npm(
+    [
+      'cache',
+      'add',
+      packageName + '@*'
+    ],
+    {},
+    function (er, code, stdout, stderr) {
+      t.ifError(er, 'correctly handled 404')
+      t.equal(code, 1, 'exited with error')
+      t.match(stderr, packageName, 'should have package name in error')
       t.end()
-    })
-  })
+    }
+  )
+})
+
+test('cleanup', function (t) {
+  t.pass('cleaned up')
+  server.done()
+  server.close()
+  t.end()
 })
diff --git a/deps/npm/test/tap/access.js b/deps/npm/test/tap/access.js
index 5feb892329..4bed4b4b25 100644
--- a/deps/npm/test/tap/access.js
+++ b/deps/npm/test/tap/access.js
@@ -59,6 +59,48 @@ test('npm access public on current package', function (t) {
   )
 })
 
+test('npm access public when no package passed and no package.json', function (t) {
+  // need to simulate a missing package.json
+  var missing = path.join(__dirname, 'access-public-missing-guard')
+  mkdirp.sync(path.join(missing, 'node_modules'))
+
+  common.npm([
+    'access',
+    'public',
+    '--registry', common.registry
+  ], {
+    cwd: missing
+  },
+  function (er, code, stdout, stderr) {
+    t.ifError(er, 'npm access')
+    t.match(stderr, /no package name passed to command and no package.json found/)
+    rimraf.sync(missing)
+    t.end()
+  })
+})
+
+test('npm access public when no package passed and invalid package.json', function (t) {
+  // need to simulate a missing package.json
+  var invalid = path.join(__dirname, 'access-public-invalid-package')
+  mkdirp.sync(path.join(invalid, 'node_modules'))
+  // it's hard to force `read-package-json` to break w/o ENOENT, but this will do it
+  fs.writeFileSync(path.join(invalid, 'package.json'), '{\n')
+
+  common.npm([
+    'access',
+    'public',
+    '--registry', common.registry
+  ], {
+    cwd: invalid
+  },
+  function (er, code, stdout, stderr) {
+    t.ifError(er, 'npm access')
+    t.match(stderr, /Failed to parse json/)
+    rimraf.sync(invalid)
+    t.end()
+  })
+})
+
 test('npm access restricted on current package', function (t) {
   server.post('/-/package/%40scoped%2Fpkg/access', JSON.stringify({
     access: 'restricted'
@@ -214,6 +256,33 @@ test('npm access revoke', function (t) {
   )
 })
 
+test('npm access ls-packages with no team', function (t) {
+  var serverPackages = {
+    '@foo/bar': 'write',
+    '@foo/util': 'read'
+  }
+  var clientPackages = {
+    '@foo/bar': 'read-write',
+    '@foo/util': 'read-only'
+  }
+  server.get(
+    '/-/org/username/package?format=cli'
+  ).reply(200, serverPackages)
+  common.npm(
+    [
+      'access',
+      'ls-packages',
+      '--registry', common.registry
+    ],
+    { cwd: pkg },
+    function (er, code, stdout, stderr) {
+      t.ifError(er, 'npm access ls-packages')
+      t.same(JSON.parse(stdout), clientPackages)
+      t.end()
+    }
+  )
+})
+
 test('npm access ls-packages on team', function (t) {
   var serverPackages = {
     '@foo/bar': 'write',
@@ -301,6 +370,42 @@ test('npm access ls-packages on user', function (t) {
   )
 })
 
+test('npm access ls-packages with no package specified or package.json', function (t) {
+  // need to simulate a missing package.json
+  var missing = path.join(__dirname, 'access-missing-guard')
+  mkdirp.sync(path.join(missing, 'node_modules'))
+
+  var serverPackages = {
+    '@foo/bar': 'write',
+    '@foo/util': 'read'
+  }
+  var clientPackages = {
+    '@foo/bar': 'read-write',
+    '@foo/util': 'read-only'
+  }
+  server.get(
+    '/-/org/myorg/package?format=cli'
+  ).reply(404, {error: 'nope'})
+  server.get(
+    '/-/user/myorg/package?format=cli'
+  ).reply(200, serverPackages)
+  common.npm(
+    [
+      'access',
+      'ls-packages',
+      'myorg',
+      '--registry', common.registry
+    ],
+    { cwd: missing },
+    function (er, code, stdout, stderr) {
+      t.ifError(er, 'npm access ls-packages')
+      t.same(JSON.parse(stdout), clientPackages)
+      rimraf.sync(missing)
+      t.end()
+    }
+  )
+})
+
 test('npm access ls-collaborators on current', function (t) {
   var serverCollaborators = {
     'myorg:myteam': 'write',
diff --git a/deps/npm/test/tap/add-named-update-protocol-port.js b/deps/npm/test/tap/add-named-update-protocol-port.js
index 5993b07c9a..78130e2f89 100644
--- a/deps/npm/test/tap/add-named-update-protocol-port.js
+++ b/deps/npm/test/tap/add-named-update-protocol-port.js
@@ -1,9 +1,10 @@
 'use strict'
 var path = require('path')
-var nock = require('nock')
 var test = require('tap').test
-var npm = require('../../')
-var addNamed = require('../../lib/cache/add-named')
+var common = require('../common-tap')
+var mr = require('npm-registry-mock')
+var server1
+var server2
 
 var packageName = path.basename(__filename, '.js')
 
@@ -36,44 +37,76 @@ var fooiPkg = {
   }
 }
 
-test('tarball paths should update port if updating protocol', function (t) {
-  nock('http://localhost:1337/registry')
-    .get('/' + packageName)
-    .reply(200, fooPkg)
-
-  nock('http://localhost:1337/registry')
-    .get('/' + packageName + '/-/' + packageName + '-0.0.0.tgz')
-    .reply(200, '1')
-
-  nock('http://localhost:1338/registry')
-    .get('/' + packageName + '/-/' + packageName + '-0.0.0.tgz')
-    .reply(404)
-
-  npm.load({registry: 'http://localhost:1337/registry', global: true}, function () {
-    addNamed(packageName, '0.0.0', null, function checkPath (err, pkg) {
-      t.ifError(err, 'addNamed worked')
+test('setup', function (t) {
+  mr({
+    port: 1337,
+    throwOnUnmatched: true
+  }, function (err, s) {
+    t.ifError(err, 'registry mocked successfully')
+    server1 = s
+    mr({
+      port: 1338,
+      throwOnUnmatched: true
+    }, function (err, s) {
+      t.ifError(err, 'registry mocked successfully')
+      server2 = s
       t.end()
     })
   })
 })
 
-test('tarball paths should NOT update if different hostname', function (t) {
-  nock('http://localhost:1337/registry')
-    .get('/' + iPackageName)
-    .reply(200, fooiPkg)
+test('tarball paths should update port if updating protocol', function (t) {
+  server1.get('/registry/' + packageName).reply(200, fooPkg)
+  server1.get(
+    '/registry/' + packageName + '/-/' + packageName + '-0.0.0.tgz'
+  ).reply(200, '1')
 
-  nock('http://127.0.0.1:1338/registry')
-    .get('/' + iPackageName + '/-/' + iPackageName + '-0.0.0.tgz')
-    .reply(200, '1')
+  common.npm(
+    [
+      'cache',
+      'add',
+      packageName + '@0.0.0',
+      '--registry',
+      'http://localhost:1337/registry'
+    ],
+    {},
+    function (er, code, stdout, stderr) {
+      if (er) { throw er }
+      t.equal(code, 0, 'addNamed worked')
+      server1.done()
+      t.end()
+    }
+  )
+})
 
-  nock('http://127.0.0.1:1337/registry')
-    .get('/' + iPackageName + '/-/' + iPackageName + '-0.0.0.tgz')
-    .reply(404)
+test('tarball paths should NOT update if different hostname', function (t) {
+  server1.get('/registry/' + iPackageName).reply(200, fooiPkg)
+  server2.get(
+    '/registry/' + iPackageName + '/-/' + iPackageName + '-0.0.0.tgz'
+  ).reply(200, '1')
 
-  npm.load({registry: 'http://localhost:1337/registry', global: true}, function () {
-    addNamed(iPackageName, '0.0.0', null, function checkPath (err, pkg) {
-      t.ifError(err, 'addNamed worked')
+  common.npm(
+    [
+      'cache',
+      'add',
+      iPackageName + '@0.0.0',
+      '--registry',
+      'http://localhost:1337/registry'
+    ],
+    {},
+    function (er, code, stdout, stderr) {
+      if (er) { throw er }
+      t.equal(code, 0, 'addNamed worked')
+      server1.done()
+      server2.done()
       t.end()
-    })
-  })
+    }
+  )
+})
+
+test('cleanup', function (t) {
+  t.pass('cleaned up')
+  server1.close()
+  server2.close()
+  t.end()
 })
diff --git a/deps/npm/test/tap/add-remote-git-fake-windows.js b/deps/npm/test/tap/add-remote-git-fake-windows.js
index 33b38781a8..24175c5455 100644
--- a/deps/npm/test/tap/add-remote-git-fake-windows.js
+++ b/deps/npm/test/tap/add-remote-git-fake-windows.js
@@ -20,7 +20,7 @@ var pjParent = JSON.stringify({
   name: 'parent',
   version: '1.2.3',
   dependencies: {
-    child: 'git://localhost:1233/child.git'
+    child: 'git://localhost:1234/child.git'
   }
 }, null, 2) + '\n'
 
@@ -92,7 +92,8 @@ function setup (cb) {
           '--listen=localhost',
           '--export-all',
           '--base-path=.',
-          '--port=1233'
+          '--reuseaddr',
+          '--port=1234'
         ],
         {
           cwd: pkg,
diff --git a/deps/npm/test/tap/add-remote-git-shrinkwrap.js b/deps/npm/test/tap/add-remote-git-shrinkwrap.js
index d734c11cfe..b79405c2b8 100644
--- a/deps/npm/test/tap/add-remote-git-shrinkwrap.js
+++ b/deps/npm/test/tap/add-remote-git-shrinkwrap.js
@@ -20,7 +20,7 @@ var pjParent = JSON.stringify({
   name: 'parent',
   version: '1.2.3',
   dependencies: {
-    'child': 'git://localhost:1235/child.git#master'
+    'child': 'git://localhost:1234/child.git#master'
   }
 }, null, 2) + '\n'
 
@@ -68,7 +68,7 @@ test('shrinkwrap gets correct _from and _resolved (#7121)', function (t) {
       var shrinkwrap = require(resolve(pkg, 'npm-shrinkwrap.json'))
       t.equal(
         shrinkwrap.dependencies.child.from,
-        'git://localhost:1235/child.git#master',
+        'git://localhost:1234/child.git#master',
         'npm shrinkwrapped from correctly'
       )
 
@@ -82,7 +82,7 @@ test('shrinkwrap gets correct _from and _resolved (#7121)', function (t) {
 
           t.equal(
             shrinkwrap.dependencies.child.resolved,
-            'git://localhost:1235/child.git#' + treeish,
+            'git://localhost:1234/child.git#' + treeish,
             'npm shrinkwrapped resolved correctly'
           )
 
@@ -121,7 +121,8 @@ function setup (cb) {
           '--listen=localhost',
           '--export-all',
           '--base-path=.',
-          '--port=1235'
+          '--reuseaddr',
+          '--port=1234'
         ],
         {
           cwd: pkg,
diff --git a/deps/npm/test/tap/add-remote-git.js b/deps/npm/test/tap/add-remote-git.js
index e33d09c1a1..24abf33a77 100644
--- a/deps/npm/test/tap/add-remote-git.js
+++ b/deps/npm/test/tap/add-remote-git.js
@@ -80,6 +80,7 @@ function setup (cb) {
           '--listen=localhost',
           '--export-all',
           '--base-path=.',
+          '--reuseaddr',
           '--port=1234'
         ],
         {
diff --git a/deps/npm/test/tap/adduser-always-auth.js b/deps/npm/test/tap/adduser-always-auth.js
index cca560b1f0..375c3ab262 100644
--- a/deps/npm/test/tap/adduser-always-auth.js
+++ b/deps/npm/test/tap/adduser-always-auth.js
@@ -14,6 +14,23 @@ var responses = {
   'Email': 'u@p.me\n'
 }
 
+function verifyStdout (runner, successMessage, t) {
+  var remaining = Object.keys(responses).length
+  return function (chunk) {
+    if (remaining > 0) {
+      remaining--
+
+      var label = chunk.toString('utf8').split(':')[0]
+      runner.stdin.write(responses[label])
+
+      if (remaining === 0) runner.stdin.end()
+    } else {
+      var message = chunk.toString('utf8').trim()
+      t.equal(message, successMessage)
+    }
+  }
+}
+
 function mocks (server) {
   server.filteringRequestBody(function (r) {
     if (r.match(/\"_id\":\"org\.couchdb\.user:u\"/)) {
@@ -46,19 +63,140 @@ test('npm login', function (t) {
       })
     })
 
-    var o = ''
-    var e = ''
-    var remaining = Object.keys(responses).length
-    runner.stdout.on('data', function (chunk) {
-      remaining--
-      o += chunk
+    var message = 'Logged in as u on ' + common.registry + '/.'
+    runner.stdout.on('data', verifyStdout(runner, message, t))
+  })
+})
 
-      var label = chunk.toString('utf8').split(':')[0]
-      runner.stdin.write(responses[label])
+test('npm login --scope <scope> uses <scope>:registry as its URI', function (t) {
+  var port = common.port + 1
+  var uri = 'http://localhost:' + port + '/'
+  var scope = '@myco'
+  common.npm(
+    [
+      'config',
+      '--userconfig', outfile,
+      'set',
+      scope + ':registry',
+      uri
+    ],
+  opts,
+  function (err, code) {
+    t.notOk(code, 'exited OK')
+    t.notOk(err, 'no error output')
 
-      if (remaining === 0) runner.stdin.end()
+    mr({ port: port, plugin: mocks }, function (er, s) {
+      var runner = common.npm(
+        [
+          'login',
+          '--loglevel', 'silent',
+          '--userconfig', outfile,
+          '--scope', scope
+        ],
+      opts,
+      function (err, code) {
+        t.notOk(code, 'exited OK')
+        t.notOk(err, 'no error output')
+        var config = fs.readFileSync(outfile, 'utf8')
+        t.like(config, new RegExp(scope + ':registry=' + uri), 'scope:registry is set')
+        s.close()
+        rimraf(outfile, function (err) {
+          t.ifError(err, 'removed config file OK')
+          t.end()
+        })
+      })
+
+      var message = 'Logged in as u to scope ' + scope + ' on ' + uri + '.'
+      runner.stdout.on('data', verifyStdout(runner, message, t))
+    })
+  })
+})
+
+test('npm login --scope <scope> makes sure <scope> is prefixed by an @', function (t) {
+  var port = common.port + 1
+  var uri = 'http://localhost:' + port + '/'
+  var scope = 'myco'
+  var prefixedScope = '@' + scope
+  common.npm(
+    [
+      '--userconfig', outfile,
+      'config',
+      'set',
+      prefixedScope + ':registry',
+      uri
+    ],
+  opts,
+  function (err, code) {
+    t.notOk(code, 'exited OK')
+    t.notOk(err, 'no error output')
+
+    mr({ port: port, plugin: mocks }, function (er, s) {
+      var runner = common.npm(
+        [
+          'login',
+          '--loglevel', 'silent',
+          '--userconfig', outfile,
+          '--scope', scope
+        ],
+      opts,
+      function (err, code) {
+        t.notOk(code, 'exited OK')
+        t.notOk(err, 'no error output')
+        var config = fs.readFileSync(outfile, 'utf8')
+        t.like(config, new RegExp(prefixedScope + ':registry=' + uri), 'scope:registry is set')
+        s.close()
+        rimraf(outfile, function (err) {
+          t.ifError(err, 'removed config file OK')
+          t.end()
+        })
+      })
+
+      var message = 'Logged in as u to scope ' + prefixedScope + ' on ' + uri + '.'
+      runner.stdout.on('data', verifyStdout(runner, message, t))
+    })
+  })
+})
+
+test('npm login --scope <scope> --registry <registry> uses <registry> as its URI', function (t) {
+  var scope = '@myco'
+  common.npm(
+    [
+      '--userconfig', outfile,
+      'config',
+      'set',
+      scope + ':registry',
+      'invalidurl'
+    ],
+  opts,
+  function (err, code) {
+    t.notOk(code, 'exited OK')
+    t.notOk(err, 'no error output')
+
+    mr({ port: common.port, plugin: mocks }, function (er, s) {
+      var runner = common.npm(
+        [
+          'login',
+          '--registry', common.registry,
+          '--loglevel', 'silent',
+          '--userconfig', outfile,
+          '--scope', scope
+        ],
+      opts,
+      function (err, code) {
+        t.notOk(code, 'exited OK')
+        t.notOk(err, 'no error output')
+        var config = fs.readFileSync(outfile, 'utf8')
+        t.like(config, new RegExp(scope + ':registry=' + common.registry), 'scope:registry is set')
+        s.close()
+        rimraf(outfile, function (err) {
+          t.ifError(err, 'removed config file OK')
+          t.end()
+        })
+      })
+
+      var message = 'Logged in as u to scope ' + scope + ' on ' + common.registry + '/.'
+      runner.stdout.on('data', verifyStdout(runner, message, t))
     })
-    runner.stderr.on('data', function (chunk) { e += chunk })
   })
 })
 
@@ -85,19 +223,8 @@ test('npm login --always-auth', function (t) {
       })
     })
 
-    var o = ''
-    var e = ''
-    var remaining = Object.keys(responses).length
-    runner.stdout.on('data', function (chunk) {
-      remaining--
-      o += chunk
-
-      var label = chunk.toString('utf8').split(':')[0]
-      runner.stdin.write(responses[label])
-
-      if (remaining === 0) runner.stdin.end()
-    })
-    runner.stderr.on('data', function (chunk) { e += chunk })
+    var message = 'Logged in as u on ' + common.registry + '/.'
+    runner.stdout.on('data', verifyStdout(runner, message, t))
   })
 })
 
@@ -124,19 +251,8 @@ test('npm login --no-always-auth', function (t) {
       })
     })
 
-    var o = ''
-    var e = ''
-    var remaining = Object.keys(responses).length
-    runner.stdout.on('data', function (chunk) {
-      remaining--
-      o += chunk
-
-      var label = chunk.toString('utf8').split(':')[0]
-      runner.stdin.write(responses[label])
-
-      if (remaining === 0) runner.stdin.end()
-    })
-    runner.stderr.on('data', function (chunk) { e += chunk })
+    var message = 'Logged in as u on ' + common.registry + '/.'
+    runner.stdout.on('data', verifyStdout(runner, message, t))
   })
 })
 
diff --git a/deps/npm/test/tap/adduser-legacy-auth.js b/deps/npm/test/tap/adduser-legacy-auth.js
index 3fa03e7d39..1fc1210edb 100644
--- a/deps/npm/test/tap/adduser-legacy-auth.js
+++ b/deps/npm/test/tap/adduser-legacy-auth.js
@@ -74,19 +74,20 @@ test('npm login', function (t) {
       }
     )
 
-    var o = ''
-    var e = ''
     var remaining = Object.keys(responses).length
     runner.stdout.on('data', function (chunk) {
-      remaining--
-      o += chunk
+      if (remaining > 0) {
+        remaining--
 
-      var label = chunk.toString('utf8').split(':')[0]
-      runner.stdin.write(responses[label])
+        var label = chunk.toString('utf8').split(':')[0]
+        runner.stdin.write(responses[label])
 
-      if (remaining === 0) runner.stdin.end()
+        if (remaining === 0) runner.stdin.end()
+      } else {
+        var message = chunk.toString('utf8').trim()
+        t.equal(message, 'Logged in as u on ' + common.registry + '/.')
+      }
     })
-    runner.stderr.on('data', function (chunk) { e += chunk })
   })
 })
 
diff --git a/deps/npm/test/tap/config-basic.js b/deps/npm/test/tap/config-basic.js
index 82fa8ab585..ff33181470 100644
--- a/deps/npm/test/tap/config-basic.js
+++ b/deps/npm/test/tap/config-basic.js
@@ -5,7 +5,8 @@ var path = require('path')
 
 var projectData = {
   'save-prefix': '~',
-  'proprietary-attribs': false
+  'proprietary-attribs': false,
+  'legacy-bundling': true
 }
 
 var ucData = common.ucData
@@ -53,15 +54,16 @@ var expectSources = {
 }
 
 test('no builtin', function (t) {
+  t.comment(process.env)
   npmconf.load(cli, function (er, conf) {
     if (er) throw er
-    t.same(conf.list, expectList)
-    t.same(conf.sources, expectSources)
-    t.same(npmconf.rootConf.list, [])
-    t.equal(npmconf.rootConf.root, npmconf.defs.defaults)
-    t.equal(conf.root, npmconf.defs.defaults)
-    t.equal(conf.get('umask'), parseInt('022', 8))
-    t.equal(conf.get('heading'), 'npm')
+    t.same(conf.list, expectList, 'config properties in list format match expected')
+    t.same(conf.sources, expectSources, 'config by source matches expected')
+    t.same(npmconf.rootConf.list, [], 'root configuration is empty')
+    t.equal(npmconf.rootConf.root, npmconf.defs.defaults, 'defaults match up')
+    t.equal(conf.root, npmconf.defs.defaults, 'current root config matches defaults')
+    t.equal(conf.get('umask'), parseInt('022', 8), 'umask is as expected')
+    t.equal(conf.get('heading'), 'npm', 'config name is as expected')
     t.end()
   })
 })
diff --git a/deps/npm/test/tap/config-builtin.js b/deps/npm/test/tap/config-builtin.js
index 708eb30565..cb1e4eb20f 100644
--- a/deps/npm/test/tap/config-builtin.js
+++ b/deps/npm/test/tap/config-builtin.js
@@ -16,7 +16,8 @@ var cli = { foo: 'bar', heading: 'foo', 'git-tag-version': false }
 
 var projectData = {
   'save-prefix': '~',
-  'proprietary-attribs': false
+  'proprietary-attribs': false,
+  'legacy-bundling': true
 }
 
 var expectList = [
diff --git a/deps/npm/test/tap/correct-mkdir.js b/deps/npm/test/tap/correct-mkdir.js
new file mode 100644
index 0000000000..4bfc6b1c97
--- /dev/null
+++ b/deps/npm/test/tap/correct-mkdir.js
@@ -0,0 +1,58 @@
+var test = require('tap').test
+var assert = require('assert')
+var path = require('path')
+var requireInject = require('require-inject')
+var cache_dir = path.resolve(__dirname, 'correct-mkdir')
+
+test('correct-mkdir: no race conditions', function (t) {
+  var mock_fs = {}
+  var did_hook = false
+  mock_fs.stat = function (path, cb) {
+    if (path === cache_dir) {
+      // Return a non-matching owner
+      cb(null, {
+        uid: +process.uid + 1,
+        isDirectory: function () {
+          return true
+        }
+      })
+      if (!did_hook) {
+        did_hook = true
+        doHook()
+      }
+    } else {
+      assert.ok(false, 'Unhandled stat path: ' + path)
+    }
+  }
+  var chown_in_progress = 0
+  var mock_chownr = function (path, uid, gid, cb) {
+    ++chown_in_progress
+    process.nextTick(function () {
+      --chown_in_progress
+      cb(null)
+    })
+  }
+  var mocks = {
+    'graceful-fs': mock_fs,
+    'chownr': mock_chownr
+  }
+  var correctMkdir = requireInject('../../lib/utils/correct-mkdir.js', mocks)
+
+  var calls_in_progress = 3
+  function handleCallFinish () {
+    t.equal(chown_in_progress, 0, 'should not return while chown still in progress')
+    if (!--calls_in_progress) {
+      t.end()
+    }
+  }
+  function doHook () {
+    // This is fired during the first correctMkdir call, after the stat has finished
+    // but before the chownr has finished
+    // Buggy old code will fail and return a cached value before initial call is done
+    correctMkdir(cache_dir, handleCallFinish)
+  }
+  // Initial call
+  correctMkdir(cache_dir, handleCallFinish)
+  // Immediate call again in case of race condition there
+  correctMkdir(cache_dir, handleCallFinish)
+})
diff --git a/deps/npm/test/tap/full-warning-messages.js b/deps/npm/test/tap/full-warning-messages.js
new file mode 100644
index 0000000000..3c74c61d0c
--- /dev/null
+++ b/deps/npm/test/tap/full-warning-messages.js
@@ -0,0 +1,108 @@
+'use strict'
+var test = require('tap').test
+var path = require('path')
+var mkdirp = require('mkdirp')
+var rimraf = require('rimraf')
+var fs = require('graceful-fs')
+var common = require('../common-tap')
+
+var base = path.resolve(__dirname, path.basename(__filename, '.js'))
+var modA = path.resolve(base, 'modA')
+var modB = path.resolve(base, 'modB')
+
+var json = {
+  'name': 'test-full-warning-messages',
+  'version': '1.0.0',
+  'description': 'abc',
+  'repository': 'git://abc/',
+  'license': 'ISC',
+  'dependencies': {
+    'modA': modA
+  }
+}
+
+var modAJson = {
+  'name': 'modA',
+  'version': '1.0.0',
+  'optionalDependencies': {
+    'modB': modB
+  }
+}
+
+var modBJson = {
+  'name': 'modB',
+  'version': '1.0.0',
+  'os': ['nope'],
+  'cpu': 'invalid'
+}
+
+function modJoin () {
+  var modules = Array.prototype.slice.call(arguments)
+  return modules.reduce(function (a, b) {
+    return path.resolve(a, 'node_modules', b)
+  })
+}
+
+function writeJson (mod, data) {
+  fs.writeFileSync(path.resolve(mod, 'package.json'), JSON.stringify(data))
+}
+
+function setup () {
+  cleanup()
+  ;[modA, modB].forEach(function (mod) { mkdirp.sync(mod) })
+  writeJson(base, json)
+  writeJson(modA, modAJson)
+  writeJson(modB, modBJson)
+}
+
+function cleanup () {
+  rimraf.sync(base)
+}
+
+test('setup', function (t) {
+  setup()
+  t.end()
+})
+
+function exists (t, filepath, msg) {
+  try {
+    fs.statSync(filepath)
+    t.pass(msg)
+    return true
+  } catch (ex) {
+    t.fail(msg, {found: null, wanted: 'exists', compare: 'fs.stat(' + filepath + ')'})
+    return false
+  }
+}
+
+function notExists (t, filepath, msg) {
+  try {
+    fs.statSync(filepath)
+    t.fail(msg, {found: 'exists', wanted: null, compare: 'fs.stat(' + filepath + ')'})
+    return true
+  } catch (ex) {
+    t.pass(msg)
+    return false
+  }
+}
+
+test('tree-style', function (t) {
+  common.npm(['install', '--loglevel=warn'], {cwd: base}, function (err, code, stdout, stderr) {
+    if (err) throw err
+    t.is(code, 0, 'result code')
+    t.match(stdout, /modA@1.0.0/, 'modA got installed')
+    t.notMatch(stdout, /modB/, 'modB not installed')
+    var stderrlines = stderr.trim().split(/\n/)
+    t.is(stderrlines.length, 2, 'two lines of warnings')
+    t.match(stderr, /Skipping failed optional dependency/, 'expected optional failure warning')
+    t.match(stderr, /Not compatible with your operating system or architecture/, 'reason for optional failure')
+    exists(t, modJoin(base, 'modA'), 'module A')
+    notExists(t, modJoin(base, 'modB'), 'module B')
+    t.done()
+  })
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
diff --git a/deps/npm/test/tap/gently-rm-linked-module.js b/deps/npm/test/tap/gently-rm-linked-module.js
new file mode 100644
index 0000000000..1ffe7a8208
--- /dev/null
+++ b/deps/npm/test/tap/gently-rm-linked-module.js
@@ -0,0 +1,106 @@
+var basename = require('path').basename
+var resolve = require('path').resolve
+var fs = require('graceful-fs')
+var test = require('tap').test
+var mkdirp = require('mkdirp')
+var rimraf = require('rimraf')
+
+var common = require('../common-tap.js')
+
+var base = resolve(__dirname, basename(__filename, '.js'))
+var pkg = resolve(base, 'gently-rm-linked')
+var dep = resolve(base, 'test-linked')
+var glb = resolve(base, 'test-global')
+var lnk = resolve(base, 'test-global-link')
+
+var EXEC_OPTS = { cwd: pkg }
+
+var index = "module.exports = function () { console.log('whoop whoop') }"
+
+var fixture = {
+  name: '@test/linked',
+  version: '1.0.0',
+  bin: {
+    linked: './index.js'
+  }
+}
+
+test('setup', function (t) {
+  cleanup()
+  setup()
+
+  t.end()
+})
+
+test('install and link', function (t) {
+  // link our test module into the global folder
+  common.npm(
+    [
+      '--prefix', lnk,
+      '--loglevel', 'error',
+      'link',
+      dep
+    ],
+    EXEC_OPTS,
+    function (er, code, stdout, stderr) {
+      if (er) throw er
+      t.is(code, 0, 'link succeeded')
+      t.is(stderr, '', 'no log output')
+      t.ok(doesModuleExist(), 'installed ok')
+
+      // and try removing it and make sure that succeeds
+      common.npm(
+        [
+          '--global',
+          '--prefix', lnk,
+          '--loglevel', 'error',
+          'rm', '@test/linked'
+        ],
+        EXEC_OPTS,
+        function (er, code, stdout, stderr) {
+          if (er) throw er
+          t.is(code, 0, 'rm succeeded')
+          t.is(stderr, '', 'no log output')
+          t.notOk(doesModuleExist(), 'removed ok')
+          t.end()
+        }
+      )
+    }
+  )
+})
+
+test('cleanup', function (t) {
+  cleanup()
+
+  t.end()
+})
+
+function doesModuleExist () {
+  var binPath = resolve(lnk, 'bin', 'linked')
+  var pkgPath = resolve(lnk, 'lib', 'node_modules', '@test', 'linked')
+  try {
+    fs.statSync(binPath)
+    fs.statSync(pkgPath)
+    return true
+  } catch (ex) {
+    return false
+  }
+}
+
+function cleanup () {
+  rimraf.sync(pkg)
+  rimraf.sync(dep)
+  rimraf.sync(lnk)
+  rimraf.sync(glb)
+}
+
+function setup () {
+  mkdirp.sync(pkg)
+  mkdirp.sync(glb)
+  fs.symlinkSync(glb, lnk)
+  // so it doesn't try to install into npm's own node_modules
+  mkdirp.sync(resolve(pkg, 'node_modules'))
+  mkdirp.sync(dep)
+  fs.writeFileSync(resolve(dep, 'package.json'), JSON.stringify(fixture))
+  fs.writeFileSync(resolve(dep, 'index.js'), index)
+}
diff --git a/deps/npm/test/tap/gently-rm-symlink.js b/deps/npm/test/tap/gently-rm-symlinked-global-dir.js
index 93ed3edaa4..93ed3edaa4 100644
--- a/deps/npm/test/tap/gently-rm-symlink.js
+++ b/deps/npm/test/tap/gently-rm-symlinked-global-dir.js
diff --git a/deps/npm/test/tap/git-dependency-install-link.js b/deps/npm/test/tap/git-dependency-install-link.js
index 15f43e7bb7..8af1b853ad 100644
--- a/deps/npm/test/tap/git-dependency-install-link.js
+++ b/deps/npm/test/tap/git-dependency-install-link.js
@@ -134,6 +134,7 @@ function setup (cb) {
           '--listen=localhost',
           '--export-all',
           '--base-path=.',
+          '--reuseaddr',
           '--port=1234'
         ],
         {
diff --git a/deps/npm/test/tap/install-link-scripts.js b/deps/npm/test/tap/install-link-scripts.js
index bd8b9a3e37..5ad2feafe8 100644
--- a/deps/npm/test/tap/install-link-scripts.js
+++ b/deps/npm/test/tap/install-link-scripts.js
@@ -122,7 +122,8 @@ function setup () {
     path.join(dep, 'package.json'),
     JSON.stringify(dependency, null, 2)
   )
-  fs.writeFileSync(path.join(dep, 'bin', 'foo'), foo, { mode: '0755' })
+  fs.writeFileSync(path.join(dep, 'bin', 'foo'), foo)
+  fs.chmod(path.join(dep, 'bin', 'foo'), '0755')
 }
 
 function cleanup () {
diff --git a/deps/npm/test/tap/install-scoped-with-peer-dependency.js b/deps/npm/test/tap/install-scoped-with-peer-dependency.js
index da571ae549..71584b115a 100644
--- a/deps/npm/test/tap/install-scoped-with-peer-dependency.js
+++ b/deps/npm/test/tap/install-scoped-with-peer-dependency.js
@@ -30,7 +30,7 @@ test('it should install peerDependencies in same tree level as the parent packag
   common.npm(['install', '--loglevel=warn', './package'], EXEC_OPTS, function (err, code, stdout, stderr) {
     t.ifError(err, 'install local package successful')
     t.equal(code, 0, 'npm install exited with code')
-    t.match(stderr, /npm WARN EPEERINVALID @scope[/]package@0[.]0[.]0 requires a peer of underscore@[*] but none was installed[.]\n/,
+    t.match(stderr, /npm WARN @scope[/]package@0[.]0[.]0 requires a peer of underscore@[*] but none was installed[.]\n/,
       'npm install warned about unresolved peer dep')
 
     t.end()
diff --git a/deps/npm/test/tap/it.js b/deps/npm/test/tap/it.js
new file mode 100644
index 0000000000..6fc2a6fd49
--- /dev/null
+++ b/deps/npm/test/tap/it.js
@@ -0,0 +1,77 @@
+var join = require('path').join
+var statSync = require('graceful-fs').statSync
+var writeFileSync = require('graceful-fs').writeFileSync
+
+var mkdirp = require('mkdirp')
+var mr = require('npm-registry-mock')
+var osenv = require('osenv')
+var rimraf = require('rimraf')
+var test = require('tap').test
+
+var common = require('../common-tap')
+
+var pkg = join(__dirname, 'run-script')
+var installed = join(pkg, 'node_modules', 'underscore', 'package.json')
+
+var json = {
+  name: 'npm-it-test',
+  dependencies: {
+    underscore: '1.5.1'
+  },
+  scripts: {
+    test: 'echo hax'
+  }
+}
+
+var server
+
+test('run up the mock registry', function (t) {
+  mr({ port: common.port }, function (err, s) {
+    if (err) throw err
+    server = s
+    t.end()
+  })
+})
+
+test('npm install-test', function (t) {
+  setup()
+  common.npm('install-test', { cwd: pkg }, function (err, code, stdout, stderr) {
+    if (err) throw err
+    t.equal(code, 0, 'command ran without error')
+    t.ok(statSync(installed), 'package was installed')
+    t.equal(require(installed).version, '1.5.1', 'underscore got installed as expected')
+    t.match(stdout, /hax/, 'found expected test output')
+    t.notOk(stderr, 'stderr should be empty')
+    t.end()
+  })
+})
+
+test('npm it (the form most people will use)', function (t) {
+  setup()
+  common.npm('it', { cwd: pkg }, function (err, code, stdout, stderr) {
+    if (err) throw err
+    t.equal(code, 0, 'command ran without error')
+    t.ok(statSync(installed), 'package was installed')
+    t.equal(require(installed).version, '1.5.1', 'underscore got installed as expected')
+    t.match(stdout, /hax/, 'found expected test output')
+    t.notOk(stderr, 'stderr should be empty')
+    t.end()
+  })
+})
+
+test('cleanup', function (t) {
+  process.chdir(osenv.tmpdir())
+  server.close()
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  rimraf.sync(pkg)
+}
+
+function setup () {
+  cleanup()
+  mkdirp.sync(pkg)
+  writeFileSync(join(pkg, 'package.json'), JSON.stringify(json, null, 2))
+}
diff --git a/deps/npm/test/tap/ls-depth-cli.js b/deps/npm/test/tap/ls-depth-cli.js
index 77689cbc54..760681427c 100644
--- a/deps/npm/test/tap/ls-depth-cli.js
+++ b/deps/npm/test/tap/ls-depth-cli.js
@@ -113,6 +113,52 @@ test('npm ls --depth=Infinity', function (t) {
   )
 })
 
+test('npm ls --depth=0 --json', function (t) {
+  common.npm(
+    ['ls', '--depth=0', '--json'],
+    EXEC_OPTS,
+    function (er, c, out) {
+      t.ifError(er, 'npm ls ran without issue')
+      t.equal(c, 0, 'ls ran without raising error code')
+      t.has(
+        out,
+        /test-package-with-one-dep@0\.0\.0/,
+        'output contains test-package-with-one-dep@0.0.0'
+      )
+      t.doesNotHave(
+        out,
+        /test-package@0\.0\.0/,
+        'output not contains test-package@0.0.0'
+      )
+      t.end()
+    }
+  )
+})
+
+test('npm ls --depth=Infinity --json', function (t) {
+  // travis has a preconfigured depth=0, in general we can not depend
+  // on the default value in all environments, so explictly set it here
+  common.npm(
+    ['ls', '--depth=Infinity', '--json'],
+    EXEC_OPTS,
+    function (er, c, out) {
+      t.ifError(er, 'npm ls ran without issue')
+      t.equal(c, 0, 'ls ran without raising error code')
+      t.has(
+        out,
+        /test-package-with-one-dep@0\.0\.0/,
+        'output contains test-package-with-one-dep@0.0.0'
+      )
+      t.has(
+        out,
+        /test-package@0\.0\.0/,
+        'output contains test-package@0.0.0'
+      )
+      t.end()
+    }
+  )
+})
+
 test('cleanup', function (t) {
   cleanup()
   t.end()
diff --git a/deps/npm/test/tap/no-global-warns.js b/deps/npm/test/tap/no-global-warns.js
index 439388fe19..2d831eaae9 100644
--- a/deps/npm/test/tap/no-global-warns.js
+++ b/deps/npm/test/tap/no-global-warns.js
@@ -14,10 +14,12 @@ var toInstall = path.join(base, 'to-install')
 var config = 'prefix = ' + base
 var configPath = path.join(base, '_npmrc')
 
+var extend = Object.assign || require('util')._extend
+
 var OPTS = {
-  env: {
+  env: extend({
     'npm_config_userconfig': configPath
-  }
+  }, process.env)
 }
 
 var installJSON = {
diff --git a/deps/npm/test/tap/no-scan-full-global-dir.js b/deps/npm/test/tap/no-scan-full-global-dir.js
index b2863c8819..ca051fc628 100644
--- a/deps/npm/test/tap/no-scan-full-global-dir.js
+++ b/deps/npm/test/tap/no-scan-full-global-dir.js
@@ -1,4 +1,5 @@
 'use strict'
+var fs = require('fs')
 var path = require('path')
 var test = require('tap').test
 var requireInject = require('require-inject')
@@ -34,10 +35,9 @@ var mockReadPackageJson = function (file, cb) {
   er.code = 'ENOENT'
   cb(er)
 }
-var mockFs = {
-  realpath: function (dir, cb) {
-    return cb(null, dir)
-  }
+var mockFs = Object.create(fs)
+mockFs.realpath = function (dir, cb) {
+  return cb(null, dir)
 }
 
 test('setup', function (t) {
diff --git a/deps/npm/test/tap/noargs-install-config-save.js b/deps/npm/test/tap/noargs-install-config-save.js
index 7b13f3bdc4..074d5e848d 100644
--- a/deps/npm/test/tap/noargs-install-config-save.js
+++ b/deps/npm/test/tap/noargs-install-config-save.js
@@ -1,6 +1,5 @@
 var common = require('../common-tap.js')
 var test = require('tap').test
-var npm = require.resolve('../../bin/npm-cli.js')
 var path = require('path')
 var fs = require('fs')
 var rimraf = require('rimraf')
@@ -8,9 +7,6 @@ var mkdirp = require('mkdirp')
 
 var mr = require('npm-registry-mock')
 
-var spawn = require('child_process').spawn
-var node = process.execPath
-
 var pkg = path.resolve(process.env.npm_config_tmp || '/tmp',
   'noargs-install-config-save')
 
@@ -29,33 +25,31 @@ function writePackageJson () {
   }), 'utf8')
 }
 
-function createChild (args) {
-  var env = {
-    'npm_config_save': true,
-    'npm_config_registry': common.registry,
-    'npm_config_cache': pkg + '/cache',
-    HOME: process.env.HOME,
-    Path: process.env.PATH,
-    PATH: process.env.PATH
-  }
-
-  if (process.platform === 'win32') {
-    env.npm_config_cache = '%APPDATA%\\npm-cache'
-  }
-
-  return spawn(node, args, {
-    cwd: pkg,
-    env: env
-  })
+var env = {
+  'npm_config_save': true,
+  'npm_config_registry': common.registry,
+  'npm_config_cache': pkg + '/cache',
+  HOME: process.env.HOME,
+  Path: process.env.PATH,
+  PATH: process.env.PATH
+}
+var OPTS = {
+  cwd: pkg,
+  env: env
 }
 
 test('does not update the package.json with empty arguments', function (t) {
   writePackageJson()
-  t.plan(1)
+  t.plan(2)
 
   mr({ port: common.port }, function (er, s) {
-    var child = createChild([npm, 'install'])
-    child.on('close', function () {
+    common.npm('install', OPTS, function (er, code, stdout, stderr) {
+      if (er) throw er
+      t.is(code, 0)
+      if (code !== 0) {
+        console.error('#', stdout)
+        console.error('#', stderr)
+      }
       var text = JSON.stringify(fs.readFileSync(pkg + '/package.json', 'utf8'))
       s.close()
       t.equal(text.indexOf('"dependencies'), -1, 'dependencies do not exist in file')
@@ -65,11 +59,12 @@ test('does not update the package.json with empty arguments', function (t) {
 
 test('updates the package.json (adds dependencies) with an argument', function (t) {
   writePackageJson()
-  t.plan(1)
+  t.plan(2)
 
   mr({ port: common.port }, function (er, s) {
-    var child = createChild([npm, 'install', 'underscore'])
-    child.on('close', function () {
+    common.npm(['install', 'underscore'], OPTS, function (er, code, stdout, stderr) {
+      if (er) throw er
+      t.is(code, 0)
       s.close()
       var text = JSON.stringify(fs.readFileSync(pkg + '/package.json', 'utf8'))
       t.notEqual(text.indexOf('"dependencies'), -1, 'dependencies exist in file')
diff --git a/deps/npm/test/tap/outdated-symlink.js b/deps/npm/test/tap/outdated-symlink.js
new file mode 100644
index 0000000000..203df9ba8f
--- /dev/null
+++ b/deps/npm/test/tap/outdated-symlink.js
@@ -0,0 +1,89 @@
+var fs = require('graceful-fs')
+var path = require('path')
+var osenv = require('osenv')
+var mkdirp = require('mkdirp')
+var mr = require('npm-registry-mock')
+var rimraf = require('rimraf')
+var test = require('tap').test
+
+var common = require('../common-tap.js')
+
+var pkg = path.resolve(__dirname, 'outdated-symlink')
+var cache = path.resolve(pkg, 'cache')
+var originalLog
+
+var fakeRoot = path.join(__dirname, 'fakeRoot')
+var OPTS = {
+  env: {
+    'npm_config_prefix': fakeRoot
+  }
+}
+
+var json = {
+  name: 'my-local-package',
+  description: 'fixture',
+  version: '1.0.0'
+}
+
+test('setup', function (t) {
+  cleanup()
+  originalLog = console.log
+  mkdirp.sync(cache)
+  fs.writeFileSync(
+    path.join(pkg, 'package.json'),
+    JSON.stringify(json, null, 2)
+  )
+  process.chdir(pkg)
+  common.npm(['install', '-g', 'async@0.2.9', 'underscore@1.3.1'], OPTS, function (err, c, out) {
+    t.ifError(err, 'global install did not error')
+    common.npm(['link'], OPTS, function (err, c, out) {
+      t.ifError(err, 'link did not error')
+      common.npm(['ls', '-g'], OPTS, function (err, c, out, stderr) {
+        t.ifError(err)
+        t.equal(c, 0)
+        t.equal(stderr, '', 'got expected stderr')
+        t.has(out, /my-local-package@1.0.0/, 'creates global link ok')
+        t.end()
+      })
+    })
+  })
+})
+
+test('when outdated is called linked packages should be displayed as such', function (t) {
+  var regOutLinked = /my-local-package\s*1.0.0\s*linked\s*linked\n/
+  var regOutInstallOne = /async\s*0.2.9\s*0.2.9\s*1.5.2\n/
+  var regOutInstallTwo = /underscore\s*1.3.1\s*1.3.1\s*1.8.3\n/
+
+  console.log = function () {}
+  mr({ port: common.port }, function (er, s) {
+    common.npm(['outdated', '-g'], OPTS, function (err, c, out, stderr) {
+      t.ifError(err)
+      t.ok(out.match(regOutLinked), 'Global Link format as expected')
+      t.ok(out.match(regOutInstallOne), 'Global Install format as expected')
+      t.ok(out.match(regOutInstallTwo), 'Global Install format as expected')
+      s.close()
+      t.end()
+    })
+  })
+})
+
+test('cleanup', function (t) {
+  process.chdir(osenv.tmpdir())
+  common.npm(['rm', 'outdated'], OPTS, function (err, code) {
+    t.ifError(err, 'npm removed the linked package without error')
+    t.equal(code, 0, 'cleanup outdated in local ok')
+    common.npm(['rm', '-g', 'outdated', 'async', 'underscore'], OPTS, function (err, code) {
+      t.ifError(err, 'npm removed the global package without error')
+      t.equal(code, 0, 'cleanup outdated in global ok')
+
+      console.log = originalLog
+      cleanup()
+      t.end()
+    })
+  })
+})
+
+function cleanup () {
+  rimraf.sync(pkg)
+  rimraf.sync(fakeRoot)
+}
diff --git a/deps/npm/test/tap/override-bundled.js b/deps/npm/test/tap/override-bundled.js
index deed57771e..e23c8255c4 100644
--- a/deps/npm/test/tap/override-bundled.js
+++ b/deps/npm/test/tap/override-bundled.js
@@ -6,41 +6,73 @@ var rimraf = require('rimraf')
 var path = require('path')
 var common = require('../common-tap.js')
 
-var testdir = path.resolve(__dirname, path.basename(__filename, '.js'))
-var testjson = {
-  dependencies: {'top-test': 'file:top-test/'}
-}
-
+var testname = path.basename(__filename, '.js')
+var testdir = path.resolve(__dirname, testname)
 var testmod = path.resolve(testdir, 'top-test')
-var testmodjson = {
-  name: 'top-test',
-  version: '1.0.0',
-  dependencies: {
-    'bundle-update': 'file:bundle-update/',
-    'bundle-keep': 'file:bundle-keep/'
-  },
-  bundledDependencies: ['bundle-update', 'bundle-keep']
-}
 
 var bundleupdatesrc = path.resolve(testmod, 'bundle-update')
 var bundleupdateNEW = path.resolve(bundleupdatesrc, 'NEW')
 var bundleupdateNEWpostinstall = path.resolve(testdir, 'node_modules', 'top-test', 'node_modules', 'bundle-update', 'NEW')
 var bundleupdatebad = path.resolve(testmod, 'node_modules', 'bundle-update')
+
 var bundlekeepsrc = path.resolve(testmod, 'bundle-keep')
 var bundlekeep = path.resolve(testmod, 'node_modules', 'bundle-keep')
 var bundlekeepOLD = path.resolve(bundlekeep, 'OLD')
 var bundlekeepOLDpostinstall = path.resolve(testdir, 'node_modules', 'top-test', 'node_modules', 'bundle-keep', 'OLD')
+
+var bundledeepsrc = path.resolve(testmod, 'bundle-deep')
+var bundledeep = path.resolve(testmod, 'node_modules', 'bundle-deep')
+var bundledeepOLD = path.resolve(bundledeep, 'OLD')
+var bundledeepOLDpostinstall = path.resolve(testdir, 'node_modules', 'top-test', 'node_modules', 'bundle-deep', 'OLD')
+
+var bundledeepupdatesrc = path.resolve(testmod, 'bundle-deep-update')
+var bundledeepupdate = path.resolve(bundledeep, 'node_modules', 'bundle-deep-update')
+var bundledeepupdateNEW = path.resolve(bundledeepupdatesrc, 'NEW')
+var bundledeepupdateNEWpostinstall = path.resolve(testdir, 'node_modules', 'top-test',
+  'node_modules', 'bundle-deep', 'node_modules', 'bundle-deep-update', 'NEW')
+
+var testjson = {
+  dependencies: {'top-test': 'file:top-test/'}
+}
+
+var testmodjson = {
+  name: 'top-test',
+  version: '1.0.0',
+  dependencies: {
+    'bundle-update': bundleupdatesrc,
+    'bundle-keep': bundlekeepsrc,
+    'bundle-deep': bundledeepsrc
+  },
+  bundledDependencies: ['bundle-update', 'bundle-keep', 'bundle-deep']
+}
 var bundlejson = {
   name: 'bundle-update',
   version: '1.0.0'
 }
+
 var bundlekeepjson = {
   name: 'bundle-keep',
+  version: '1.0.0',
   _requested: {
-    rawSpec: 'file:bundle-keep/'
+    rawSpec: bundlekeepsrc
+  }
+}
+var bundledeepjson = {
+  name: 'bundle-deep',
+  version: '1.0.0',
+  dependencies: {
+    'bundle-deep-update': bundledeepupdatesrc
+  },
+  _requested: {
+    rawSpec: bundledeepsrc
   }
 }
 
+var bundledeepupdatejson = {
+  version: '1.0.0',
+  name: 'bundle-deep-update'
+}
+
 function writepjs (dir, content) {
   fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify(content, null, 2))
 }
@@ -50,16 +82,30 @@ function setup () {
   writepjs(testdir, testjson)
   mkdirp.sync(testmod)
   writepjs(testmod, testmodjson)
+
   mkdirp.sync(bundleupdatesrc)
   writepjs(bundleupdatesrc, bundlejson)
   fs.writeFileSync(bundleupdateNEW, '')
   mkdirp.sync(bundleupdatebad)
   writepjs(bundleupdatebad, bundlejson)
+
   mkdirp.sync(bundlekeepsrc)
   writepjs(bundlekeepsrc, bundlekeepjson)
   mkdirp.sync(bundlekeep)
   writepjs(bundlekeep, bundlekeepjson)
   fs.writeFileSync(bundlekeepOLD, '')
+
+  mkdirp.sync(bundledeepsrc)
+  writepjs(bundledeepsrc, bundledeepjson)
+  mkdirp.sync(bundledeep)
+  writepjs(bundledeep, bundledeepjson)
+  fs.writeFileSync(bundledeepOLD, '')
+
+  mkdirp.sync(bundledeepupdatesrc)
+  writepjs(bundledeepupdatesrc, bundledeepupdatejson)
+  mkdirp.sync(bundledeepupdate)
+  writepjs(bundledeepupdate, bundledeepupdatejson)
+  fs.writeFileSync(bundledeepupdateNEW, '')
 }
 
 function cleanup () {
@@ -75,7 +121,7 @@ test('setup', function (t) {
 test('bundled', function (t) {
   common.npm(['install', '--loglevel=warn'], {cwd: testdir}, function (err, code, stdout, stderr) {
     if (err) throw err
-    t.plan(5)
+    t.plan(8)
     t.is(code, 0, 'npm itself completed ok')
 
     // This tests that after the install we have a freshly installed version
@@ -86,16 +132,22 @@ test('bundled', function (t) {
     // metadata) installed in that location and will go off and try to do
     // _things_ to it.  Things like chmod in particular, which in turn results
     // in the dreaded ENOENT errors.
-    t.like(stderr, /EPACKAGEJSON override-bundled/, "didn't stomp on other warnings")
-    t.like(stderr, /EBUNDLEOVERRIDE/, 'included warning about bundled dep')
+    t.like(stderr, new RegExp('npm WARN ' + testname), "didn't stomp on other warnings")
+    t.like(stderr, /npm WARN.*bundle-update/, 'included update warning about bundled dep')
+    t.like(stderr, /npm WARN.*bundle-deep-update/, 'included update warning about deeply bundled dep')
     fs.stat(bundleupdateNEWpostinstall, function (missing) {
       t.ok(!missing, 'package.json overrode bundle')
     })
-
+    fs.stat(bundledeepupdateNEWpostinstall, function (missing) {
+      t.ok(!missing, 'deep package.json overrode bundle')
+    })
     // Relatedly, when upgrading, if a bundled module is replacing an existing
     // module we want to choose the bundled version, not the version we're replacing.
     fs.stat(bundlekeepOLDpostinstall, function (missing) {
-      t.ok(!missing, 'package.json overrode bundle')
+      t.ok(!missing, 'no override when package.json matches')
+    })
+    fs.stat(bundledeepOLDpostinstall, function (missing) {
+      t.ok(!missing, 'deep no override when package.json matches')
     })
   })
 })
diff --git a/deps/npm/test/tap/publish-access-scoped.js b/deps/npm/test/tap/publish-access-scoped.js
index adc67a48e3..17339cedfd 100644
--- a/deps/npm/test/tap/publish-access-scoped.js
+++ b/deps/npm/test/tap/publish-access-scoped.js
@@ -4,78 +4,67 @@ var path = require('path')
 var test = require('tap').test
 var mkdirp = require('mkdirp')
 var rimraf = require('rimraf')
-var nock = require('nock')
-
-var npm = require('../../')
-var common = require('../common-tap.js')
+var mr = require('npm-registry-mock')
+var common = require('../common-tap')
+var server
 
 var pkg = path.join(__dirname, 'publish-access')
 
-// TODO: nock uses setImmediate, breaks 0.8: replace with mockRegistry
-if (!global.setImmediate) {
-  global.setImmediate = function () {
-    var args = [arguments[0], 0].concat([].slice.call(arguments, 1))
-    setTimeout.apply(this, args)
-  }
-}
-
 test('setup', function (t) {
-  mkdirp(path.join(pkg, 'cache'), function () {
-    var configuration = {
-      cache: path.join(pkg, 'cache'),
-      loglevel: 'silent',
-      registry: common.registry
-    }
-
-    npm.load(configuration, next)
+  mr({port: common.port, throwOnUnmatched: true}, function (err, s) {
+    t.ifError(err, 'registry mocked successfully')
+    t.pass('setup done')
+    server = s
+    t.end()
   })
+})
 
-  function next (er) {
-    t.ifError(er, 'npm loaded successfully')
+test('scoped packages pass public access if set', function (t) {
+  server.filteringRequestBody(function (body) {
+    t.doesNotThrow(function () {
+      var parsed = JSON.parse(body)
+      t.equal(parsed.access, 'public', 'access level is correct')
+    }, 'converted body back into object')
+    return true
+  }).put('/@bigco%2fpublish-access', true).reply(201, {ok: true})
 
-    process.chdir(pkg)
+  mkdirp(path.join(pkg, 'cache'), function () {
     fs.writeFile(
       path.join(pkg, 'package.json'),
       JSON.stringify({
         name: '@bigco/publish-access',
-        version: '1.2.5'
+        version: '1.2.5',
+        public: true
       }),
       'ascii',
       function (er) {
-        t.ifError(er)
-
-        t.pass('setup done')
-        t.end()
+        t.ifError(er, 'package file written')
+        common.npm(
+          [
+            'publish',
+            '--access', 'public',
+            '--cache', path.join(pkg, 'cache'),
+            '--loglevel', 'silly',
+            '--registry', common.registry
+          ],
+          {
+            cwd: pkg
+          },
+          function (er) {
+            t.ifError(er, 'published without error')
+
+            server.done()
+            t.end()
+          }
+        )
       }
     )
-  }
-})
-
-test('scoped packages pass public access if set', function (t) {
-  var put = nock(common.registry)
-              .put('/@bigco%2fpublish-access')
-              .reply(201, verify)
-
-  npm.config.set('access', 'public')
-  npm.commands.publish([], false, function (er) {
-    t.ifError(er, 'published without error')
-
-    put.done()
-    t.end()
   })
-
-  function verify (_, body) {
-    t.doesNotThrow(function () {
-      var parsed = JSON.parse(body)
-      t.equal(parsed.access, 'public', 'access level is correct')
-    }, 'converted body back into object')
-
-    return {ok: true}
-  }
 })
 
 test('cleanup', function (t) {
   process.chdir(__dirname)
+  server.close()
   rimraf(pkg, function (er) {
     t.ifError(er)
 
diff --git a/deps/npm/test/tap/publish-access-unscoped-restricted-fails.js b/deps/npm/test/tap/publish-access-unscoped-restricted-fails.js
index b975399384..4c7fce7351 100644
--- a/deps/npm/test/tap/publish-access-unscoped-restricted-fails.js
+++ b/deps/npm/test/tap/publish-access-unscoped-restricted-fails.js
@@ -10,14 +10,6 @@ var common = require('../common-tap.js')
 
 var pkg = path.join(__dirname, 'publish-access-unscoped')
 
-// TODO: nock uses setImmediate, breaks 0.8: replace with mockRegistry
-if (!global.setImmediate) {
-  global.setImmediate = function () {
-    var args = [arguments[0], 0].concat([].slice.call(arguments, 1))
-    setTimeout.apply(this, args)
-  }
-}
-
 test('setup', function (t) {
   mkdirp(path.join(pkg, 'cache'), function () {
     var configuration = {
diff --git a/deps/npm/test/tap/publish-access-unscoped.js b/deps/npm/test/tap/publish-access-unscoped.js
index 48b12ed521..1766f61f4f 100644
--- a/deps/npm/test/tap/publish-access-unscoped.js
+++ b/deps/npm/test/tap/publish-access-unscoped.js
@@ -4,78 +4,67 @@ var path = require('path')
 var test = require('tap').test
 var mkdirp = require('mkdirp')
 var rimraf = require('rimraf')
-var nock = require('nock')
-
-var npm = require('../../')
-var common = require('../common-tap.js')
+var mr = require('npm-registry-mock')
+var common = require('../common-tap')
+var server
 
 var pkg = path.join(__dirname, 'publish-access-unscoped')
 
-// TODO: nock uses setImmediate, breaks 0.8: replace with mockRegistry
-if (!global.setImmediate) {
-  global.setImmediate = function () {
-    var args = [arguments[0], 0].concat([].slice.call(arguments, 1))
-    setTimeout.apply(this, args)
-  }
-}
-
 test('setup', function (t) {
-  mkdirp(path.join(pkg, 'cache'), function () {
-    var configuration = {
-      cache: path.join(pkg, 'cache'),
-      loglevel: 'silent',
-      registry: common.registry
-    }
-
-    npm.load(configuration, next)
+  mr({port: common.port, throwOnUnmatched: true}, function (err, s) {
+    t.ifError(err, 'registry mocked successfully')
+    t.pass('setup done')
+    server = s
+    t.end()
   })
+})
 
-  function next (er) {
-    t.ifError(er, 'npm loaded successfully')
+test('unscoped packages can be explicitly set as public', function (t) {
+  server.filteringRequestBody(function (body) {
+    t.doesNotThrow(function () {
+      var parsed = JSON.parse(body)
+      t.equal(parsed.access, 'public', 'access level is correct')
+    }, 'converted body back into object')
+    return true
+  }).put('/publish-access', true).reply(201, {ok: true})
 
-    process.chdir(pkg)
+  mkdirp(path.join(pkg, 'cache'), function () {
     fs.writeFile(
       path.join(pkg, 'package.json'),
       JSON.stringify({
         name: 'publish-access',
-        version: '1.2.5'
+        version: '1.2.5',
+        public: true
       }),
       'ascii',
       function (er) {
-        t.ifError(er)
-
-        t.pass('setup done')
-        t.end()
+        t.ifError(er, 'package file written')
+        common.npm(
+          [
+            'publish',
+            '--access', 'public',
+            '--cache', path.join(pkg, 'cache'),
+            '--loglevel', 'silly',
+            '--registry', common.registry
+          ],
+          {
+            cwd: pkg
+          },
+          function (er) {
+            t.ifError(er, 'published without error')
+
+            server.done()
+            t.end()
+          }
+        )
       }
     )
-  }
-})
-
-test('unscoped packages can be explicitly set as public', function (t) {
-  var put = nock(common.registry)
-              .put('/publish-access')
-              .reply(201, verify)
-
-  npm.config.set('access', 'public')
-  npm.commands.publish([], false, function (er) {
-    t.ifError(er, 'published without error')
-
-    put.done()
-    t.end()
   })
-
-  function verify (_, body) {
-    t.doesNotThrow(function () {
-      var parsed = JSON.parse(body)
-      t.equal(parsed.access, 'public', 'access level is correct')
-    }, 'converted body back into object')
-
-    return {ok: true}
-  }
 })
 
 test('cleanup', function (t) {
   process.chdir(__dirname)
+  server.close()
   rimraf(pkg, function (er) {
     t.ifError(er)
 
diff --git a/deps/npm/test/tap/publish-scoped.js b/deps/npm/test/tap/publish-scoped.js
index eb14ae5049..c2a8301b77 100644
--- a/deps/npm/test/tap/publish-scoped.js
+++ b/deps/npm/test/tap/publish-scoped.js
@@ -4,65 +4,61 @@ var path = require('path')
 var test = require('tap').test
 var mkdirp = require('mkdirp')
 var rimraf = require('rimraf')
-var nock = require('nock')
-
-var npm = require('../../')
-var common = require('../common-tap.js')
+var common = require('../common-tap')
+var mr = require('npm-registry-mock')
 
 var pkg = path.join(__dirname, 'prepublish_package')
 
-test('setup', function (t) {
-  mkdirp(path.join(pkg, 'cache'), next)
+var server
 
-  function next () {
-    process.chdir(pkg)
-    fs.writeFile(
-      path.join(pkg, 'package.json'),
-      JSON.stringify({
-        name: '@bigco/publish-organized',
-        version: '1.2.5'
-      }),
-      'ascii',
-      function (er) {
-        t.ifError(er)
+function setup () {
+  cleanup()
+  mkdirp.sync(path.join(pkg, 'cache'))
 
-        t.pass('setup done')
-        t.end()
-      }
-    )
-  }
+  fs.writeFileSync(
+    path.join(pkg, 'package.json'),
+    JSON.stringify({
+      name: '@bigco/publish-organized',
+      version: '1.2.5'
+    }, null, 2),
+    'ascii')
+}
+
+test('setup', function (t) {
+  setup()
+  mr({port: common.port, throwOnUnmatched: true}, function (err, s) {
+    t.ifError(err, 'registry mocked successfully')
+    server = s
+    t.end()
+  })
 })
 
 test('npm publish should honor scoping', function (t) {
-  var put = nock(common.registry)
-              .put('/@bigco%2fpublish-organized')
-              .reply(201, verify)
-
-  var configuration = {
-    cache: path.join(pkg, 'cache'),
-    loglevel: 'silent',
-    registry: 'http://nonexistent.lvh.me',
-    '//localhost:1337/:username': 'username',
-    '//localhost:1337/:_password': new Buffer('password').toString('base64'),
-    '//localhost:1337/:email': 'ogd@aoaioxxysz.net'
-  }
-
-  npm.load(configuration, onload)
-
-  function onload (er) {
-    t.ifError(er, 'npm bootstrapped successfully')
-
-    npm.config.set('@bigco:registry', common.registry)
-    npm.commands.publish([], false, function (er) {
-      t.ifError(er, 'published without error')
-
-      put.done()
-
-      t.end()
-    })
-  }
+  server.filteringRequestBody(verify)
+        .put('/@bigco%2fpublish-organized', true)
+        .reply(201, {ok: true})
+
+  var configuration = [
+    'progress=false',
+    'cache=' + path.join(pkg, 'cache'),
+    'registry=http://nonexistent.lvh.me',
+    '//localhost:1337/:username=username',
+    '//localhost:1337/:_password=' + new Buffer('password').toString('base64'),
+    '//localhost:1337/:email=' + 'ogd@aoaioxxysz.net',
+    '@bigco:registry=' + common.registry
+  ]
+  var configFile = path.join(pkg, '.npmrc')
+
+  fs.writeFileSync(configFile, configuration.join('\n') + '\n')
+
+  common.npm(['publish'], {'cwd': pkg}, function (err, code, stdout, stderr) {
+    if (err) throw err
+    t.is(code, 0, 'published without error')
+    server.done()
+    t.end()
+  })
 
-  function verify (_, body) {
+  function verify (body) {
     t.doesNotThrow(function () {
       var parsed = JSON.parse(body)
       var current = parsed.versions['1.2.5']
@@ -79,15 +75,17 @@ test('npm publish should honor scoping', function (t) {
       )
     }, 'converted body back into object')
 
-    return {ok: true}
+    return true
   }
 })
 
 test('cleanup', function (t) {
-  process.chdir(__dirname)
-  rimraf(pkg, function (er) {
-    t.ifError(er)
-
-    t.end()
-  })
+  server.close()
+  t.end()
+  cleanup()
 })
+
+function cleanup () {
+  process.chdir(__dirname)
+  rimraf.sync(pkg)
+}
diff --git a/deps/npm/test/tap/registry.js b/deps/npm/test/tap/registry.js
index 61ed0d0aae..7b17192f66 100644
--- a/deps/npm/test/tap/registry.js
+++ b/deps/npm/test/tap/registry.js
@@ -26,9 +26,10 @@ if (v[0] === 0 && v[1] < 10) {
   })
 }
 
+var extend = Object.assign || require('util')._extend
+
 function runTests () {
-  var env = { TAP: 1 }
-  for (var i in process.env) env[i] = process.env[i]
+  var env = extend({ TAP: 1 }, process.env)
   env.npm = npmExec
 
   var opts = {
diff --git a/deps/npm/test/tap/scripts-whitespace-windows.js b/deps/npm/test/tap/scripts-whitespace-windows.js
index 5aa7d00840..bff0e534ef 100644
--- a/deps/npm/test/tap/scripts-whitespace-windows.js
+++ b/deps/npm/test/tap/scripts-whitespace-windows.js
@@ -35,6 +35,8 @@ var dependency = {
   bin: [ 'bin/foo' ]
 }
 
+var extend = Object.assign || require('util')._extend
+
 var foo = function () {/*
 #!/usr/bin/env node
 
@@ -63,12 +65,12 @@ test('setup', function (t) {
 
   common.npm(['i', dep], {
     cwd: pkg,
-    env: {
+    env: extend({
       npm_config_cache: cache,
       npm_config_tmp: tmp,
       npm_config_prefix: pkg,
       npm_config_global: 'false'
-    }
+    }, process.env)
   }, function (err, code, stdout, stderr) {
     t.ifErr(err, 'npm i ' + dep + ' finished without error')
     t.equal(code, 0, 'npm i ' + dep + ' exited ok')
diff --git a/deps/npm/test/tap/sorted-package-json.js b/deps/npm/test/tap/sorted-package-json.js
index 9b2e935926..427212ff56 100644
--- a/deps/npm/test/tap/sorted-package-json.js
+++ b/deps/npm/test/tap/sorted-package-json.js
@@ -26,7 +26,7 @@ test('sorting dependencies', function (t) {
   mr({ port: common.port }, function (er, s) {
     // underscore is already in the package.json,
     // but --save will trigger a rewrite with sort
-    var child = spawn(node, [npm, 'install', '--save', 'underscore@1.3.3'], {
+    var child = spawn(node, [npm, 'install', '--save', 'underscore@1.3.3', '--no-progress', '--loglevel=error'], {
       cwd: pkg,
       env: {
         'npm_config_registry': common.registry,
@@ -37,7 +37,8 @@ test('sorting dependencies', function (t) {
         HOME: process.env.HOME,
         Path: process.env.PATH,
         PATH: process.env.PATH
-      }
+      },
+      stdio: ['ignore', 'ignore', process.stderr]
     })
 
     child.on('close', function (code) {
diff --git a/deps/npm/test/tap/splat-with-only-prerelease-to-latest.js b/deps/npm/test/tap/splat-with-only-prerelease-to-latest.js
index 09eb4ebe3b..2598d55786 100644
--- a/deps/npm/test/tap/splat-with-only-prerelease-to-latest.js
+++ b/deps/npm/test/tap/splat-with-only-prerelease-to-latest.js
@@ -51,13 +51,13 @@ test('setup', function (t) {
     npm.config.set('loglevel', 'silly')
     npm.registry = {
       get: function (uri, opts, cb) {
-        setImmediate(function () {
+        setTimeout(function () {
           cb(null, testModule, null, {statusCode: 200})
         })
       },
       fetch: function (u, opts, cb) {
         lastFetched = u
-        setImmediate(function () {
+        setTimeout(function () {
           var empty = new stream.Readable()
           empty.push(null)
           cb(null, empty)
diff --git a/deps/npm/test/tap/tree-style.js b/deps/npm/test/tap/tree-style.js
new file mode 100644
index 0000000000..b2bf0ce709
--- /dev/null
+++ b/deps/npm/test/tap/tree-style.js
@@ -0,0 +1,116 @@
+'use strict'
+var test = require('tap').test
+var path = require('path')
+var mkdirp = require('mkdirp')
+var rimraf = require('rimraf')
+var fs = require('graceful-fs')
+var common = require('../common-tap')
+
+var base = path.resolve(__dirname, path.basename(__filename, '.js'))
+var modA = path.resolve(base, 'modA')
+var modB = path.resolve(base, 'modB')
+var modC = path.resolve(base, 'modC')
+var testNormal = path.resolve(base, 'testNormal')
+var testGlobal = path.resolve(base, 'testGlobal')
+var testLegacy = path.resolve(base, 'testLegacy')
+
+var json = {
+  'name': 'test-tree-style',
+  'version': '1.0.0',
+  'dependencies': {
+    'modA': modA
+  }
+}
+
+var modAJson = {
+  'name': 'modA',
+  'version': '1.0.0',
+  'dependencies': {
+    'modB': modB
+  }
+}
+
+var modBJson = {
+  'name': 'modB',
+  'version': '1.0.0',
+  'dependencies': {
+    'modC': modC
+  }
+}
+
+var modCJson = {
+  'name': 'modC',
+  'version': '1.0.0'
+}
+
+function modJoin () {
+  var modules = Array.prototype.slice.call(arguments)
+  return modules.reduce(function (a, b) {
+    return path.resolve(a, 'node_modules', b)
+  })
+}
+
+function writeJson (mod, data) {
+  fs.writeFileSync(path.resolve(mod, 'package.json'), JSON.stringify(data))
+}
+
+function setup () {
+  cleanup()
+  ;[modA, modB, modC, testNormal, testGlobal, testLegacy].forEach(function (mod) {
+    mkdirp.sync(mod)
+  })
+  writeJson(modA, modAJson)
+  writeJson(modB, modBJson)
+  writeJson(modC, modCJson)
+  ;[testNormal, testGlobal, testLegacy].forEach(function (mod) { writeJson(mod, json) })
+}
+
+function cleanup () {
+  rimraf.sync(base)
+}
+
+test('setup', function (t) {
+  setup()
+  t.end()
+})
+
+function exists (t, filepath, msg) {
+  try {
+    fs.statSync(filepath)
+    t.pass(msg)
+    return true
+  } catch (ex) {
+    t.fail(msg, {found: null, wanted: 'exists', compare: 'fs.stat(' + filepath + ')'})
+    return false
+  }
+}
+
+test('tree-style', function (t) {
+  t.plan(12)
+  common.npm(['install'], {cwd: testNormal}, function (err, code, stdout, stderr) {
+    if (err) throw err
+    t.is(code, 0, 'normal install; result code')
+    t.is(stderr, '', 'normal install; no errors')
+    exists(t, modJoin(testNormal, 'modA'), 'normal install; module A')
+    exists(t, modJoin(testNormal, 'modB'), 'normal install; module B')
+    exists(t, modJoin(testNormal, 'modC'), 'normal install; module C')
+  })
+  common.npm(['install', '--global-style'], {cwd: testGlobal}, function (err, code, stdout, stderr) {
+    if (err) throw err
+    t.is(code, 0, 'global-style install; result code')
+    t.is(stderr, '', 'global-style install; no errors')
+    exists(t, modJoin(testGlobal, 'modA', 'modB'), 'global-style install; module B')
+    exists(t, modJoin(testGlobal, 'modA', 'modC'), 'global-style install; module C')
+  })
+  common.npm(['install', '--legacy-bundling'], {cwd: testLegacy}, function (err, code, stdout, stderr) {
+    if (err) throw err
+    t.is(code, 0, 'legacy-bundling install; result code')
+    t.is(stderr, '', 'legacy-bundling install; no errors')
+    exists(t, modJoin(testLegacy, 'modA', 'modB', 'modC'), 'legacy-bundling install; module C')
+  })
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
diff --git a/deps/npm/test/tap/uninstall-link-clean.js b/deps/npm/test/tap/uninstall-link-clean.js
new file mode 100644
index 0000000000..eccdac8b26
--- /dev/null
+++ b/deps/npm/test/tap/uninstall-link-clean.js
@@ -0,0 +1,117 @@
+var fs = require('graceful-fs')
+var path = require('path')
+var existsSync = fs.existsSync || path.existsSync
+
+var mkdirp = require('mkdirp')
+var osenv = require('osenv')
+var rimraf = require('rimraf')
+var test = require('tap').test
+
+var common = require('../common-tap.js')
+
+var pkg = path.join(__dirname, 'uninstall-link-clean')
+var dep = path.join(__dirname, 'dep')
+var work = path.join(__dirname, 'uninstall-link-clean-TEST')
+var modules = path.join(work, 'node_modules')
+
+var EXEC_OPTS = { cwd: work }
+
+var world = 'console.log("hello blrbld")\n'
+
+var json = {
+  name: 'package',
+  version: '0.0.0',
+  bin: {
+    hello: './world.js'
+  },
+  dependencies: {
+    'dep': 'file:../dep'
+  }
+}
+
+var pjDep = {
+  name: 'dep',
+  version: '0.0.0',
+  bin: {
+    hello: './world.js'
+  }
+}
+
+test('setup', function (t) {
+  cleanup()
+  mkdirp.sync(pkg)
+  fs.writeFileSync(
+    path.join(pkg, 'package.json'),
+    JSON.stringify(json, null, 2)
+  )
+  fs.writeFileSync(path.join(pkg, 'world.js'), world)
+
+  mkdirp.sync(dep)
+  fs.writeFileSync(
+    path.join(dep, 'package.json'),
+    JSON.stringify(pjDep, null, 2)
+  )
+  fs.writeFileSync(path.join(dep, 'world.js'), world)
+
+  mkdirp.sync(modules)
+  process.chdir(work)
+
+  t.end()
+})
+
+test('installing package with links', function (t) {
+  common.npm(
+    [
+      '--loglevel', 'silent',
+      'install', pkg
+    ],
+    EXEC_OPTS,
+    function (err, code) {
+      t.ifError(err, 'install ran to completion without error')
+      t.notOk(code, 'npm install exited with code 0')
+
+      t.ok(
+        existsSync(path.join(modules, 'package', 'package.json')),
+        'package installed'
+      )
+      t.ok(existsSync(path.join(modules, '.bin')), 'binary link directory exists')
+      t.ok(existsSync(path.join(modules, 'package', 'node_modules', '.bin')),
+        'nested binary link directory exists')
+
+      t.end()
+    }
+  )
+})
+
+test('uninstalling package with links', function (t) {
+  common.npm(
+    [
+      '--loglevel', 'silent',
+      'uninstall', 'package'
+    ],
+    EXEC_OPTS,
+    function (err, code) {
+      t.ifError(err, 'uninstall ran to completion without error')
+      t.notOk(code, 'npm uninstall exited with code 0')
+
+      t.notOk(existsSync(path.join(modules, 'package')),
+        'package directory no longer exists')
+      t.notOk(existsSync(path.join(modules, 'package', 'node_modules', '.bin')),
+        'nested binary link directory no longer exists')
+
+      t.end()
+    }
+  )
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  process.chdir(osenv.tmpdir())
+  rimraf.sync(dep)
+  rimraf.sync(work)
+  rimraf.sync(pkg)
+}
diff --git a/deps/npm/test/tap/unit-deps-removeObsoleteDep.js b/deps/npm/test/tap/unit-deps-removeObsoleteDep.js
new file mode 100644
index 0000000000..2e34fd730f
--- /dev/null
+++ b/deps/npm/test/tap/unit-deps-removeObsoleteDep.js
@@ -0,0 +1,41 @@
+'use strict'
+var test = require('tap').test
+var requireInject = require('require-inject')
+
+// we're just mocking to avoid having to call `npm.load`
+var deps = requireInject('../../lib/install/deps.js', {
+  '../../lib/npm.js': {
+    config: {
+      get: function () { return 'mock' }
+    }
+  }
+})
+
+var removeObsoleteDep = deps._removeObsoleteDep
+
+test('removeObsoleteDep', function (t) {
+  var child1 = {requiredBy: []}
+  var test1 = {
+    removed: true,
+    requires: [ child1 ]
+  }
+  removeObsoleteDep(test1)
+  t.is(child1.removed, undefined, 'no recursion on deps flagged as removed already')
+
+  var child2 = {requiredBy: []}
+  var test2 = {
+    requires: [ child2 ]
+  }
+  child2.requiredBy.push(test2)
+  removeObsoleteDep(test2)
+  t.is(child2.removed, true, 'required by no other modules, removing')
+
+  var child3 = {requiredBy: ['NOTEMPTY']}
+  var test3 = {
+    requires: [ child3 ]
+  }
+  child3.requiredBy.push(test3)
+  removeObsoleteDep(test3)
+  t.is(child3.removed, undefined, 'required by other modules, keeping')
+  t.done()
+})
diff --git a/deps/npm/test/tap/unit-deps-replaceModule.js b/deps/npm/test/tap/unit-deps-replaceModule.js
index aa7c2f51d9..d38aa9985d 100644
--- a/deps/npm/test/tap/unit-deps-replaceModule.js
+++ b/deps/npm/test/tap/unit-deps-replaceModule.js
@@ -7,7 +7,7 @@ test('setup', function (t) {
 })
 
 test('replaceModule', function (t) {
-  var replaceModule = require('../../lib/install/deps').test.replaceModule
+  var replaceModule = require('../../lib/install/deps')._replaceModule
   var mods = []
   for (var ii = 0; ii < 10; ++ii) {
     mods.push({package: {name: ii}})
@@ -31,7 +31,7 @@ test('replaceModule', function (t) {
 })
 
 test('replaceModuleName', function (t) {
-  var replaceModuleName = require('../../lib/install/deps').test.replaceModuleName
+  var replaceModuleName = require('../../lib/install/deps')._replaceModuleName
   var mods = []
   for (var ii = 0; ii < 10; ++ii) {
     mods.push('pkg' + ii)
diff --git a/deps/npm/test/tap/unit-gentlyrm.js b/deps/npm/test/tap/unit-gentlyrm.js
new file mode 100644
index 0000000000..8e61be1964
--- /dev/null
+++ b/deps/npm/test/tap/unit-gentlyrm.js
@@ -0,0 +1,337 @@
+'use strict'
+var test = require('tap').test
+var requireInject = require('require-inject')
+
+function error (code) {
+  var er = new Error()
+  er.code = code
+  return er
+}
+
+function mockWith (fixture) {
+  return {
+    '../../lib/npm.js': {},
+    'graceful-fs': {
+      lstat: function (path, cb) {
+        var entry = fixture[path]
+        if (!entry) return cb(error('ENOENT'))
+        cb(null, {
+          isDirectory: function () { return entry.type === 'directory' },
+          isSymbolicLink: function () { return entry.type === 'symlink' },
+          isFile: function () { return entry.type === 'file' || entry.type === 'cmdshim' || entry.type === 'error' }
+        })
+      },
+      readlink: function (path, cb) {
+        var entry = fixture[path]
+        if (!entry) return cb(error('ENOENT'))
+        if (entry.type !== 'symlink') return cb(error('EINVAL'))
+        cb(null, entry.dest)
+      }
+    },
+    'read-cmd-shim': function (path, cb) {
+      var entry = fixture[path]
+      if (!entry) return cb(error('ENOENT'))
+      if (entry.type === 'directory') return cb(error('EISDIR'))
+      if (entry.type === 'error') return cb(error(entry.code))
+      if (entry.type !== 'cmdshim') return cb(error('ENOTASHIM'))
+      cb(null, entry.dest)
+    }
+  }
+}
+
+test('readLinkOrShim', function (t) {
+  t.plan(10)
+
+  var mocks = mockWith({
+    '/path/to/directory': { type: 'directory' },
+    '/path/to/link': { type: 'symlink', dest: '../to/file' },
+    '/path/to/file': { type: 'file' },
+    '/path/to/cmdshim': { type: 'cmdshim', dest: '../to/file' },
+    '/path/to/invalid': { type: 'error', code: 'EINVAL' }
+  })
+
+  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mocks)
+  var readLinkOrShim = gentlyRm._readLinkOrShim
+
+  readLinkOrShim('/path/to/nowhere', function (er, path) {
+    t.is(er && er.code, 'ENOENT', 'missing files are errors')
+  })
+  readLinkOrShim('/path/to/invalid', function (er, path) {
+    t.is(er && er.code, 'EINVAL', 'other errors pass through too')
+  })
+  readLinkOrShim('/path/to/directory', function (er, path) {
+    t.ifError(er, "reading dirs isn't an error")
+    t.is(path, null, 'reading non links/cmdshims gives us null')
+  })
+  readLinkOrShim('/path/to/file', function (er, path) {
+    t.ifError(er, "reading non-cmdshim files isn't an error")
+    t.is(path, null, 'reading non links/cmdshims gives us null')
+  })
+  readLinkOrShim('/path/to/link', function (er, path) {
+    t.ifError(er, "reading links isn't an error")
+    t.is(path, '../to/file', 'reading links works')
+  })
+  readLinkOrShim('/path/to/cmdshim', function (er, path) {
+    t.ifError(er, "reading cmdshims isn't an error")
+    t.is(path, '../to/file', 'reading cmdshims works')
+  })
+  t.done()
+})
+
+test('resolveSymlink', function (t) {
+  t.plan(9)
+
+  var mocks = mockWith({
+    '/path/to/directory': { type: 'directory' },
+    '/path/to/link': { type: 'symlink', dest: '../to/file' },
+    '/path/to/file': { type: 'file' },
+    '/path/to/cmdshim': { type: 'cmdshim', dest: '../to/file' }
+  })
+
+  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mocks)
+  var resolveSymlink = gentlyRm._resolveSymlink
+
+  resolveSymlink('/path/to/nowhere', function (er, path) {
+    t.is(er && er.code, 'ENOENT', 'missing files are errors')
+  })
+  resolveSymlink('/path/to/directory', function (er, path) {
+    t.ifError(er, "reading dirs isn't an error")
+    t.is(path, '/path/to/directory', 'reading non links/cmdshims gives us path we passed in')
+  })
+  resolveSymlink('/path/to/file', function (er, path) {
+    t.ifError(er, "reading non-cmdshim files isn't an error")
+    t.is(path, '/path/to/file', 'reading non links/cmdshims gives us the path we passed in')
+  })
+  resolveSymlink('/path/to/link', function (er, path) {
+    t.ifError(er, "reading links isn't an error")
+    t.is(path, '/path/to/file', 'reading links works')
+  })
+  resolveSymlink('/path/to/cmdshim', function (er, path) {
+    t.ifError(er, "reading cmdshims isn't an error")
+    t.is(path, '/path/to/file', 'reading cmdshims works')
+  })
+  t.done()
+})
+
+test('readAllLinks', function (t) {
+  t.plan(16)
+
+  var mocks = mockWith({
+    '/path/to/directory': { type: 'directory' },
+    '/path/to/link': { type: 'symlink', dest: '../to/file' },
+    '/path/to/file': { type: 'file' },
+    '/path/to/cmdshim': { type: 'cmdshim', dest: '../to/file' },
+    '/path/to/linktolink': { type: 'symlink', dest: 'link' },
+    '/path/to/linktolink^2': { type: 'symlink', dest: 'linktolink' },
+    '/path/to/linktocmdshim': { type: 'symlink', dest: 'cmdshim' },
+    '/path/to/linktobad': { type: 'symlink', dest: '/does/not/exist' }
+  })
+
+  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mocks)
+  var readAllLinks = gentlyRm._readAllLinks
+
+  readAllLinks('/path/to/nowhere', function (er, path) {
+    t.is(er && er.code, 'ENOENT', 'missing files are errors')
+  })
+  readAllLinks('/path/to/directory', function (er, path) {
+    t.ifError(er, "reading dirs isn't an error")
+    t.isDeeply(path, ['/path/to/directory'], 'reading non links/cmdshims gives us path we passed in')
+  })
+  readAllLinks('/path/to/file', function (er, path) {
+    t.ifError(er, "reading non-cmdshim files isn't an error")
+    t.isDeeply(path, ['/path/to/file'], 'reading non links/cmdshims gives us the path we passed in')
+  })
+  readAllLinks('/path/to/linktobad', function (er, path) {
+    t.is(er && er.code, 'ENOENT', 'links to missing files are errors')
+  })
+  readAllLinks('/path/to/link', function (er, path) {
+    t.ifError(er, "reading links isn't an error")
+    t.isDeeply(path, ['/path/to/link', '/path/to/file'], 'reading links works')
+  })
+  readAllLinks('/path/to/cmdshim', function (er, path) {
+    t.ifError(er, "reading cmdshims isn't an error")
+    t.isDeeply(path, ['/path/to/cmdshim', '/path/to/file'], 'reading cmdshims works')
+  })
+  readAllLinks('/path/to/linktolink', function (er, path) {
+    t.ifError(er, "reading link to link isn't an error")
+    t.isDeeply(path, ['/path/to/linktolink', '/path/to/link', '/path/to/file'], 'reading link to link works')
+  })
+  readAllLinks('/path/to/linktolink^2', function (er, path) {
+    t.ifError(er, "reading link to link to link isn't an error")
+    t.isDeeply(path, ['/path/to/linktolink^2', '/path/to/linktolink', '/path/to/link', '/path/to/file'], 'reading link to link to link works')
+  })
+  readAllLinks('/path/to/linktocmdshim', function (er, path) {
+    t.ifError(er, "reading link to cmdshim isn't an error")
+    t.isDeeply(path, ['/path/to/linktocmdshim', '/path/to/cmdshim', '/path/to/file'], 'reading link to cmdshim works')
+  })
+  t.done()
+})
+
+test('areAnyInsideAny', function (t) {
+  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mockWith({}))
+  var areAnyInsideAny = gentlyRm._areAnyInsideAny
+
+  var noneOneToOne = areAnyInsideAny(['/abc'], ['/xyz'])
+  t.is(noneOneToOne, false, 'none inside: one to one')
+  var noneOneToMany = areAnyInsideAny(['/abc'], ['/rst', '/uvw', '/xyz'])
+  t.is(noneOneToMany, false, 'none inside: one to many')
+  var noneManyToOne = areAnyInsideAny(['/abc', '/def', '/ghi'], ['/xyz'])
+  t.is(noneManyToOne, false, 'none inside: many to one')
+  var noneManyToMany = areAnyInsideAny(['/abc', '/def', '/ghi'], ['/rst', '/uvw', '/xyz'])
+  t.is(noneManyToMany, false, 'none inside: many to many')
+
+  var oneToOne = areAnyInsideAny(['/one/toOne'], ['/one'])
+  t.isDeeply(oneToOne, {target: '/one/toOne', path: '/one'}, 'first: one to one')
+
+  var firstOneToMany = areAnyInsideAny(['/abc/def'], ['/abc', '/def', '/ghi'])
+  t.isDeeply(firstOneToMany, {target: '/abc/def', path: '/abc'}, 'first: one to many')
+  var secondOneToMany = areAnyInsideAny(['/def/ghi'], ['/abc', '/def', '/ghi'])
+  t.isDeeply(secondOneToMany, {target: '/def/ghi', path: '/def'}, 'second: one to many')
+  var lastOneToMany = areAnyInsideAny(['/ghi/jkl'], ['/abc', '/def', '/ghi'])
+  t.isDeeply(lastOneToMany, {target: '/ghi/jkl', path: '/ghi'}, 'last: one to many')
+
+  var firstManyToOne = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/abc'])
+  t.isDeeply(firstManyToOne, {target: '/abc/def', path: '/abc'}, 'first: many to one')
+  var secondManyToOne = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/uvw'])
+  t.isDeeply(secondManyToOne, {target: '/uvw/def', path: '/uvw'}, 'second: many to one')
+  var lastManyToOne = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/xyz'])
+  t.isDeeply(lastManyToOne, {target: '/xyz/def', path: '/xyz'}, 'last: many to one')
+
+  var firstToFirst = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/abc', '/uvw', '/xyz'])
+  t.isDeeply(firstToFirst, {target: '/abc/def', path: '/abc'}, 'first to first: many to many')
+  var firstToSecond = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/nope', '/abc', '/xyz'])
+  t.isDeeply(firstToSecond, {target: '/abc/def', path: '/abc'}, 'first to second: many to many')
+  var firstToLast = areAnyInsideAny(['/abc/def', '/uvw/def', '/xyz/def'], ['/nope', '/nooo', '/abc'])
+  t.isDeeply(firstToLast, {target: '/abc/def', path: '/abc'}, 'first to last: many to many')
+
+  var secondToFirst = areAnyInsideAny(['/!!!', '/abc/def', '/xyz/def'], ['/abc', '/uvw', '/xyz'])
+  t.isDeeply(secondToFirst, {target: '/abc/def', path: '/abc'}, 'second to first: many to many')
+  var secondToSecond = areAnyInsideAny(['/!!!', '/abc/def', '/xyz/def'], ['/nope', '/abc', '/xyz'])
+  t.isDeeply(secondToSecond, {target: '/abc/def', path: '/abc'}, 'second to second: many to many')
+  var secondToLast = areAnyInsideAny(['/!!!', '/abc/def', '/uvw/def'], ['/nope', '/nooo', '/abc'])
+  t.isDeeply(secondToLast, {target: '/abc/def', path: '/abc'}, 'second to last: many to many')
+
+  var lastToFirst = areAnyInsideAny(['/!!!', '/???', '/abc/def'], ['/abc', '/uvw', '/xyz'])
+  t.isDeeply(lastToFirst, {target: '/abc/def', path: '/abc'}, 'last to first: many to many')
+  var lastToSecond = areAnyInsideAny(['/!!!', '/???', '/abc/def'], ['/nope', '/abc', '/xyz'])
+  t.isDeeply(lastToSecond, {target: '/abc/def', path: '/abc'}, 'last to second: many to many')
+  var lastToLast = areAnyInsideAny(['/!!!', '/???', '/abc/def'], ['/nope', '/nooo', '/abc'])
+  t.isDeeply(lastToLast, {target: '/abc/def', path: '/abc'}, 'last to last: many to many')
+
+  t.done()
+})
+
+test('isEverInside', function (t) {
+  t.plan(15)
+
+  var mocks = mockWith({
+    '/path/other/link': { type: 'symlink', dest: '../to/file' },
+    '/path/to/file': { type: 'file' },
+    '/path/to': { type: 'directory' },
+    '/linkpath': { type: 'symlink', dest: '../path/to' },
+    '/path/to/invalid': { type: 'error', code: 'EINVAL' }
+  })
+
+  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mocks)
+  var isEverInside = gentlyRm._isEverInside
+
+  isEverInside('/path/to/file', ['/path/to', '/path/to/invalid'], function (er, inside) {
+    t.ifError(er)
+    t.isDeeply(inside, {target: '/path/to/file', path: '/path/to'}, 'bad paths are ignored if something matches')
+  })
+
+  isEverInside('/path/to/invalid', ['/path/to/invalid'], function (er, inside) {
+    t.is(er && er.code, 'EINVAL', 'errors bubble out')
+  })
+
+  isEverInside('/path/to/file', ['/ten'], function (er, inside) {
+    t.ifError(er)
+    t.is(inside, false, 'not inside')
+  })
+  isEverInside('/path/to/nowhere', ['/ten'], function (er, inside) {
+    t.ifError(er)
+    t.is(inside, false, 'missing target')
+  })
+
+  isEverInside('/path/to/file', ['/path/to'], function (er, inside) {
+    t.ifError(er)
+    t.isDeeply(inside, {target: '/path/to/file', path: '/path/to'}, 'plain file in plain path')
+  })
+  isEverInside('/path/other/link', ['/path/to'], function (er, inside) {
+    t.ifError(er)
+    t.isDeeply(inside, {target: '/path/to/file', path: '/path/to'}, 'link in plain path')
+  })
+
+  isEverInside('/path/to/file', ['/linkpath'], function (er, inside) {
+    t.ifError(er)
+    t.isDeeply(inside, {target: '/path/to/file', path: '/path/to'}, 'plain file in link path')
+  })
+  isEverInside('/path/other/link', ['/linkpath'], function (er, inside) {
+    t.ifError(er)
+    t.isDeeply(inside, {target: '/path/to/file', path: '/path/to'}, 'link in link path')
+  })
+
+  t.done()
+})
+
+test('isSafeToRm', function (t) {
+  var gentlyRm = requireInject('../../lib/utils/gently-rm.js', mockWith({}))
+  var isSafeToRm = gentlyRm._isSafeToRm
+
+  t.plan(12)
+
+  function testIsSafeToRm (t, parent, target, shouldPath, shouldBase, msg) {
+    isSafeToRm(parent, target, function (er, path, base) {
+      t.ifError(er, msg + ' no error')
+      t.is(path, shouldPath, msg + ' path')
+      t.is(base, shouldBase, msg + ' base')
+    })
+  }
+
+  function testNotIsSafeToRm (t, parent, target, msg) {
+    isSafeToRm(parent, target, function (er) {
+      t.is(er && er.code, 'EEXIST', msg + ' error')
+    })
+  }
+
+  var unmanagedParent = {path: '/foo', managed: false}
+  var managedParent = {path: '/foo', managed: true}
+  var targetInParent = {
+    path: '/foo/bar/baz',
+    inParent: {
+      target: '/foo/bar/baz',
+      path: '/foo'
+    }
+  }
+  var targetLinkInParent = {
+    path: '/foo/bar/baz',
+    inParent: {
+      target: '/other/area/baz',
+      path: '/other/area'
+    }
+  }
+  var targetManagedLinkNotInParent = {
+    path: '/foo/bar/baz',
+    managed: true,
+    inParent: false,
+    symlink: '/foo/bar/bark'
+  }
+  var targetUnmanagedLink = {
+    path: '/not/managed/baz',
+    managed: false,
+    inParent: false,
+    symlink: '/not/managed/foo'
+  }
+  var targetUnmanagedFile = {
+    path: '/not/managed/baz',
+    managed: false,
+    inParent: false,
+    symlink: false
+  }
+  testNotIsSafeToRm(t, unmanagedParent, targetInParent, 'unmanaged parent')
+  testIsSafeToRm(t, managedParent, targetInParent, '/foo/bar/baz', '/foo', 'path is in parent')
+  testIsSafeToRm(t, managedParent, targetLinkInParent, '/foo/bar/baz', '/foo/bar', 'path links to parent')
+  testIsSafeToRm(t, managedParent, targetManagedLinkNotInParent, undefined, undefined, 'managed but not owned by package')
+  testNotIsSafeToRm(t, managedParent, targetUnmanagedLink, 'unmanaged link')
+  testNotIsSafeToRm(t, managedParent, targetUnmanagedFile, 'unmanaged file')
+})
diff --git a/deps/npm/test/tap/version-from-git.js b/deps/npm/test/tap/version-from-git.js
new file mode 100644
index 0000000000..6f2c794ce2
--- /dev/null
+++ b/deps/npm/test/tap/version-from-git.js
@@ -0,0 +1,224 @@
+var common = require('../common-tap.js')
+var fs = require('fs')
+var path = require('path')
+
+var mkdirp = require('mkdirp')
+var osenv = require('osenv')
+var rimraf = require('rimraf')
+var test = require('tap').test
+
+var npm = require('../../lib/npm.js')
+
+var pkg = path.resolve(__dirname, 'version-from-git')
+var packagePath = path.resolve(pkg, 'package.json')
+var cache = path.resolve(pkg, 'cache')
+
+var json = { name: 'cat', version: '0.1.2' }
+
+test('npm version from-git with a valid tag creates a new commit', function (t) {
+  var version = '1.2.3'
+  setup()
+  createTag(t, version, runVersion)
+
+  function runVersion (er) {
+    t.ifError(er, 'git tag ran without error')
+    npm.config.set('sign-git-tag', false)
+    npm.commands.version(['from-git'], checkVersion)
+  }
+
+  function checkVersion (er) {
+    var git = require('../../lib/utils/git.js')
+    t.ifError(er, 'version command ran without error')
+    git.whichAndExec(
+      ['log'],
+      { cwd: pkg, env: process.env },
+      checkCommit
+    )
+  }
+
+  function checkCommit (er, log, stderr) {
+    t.ifError(er, 'git log ran without issue')
+    t.notOk(stderr, 'no error output')
+    t.ok(log.indexOf(version) !== -1, 'commit was created')
+    t.end()
+  }
+})
+
+test('npm version from-git with a valid tag updates the package.json version', function (t) {
+  var version = '1.2.3'
+  setup()
+  createTag(t, version, runVersion)
+
+  function runVersion (er) {
+    t.ifError(er, 'git tag ran without error')
+    npm.config.set('sign-git-tag', false)
+    npm.commands.version(['from-git'], checkManifest)
+  }
+
+  function checkManifest (er) {
+    t.ifError(er, 'npm run version ran without error')
+    fs.readFile(path.resolve(pkg, 'package.json'), 'utf8', function (er, data) {
+      t.ifError(er, 'read manifest without error')
+      var manifest = JSON.parse(data)
+      t.equal(manifest.version, version, 'updated the package.json version')
+      t.done()
+    })
+  }
+})
+
+test('npm version from-git strips tag-version-prefix', function (t) {
+  var version = '1.2.3'
+  var prefix = 'custom-'
+  var tag = prefix + version
+  setup()
+  createTag(t, tag, runVersion)
+
+  function runVersion (er) {
+    t.ifError(er, 'git tag ran without error')
+    npm.config.set('sign-git-tag', false)
+    npm.config.set('tag-version-prefix', prefix)
+    npm.commands.version(['from-git'], checkVersion)
+  }
+
+  function checkVersion (er) {
+    var git = require('../../lib/utils/git.js')
+    t.ifError(er, 'version command ran without error')
+    git.whichAndExec(
+      ['log', '--pretty=medium'],
+      { cwd: pkg, env: process.env },
+      checkCommit
+    )
+  }
+
+  function checkCommit (er, log, stderr) {
+    t.ifError(er, 'git log ran without issue')
+    t.notOk(stderr, 'no error output')
+    t.ok(log.indexOf(tag) === -1, 'commit should not include prefix')
+    t.ok(log.indexOf(version) !== -1, 'commit should include version')
+    t.end()
+  }
+})
+
+test('npm version from-git only strips tag-version-prefix if it is a prefix', function (t) {
+  var prefix = 'test'
+  var version = '1.2.3-' + prefix
+  setup()
+  createTag(t, version, runVersion)
+
+  function runVersion (er) {
+    t.ifError(er, 'git tag ran without error')
+    npm.config.set('sign-git-tag', false)
+    npm.config.set('tag-version-prefix', prefix)
+    npm.commands.version(['from-git'], checkVersion)
+  }
+
+  function checkVersion (er) {
+    var git = require('../../lib/utils/git.js')
+    t.ifError(er, 'version command ran without error')
+    git.whichAndExec(
+      ['log'],
+      { cwd: pkg, env: process.env },
+      checkCommit
+    )
+  }
+
+  function checkCommit (er, log, stderr) {
+    t.ifError(er, 'git log ran without issue')
+    t.notOk(stderr, 'no error output')
+    t.ok(log.indexOf(version) !== -1, 'commit should include the full version')
+    t.end()
+  }
+})
+
+test('npm version from-git with an existing version', function (t) {
+  var tag = 'v' + json.version
+  setup()
+  createTag(t, tag, runVersion)
+
+  function runVersion (er) {
+    t.ifError(er, 'git tag ran without error')
+    npm.config.set('sign-git-tag', false)
+    npm.commands.version(['from-git'], checkVersion)
+  }
+
+  function checkVersion (er) {
+    t.equal(er.message, 'Version not changed')
+    t.done()
+  }
+})
+
+test('npm version from-git with an invalid version tag', function (t) {
+  var tag = 'invalidversion'
+  setup()
+  createTag(t, tag, runVersion)
+
+  function runVersion (er) {
+    t.ifError(er, 'git tag ran without error')
+    npm.config.set('sign-git-tag', false)
+    npm.commands.version(['from-git'], checkVersion)
+  }
+
+  function checkVersion (er) {
+    t.equal(er.message, tag + ' is not a valid version')
+    t.done()
+  }
+})
+
+test('npm version from-git without any versions', function (t) {
+  setup()
+  createGitRepo(t, runVersion)
+
+  function runVersion (er) {
+    t.ifError(er, 'created git repo without errors')
+    npm.config.set('sign-git-tag', false)
+    npm.commands.version(['from-git'], checkVersion)
+  }
+
+  function checkVersion (er) {
+    t.equal(er.message, 'No tags found')
+    t.done()
+  }
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  // windows fix for locked files
+  process.chdir(osenv.tmpdir())
+  rimraf.sync(pkg)
+}
+
+function setup () {
+  cleanup()
+  mkdirp.sync(cache)
+  process.chdir(pkg)
+  fs.writeFileSync(packagePath, JSON.stringify(json), 'utf8')
+}
+
+function createGitRepo (t, cb) {
+  npm.load({ cache: cache }, function (er) {
+    t.ifError(er, 'npm load ran without issue')
+    common.makeGitRepo({
+      path: pkg,
+      added: ['package.json']
+    }, cb)
+  })
+}
+
+function createTag (t, tag, cb) {
+  var opts = { cwd: pkg, env: { PATH: process.env.PATH } }
+  npm.load({ cache: cache }, function (er) {
+    t.ifError(er, 'npm load ran without issue')
+
+    // git must be called after npm.load because it uses config
+    var git = require('../../lib/utils/git.js')
+    common.makeGitRepo({
+      path: pkg,
+      added: ['package.json'],
+      commands: [git.chainableExec(['tag', tag, '-am', tag], opts)]
+    }, cb)
+  })
+}
diff --git a/deps/npm/test/tap/version-sub-directory.js b/deps/npm/test/tap/version-sub-directory.js
new file mode 100644
index 0000000000..52074a18e7
--- /dev/null
+++ b/deps/npm/test/tap/version-sub-directory.js
@@ -0,0 +1,74 @@
+var common = require('../common-tap.js')
+var fs = require('fs')
+var path = require('path')
+
+var mkdirp = require('mkdirp')
+var osenv = require('osenv')
+var rimraf = require('rimraf')
+var test = require('tap').test
+
+var npm = require('../../lib/npm.js')
+
+var pkg = path.resolve(__dirname, 'version-sub-directory')
+var subDirectory = path.resolve(pkg, 'sub-directory')
+var packagePath = path.resolve(pkg, 'package.json')
+var cache = path.resolve(pkg, 'cache')
+
+var json = { name: 'cat', version: '0.1.2' }
+
+test('npm version <semver> from a subdirectory', function (t) {
+  setup()
+  npmLoad()
+
+  function npmLoad () {
+    npm.load({ cache: cache }, function () {
+      common.makeGitRepo({
+        path: pkg,
+        added: ['package.json']
+      }, version)
+    })
+  }
+
+  function version (er, stdout, stderr) {
+    t.ifError(er, 'git repo initialized without issue')
+    t.notOk(stderr, 'no error output')
+    npm.config.set('sign-git-tag', false)
+    npm.commands.version(['patch'], checkVersion)
+  }
+
+  function checkVersion (er) {
+    var git = require('../../lib/utils/git.js')
+    t.ifError(er, 'version command ran without error')
+    git.whichAndExec(
+      ['log'],
+      { cwd: pkg, env: process.env },
+      checkCommit
+    )
+  }
+
+  function checkCommit (er, log, stderr) {
+    t.ifError(er, 'git log ran without issue')
+    t.notOk(stderr, 'no error output')
+    t.ok(log.match(/0\.1\.3/g), 'commited from subdirectory')
+    t.end()
+  }
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
+
+function cleanup () {
+  // windows fix for locked files
+  process.chdir(osenv.tmpdir())
+  rimraf.sync(pkg)
+}
+
+function setup () {
+  cleanup()
+  mkdirp.sync(cache)
+  mkdirp.sync(subDirectory)
+  process.chdir(subDirectory)
+  fs.writeFileSync(packagePath, JSON.stringify(json), 'utf8')
+}