deps: update npm to 6.13.4

PR-URL: https://github.com/nodejs/node/pull/30904
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
Reviewed-By: Daijiro Wachi <daijiro.wachi@gmail.com>

6 files changed, 318 insertions, 14 deletions

diff --git a/deps/npm/test/fixtures/config/userconfig-with-gc b/deps/npm/test/fixtures/config/userconfig-with-gc
index b00d5195bd..cf774bb883 100644
--- a/deps/npm/test/fixtures/config/userconfig-with-gc
+++ b/deps/npm/test/fixtures/config/userconfig-with-gc
@@ -1,4 +1,4 @@
-globalconfig = /Users/claudiahdz/npm/cli/test/fixtures/config/globalconfig
+globalconfig = /Users/isaacs/dev/npm/cli/test/fixtures/config/globalconfig
 email = i@izs.me
 env-thing = ${random_env_var}
 init.author.name = Isaac Z. Schlueter
diff --git a/deps/npm/test/tap/bin-overwriting.js b/deps/npm/test/tap/bin-overwriting.js
new file mode 100644
index 0000000000..155d4abf52
--- /dev/null
+++ b/deps/npm/test/tap/bin-overwriting.js
@@ -0,0 +1,107 @@
+const t = require('tap')
+const common = require('../common-tap.js')
+const pkg = common.pkg
+
+const { writeFileSync, readFileSync, readlink } = require('fs')
+const readCmdShim = require('read-cmd-shim')
+const path = require('path')
+const readBinCb = process.platform === 'win32' ? readCmdShim : readlink
+const readBin = bin => new Promise((resolve, reject) => {
+  readBinCb(bin, (er, target) => {
+    if (er)
+      reject(er)
+    else
+      resolve(path.resolve(pkg + '/global/bin', target))
+  })
+})
+
+// verify that we can't overwrite bins that we shouldn't be able to
+
+const mkdirp = require('mkdirp').sync
+
+process.env.npm_config_prefix = pkg + '/global'
+process.env.npm_config_global = true
+
+const globalBin = process.platform === 'win32'
+  ? path.resolve(pkg, 'global')
+  : path.resolve(pkg, 'global/bin')
+
+const globalDir = process.platform === 'win32'
+  ? path.resolve(pkg, 'global/node_modules')
+  : path.resolve(pkg, 'global/lib/node_modules')
+
+const beep = path.resolve(globalBin, 'beep')
+const firstBin = path.resolve(globalDir, 'first/first.js')
+const secondBin = path.resolve(globalDir, 'second/second.js')
+
+t.test('setup', { bail: true }, t => {
+  // set up non-link bin in place
+  mkdirp(globalBin)
+  writeFileSync(beep, 'beep boop')
+
+  // create first package
+  mkdirp(pkg + '/first')
+  writeFileSync(pkg + '/first/package.json', JSON.stringify({
+    name: 'first',
+    version: '1.0.0',
+    bin: { beep: 'first.js' }
+  }))
+  writeFileSync(pkg + '/first/first.js', `#!/usr/bin/env node
+    console.log('first')`)
+
+  // create second package
+  mkdirp(pkg + '/second')
+  writeFileSync(pkg + '/second/package.json', JSON.stringify({
+    name: 'second',
+    version: '1.0.0',
+    bin: { beep: 'second.js' }
+  }))
+  writeFileSync(pkg + '/second/second.js', `#!/usr/bin/env node
+    console.log('second')`)
+
+  // pack both to install globally
+  return common.npm(['pack'], { cwd: pkg + '/first' })
+    .then(() => common.npm(['pack'], { cwd: pkg + '/second' }))
+})
+
+t.test('installing first fails, because pre-existing bin in place', t => {
+  return common.npm([
+    'install',
+    pkg + '/first/first-1.0.0.tgz'
+  ]).then(([code, stdout, stderr]) => {
+    t.notEqual(code, 0)
+    t.match(stderr, 'EEXIST')
+    t.equal(readFileSync(beep, 'utf8'), 'beep boop')
+  })
+})
+
+t.test('installing first with --force succeeds', t => {
+  return common.npm([
+    'install',
+    pkg + '/first/first-1.0.0.tgz',
+    '--force'
+  ]).then(() => {
+    return t.resolveMatch(readBin(beep), firstBin, 'bin written to first.js')
+  })
+})
+
+t.test('installing second fails, because bin links to other package', t => {
+  return common.npm([
+    'install',
+    pkg + '/second/second-1.0.0.tgz'
+  ]).then(([code, stdout, stderr]) => {
+    t.notEqual(code, 0)
+    t.match(stderr, 'EEXIST')
+    return t.resolveMatch(readBin(beep), firstBin, 'bin still linked to first')
+  })
+})
+
+t.test('installing second with --force succeeds', t => {
+  return common.npm([
+    'install',
+    pkg + '/second/second-1.0.0.tgz',
+    '--force'
+  ]).then(() => {
+    return t.resolveMatch(readBin(beep), secondBin, 'bin written to second.js')
+  })
+})
diff --git a/deps/npm/test/tap/fund.js b/deps/npm/test/tap/fund.js
index 364dc1b6f8..97b414bf6e 100644
--- a/deps/npm/test/tap/fund.js
+++ b/deps/npm/test/tap/fund.js
@@ -14,6 +14,7 @@ const base = common.pkg
 const noFunding = path.join(base, 'no-funding-package')
 const maintainerOwnsAllDeps = path.join(base, 'maintainer-owns-all-deps')
 const nestedNoFundingPackages = path.join(base, 'nested-no-funding-packages')
+const fundingStringShorthand = path.join(base, 'funding-string-shorthand')
 
 function getFixturePackage ({ name, version, dependencies, funding }, extras) {
   const getDeps = () => Object
@@ -36,6 +37,13 @@ function getFixturePackage ({ name, version, dependencies, funding }, extras) {
 }
 
 const fixture = new Tacks(Dir({
+  'funding-string-shorthand': Dir({
+    'package.json': File({
+      name: 'funding-string-shorthand',
+      version: '0.0.0',
+      funding: 'https://example.com/sponsor'
+    })
+  }),
   'no-funding-package': Dir({
     'package.json': File({
       name: 'no-funding-package',
@@ -254,6 +262,13 @@ testFundCmd({
 })
 
 testFundCmd({
+  title: 'fund using string shorthand',
+  assertionMsg: 'should open string-only url',
+  args: ['.', '--no-browser'],
+  opts: { cwd: fundingStringShorthand }
+})
+
+testFundCmd({
   title: 'fund using package argument with no browser, using --json option',
   assertionMsg: 'should open funding url',
   args: ['.', '--json', '--no-browser'],
diff --git a/deps/npm/test/tap/install-dep-classification.js b/deps/npm/test/tap/install-dep-classification.js
index 2775c367b0..257fc99fc1 100644
--- a/deps/npm/test/tap/install-dep-classification.js
+++ b/deps/npm/test/tap/install-dep-classification.js
@@ -23,18 +23,39 @@ const env = common.newEnv().extend({
   npm_config_loglevel: 'error'
 })
 
+/**
+ * NOTE: Tarball Fixtures
+ * They contain package.json files with dependencies like the following:
+ * a-1.0.0.tgz: package/package.json
+ * {
+ *   "name":"a",
+ *   "version":"1.0.0",
+ *   "dependencies":{
+ *     "b":"./b-1.0.0.tgz"
+ *   }
+ * }
+ * example-1.0.0.tgz: package/package.json
+ * {
+ *   "name":"example",
+ *   "version":"1.0.0",
+ *   "dependencies":{
+ *     "a":"./a-1.0.0.tgz",
+ *     "b":"./b-1.0.0.tgz"
+ *   }
+ * }
+ */
 const fixture = new Tacks(Dir({
   cache: Dir(),
   global: Dir(),
   tmp: Dir(),
   testdir: Dir({
     'a-1.0.0.tgz': File(Buffer.from(
-      '1f8b0800000000000003edcfc10e82300c0660ce3ec5d2b38e4eb71d789b' +
-      '010d41e358187890f0ee56493c71319218937d977feb9aa50daebab886f2' +
-      'b0a43cc7ce671b4344abb558ab3f2934223b198b4a598bdcc707a38f9c5b' +
-      '0fb2668c83eb79946fff597611effc131378772528c0c11e6ed4c7b6f37c' +
-      '53122572a5a640be265fb514a198a0e43729f3f2f06a9043738779defd7a' +
-      '89244992e4630fd69e456800080000',
+      '1f8b0800000000000003edcfc10a83300c06e09df71492f35653567bf06d' +
+      'a2067163b558b7c3c4775f54f0e4654c18837e973f4da0249eca1bd59cfa' +
+      '25d535b4eeb03344b4c6245bfd8946995d328b5a5b3bd55264464beebdc8' +
+      '9647e8a99355befd67b92559f34f0ce0e8ce9003c1099edc85a675f2d20a' +
+      '154aa762cfae6257361c201fa090994a8bf33c577dfd82713cfefa86288a' +
+      'a2e8736f68a0ff4400080000',
       'hex'
     )),
     'b-1.0.0.tgz': File(Buffer.from(
@@ -55,12 +76,12 @@ const fixture = new Tacks(Dir({
       })
     }),
     'example-1.0.0.tgz': File(Buffer.from(
-      '1f8b0800000000000003ed8fc10ac2300c8677f62946cedaa5d8f5e0db64' +
-      '5b1853d795758a38f6ee4607e261370722f4bbfce5cb4f493c9527aa39f3' +
-      '73aa63e85cb23288688d4997fc136d304df6b945adad45e9c923375a72ed' +
-      '4596b884817a59e5db7fe65bd277fe0923386a190ec0376afd99610b57ee' +
-      '43d339715aa14231157b7615bbb2e100871148664a65b47b15d450dfa554' +
-      'ccb2f890d3b4f9f57d9148241259e60112d8208a00080000',
+      '1f8b0800000000000003ed8fc10a83300c863def2924e7ada6587bf06daa' +
+      '06719bb55837c6c4775fa6307670a70963d0ef92f02584fcce94275353e2' +
+      '962a8ebeb3d1c620a2562a5ef34f64aae328cd344aa935f21e379962875b' +
+      '3fb2c6c50fa6e757bebdb364895ff54f18c19a962007ba99d69d09f670a5' +
+      'de379d6527050a645391235b912d1bf2908f607826127398e762a8efbc53' +
+      'ccae7873d3b4fb75ba402010087ce2014747c9d500080000',
       'hex'
     )),
     optional: Dir({
diff --git a/deps/npm/test/tap/install-local-from-local.js b/deps/npm/test/tap/install-local-from-local.js
new file mode 100644
index 0000000000..ec53c74a39
--- /dev/null
+++ b/deps/npm/test/tap/install-local-from-local.js
@@ -0,0 +1,94 @@
+'use strict'
+var path = require('path')
+var fs = require('graceful-fs')
+var test = require('tap').test
+var common = require('../common-tap.js')
+var Tacks = require('tacks')
+var Dir = Tacks.Dir
+var File = Tacks.File
+
+var testdir = path.join(__dirname, path.basename(__filename, '.js'))
+var cwd = path.join(testdir, '3')
+
+/**
+ * NOTE: Tarball Fixtures
+ * They contain package.json files with dependencies like the following:
+ * 1-1.0.0.tgz: package/package.json
+ * {
+ *   "name":"1",
+ *   "version":"1.0.0"
+ * }
+ * 2-1.0.0.tgz: package/package.json
+ * {
+ *   "name":"2",
+ *   "version":"1.0.0",
+ *   "dependencies":{
+ *     "1":"file:../1/1-1.0.0.tgz"
+ *   }
+ * }
+ */
+var fixture = new Tacks(Dir({
+  '1': Dir({
+    '1-1.0.0.tgz': File(Buffer.from(
+      '1f8b08000000000000032b484cce4e4c4fd52f80d07a59c5f9790c540606' +
+      '06066626260ad8c4c1c0d85c81c1d8d4ccc0d0d0cccc00a80ec830353103' +
+      'd2d4760836505a5c925804740aa5e640bca200a78708a856ca4bcc4d55b2' +
+      '523254d2512a4b2d2acecccf03f1f40cf40c946ab906da79a360148c8251' +
+      '300a6804007849dfdf00080000',
+      'hex'
+    ))
+  }),
+  '2': Dir({
+    '2-1.0.0.tgz': File(Buffer.from(
+      '1f8b0800000000000003ed8f3d0e83300c8599394594b90d36840cdc2602' +
+      '17d19f80087468c5ddeb14a9135b91aa4af996e73c3f47f660eb8b6d291b' +
+      '565567dfbb646700c0682db6fc00ea5c24456900d118e01c17a52e58f75e' +
+      '648bd94f76e455befd67bd457cf44f78a64248676f242b21737908cf3b8d' +
+      'beeb5d70508182d56d6820d790ab3bf2dc0a83ec62489dba2b554a6598e1' +
+      'f13da1a6f62139b0a44bfaeb0b23914824b2c50b8b5b623100080000',
+      'hex'
+    ))
+  }),
+  '3': Dir({
+    'package.json': File({
+      name: '3',
+      version: '1.0.0',
+      dependencies: {
+        '2': '../2/2-1.0.0.tgz'
+      }
+    })
+  })
+}))
+
+function setup () {
+  fixture.create(testdir)
+}
+
+function cleanup () {
+  fixture.remove(testdir)
+}
+
+test('setup', function (t) {
+  cleanup()
+  setup()
+  t.end()
+})
+
+test('installing local package with local dependency', function (t) {
+  common.npm(
+    ['install'],
+    {cwd: cwd},
+    function (er, code, stdout, stderr) {
+      t.is(code, 0, 'no error code')
+      t.is(stderr, '', 'no error output')
+      t.ok(fs.existsSync(path.join(cwd, 'node_modules', '2')), 'installed direct dep')
+      t.ok(fs.existsSync(path.join(cwd, 'node_modules', '1')), 'installed indirect dep')
+      t.end()
+    }
+  )
+})
+
+test('cleanup', function (t) {
+  cleanup()
+  t.end()
+})
diff --git a/deps/npm/test/tap/utils.funding.js b/deps/npm/test/tap/utils.funding.js
index 51b89e5f8d..709762eacb 100644
--- a/deps/npm/test/tap/utils.funding.js
+++ b/deps/npm/test/tap/utils.funding.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const { test } = require('tap')
-const { getFundingInfo } = require('../../lib/utils/funding')
+const { retrieveFunding, getFundingInfo } = require('../../lib/utils/funding')
 
 test('empty tree', (t) => {
   t.deepEqual(
@@ -545,3 +545,70 @@ test('handle different versions', (t) => {
   )
   t.end()
 })
+
+test('retrieve funding info from valid objects', (t) => {
+  t.deepEqual(
+    retrieveFunding({
+      url: 'http://example.com',
+      type: 'Foo'
+    }),
+    {
+      url: 'http://example.com',
+      type: 'Foo'
+    },
+    'should return standard object fields'
+  )
+  t.deepEqual(
+    retrieveFunding({
+      extra: 'Foo',
+      url: 'http://example.com',
+      type: 'Foo'
+    }),
+    {
+      extra: 'Foo',
+      url: 'http://example.com',
+      type: 'Foo'
+    },
+    'should leave untouched extra fields'
+  )
+  t.deepEqual(
+    retrieveFunding({
+      url: 'http://example.com'
+    }),
+    {
+      url: 'http://example.com'
+    },
+    'should accept url-only objects'
+  )
+  t.end()
+})
+
+test('retrieve funding info from invalid objects', (t) => {
+  t.deepEqual(
+    retrieveFunding({}),
+    {},
+    'should passthrough empty objects'
+  )
+  t.deepEqual(
+    retrieveFunding(),
+    undefined,
+    'should not care about undefined'
+  )
+  t.deepEqual(
+    retrieveFunding(),
+    null,
+    'should not care about null'
+  )
+  t.end()
+})
+
+test('retrieve funding info string shorthand', (t) => {
+  t.deepEqual(
+    retrieveFunding('http://example.com'),
+    {
+      url: 'http://example.com'
+    },
+    'should accept string shorthand'
+  )
+  t.end()
+})