[v8.x] deps: update npm to 5.4.2

[targos]

This includes three npm releases, one of which is pretty big (5.4.0).

Changes of Note

• Significant performance boost for installations from cache (~10%+)
• A number of bugfixes for important and severe bugs affecting
  installation on all supported platforms, but particularly noticeable
  on Windows.
• More Windows-related fixes for npx.
• #17844
  Make package-lock.json sorting locale-agnostic. This will cause
  some users to see seemingly spurious diffs on their pkglocks if
  they were using previous versions of npm5, because, for example,
  JSONStream is sorted into a different location. This is fine and
  will go away as people upgrade.

Changelogs

• v5.4.0
• v5.4.1
• v5.4.2

Checklist

• make -j4 test (UNIX), or vcbuild test (Windows) passes
• commit message follows commit guidelines

Affected core subsystem(s)

[bzoz]

Looks like this will fix #15095

[bricss]

I can confirm that it will definitely fix #15095

[gibfahn]

cc/ @nodejs/npm , would be good to get @zkat and @iarna to give this a look (AIUI it's #15486 (comment) but for 8.x).

@targos did you manage to run make test-npm on this? It should work on Darwin/Linux, but in my experience (not up to date) you get the odd test failure.

[targos]

@gibfahn make test-npm seems to block on

> npm@5.4.2 test-node /home/mzasso/git/nodejs/node-v8/test-npm
> tap --timeout 240 "test/tap/*.js" "test/network/*.js" "test/broken-under-nyc*/*.js"

Reading TAP data from stdin (use "-" argument to suppress)

CPU is not working

[gibfahn]

You could try the js one:

./node tools/test-npm-package --install deps/npm test

Or I could just land #11540 and we could run it through CI. Really needs some more reviews, but 🤷‍♂️ .

FWIW that output usually means that tap didn't find any files. Chances are the directory didn't get set up properly, you can just look through the bash script, it just copies deps/npm to test-npm and then does an npm install && npm test on it.

[targos]

I tried test-npm-package and manual run. Both also hang. It's weird because I don't have this issue with a fresh clone of the npm repo.

[iarna]

I'm ok with 5.4.2 going in (previous 5.4 releases weren't stable enough for me to feel comfortable).

I'll take a look at the tests, this should be pretty straight forward. The blocking happens when tap is given an empty list of tests (it falls back to reading them from STDIN, which results in the process never doing anything).

[gibfahn]

@targos the version of npm in your PR doesn't seem to have a test directory, which I assume is why the test is hanging.

See https://github.com/targos/node/tree/npm-5.4.2-v8.x/deps/npm
cf: https://github.com/nodejs/node/tree/master/deps/npm

[targos]

OK. That makes sense... Then the issue is that npm doesn't include the test directory anymore in the release tarball.

[targos]

This is because the version of npm-packlist present in npm 5.4.2 ignores the test directory. This has been reverted in npm/npm-packlist#3 and should be OK in the next version of npm.
@iarna do you know when the release is scheduled?

[MylesBorins]

landed in 547fe58