deps: upgrade npm to 6.14.7

deps/npm/AUTHORS

@@ -699,3 +699,6 @@ Peter Fich <peterfich@users.noreply.github.com>
 Maxwell Gerber <mgerber@berkeley.edu>
 Sean Poulter <sean.poulter@gmail.com>
 vanishcode <vanishcode@outlook.com>
+Jean-Charles Sisk <jasisk@gmail.com>
+Martin Packman <martin@zegami.com>
+Danielle Adams <danielle.adams@heroku.com>

deps/npm/CHANGELOG.md

@@ -1,3 +1,23 @@
+## 6.14.7 (2020-07-21)
+
+### BUG FIXES
+* [`de5108836`](https://github.com/npm/cli/commit/de5108836189bddf28d4d3542f9bd5869cc5c2e9) [#784](https://github.com/npm/cli/pull/784) npm explore spawn shell correctly ([@jasisk](https://github.com/jasisk))
+* [`36e6c01d3`](https://github.com/npm/cli/commit/36e6c01d334c4db75018bc6a4a0bef726fd41ce4) git tag handling regression on shrinkwrap ([@claudiahdz](https://github.com/claudiahdz))
+* [`1961c9369`](https://github.com/npm/cli/commit/1961c9369c92bf8fe530cecba9834ca3c7f5567c) [#288](https://github.com/npm/cli/pull/288) Fix package id in shrinkwrap lifecycle step output ([@bz2](https://github.com/bz2))
+* [`87888892a`](https://github.com/npm/cli/commit/87888892a1282cc3edae968c3ae4ec279189271c) [#1009](https://github.com/npm/cli/pull/1009) gracefully handle error during npm install ([@danielleadams](https://github.com/danielleadams))
+* [`6fe2bdc25`](https://github.com/npm/cli/commit/6fe2bdc25e7961956e5c0067fa4db54ff1bd0dbd) [#1547](https://github.com/npm/cli/pull/1547) npm ls --parseable --long output ([@ruyadorno](https://github.com/ruyadorno))
+
+### DEPENDENCIES
+* [`2d78481c7`](https://github.com/npm/cli/commit/2d78481c7ec178e628ce23df940f73a05d5c6367) update mkdirp on tacks ([@claudiahdz](https://github.com/claudiahdz))
+* [`4e129d105`](https://github.com/npm/cli/commit/4e129d105eba3b12d474caa6e5ca216a98deb75a) uninstall npm-registry-couchapp ([@claudiahdz](https://github.com/claudiahdz))
+* [`8e1869e27`](https://github.com/npm/cli/commit/8e1869e278d1dd37ddefd6b4e961d1bb17fc9d09) update marked dev dep ([@claudiahdz](https://github.com/claudiahdz))
+* [`6a6151f37`](https://github.com/npm/cli/commit/6a6151f377063c6aca852c859c01910edd235ec6) `libnpx@10.2.4` ([@claudiahdz](https://github.com/claudiahdz))
+* [`dc21422eb`](https://github.com/npm/cli/commit/dc21422eb1ca1a4a19f160fad0e924566e08c496) `bin-links@1.1.8` ([@claudiahdz](https://github.com/claudiahdz))
+* [`d341f88ce`](https://github.com/npm/cli/commit/d341f88ce6feb3df1dcb37f34910fcc6c1db85f2) `gentle-fs@2.3.1` ([@claudiahdz](https://github.com/claudiahdz))
+* [`3e168d49b`](https://github.com/npm/cli/commit/3e168d49b41574809cae2ad013776a00d3f20ff4) `libcipm@4.0.8` ([@claudiahdz](https://github.com/claudiahdz))
+* [`6ae942a51`](https://github.com/npm/cli/commit/6ae942a510520b7dff11b5b78eebeff1706e38af) `npm-audit-report@1.3.3` ([@claudiahdz](https://github.com/claudiahdz))
+* [`6a35e3dee`](https://github.com/npm/cli/commit/6a35e3deec275bf2ae76603acd424a0640458047) `npm-lifecycle@3.1.5` ([@claudiahdz](https://github.com/claudiahdz))
+
 ## 6.14.6 (2020-07-07)
 
 ### BUG FIXES

deps/npm/CONTRIBUTING.md

@@ -123,7 +123,7 @@ We often want to know if the bug we've fixed for the feature we've added has any
 1. Make a pull-request against this repository
 2. Add the following comment to the pull-request: "`test this please ✅`"
 
-This will trigger the [benmark suite](https://github.com/npm/benchmarks) to run against your pull-request, and when it's finished running it will post a comment on your pull-request just like bellow. You'll be able to see the results from the suite inline in your pull-request.
+This will trigger the [benchmark suite](https://github.com/npm/benchmarks) to run against your pull-request, and when it's finished running it will post a comment on your pull-request just like below. You'll be able to see the results from the suite inline in your pull-request.
 
 > You'll notice that the bot-user will also add a 🚀 reaction to your comment to
 let you know that it's sent the request to start the benchmark suite.
@@ -186,7 +186,6 @@ You'll need a few things installed in order to update and test the CLI project d
 
 > Package vendoring is commonly referred to as the case where dependent packages are stored in the same place as your project. That usually means you dependencies are checked into your source management system, such as Git.
 
-The CLI project vendors it's dependencies in the `node_modules/` folder. Meaning all the dependencies that the CLI project uses are contained withing the project itself. This is represented by the `bundledDependencies` section in the root level `package.json` file. The main reason for this is because the `npm` CLI project is distributed with the NodeJS runtime and needs to work out of the box, which means all dependencies need to be available after the runtime is installed.
+The CLI project vendors its dependencies in the `node_modules/` folder. Meaning all the dependencies that the CLI project uses are contained within the project itself. This is represented by the `bundledDependencies` section in the root level `package.json` file. The main reason for this is because the `npm` CLI project is distributed with the NodeJS runtime and needs to work out of the box, which means all dependencies need to be available after the runtime is installed.
 
 There are a couple scripts created to help manage this process in the `scripts/` folder.
-

deps/npm/lib/explore.js

@@ -23,14 +23,13 @@ function explore (args, cb) {
   var opts = {cwd: cwd, stdio: 'inherit'}
 
   var shellArgs = []
-  if (args) {
+  if (args.length) {
     if (isWindows) {
       var execCmd = escapeExecPath(args.shift())
       var execArgs = [execCmd].concat(args.map(escapeArg))
       opts.windowsVerbatimArguments = true
       shellArgs = ['/d', '/s', '/c'].concat(execArgs)
     } else {
-      shellArgs.unshift('-c')
       shellArgs = ['-c', args.map(escapeArg).join(' ').trim()]
     }
   }

deps/npm/lib/install.js

@@ -650,6 +650,9 @@ Installer.prototype.saveToDependencies = function (cb) {
   validate('F', arguments)
   if (this.failing) return cb()
   log.silly('install', 'saveToDependencies')
+  // Note idealTree will be mutated during the save operations below as the
+  // package is reloaded from disk to preserve additional details. This means
+  // steps after postInstall will see a slightly different package object.
   if (this.saveOnlyLock) {
     saveShrinkwrap(this.idealTree, cb)
   } else {

deps/npm/lib/install/deps.js

@@ -76,7 +76,7 @@ function doesChildVersionMatch (child, requested, requestor) {
       if (childReq.rawSpec === requested.rawSpec) return true
       if (childReq.type === requested.type) {
         if (childReq.saveSpec === requested.saveSpec) return true
-        if (childReq.fetchSpec === requested.fetchSpec) return true
+        if ((childReq.fetchSpec === requested.fetchSpec) && requested.type !== 'git') return true
       }
     }
     // If _requested didn't exist OR if it didn't match then we'll try using

deps/npm/lib/install/inflate-shrinkwrap.js

@@ -52,6 +52,14 @@ function inflateShrinkwrap (topPath, tree, swdeps, opts) {
     const sw = swdeps[name]
     const dependencies = sw.dependencies || {}
     const requested = realizeShrinkwrapSpecifier(name, sw, topPath)
+
+    if (Object.keys(sw).length === 0) {
+      let message = `Object for dependency "${name}" is empty.\n`
+      message += 'Something went wrong. Regenerate the package-lock.json with "npm install".\n'
+      message += 'If using a shrinkwrap, regenerate with "npm shrinkwrap".'
+      return Promise.reject(new Error(message))
+    }
+
     return inflatableChild(
       onDisk[name], name, topPath, tree, sw, requested, opts
     ).then((child) => {

deps/npm/lib/install/save.js

@@ -8,6 +8,7 @@ const iferr = require('iferr')
 const log = require('npmlog')
 const moduleName = require('../utils/module-name.js')
 const npm = require('../npm.js')
+const packageId = require('../utils/package-id.js')
 const parseJSON = require('../utils/parse-json.js')
 const path = require('path')
 const stringifyPackage = require('stringify-package')
@@ -131,6 +132,9 @@ function savePackageJson (tree, next) {
     } else {
       writeFileAtomic(saveTarget, json, next)
     }
+
+    // Restore derived id as it was removed when reloading from disk
+    tree.package._id = packageId(tree.package)
   }))
 }
 

deps/npm/lib/ls.js

@@ -545,7 +545,7 @@ function makeParseable_ (data, long, dir, depth, parent, d) {
 
   return data.path +
          ':' + (data._id || '') +
-         ':' + (data.realPath !== data.path ? data.realPath : '') +
+         (data.link && data.link !== data.path ? ':' + data.link : '') +
          (data.extraneous ? ':EXTRANEOUS' : '') +
          (data.error && data.path !== path.resolve(npm.globalDir, '..') ? ':ERROR' : '') +
          (data.invalid ? ':INVALID' : '') +

deps/npm/man/man1/npm-adduser.1

@@ -2,7 +2,8 @@
 .P
 section: cli\-commands
 title: npm\-adduser
-.SH description: Set access level on published packages
+description: Set access level on published packages
+.HR
 .TH "NPM\-ADDUSER" "1" "July 2020" "" ""
 .SH "NAME"
 \fBnpm-adduser\fR \- Add a registry user account

deps/npm/man/man1/npm-dist-tag.1

@@ -2,7 +2,8 @@
 .P
 section: cli\-commands
 title: npm\-dist\-tag
-.SH description: Modify package distribution tags
+description: Modify package distribution tags
+.HR
 .TH "NPM\-DIST\-TAG" "1" "July 2020" "" ""
 .SH "NAME"
 \fBnpm-dist-tag\fR \- Modify package distribution tags

deps/npm/man/man1/npm-explore.1

@@ -2,7 +2,8 @@
 .P
 section: cli\-commands
 title: npm\-explore
-.SH description: Browse an installed package
+description: Browse an installed package
+.HR
 .TH "NPM\-EXPLORE" "1" "July 2020" "" ""
 .SH "NAME"
 \fBnpm-explore\fR \- Browse an installed package

deps/npm/man/man1/npm-ls.1

@@ -22,7 +22,7 @@ For example, running \fBnpm ls promzard\fP in npm's source tree will show:
 .P
 .RS 2
 .nf
-    npm@6\.14\.6 /path/to/npm
+    npm@6\.14\.7 /path/to/npm
     └─┬ init\-package\-json@0\.0\.4
       └── promzard@0\.1\.5
 .fi

deps/npm/man/man1/npm.1

@@ -10,7 +10,7 @@ npm <command> [args]
 .RE
 .SS Version
 .P
-6\.14\.6
+6\.14\.7
 .SS Description
 .P
 npm is the package manager for the Node JavaScript platform\.  It puts

deps/npm/man/man1/npx.1

@@ -1,4 +1,4 @@
-.TH "NPX" "1" "January 2020" "npx@10.2.1" "User Commands"
+.TH "NPX" "1" "July 2020" "npx@10.2.3" "User Commands"
 .SH "NAME"
 \fBnpx\fR \- execute npm package binaries
 .SH SYNOPSIS