chore(deps): update dependency npm to v9.9.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
npm (source)	9.2.0 -> 9.9.3
npm (source)	~9.2.0 -> ~9.9.0

---

Release Notes

npm/cli (npm)

v9.9.3

Compare Source

Bug Fixes

• 88ea8c7 #​7010 set objectMode for search filter stream (@​lukekarrys)
• 8d9d735 #​7010 unpublish: bubble up all errors parsing local package.json (#​7049) (@​wraithgar)
• e0e75e5 #​7010 unpublish bugfixes (#​7039) (@​wraithgar)
• 4d59ce1 #​7047 reverse direction of SPDX SBOM dep rels (#​7047) (@​bdehamer, @​antonbauhofer)
• 878f22b #​7008 properly catch missing url opener error (@​wraithgar)
• 91a8eca #​7008 properly catch missing url opener error on interactive prompt (@​wraithgar)

Dependencies

• 1968e0e #​7010 spdx-license-ids@3.0.17
• d130576 #​7010 spdx-exceptions@2.5.0
• 00f28b8 #​7010 signal-exit@4.1.0
• 57096c3 #​7010 postcss-selector-parser@6.0.15
• 3ce677e #​7010 minipass-fetch@3.0.4
• 89757ed #​7010 is-core-module@2.13.1
• bc1e841 #​7010 socks@2.8.1
• 01f4049 #​7010 ignore-walk@6.0.4
• 15f8982 #​7010 function-bind@1.1.2
• 88ff949 #​7010 cmd-shim@6.0.2
• 3e298f6 #​7010 bin-links@4.0.3
• 35a6286 #​7010 are-we-there-yet@4.0.2
• aeb28c4 #​7010 agentkeepalive@4.5.0
• edc7e23 #​7010 @npmcli/query@3.1.0
• 00a3a08 #​7010 tar@6.2.0
• 7f424c3 #​7010 ssri@10.0.5
• 79b8538 #​7010 semver@7.6.0
• b5faf10 #​7010 npm-install-checks@6.3.0
• 2c62266 #​7010 node-gyp@9.4.1
• cc0516b #​7010 minipass@7.0.4
• 651d362 #​7010 json-parse-even-better-errors@3.0.1
• 4b239c6 #​7010 glob@10.3.10
• 2f65b46 #​7010 fs-minipass@3.0.3
• 6c73ddf #​7010 diff@5.2.0
• 73ee6cc #​7010 ci-info@4.0.0
• 64715a4 #​7010 cacache@17.1.4
• workspace: @npmcli/arborist@6.5.1
• workspace: @npmcli/config@6.4.1
• workspace: libnpmaccess@7.0.3
• workspace: libnpmdiff@5.0.21
• workspace: libnpmexec@6.0.5
• workspace: libnpmfund@4.2.2
• workspace: libnpmhook@9.0.4
• workspace: libnpmorg@5.0.5
• workspace: libnpmpack@5.0.21
• workspace: libnpmpublish@7.5.2
• workspace: libnpmsearch@6.0.3
• workspace: libnpmteam@5.0.4
• workspace: libnpmversion@4.0.3

Chores

• 77fa150 #​7252 release: do not exclude docs directory from CLI release commits (#​7162) (@​lukekarrys)
• 1d4c464 #​7252 @npmcli/template-oss@4.21.3 (@​lukekarrys)
• 6780643 #​7010 dev dependency updates (@​wraithgar)
• ce701e9 #​7048 fix tests for zlib differences between node versions (#​7048) (@​wraithgar)

v9.9.2

Compare Source

Bug Fixes

• 4c9a5e1 #​6993 look in workspace for exec commands (#​6993) (@​wraithgar)
• bb6f496 #​6992 correctly handle object licenses in SBOM generation (#​6992) (@​bdehamer, @​jamietanna)
• 10db3ca #​6990 pkg: properly output in workspace mode (#​6990) (@​wraithgar)

Documentation

• 6ab06d7 #​6985 update npm-prune description (#​6985) (@​Eomm)

Dependencies

• Workspace: libnpmpublish@7.5.1

v9.9.1

Compare Source

Bug Fixes

• 0dba79a #​6942 add back bin/node-gyp-bin/node-gyp files (@​lukekarrys)
• c93edb5 #​6932 add back bin/node-gyp-bin/node-gyp files (@​lukekarrys)

Documentation

• e6cce28 #​6925 use markdown links instead of html (@​lukekarrys)

v9.9.0

Compare Source

Features

• ecda95a #​6841 add npm sbom command (#​6841) (@​bdehamer)
• fdb8a86 #​6794 add package-lock-only mode to npm query (@​wraithgar)
• 16c04b1 #​6877 add no-package-lock mode to npm audit (@​wraithgar)
• 66ef765 #​6776 Add --cpu and --os option to override platform specific install (#​6776) (@​yukukotani)

Bug Fixes

• c9406f7 #​6791 deprecate: ignore implicit workspace mode (#​6758) (#​6791) (@​wraithgar)
• 0b1d7c3 #​6779 allow searching packages with no description (#​6779) (@​wraithgar, @​lukekarrys)

Documentation

• 9750720 #​6694 fix example path (#​6694) (@​fvilers)

Dependencies

• 588a245 #​6756 npm-pick-manifest@8.0.2
• a76b1df #​6877 sigstore@1.9.0
• 95b5ab0 #​6877 npm-install-checks@6.2.0
• Workspace: @npmcli/arborist@6.5.0
• Workspace: @npmcli/config@6.4.0
• Workspace: libnpmdiff@5.0.20
• Workspace: libnpmexec@6.0.4
• Workspace: libnpmfund@4.2.1
• Workspace: libnpmpack@5.0.20

v9.8.1

Compare Source

Bug Fixes

• 38351c9 #​6651 warn on autocorrected package.json entries during publish (@​wraithgar)
• 02c7ddb #​6642 much clearer npx 'canceled' error (#​6642) (@​rahulio96, @​AaronHamilton965)

Documentation

• 36bf5fe #​6643 Added steps for using npm/npx locally to CONTRIBUTING.md (#​6643) (@​AaronHamilton965, @​rahulio96)

Dependencies

• a0763d3 #​6651 @npmcli/package-json@4.0.1
• 24f5a8b #​6653 supports-color@9.4.0
• f45498b #​6653 chalk@5.3.0
• 44d60eb #​6653 minimatch@9.0.3
• fc9a843 #​6653 bin-links@3.0.2
• daad9ad #​6653 semver@7.5.4
• c1ffd6a #​6653 move @​npmcli/fs, @​npmcli/promise-spawn into dependencies
• Workspace: libnpmexec@6.0.3

v9.8.0

Compare Source

Features

• 67459e7 #​6626 add pkg fix subcommand (@​wraithgar)
• 89b2741 #​6548 add ps1 scripts (#​6548) (@​mribbons, @​lukekarrys)

Dependencies

• b252164 #​6626 @npmcli/package-json@4.0.0
• 9238682 #​6623 sigstore@1.7.0 (#​6623)
• Workspace: @npmcli/arborist@6.3.0
• Workspace: libnpmdiff@5.0.19
• Workspace: libnpmexec@6.0.2
• Workspace: libnpmfund@4.0.19
• Workspace: libnpmpack@5.0.19
• Workspace: libnpmpublish@7.5.0

v9.7.2

Compare Source

Bug Fixes

• 939a188 #​6574 ignore node prereleases in npm engines check (#​6574) (@​wraithgar)
• d980405 #​6556 better color support detection (#​6556) (@​lukekarrys)
• 40d7e09 #​6555 remove unnecessary package.json values (#​6555) (@​lukekarrys)
• 3a7378d #​6554 cleanup bin contents (@​lukekarrys)
• e722439 #​6497 move all definitions to @​npmcli/config package (@​lukekarrys)

Documentation

• 405ffbf #​6557 remove redundant statement about files attribute (#​6557) (@​DaviDevMod)
• cd1e6aa #​6551 add flag package-lock-only for npm install (#​6551) (@​m4rch3n1ng)

Dependencies

• aebc523 #​6585 safe-buffer@5.2.1 string_decoder@1.3.0 (#​6585)
• bb6054b #​6573 tuf-js@1.1.7
• aee4a30 #​6573 strip-ansi@7.1.0
• 6105dbc #​6573 path-scurry@1.9.2
• 22d44e8 #​6573 read-package-json@6.0.4
• fdd02fd #​6573 jackspeak@2.2.1
• 7797075 #​6573 is-core-module@2.12.1
• f9780cc #​6573 sigstore@1.6.0
• 72d6a79 #​6573 semver@7.5.2
• 98f1f5f #​6573 nopt@7.2.0
• 8710ff8 #​6573 pacote@15.2.0
• 0cb539d #​6573 node-gyp@9.4.0
• 39ad586 #​6573 ini@4.1.1
• 5e0070c #​6573 glob@10.2.7 minimatch@9.0.1
• 26cf235 #​6573 cacache@17.1.3
• Workspace: @npmcli/arborist@6.2.10
• Workspace: @npmcli/config@6.2.1
• Workspace: libnpmdiff@5.0.18
• Workspace: libnpmexec@6.0.1
• Workspace: libnpmfund@4.0.18
• Workspace: libnpmpack@5.0.18
• Workspace: libnpmpublish@7.4.0

v9.7.1

Compare Source

Dependencies

• 7467ff6 #​6518 @npmcli/package-json@3.1.1, @npmcli/git@4.1.0

v9.7.0

Compare Source

⚠️ DEPRECATED ⚠️

Features

• a63a6d8 #​6490 add provenanceFile option for libnpmpublish (@​bdehamer)
• 2a8f4f2 #​6490 add new exclusive config item publish-file (@​wraithgar)
• 361e194 #​6483 implement flag --prefer-dedupe for npm install (#​6483) (@​m4rch3n1ng)

Bug Fixes

• 38eb39b #​6514 strip ansi characters from search results (#​6514) (@​wraithgar)
• 4b5ccfc #​6477 make usage and completion static functions (#​6477) (@​lukekarrys)
• 4f39e8c #​6479 refactor engines validation to lint syntax (#​6479) (@​lukekarrys)
• f3cfe12 #​6482 remove unused lib/npm relics (#​6482) (@​lukekarrys)
• 87de0c7 #​6472 move explore command to @​npmcli/package-json (@​wraithgar)
• 636e29e #​6472 move to @​npmcli/package-json where possible (@​wraithgar)
• 37cc797 #​6418 retrieve registry keys via TUF (#​6418) (@​bdehamer)

Documentation

• 83cd5bd #​6480 add global option for uninstall (#​6480) (@​m4rch3n1ng)
• 0400ce3 #​6481 add cli params to npm set, npm get (#​6481) (@​m4rch3n1ng)
• c3638ce #​6468 remove package-lock option for npm ci (#​6468) (@​m4rch3n1ng)

Dependencies

• 060d587 chalk@5.2.0, npm-audit-report@5.0.0
• fc52ca8 #​6472 remove read-package-json-fast
• 3238aa7 #​6472 remove read-package-json
• Workspace: @npmcli/config@6.2.0
• Workspace: libnpmexec@6.0.0
• Workspace: libnpmpublish@7.3.0

v9.6.7

Compare Source

Bug Fixes

• 9202c7d #​6464 npm cache completion (#​6464) (@​m4rch3n1ng)
• 6ce99a8 #​6461 exit codes in node v20 (#​6461) (@​MichaelBitard)
• 23c865f #​6434 deprecate ci-name config (#​6434) (@​wraithgar)

Documentation

• 7751dd4 #​6413 add a comma (#​6413) (@​darryltec)

Dependencies

• afc38a5 #​6458 cacache@17.1.2
• afb936c #​6458 tuf-js@1.1.6
• f6a0884 #​6458 readable-stream@4.4.0
• 858f0ca #​6458 postcss-selector-parser@6.0.13
• 53ecb84 #​6458 path-scurry@1.9.1
• d93f70c #​6458 signal-exit@4.0.2
• 19214b5 #​6458 @npmcli/package-json@3.1.0
• f53e6ff #​6458 sigstore@1.5.2
• 94d6ee7 #​6458 glob@10.2.4
• 902cb80 #​6458 semver@7.5.1
• 35e2e9a #​6458 @npmcli/run-script@6.0.2
• Workspace: @npmcli/config@6.1.7
• Workspace: libnpmpublish@7.2.0

v9.6.6

Compare Source

Dependencies

• 70e65b1 #​6423 tuf-js@1.1.5 (#​6423)
• 72291f7 #​6416 read-package-json@6.0.3
• e498f82 #​6416 minimatch@9.0.0
• 13aa7b7 #​6416 minipass@5.0.0
• f2a5678 #​6416 tar@6.1.14
• 69d4dd2 #​6416 npm update
• abdca39 #​6416 sigstore@1.4.0
• 16f68fb #​6416 glob@10.2.2
• 67fcfb1 #​6416 ignore-walk@6.0.3
• bfa2ff3 #​6416 make-fetch-happen@11.1.1
• 877591a #​6416 npm-registry-fetch@14.0.5
• 7630517 #​6416 pacote@15.1.3
• c2d6e0a #​6416 write-file-atomic@5.0.1
• acdf97e #​6416 which@3.0.1
• 00c541a #​6416 ssri@10.0.4
• 1b95e73 #​6416 read-package-json@6.0.2
• 6927fd3 #​6416 fs-minipass@3.0.2
• 3eec56e #​6416 cacache@17.1.0
• 7a2ce3f #​6416 @npmcli/run-script@6.0.1
• 3881770 #​6416 @npmcli/map-workspaces@3.0.4
• Workspace: @npmcli/arborist@6.2.9
• Workspace: libnpmdiff@5.0.17
• Workspace: libnpmexec@5.0.17
• Workspace: libnpmfund@4.0.17
• Workspace: libnpmorg@5.0.4
• Workspace: libnpmpack@5.0.17
• Workspace: libnpmpublish@7.1.4

v9.6.5

Compare Source

Bug Fixes

• 33dc428 #​6374 account for npx package-name with no spec (@​wraithgar)
• 82879f6 #​6225 lazy loading of arborist and pacote (#​6225) (@​wraithgar)
• f4e73ab #​6322 remove incompatible params from ci (#​6322) (@​wraithgar)
• c7fe1c7 #​6328 save raw data to file, not parsed data (@​wraithgar)

Documentation

• 31214a6 #​6381 Update description for publish --provenance flag (#​6381) (@​feelepxyz)
• 997bcdf #​6329 fix npm cache folder location for windows (#​6329) (@​charlie-wong)

Dependencies

• fae5e00 #​6372 sigstore@1.3.0 (#​6372)
• 3fa9542 #​6363 semver@7.5.0
• e49844e #​6363 minipass-fetch@3.0.2
• 357cc29 #​6363 walk-up-path@3.0.1
• 2c80b1e #​6363 ini@4.1.0
• 5933841 #​6363 minipass@4.2.8
• b39d54e #​6363 minimatch@7.4.6
• 201aa5a #​6363 ssri@10.0.3
• acb9120 #​6363 read@2.1.0
• 2472205 #​6363 npm-registry-fetch@14.0.4
• 2780714 #​6363 npm-install-checks@6.1.1
• b5af015 #​6363 make-fetch-happen@11.1.0
• 14c498d #​6363 @npmcli/metavuln-calculator@5.0.1
• Workspace: @npmcli/arborist@6.2.8
• Workspace: @npmcli/config@6.1.6
• Workspace: libnpmdiff@5.0.16
• Workspace: libnpmexec@5.0.16
• Workspace: libnpmfund@4.0.16
• Workspace: libnpmpack@5.0.16

v9.6.4

Compare Source

Documentation

• 54795a3 #​6312 filter archives out of version manager search (#​6312) (@​ljharb)
• 530c285 #​6306 remove reference to npm-packlist (#​6306) (@​staff0rd)

Dependencies

• 85935ac #​6325 ssri@10.0.2 (#​6325)
• f1388b4 #​6317 npm update
• 7dd0129 #​6317 glob@9.3.2
• deca335 #​6317 promise-call-limit@1.0.2
• Workspace: @npmcli/arborist@6.2.7
• Workspace: libnpmdiff@5.0.15
• Workspace: libnpmexec@5.0.15
• Workspace: libnpmfund@4.0.15
• Workspace: libnpmpack@5.0.15

v9.6.3

Compare Source

Bug Fixes

• 829503b #​6304 don't break up log message across lines (@​wraithgar)
• 1435fcf #​6304 do less work loading ./lib/npm.js (@​wraithgar)
• 09b58e4 #​6284 make all color output use an npm instance of chalk (#​6284) (@​lukekarrys)
• e252532 #​6283 do less work looking up commands (#​6283) (@​wraithgar)
• 6a4bcba #​6275 clean up man sorting (@​wraithgar)
• 8a96b65 #​6275 ignore ts and map files (@​wraithgar)
• 94d2b39 #​6271 Do not log warnings about log cleanup when logs_max=0 (#​6271) (@​jmealo)
• 2def359 #​6277 updated ebadplatform messaging to be generated based on the error (#​6277) (@​nlf)

Documentation

• 1e2eb81 #​6311 replace version manager list with a github search (#​6311) (@​wraithgar)
• 9d2be4e #​6289 remove npm bin link (#​6289) (@​KevinRouchut)

Dependencies

• e652dbd #​6308 minimatch@7.4.3 (#​6308)
• 01986d1 #​6307 sigstore@1.2.0 (#​6307)
• ea12627 #​6275 minimatch@7.4.2
• ec3e020 #​6275 glob@9.3.1
• 952fbed #​6275 read-package-json@6.0.1
• dd43d30 #​6275 parse-conflict-json@3.0.1
• d5ce7ca #​6275 npm-install-checks@6.1.0
• 704cd1e #​6275 nopt@7.1.0
• a6da22a #​6275 ignore-walk@6.0.2
• 55955fd #​6275 cacache@17.0.5
• 839b670 #​6275 @npmcli/map-workspaces@3.0.3
• 9a7b8e8 #​6275 @npmcli/git@4.0.4
• 57c0a55 #​6275 npm update
• 74c80f5 #​6275 minipass@4.2.5
• b174c90 #​6275 graceful-fs@4.2.11
• Workspace: @npmcli/arborist@6.2.6
• Workspace: @npmcli/config@6.1.5
• Workspace: libnpmdiff@5.0.14
• Workspace: libnpmexec@5.0.14
• Workspace: libnpmfund@4.0.14
• Workspace: libnpmpack@5.0.14
• Workspace: libnpmpublish@7.1.3

v9.6.2

Compare Source

Bug Fixes

• 4622b42 #​6247 add provenance publish notice (#​6247) (@​bdehamer)

Dependencies

• 434b461 #​6255 sigstore@1.1.1 (#​6255)
• Workspace: @npmcli/config@6.1.4
• Workspace: libnpmpublish@7.1.2

v9.6.1

Compare Source

Bug Fixes

• e455e3f #​6211 send options with grant/revoke requests (#​6211) (@​DavidTanner)
• e4de224 #​6220 clean uri from audit error (#​6220) (@​wraithgar)

Dependencies

• cb45b21 #​6231 npm update
• 1f60a7e #​6231 minipass@4.2.4
• Workspace: @npmcli/arborist@6.2.5
• Workspace: libnpmdiff@5.0.13
• Workspace: libnpmexec@5.0.13
• Workspace: libnpmfund@4.0.13
• Workspace: libnpmpack@5.0.13
• Workspace: libnpmpublish@7.1.1

v9.6.0

Compare Source

Features

• 84fbaf2 #​6216 add preliminary fish shell completion (@​wraithgar)

Bug Fixes

• c4c8754 audit: add signatures to completion (@​wraithgar)
• fc46489 access: only complete once (@​wraithgar)
• b43961a cmd-list: alias only to real commands (@​wraithgar)

Documentation

• 2695e1f #​6187 npm v9 creates package-lock.json v3 (#​6187) (@​tuukka)

Dependencies

• 71ae406 #​6218 @npmcli/installed-package-contents@2.0.2
• Workspace: @npmcli/arborist@6.2.4
• Workspace: libnpmdiff@5.0.12
• Workspace: libnpmexec@5.0.12
• Workspace: libnpmfund@4.0.12
• Workspace: libnpmpack@5.0.12

v9.5.1

Compare Source

Documentation

• 9bc455b #​6188 fixing typos (#​6188) (@​deining)
• ec8c95c #​6186 update OSI link (#​6186) (@​roerohan)

Dependencies

• 7ba3e17 #​6189 npm update
• f7a5200 pacote@15.1.1
• Workspace: @npmcli/arborist@6.2.3
• Workspace: libnpmdiff@5.0.11
• Workspace: libnpmexec@5.0.11
• Workspace: libnpmfund@4.0.11
• Workspace: libnpmpack@5.0.11

v9.5.0

Compare Source

Features

• 79bfd03 #​6153 audit signatures verifies attestations (@​feelepxyz)
• 5fc6473 add provenance attestation (@​bdehamer)

Bug Fixes

• 53f75a4 #​6158 gracefully fallback from auth-type=web (#​6158) (@​MylesBorins)
• [ed59aae](https://github.com/npm/cli/commit/ed59aae51cc55f57ee32

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.98%. Comparing base (373ab04) to head (12dcd28).
Report is 8 commits behind head on master.

❗ Current head 12dcd28 differs from pull request most recent head 0a7329a. Consider uploading reports for the commit 0a7329a to get more accurate results

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #53   +/-   ##
=======================================
  Coverage   82.98%   82.98%           
=======================================
  Files           2        2           
  Lines         241      241           
=======================================
  Hits          200      200           
  Misses         41       41           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.