CLI documentation update from CI
npm CLI robot committed
Jul 12, 2022 at 03:09 UTC
28ce509b3ad59addfccf7fb99cefb1bb1f0b3cab
6 files changed
+28
-9
cli/v8
+1
-1
@@ -1 +1 @@
1
-Subproject commit ef8d2edd7da993f4086c85089952cd45834ac78b
1
+Subproject commit ac56fc41bc2f91f51c8438f98893121e7a92ee46
content/cli/v8/commands/npm-audit.md
+12
-1
@@ -21,7 +21,7 @@ github_path: docs/content/commands/npm-audit.md
21
<!-- see lib/commands/audit.js -->
22
23
```bash
24
-npm audit [fix]
24
+npm audit [fix|signatures]
25
```
26
27
<!-- automatically generated, do not edit manually -->
@@ -51,6 +51,17 @@ vulnerability is found. It may be useful in CI environments to include the
51
will cause the command to fail. This option does not filter the report
52
output, it simply changes the command's failure threshold.
53
54
+### Audit Signatures
55
+
56
+This command can also audit the integrity values of the packages in your
57
+tree against any signatures present in the registry they were downloaded
58
+from. npm will attempt to download the keys from `/-/npm/v1/keys` on
59
+each the registry used to download any given package. It will then
60
+check the `dist.signatures` object in the package itself, and verify the
61
+`sig` present there using the `keyid` there, matching it with a key
62
+returned from the registry. The command for this is `npm audit
63
+signatures`
64
+
65
### Audit Endpoints
66
67
There are two audit endpoints that npm may use to fetch vulnerability
content/cli/v8/commands/npm.md
+1
-1
@@ -111,7 +111,7 @@ following help topics:
111
done via [`npm install`](/cli/v8/commands/npm-install)
112
* adduser:
113
Create an account or log in. When you do this, npm will store
114
- credentials in the user config file config file.
114
+ credentials in the user config file.
115
* publish:
116
Use the [`npm publish`](/cli/v8/commands/npm-publish) command to upload your
117
code to the registry.
content/cli/v8/configuring-npm/package-json.md
+1
-1
@@ -134,7 +134,7 @@ IDs](https://spdx.org/licenses/). Ideally you should pick one that is
134
135
If your package is licensed under multiple common licenses, use an [SPDX
136
license expression syntax version 2.0
137
-string](https://www.npmjs.com/package/spdx), like this:
137
+string](https://spdx.dev/specifications/), like this:
138
139
```json
140
{
content/cli/v8/using-npm/scripts.md
+9
-1
@@ -47,7 +47,7 @@ There are some special life cycle scripts that happen only in certain
47
situations. These scripts happen in addition to the `pre<event>`, `post<event>`, and
48
`<event>` scripts.
49
50
-* `prepare`, `prepublish`, `prepublishOnly`, `prepack`, `postpack`
50
+* `prepare`, `prepublish`, `prepublishOnly`, `prepack`, `postpack`, `dependencies`
51
52
**prepare** (since `npm@4.0.0`)
53
* Runs any time before the package is packed, i.e. during `npm publish`
@@ -79,6 +79,10 @@ situations. These scripts happen in addition to the `pre<event>`, `post<event>`,
79
**postpack**
80
* Runs AFTER the tarball has been generated but before it is moved to its final destination (if at all, publish does not save the tarball locally)
81
82
+**dependencies**
83
+* Runs AFTER any operations that modify the `node_modules` directory IF changes occurred.
84
+* Does NOT run in global mode
85
+
86
#### Prepare and Prepublish
87
88
**Deprecation Note: prepublish**
@@ -104,6 +108,10 @@ The advantage of doing these things at `prepublish` time is that they can be don
108
* You don't need to rely on your users having `curl` or `wget` or
109
other system tools on the target machines.
110
111
+#### Dependencies
112
+
113
+The `dependencies` script is run any time an `npm` command causes changes to the `node_modules` directory. It is run AFTER the changes have been applied and the `package.json` and `package-lock.json` files have been updated.
114
+
115
### Life Cycle Operation Order
116
117
#### [`npm cache add`](/cli/v8/commands/npm-cache)
content/cli/v8/using-npm/workspaces.md
+4
-4
@@ -65,7 +65,7 @@ structure of files and folders:
65
```
66
.
67
+-- node_modules
68
-| `-- packages/a -> ../packages/a
68
+| `-- a -> ../packages/a
69
+-- package-lock.json
70
+-- package.json
71
`-- packages
@@ -120,15 +120,15 @@ respect the provided `workspace` configuration.
120
121
Given the [specifities of how Node.js handles module resolution](https://nodejs.org/dist/latest-v14.x/docs/api/modules.html#modules_all_together) it's possible to consume any defined workspace
122
by its declared `package.json` `name`. Continuing from the example defined
123
-above, let's also create a Node.js script that will require the `workspace-a`
123
+above, let's also create a Node.js script that will require the workspace `a`
124
example module, e.g:
125
126
```
127
-// ./workspace-a/index.js
127
+// ./packages/a/index.js
128
module.exports = 'a'
129
130
// ./lib/index.js
131
-const moduleA = require('workspace-a')
131
+const moduleA = require('a')
132
console.log(moduleA) // -> a
133
```
134