dependabot-preview[bot]
commented
6 years ago OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.
If you change your mind, just re-open this PR and I'll resolve any conflicts on it.
Bumps npm from 6.3.0 to 6.4.1.
Release notes
*Sourced from [npm's releases](https://github.com/npm/cli/releases).* > ## v6.4.1 > ### BUGFIXES > > * [`4bd40f543`](https://github.com/npm/cli/commit/4bd40f543dc89f0721020e7d0bb3497300d74818) [#42](https://github-redirect.dependabot.com/npm/cli/pull/42) Prevent blowing up on malformed responses from the `npm audit` endpoint, such as with third-party registries. ([[**framp**](https://github.com/framp)](https://github.com/framp)) > * [`0e576f0aa`](https://github.com/npm/cli/commit/0e576f0aa6ea02653d948c10f29102a2d4a31944) [#46](https://github-redirect.dependabot.com/npm/cli/pull/46) Fix `NO_PROXY` support by renaming npm-side config to `--noproxy`. The environment variable should still work. ([[**SneakyFish5**](https://github.com/SneakyFish5)](https://github.com/SneakyFish5)) > * [`d8e811d6a`](https://github.com/npm/cli/commit/d8e811d6adf3d87474982cb831c11316ac725605) [#33](https://github-redirect.dependabot.com/npm/cli/pull/33) Disable `update-notifier` checks when a CI environment is detected. ([[**Sibiraj-S**](https://github.com/Sibiraj-S)](https://github.com/Sibiraj-S)) > * [`1bc5b8cea`](https://github.com/npm/cli/commit/1bc5b8ceabc86bfe4777732f25ffef0f3de81bd1) [#47](https://github-redirect.dependabot.com/npm/cli/pull/47) Fix issue where `postpack` scripts would break if `pack` was used with `--dry-run`. ([[**larsgw**](https://github.com/larsgw)](https://github.com/larsgw)) > > ### DEPENDENCY BUMPS > > * [`4c57316d5`](https://github.com/npm/cli/commit/4c57316d5633e940105fa545b52d8fbfd2eb9f75) `figgy-pudding@3.4.1` ([[**zkat**](https://github.com/zkat)](https://github.com/zkat)) > * [`85f4d7905`](https://github.com/npm/cli/commit/85f4d79059865d5267f3516b6cdbc746012202c6) `cacache@11.2.0` ([[**zkat**](https://github.com/zkat)](https://github.com/zkat)) > * [`d20ac242a`](https://github.com/npm/cli/commit/d20ac242aeb44aa3581c65c052802a02d5eb22f3) `npm-packlist@1.1.11`: No real changes in npm-packlist, but npm-bundled included a circular dependency fix, as well as adding a proper LICENSE file. ([[**isaacs**](https://github.com/isaacs)](https://github.com/isaacs)) > * [`e8d5f4418`](https://github.com/npm/cli/commit/e8d5f441821553a31fc8cd751670663699d2c8ce) [npm.community#632](https://npm.community/t/https://npm.community/t/using-npm-ci-does-not-run-prepare-script-for-git-modules/632) `libcipm@2.0.2`: Fixes issue where `npm ci` wasn't running the `prepare` lifecycle script when installing git dependencies ([[**edahlseng**](https://github.com/edahlseng)](https://github.com/edahlseng)) > * [`a5e6f78e9`](https://github.com/npm/cli/commit/a5e6f78e916873f7d18639ebdb8abd20479615a9) `JSONStream@1.3.4`: Fixes memory leak problem when streaming large files (like legacy npm search). ([[**daern91**](https://github.com/daern91)](https://github.com/daern91)) > * [`3b940331d`](https://github.com/npm/cli/commit/3b940331dcccfa67f92366adb7ffd9ecf7673a9a) [npm.community#1042](https://npm.community/t/3-path-variables-are-assigned-to-child-process-launched-by-npm/1042) `npm-lifecycle@2.1.0`: Fixes issue for Windows user where multiple `Path`/`PATH` variables were being added to the environment and breaking things in all sorts of fun and interesting ways. ([[**JimiC**](https://github.com/JimiC)](https://github.com/JimiC)) > * [`d612d2ce8`](https://github.com/npm/cli/commit/d612d2ce8fab72026f344f125539ecbf3746af9a) `npm-registry-client@8.6.0` ([[**iarna**](https://github.com/iarna)](https://github.com/iarna)) > * [`1f6ba1cb1`](https://github.com/npm/cli/commit/1f6ba1cb174590c1f5d2b00e2ca238dfa39d507a) `opener@1.5.0` ([[**domenic**](https://github.com/domenic)](https://github.com/domenic)) > * [`37b8f405f`](https://github.com/npm/cli/commit/37b8f405f35c861b7beeed56f71ad20b0bf87889) `request@2.88.0` ([[**mikeal**](https://github.com/mikeal)](https://github.com/mikeal)) > * [`bb91a2a14`](https://github.com/npm/cli/commit/bb91a2a14562e77769057f1b6d06384be6d6bf7f) `tacks@1.2.7` ([[**iarna**](https://github.com/iarna)](https://github.com/iarna)) > * [`30bc9900a`](https://github.com/npm/cli/commit/30bc9900ae79c80bf0bdee0ae6372da6f668124c) `ci-info@1.4.0`: Adds support for two more CI services ([[**watson**](https://github.com/watson)](https://github.com/watson)) > * [`1d2fa4ddd`](https://github.com/npm/cli/commit/1d2fa4dddcab8facfee92096cc24b299387f3182) `marked@0.5.0` ([[**joshbruce**](https://github.com/joshbruce)](https://github.com/joshbruce)) > > ### DOCUMENTATION > > * [`08ecde292`](https://github.com/npm/cli/commit/08ecde2928f8c89a2fdaa800ae845103750b9327) [#54](https://github-redirect.dependabot.com/npm/cli/pull/54) Mention registry terms of use in manpage and registry docs and update language in README for it. ([[**kemitchell**](https://github.com/kemitchell)](https://github.com/kemitchell)) > * [`de956405d`](https://github.com/npm/cli/commit/de956405d8b72354f98579d00c6dd30ac3b9bddf) [#41](https://github-redirect.dependabot.com/npm/cli/pull/41) Add documentation for `--dry-run` in `install` and `pack` docs. ([[**reconbot**](https://github.com/reconbot)](https://github.com/reconbot)) > * [`95031b90c`](https://github.com/npm/cli/commit/95031b90ce0b0c4dcd5e4eafc86e3e5bfd59fb3e) [#48](https://github-redirect.dependabot.com/npm/cli/pull/48) Update republish time and lightly reorganize republish info. ([[**neverett**](https://github.com/neverett)](https://github.com/neverett)) > * [`767699b68`](https://github.com/npm/cli/commit/767699b6829b8b899d5479445e99b0ffc43ff92d) [#53](https://github-redirect.dependabot.com/npm/cli/pull/53) Correct `npm@6.4.0` release date in changelog. ([[**charmander**](https://github.com/charmander)](https://github.com/charmander)) > * [`3fea3166e`](https://github.com/npm/cli/commit/3fea3166eb4f43f574fcfd9ee71a171feea2bc29) [#55](https://github-redirect.dependabot.com/npm/cli/pull/55) Align command descriptions in help text. ([[**erik**](https://github.com/erik)](https://github.com/erik)) > > ## v6.4.1-next.0 > This release became [`npm@6.4.1`](https://github.com/npm/cli/releases/edit/v6.4.1). > > ## v6.4.0 > ### NEW FEATURES > > * [`6e9f04b0b`](https://github.com/npm/cli/commit/6e9f04b0baed007169d4e0c341f097cf133debf7) [npm/cli#8](https://github-redirect.dependabot.com/npm/cli/pull/8) Search for authentication token defined by environment variables by preventing the translation layer from env variable to npm option from breaking `:_authToken`. ([[**mkhl**](https://github.com/mkhl)](https://github.com/mkhl)) > * [`84bfd23e7`](https://github.com/npm/cli/commit/84bfd23e7d6434d30595594723a6e1976e84b022) [npm/cli#35](https://github-redirect.dependabot.com/npm/cli/pull/35) Stop filtering out non-IPv4 addresses from `local-addrs`, making npm actually use IPv6 addresses when it must. ([[**valentin2105**](https://github.com/valentin2105)](https://github.com/valentin2105)) > * [`792c8c709`](https://github.com/npm/cli/commit/792c8c709dc7a445687aa0c8cba5c50bc4ed83fd) [npm/cli#31](https://github-redirect.dependabot.com/npm/cli/pull/31) configurable audit level for non-zero exit `npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected. ([[**lennym**](https://github.com/lennym)](https://github.com/lennym)) > > ### BUGFIXES > > * [`d81146181`](https://github.com/npm/cli/commit/d8114618137bb5b9a52a86711bb8dc18bfc8e60c) [npm/cli#32](https://github-redirect.dependabot.com/npm/cli/pull/32) Don't check for updates to npm when we are updating npm itself. ([[**olore**](https://github.com/olore)](https://github.com/olore)) > > ### DEPENDENCY UPDATES > > A very special dependency update event! Since the [release of `node-gyp@3.8.0`](https://github-redirect.dependabot.com/nodejs/node-gyp/pull/1521), an awkward version conflict that was preventing `request` from begin flattened was resolved. This means two things: > > 1. We've cut down the npm tarball size by another 200kb, to 4.6MB > ... (truncated)Changelog
*Sourced from [npm's changelog](https://github.com/npm/cli/blob/latest/CHANGELOG.md).* > ## v6.4.1 (2018-08-22): > > ### BUGFIXES > > * [`4bd40f543`](https://github.com/npm/cli/commit/4bd40f543dc89f0721020e7d0bb3497300d74818) > [#42](https://github-redirect.dependabot.com/npm/cli/pull/42) > Prevent blowing up on malformed responses from the `npm audit` endpoint, such > as with third-party registries. > ([[**framp**](https://github.com/framp)](https://github.com/framp)) > * [`0e576f0aa`](https://github.com/npm/cli/commit/0e576f0aa6ea02653d948c10f29102a2d4a31944) > [#46](https://github-redirect.dependabot.com/npm/cli/pull/46) > Fix `NO_PROXY` support by renaming npm-side config to `--noproxy`. The > environment variable should still work. > ([[**SneakyFish5**](https://github.com/SneakyFish5)](https://github.com/SneakyFish5)) > * [`d8e811d6a`](https://github.com/npm/cli/commit/d8e811d6adf3d87474982cb831c11316ac725605) > [#33](https://github-redirect.dependabot.com/npm/cli/pull/33) > Disable `update-notifier` checks when a CI environment is detected. > ([[**Sibiraj-S**](https://github.com/Sibiraj-S)](https://github.com/Sibiraj-S)) > * [`1bc5b8cea`](https://github.com/npm/cli/commit/1bc5b8ceabc86bfe4777732f25ffef0f3de81bd1) > [#47](https://github-redirect.dependabot.com/npm/cli/pull/47) > Fix issue where `postpack` scripts would break if `pack` was used with > `--dry-run`. > ([[**larsgw**](https://github.com/larsgw)](https://github.com/larsgw)) > > ### DEPENDENCY BUMPS > > * [`4c57316d5`](https://github.com/npm/cli/commit/4c57316d5633e940105fa545b52d8fbfd2eb9f75) > `figgy-pudding@3.4.1` > ([[**zkat**](https://github.com/zkat)](https://github.com/zkat)) > * [`85f4d7905`](https://github.com/npm/cli/commit/85f4d79059865d5267f3516b6cdbc746012202c6) > `cacache@11.2.0` > ([[**zkat**](https://github.com/zkat)](https://github.com/zkat)) > * [`d20ac242a`](https://github.com/npm/cli/commit/d20ac242aeb44aa3581c65c052802a02d5eb22f3) > `npm-packlist@1.1.11`: > No real changes in npm-packlist, but npm-bundled included a > circular dependency fix, as well as adding a proper LICENSE file. > ([[**isaacs**](https://github.com/isaacs)](https://github.com/isaacs)) > * [`e8d5f4418`](https://github.com/npm/cli/commit/e8d5f441821553a31fc8cd751670663699d2c8ce) > [npm.community#632](https://npm.community/t/https://npm.community/t/using-npm-ci-does-not-run-prepare-script-for-git-modules/632) > `libcipm@2.0.2`: > Fixes issue where `npm ci` wasn't running the `prepare` lifecycle script when > installing git dependencies > ([[**edahlseng**](https://github.com/edahlseng)](https://github.com/edahlseng)) > * [`a5e6f78e9`](https://github.com/npm/cli/commit/a5e6f78e916873f7d18639ebdb8abd20479615a9) > `JSONStream@1.3.4`: > Fixes memory leak problem when streaming large files (like legacy npm search). > ([[**daern91**](https://github.com/daern91)](https://github.com/daern91)) > * [`3b940331d`](https://github.com/npm/cli/commit/3b940331dcccfa67f92366adb7ffd9ecf7673a9a) > [npm.community#1042](https://npm.community/t/3-path-variables-are-assigned-to-child-process-launched-by-npm/1042) > `npm-lifecycle@2.1.0`: > ... (truncated)Commits
- [`59e5056`](https://github.com/npm/cli/commit/59e5056a2129cb2951f4ff3b657ada20657f01a7) 6.4.1 - [`bae4ede`](https://github.com/npm/cli/commit/bae4edede4edf9f36b46092dcb13eb406012da13) 6.4.1-next.0 - [`e3a0762`](https://github.com/npm/cli/commit/e3a0762a41ada3f71a0888bd075a99171e1e6782) update AUTHORS - [`f8396dd`](https://github.com/npm/cli/commit/f8396dd09bd74955f8ab4e3ca9807c44f0a67a79) doc: update changelog for npm@6.4.1 - [`7eeacdb`](https://github.com/npm/cli/commit/7eeacdba12a75bc11db3ab6067b05281afe67ccf) gen-changelog: fix npm.community url parsing - [`d4242d4`](https://github.com/npm/cli/commit/d4242d4291222bb68f136d430a8132dcdcdf3eca) gen-changelog: appease standard - [`bced18e`](https://github.com/npm/cli/commit/bced18e52cd2f28dd7242d99569b452a7f3da11d) gen-changelog: Strip CRs from commit messages - [`54b4bc8`](https://github.com/npm/cli/commit/54b4bc8201c039ff690498effe725027102f67f9) gen-changelog: git update incresed length of "short" hashes - [`f5eed2e`](https://github.com/npm/cli/commit/f5eed2e60a994c49f46d3fcb8abe0ccc9eefa21c) gen-changelog: Default repo is npm/cli now - [`ee5066a`](https://github.com/npm/cli/commit/ee5066aaa25f48a15d4e7912383d10bc90654a5a) gen-changelog: match npm.community urls in addition to github ones - Additional commits viewable in [compare view](https://github.com/npm/cli/compare/v6.3.0...v6.4.1)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.