deps: upgrade npm to 8.3.2

PR-URL: #41621
Reviewed-By: Ruy Adorno <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Mohammed Keyvanzadeh <[email protected]>
Reviewed-By: Richard Lau <[email protected]>

Author: npm-robot

deps/npm/docs/content/commands/npm-dedupe.md

@@ -72,6 +72,12 @@ result in new modules being installed.
 
 Using `npm find-dupes` will run the command in `--dry-run` mode.
 
+Note that by default `npm dedupe` will not update the semver values of direct
+dependencies in your project `package.json`, if you want to also update
+values in `package.json` you can run: `npm dedupe --save` (or add the
+`save=true` option to a [configuration file](/configuring-npm/npmrc)
+to make that the default behavior).
+
 ### Configuration
 
 <!-- AUTOGENERATED CONFIG DESCRIPTIONS START -->

deps/npm/docs/content/commands/npm-update.md

@@ -27,6 +27,12 @@ packages.
 If no package name is specified, all packages in the specified location (global
 or local) will be updated.
 
+Note that by default `npm update` will not update the semver values of direct
+dependencies in your project `package.json`, if you want to also update
+values in `package.json` you can run: `npm update --save` (or add the
+`save=true` option to a [configuration file](/configuring-npm/npmrc)
+to make that the default behavior).
+
 ### Example
 
 For the examples below, assume that the current package is `app` and it depends

deps/npm/docs/content/using-npm/config.md

@@ -1326,13 +1326,16 @@ The base URL of the npm registry.
 
 #### `save`
 
-* Default: true
+* Default: `true` unless when using `npm update` or `npm dedupe` where it
+  defaults to `false`
 * Type: Boolean
 
-Save installed packages to a package.json file as dependencies.
+Save installed packages to a `package.json` file as dependencies.
 
 When used with the `npm rm` command, removes the dependency from
-package.json.
+`package.json`.
+
+Will also prevent writing to `package-lock.json` if set to `false`.
 
 <!-- automatically generated, do not edit manually -->
 <!-- see lib/utils/config/definitions.js -->

deps/npm/docs/output/commands/npm-dedupe.html

@@ -192,6 +192,11 @@ <h3 id="description">Description</h3>
 <p>Note that this operation transforms the dependency tree, but will never
 result in new modules being installed.</p>
 <p>Using <code>npm find-dupes</code> will run the command in <code>--dry-run</code> mode.</p>
+<p>Note that by default <code>npm dedupe</code> will not update the semver values of direct
+dependencies in your project <code>package.json</code>, if you want to also update
+values in <code>package.json</code> you can run: <code>npm dedupe --save</code> (or add the
+<code>save=true</code> option to a <a href="../configuring-npm/npmrc.html">configuration file</a>
+to make that the default behavior).</p>
 <h3 id="configuration">Configuration</h3>
 <!-- raw HTML omitted -->
 <!-- raw HTML omitted -->

deps/npm/docs/output/commands/npm-ls.html

@@ -160,7 +160,7 @@ <h3 id="description">Description</h3>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre lang="bash"><code>[email protected].1 /path/to/npm
+<pre lang="bash"><code>[email protected].2 /path/to/npm
 └─┬ [email protected]
   └── [email protected]
 </code></pre>

deps/npm/docs/output/commands/npm-update.html

@@ -160,6 +160,11 @@ <h3 id="description">Description</h3>
 packages.</p>
 <p>If no package name is specified, all packages in the specified location (global
 or local) will be updated.</p>
+<p>Note that by default <code>npm update</code> will not update the semver values of direct
+dependencies in your project <code>package.json</code>, if you want to also update
+values in <code>package.json</code> you can run: <code>npm update --save</code> (or add the
+<code>save=true</code> option to a <a href="../configuring-npm/npmrc.html">configuration file</a>
+to make that the default behavior).</p>
 <h3 id="example">Example</h3>
 <p>For the examples below, assume that the current package is <code>app</code> and it depends
 on dependencies, <code>dep1</code> (<code>dep2</code>, .. etc.).  The published versions of <code>dep1</code>

deps/npm/docs/output/commands/npm.html

@@ -149,7 +149,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 <pre lang="bash"><code>npm &lt;command&gt; [args]
 </code></pre>
 <h3 id="version">Version</h3>
-<p>8.3.1</p>
+<p>8.3.2</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/docs/output/using-npm/config.html

@@ -1210,12 +1210,14 @@ <h4 id="registry"><code>registry</code></h4>
 <!-- raw HTML omitted -->
 <h4 id="save"><code>save</code></h4>
 <ul>
-<li>Default: true</li>
+<li>Default: <code>true</code> unless when using <code>npm update</code> or <code>npm dedupe</code> where it
+defaults to <code>false</code></li>
 <li>Type: Boolean</li>
 </ul>
-<p>Save installed packages to a package.json file as dependencies.</p>
+<p>Save installed packages to a <code>package.json</code> file as dependencies.</p>
 <p>When used with the <code>npm rm</code> command, removes the dependency from
-package.json.</p>
+<code>package.json</code>.</p>
+<p>Will also prevent writing to <code>package-lock.json</code> if set to <code>false</code>.</p>
 <!-- raw HTML omitted -->
 <!-- raw HTML omitted -->
 <h4 id="save-bundle"><code>save-bundle</code></h4>

deps/npm/lib/base-command.js

@@ -1,4 +1,7 @@
 // Base class for npm commands
+
+const { relative } = require('path')
+
 const usageUtil = require('./utils/usage.js')
 const ConfigDefinitions = require('./utils/config/definitions.js')
 const getWorkspaces = require('./workspaces/get-workspaces.js')
@@ -78,9 +81,14 @@ class BaseCommand {
       this.includeWorkspaceRoot = false
     }
 
+    const relativeFrom = relative(this.npm.localPrefix, process.cwd()).startsWith('..')
+      ? this.npm.localPrefix
+      : process.cwd()
+
     const ws = await getWorkspaces(filters, {
       path: this.npm.localPrefix,
       includeWorkspaceRoot: this.includeWorkspaceRoot,
+      relativeFrom,
     })
     this.workspaces = ws
     this.workspaceNames = [...ws.keys()]

deps/npm/lib/commands/dedupe.js

@@ -13,6 +13,7 @@ class Dedupe extends ArboristWorkspaceCmd {
     'legacy-bundling',
     'strict-peer-deps',
     'package-lock',
+    'save',
     'omit',
     'ignore-scripts',
     'audit',
@@ -29,13 +30,20 @@ class Dedupe extends ArboristWorkspaceCmd {
       throw er
     }
 
+    // In the context of `npm dedupe` the save
+    // config value should default to `false`
+    const save = this.npm.config.isDefault('save')
+      ? false
+      : this.npm.config.get('save')
+
     const dryRun = this.npm.config.get('dry-run')
     const where = this.npm.prefix
     const opts = {
       ...this.npm.flatOptions,
       log,
       path: where,
       dryRun,
+      save,
       workspaces: this.workspaceNames,
     }
     const arb = new Arborist(opts)