You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/cli/v10/commands/npm-audit.mdx
+3-1
Original file line number
Diff line number
Diff line change
@@ -65,6 +65,8 @@ Registry signatures can be verified using the following `audit` command:
65
65
$ npm audit signatures
66
66
```
67
67
68
+
The `audit signatures` command will also verify the provenance attestations of downloaded packages. Because provenance attestations are such a new feature, security features may be added to (or changed in) the attestation format over time. To ensure that you're always able to verify attestation signatures check that you're running the latest version of the npm CLI. Please note this often means updating npm beyond the version that ships with Node.js.
69
+
68
70
The npm CLI supports registry signatures and signing keys provided by any registry if the following conventions are followed:
69
71
70
72
1. Signatures are provided in the package's `packument` in each published version within the `dist` object:
@@ -105,7 +107,7 @@ Keys response:
105
107
-`scheme`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
106
108
-`key`: base64 encoded public key
107
109
108
-
See this [example key's response from the public npm registry](https://registry.npmjs.org/-/npm/v1/keys").
110
+
See this [example key's response from the public npm registry](https://registry.npmjs.org/-/npm/v1/keys).
Copy file name to clipboardExpand all lines: content/cli/v10/commands/npm-ls.mdx
+1-1
Original file line number
Diff line number
Diff line change
@@ -52,7 +52,7 @@ Note: to get a "bottoms up" view of why a given package is included in the tree
52
52
Positional arguments are `name@version-range` identifiers, which will limit the results to only the paths to the packages named. Note that nested packages will _also_ show the paths to the specified packages. For example, running `npm ls promzard` in npm's source tree will show:
Copy file name to clipboardExpand all lines: content/cli/v10/configuring-npm/package-json.mdx
+9-9
Original file line number
Diff line number
Diff line change
@@ -49,7 +49,7 @@ Some rules:
49
49
Some tips:
50
50
51
51
- Don't use the same name as a core Node module.
52
-
- Don't put "js" or "node" in the name. It's assumed that it's js, since you're writing a package.json file, and you can specify the engine using the "engines" field. (See below.)
52
+
- Don't put "js" or "node" in the name. It's assumed that it's js, since you're writing a package.json file, and you can specify the engine using the "[engines](#engines)" field. (See below.)
53
53
- The name will probably be passed as an argument to require(), so it should be something short, but also reasonably descriptive.
54
54
- You may want to check the npm registry to see if there's something by that name already, before you get too attached to it. [https://www.npmjs.com/](https://www.npmjs.com/)
55
55
@@ -71,7 +71,7 @@ Put keywords in it. It's an array of strings. This helps people discover your pa
71
71
72
72
### homepage
73
73
74
-
The url to the project homepage.
74
+
The URL to the project homepage.
75
75
76
76
Example:
77
77
@@ -81,7 +81,7 @@ Example:
81
81
82
82
### bugs
83
83
84
-
The url to your project's issue tracker and / or the email address to which issues should be reported. These are helpful for people who encounter issues with your package.
84
+
The URL to your project's issue tracker and / or the email address to which issues should be reported. These are helpful for people who encounter issues with your package.
85
85
86
86
It should look like this:
87
87
@@ -94,9 +94,9 @@ It should look like this:
94
94
}
95
95
```
96
96
97
-
You can specify either one or both values. If you want to provide only a url, you can specify the value for "bugs" as a simple string instead of an object.
97
+
You can specify either one or both values. If you want to provide only a URL, you can specify the value for "bugs" as a simple string instead of an object.
98
98
99
-
If a url is provided, it will be used by the `npm bugs` command.
99
+
If a URL is provided, it will be used by the `npm bugs` command.
100
100
101
101
### license
102
102
@@ -424,7 +424,7 @@ Do it like this:
424
424
}
425
425
```
426
426
427
-
The URL should be a publicly available (perhaps read-only) url that can be handed directly to a VCS program without any modification. It should not be a url to an html project page that you put in your browser. It's for computers.
427
+
The URL should be a publicly available (perhaps read-only) URL that can be handed directly to a VCS program without any modification. It should not be a URL to an html project page that you put in your browser. It's for computers.
428
428
429
429
For GitHub, GitHub gist, Bitbucket, or GitLab repositories you can use the same shortcut syntax you use for `npm install`:
430
430
@@ -530,7 +530,7 @@ This tarball will be downloaded and installed locally to your package at install
@@ -564,7 +564,7 @@ If your git repository includes pre-built artifacts, you will likely want to mak
564
564
565
565
#### GitHub URLs
566
566
567
-
As of version 1.1.65, you can refer to GitHub urls as just "foo": "user/foo-project". Just as with git URLs, a `commit-ish` suffix can be included. For example:
567
+
As of version 1.1.65, you can refer to GitHub URLs as just "foo": "user/foo-project". Just as with git URLs, a `commit-ish` suffix can be included. For example:
568
568
569
569
```json
570
570
{
@@ -712,7 +712,7 @@ Alternatively, `"bundleDependencies"` can be defined as a boolean value. A value
712
712
713
713
### optionalDependencies
714
714
715
-
If a dependency can be used, but you would like npm to proceed if it cannot be found or fails to install, then you may put it in the `optionalDependencies` object. This is a map of package name to version or url, just like the `dependencies` object. The difference is that build failures do not cause installation to fail. Running `npm install --omit=optional` will prevent these dependencies from being installed.
715
+
If a dependency can be used, but you would like npm to proceed if it cannot be found or fails to install, then you may put it in the `optionalDependencies` object. This is a map of package name to version or URL, just like the `dependencies` object. The difference is that build failures do not cause installation to fail. Running `npm install --omit=optional` will prevent these dependencies from being installed.
716
716
717
717
It is still your program's responsibility to handle the lack of the dependency. For example, something like this:
-[`17d97d2`](https://github.com/npm/cli/commit/17d97d266807f69cfc2a7a3982e8db126f90c48a)[#7334](https://github.com/npm/cli/pull/7334) use @npmcli/redact for log redactions (@lukekarrys)
23
+
-[`8cab136`](https://github.com/npm/cli/commit/8cab136f731c69be079be08d79e3514e01bbd563)[#7324](https://github.com/npm/cli/pull/7324) ensure maxSockets is respected (#7324) (@lukekarrys)
-[`9d4e85f`](https://github.com/npm/cli/commit/9d4e85f2379eded50b54f4e0b6f307031037f1ec)[#7297](https://github.com/npm/cli/pull/7297) search: include searchlimit option in help output (#7297) (@10xLaCroixDrinker)
26
+
-[`bdb3c28`](https://github.com/npm/cli/commit/bdb3c28167f757060474ef2b82c92f3a1f210972)[#7274](https://github.com/npm/cli/pull/7274) added check for dry-run (#7274) (@cod1r)
27
+
-[`7f1ab88`](https://github.com/npm/cli/commit/7f1ab8822a8d50403338595ab9f218e4d63f37fa)[#7271](https://github.com/npm/cli/pull/7271) more lightweight npm bin discovery in windows (#7271) (@wraithgar)
28
+
29
+
### Documentation
30
+
31
+
-[`1da5cf0`](https://github.com/npm/cli/commit/1da5cf0ace30d89edf05833b91ce80467c7864bd)[#7198](https://github.com/npm/cli/pull/7198) add link to engines section (#7198) (@uiolee)
32
+
-[`1114a12`](https://github.com/npm/cli/commit/1114a12f2b4691d403d0863d4dca44f25580f57d)[#7307](https://github.com/npm/cli/pull/7307) fix incorrect npm audit key response link (#7307) (@davidlj95)
33
+
-[`9807caf`](https://github.com/npm/cli/commit/9807cafbaf274eca2a0abbd04a9b2b55e850de9d)[#7304](https://github.com/npm/cli/pull/7304) update audit docs with provenance info (#7304) (@bdehamer)
34
+
-[`e1ecfa7`](https://github.com/npm/cli/commit/e1ecfa7829be91282373862669b92ef42b9e48df)[#7285](https://github.com/npm/cli/pull/7285) Correct capitalization for URL (#7285) (@coliff)
-[`8cab136`](https://github.com/npm/cli/commit/8cab136f731c69be079be08d79e3514e01bbd563)[#7324](https://github.com/npm/cli/pull/7324) add smoke-test for large prod installs (@lukekarrys)
-[`af3c48e`](https://github.com/npm/cli/commit/af3c48e074d03caebaa8ed24d39405329f545497)[#7262](https://github.com/npm/cli/pull/7262) test refactor (#7262) (@wraithgar)
0 commit comments