npm@5 prerelease tracking

@zarenner

This is the official npm@next tracking issue listing known issues and, if relevant, workarounds. The beta ran until May 25th, and we're doing a bit more during the prerelease, to hopefully get npm@5 into latest by May 30th, in time for node@8's release.

You no longer need to install the npm5 package to try this: just do npm i -g npm@next.

For the general changelog and release-branch tracking issue, see #16244. The feature list for npm5 is listed there.

Want to help? Check for tagged npm5 issues, or pick up any of the open bugs in pacote, cacache, or make-fetch-happen. These libraries are all fundamental infrastructure for the new cache, and any improvements will have a direct effect on npm5 itself.

Known Issues

The following issues are known, and will (hopefully!) be fixed by the time npm5 goes to latest on May 30th:

The new notice loglevel messes with some tools that use npmlog. For example, you might see verbose log output from node-pre-gyp during lifecycle script execution.
cross-platform package-lock.json is still pending some WIP patches. Soooooooon
Some installs using github enterprise with 2FA and git+ssh are failing to authenticate. (npm 5 (5.0.0 / 5.0.0-beta64) throws on fetching package metadata from a git URL #16726)
Global installations fail sometimes.

Fixed Issues

FIXED inbeta.34 ~~a bad commit accidentally broke cache corruption recovery. Oops! Fix forthcoming.~~
FIXED in beta.35 ~~dependencies in package.json with spaces in them fail to match (leading space in dep with npm5 #16520)~~
FIXED in beta.36 ~~dependencies with = don't resolve (= semver range prefix breaking npm5 #16524)~~
FIXED in beta.37 (thanks, @zarenner!) ~~npm5 fails to authenticate for registries that aren't hosted at the host root (npm5 Authentication Failure (E401) for 3rd Party Private Packages Registry #16528)~~
FIXED in beta.38 This wasn't an npm5 bug per se, but some packages had tarballs with package.json data that did not match the package metadata uploaded (???). npm5 compensates a bit for this now. ~~There's apparently some situations where extraneous packages get added, or correct packages get marked as extraneous (spurious extraneous packages #16517)~~
FIXED in beta.43 (thanks, @ivanph!) npm5 sends original auth headers with tarballs hosted outside of the manifest registry (https://github.com/zkat/pacote/issues/87, remove authorization header on redirect to different host node-fetch-npm#1)
FIXED in beta.46 ~~Lockfiles are still generated off the filesystem, so they are not yet fully cross-platform.~~
FIXED in beta.46 Bundled dependencies might be replaced even if marked as bundled in your package-lock.json. This should only yield a warning, since npm will simply replace acceptable versions of those dependencies with regular downloads.
FIXED in beta.46 Local file/directory dependencies are not complete and will have weird interactions with the package-lock.json. This is pending merging https://github.com/npm/npm/tree/link-specifier (Inconsistencies between package.json and package-lock.json with local dependencies #16536)
FIXED in beta.47 ~~Global installs are failing with a cannot read 'package' of null error ([5.0.0-beta.46] Cannot read property 'package' of null #16603)~~
FIXED in beta.48 ~~npm crashes with a url not being a valid semver spec (npm5 is attempting to use a private registry incorrectly. #16600)~~
FIXED in beta.50 ~~npm fails to send auth data to scoped private registries~~
FIXED in beta.56 ~~package.json might be saved even if package-lock.json fails to save for some reason. (nb: this should happen much less as of beta.46)~~
FIXED in beta.56 ~~The installer is still erroneously marking some packages as extraneous (spurious extraneous packages #16517)~~
FIXED in beta.57 ~~npm update will by default save any updated devDeps as if they were dependencies.~~
FIXED in beta.58 (Thanks, @nlkluth!) Downloads the redirect from http to https and vice versa are not supported right now (npm5: protocol 'https' not supported when installing 'dns' package #16613, can't fetch url which will redirect to another url with different protocol zkat/make-fetch-happen#26)
FIXED in beta.59 and beta.60 (Thanks, @yyjdelete!) ~~http->https tunneling proxies don't work~~
FIXED in beta.61 ~~uid must be an unsigned int error during install (npm5 uid must be an unsigned int #16544)~~
FIXED in beta.63 ~~Using a proxy will keep the proxy agent alive, preventing the node process from exiting. You can safely ^C out if this happens.~~
FIXED in beta.63 ~~Some users have reported symlink issues while upgrading the beta. We tracked down the race, and there should be a fix very soon (utils/link: Make less race prone #16686)~~
FIXED in beta.64 ~~Installing with sudo will write cache entries as root instead of dropping permissions for cache writes (npm5 not dropping permissions on cache writes when doing sudo #16707)~~
FIXED in beta.69 ~~username/password registry auth doesn't seem to be working at least for some people~~
FIXED in beta.69 ~~package-lock entries previously marked as optional: true or dev: true, or even bundled: true are having those settings clobbered on the following install and written back as full, regular deps.~~
FIXED in npm@5.0.0 ~~The prepare, prepublish, prepublishOnly dance isn't quite set in stone yet. Things might be a bit confusing. (npm5: prepublish runs for npm install #16685)~~
FIXED in npm@5.0.0 directory dependencies aren't quite done yet in a couple of cases: you might see weird issues with dependencies of dir dependencies causing errors, or even Max callstack exceeded errors for certain combinations.

Congratulations on the release 🎉 ✨

Just saw the man entry is missing for the npm5 binary. I think that's caused by absolute paths in the registry metadata, but I'm not sure b/c npm4 has absolute paths, too, but that works.

@boennemann

@boennemann we have general issues installing the manpages (turns out they never quite worked, but that's a separate thing to explain). Getting manpages to work again just for the beta is far down the list. Thanks for letting me know, though!

And thank you. I'm excited for people to try this out and help make it better ^_^

@zkat

@zkat, congratulations on the big milestone! I bet that's a load off your shoulders for a quick second. =)

I was wondering whether you or anyone has tried credentialed access to private npm or third party registries such as Microsoft's Package Management. We are a user of the latter, and trying beta 36 just now, I am getting an "E401 - Unauthorized" error for all package requests. I'll be glad to make this a side issue to talk through to get it out of this thread if that's helpful. Would have to scrub logs a bit, perhaps, if I were to post any. Pinging Microsoft for awareness: @zarenner

@simonua

@simonua Please make a new issue with a debug log. This is a thing I was really hoping to test out. The auth code was completely rewritten, as was all the proxy stuff.

@zkat

@zkat, 10-4

@simonua

@simonua hey! beta.37 is out with a hopefully-fixed auth bit. Wanna give it another shot? Thanks @zarenner for the speedy fix over in https://github.com/zkat/pacote/pull/85 💃

@zkat

Definitely, @zkat! Might be tomorrow morning, but I will certainly report my findings. Great stuff and thank you and @zarenner!

I just opened https://github.com/zkat/pacote/issues/87 which is another issue which affects registries that redirect to another host where Authorization must not be forwarded. So (at least for VSTS specifically) auth issues aren't yet completely resolved.

just dropping a note: we're going to have a brief lull in fixes/patches for a couple of days while we work on some fixes for the bigger issues folks are having, and I'm also working on getting a beta into node 8. Shiny new beta releases will ramp back up once that stuff lands :)

Thanks all for the time you've taken to test stuff, and the excellent tickets y'all have filed!

Additionally, we've added a TODO list to the bottom of the OP in #16244.

k, we're back in business. package-lock.json should now be cross-platform, idempotent, etc. 👍

In beta.46 I am getting:

npm ERR! Maximum call stack size exceeded

Previous beta was working with the same exact package.json file

I just opened an issue - for a change to the lockfile that would be really helpful for CI services - #16580

@montogeek

@montogeek hah, nice.

Do you have a package.json you can share that reproduces this?

@janl

@janl are you sure? Looks like it's the top-level/initiating CLI args in my testing.. Unless that's another v5 change.

@rmg

@rmg I've gone down the parsing the config_argv route before with in-publish and it's limited and brittle. Honestly, if you need to distinguish the two modes I think I'd prefer that we have different lifecycles.

@janl What are you doing in your preinstall for a published module that you want to do when developing it but not when depending on it? (Or vice-versa?)

@janl

@janl you can use $PWD and see if it's inside node_modules.

When I do npm install -g npm@5 or npm install -g npm@next it runs the installer, but npm -v still shows NPM's version at 4.6.1.

@matthew-dean

@matthew-dean what does npm prefix -g say? Is the path given there when you do echo $PATH?

npm@5.0.0 is still marked as pre-release, both on GitHub and on npm itself:

scapeless:~ elyscape$ curl -s https://registry.npmjs.org/npm/ | jq '.["dist-tags"]'
{
  "latest": "4.6.1",
  "next": "5.0.0",
  "latest-2": "2.15.12",
  "next-2": "2.15.12",
  "latest-1": "1.4.29",
  "lts": "2.15.11",
  "latest-3": "3.10.10",
  "next-3": "3.10.10",
  "latest-4": "4.6.1",
  "next-4": "4.6.1"
}

(an easier command for ^ is just npm dist-tags ls npm)

Just to update here, it's latest now :)

Nice! This issue can be closed, then?
Also, should a {latest,next}-5 be created?

@SimenB

@SimenB done

I guess I should close this issue. :s I've been using it to track stuff but we're honestly in full live mode now, so... woo.

@janl

@janl you can use $PWD and see if it's inside node_modules.

@zkat that does the trick thank you!

p.s. there is now #16991 for post-release issue tracking

Navigation Menu

Repository navigation

npm@5 prerelease tracking #16510

Known Issues

Fixed Issues

15 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

npm@5 prerelease tracking #16510

Description

Known Issues

Fixed Issues

Activity

boennemann commented on May 4, 2017

zkat commented on May 4, 2017

simonua commented on May 4, 2017

zkat commented on May 4, 2017

simonua commented on May 4, 2017

zkat commented on May 4, 2017

simonua commented on May 4, 2017

zarenner commented on May 4, 2017

zkat commented on May 8, 2017

zkat commented on May 8, 2017

zkat commented on May 9, 2017

montogeek commented on May 9, 2017

christopherstott commented on May 10, 2017

zkat commented on May 10, 2017

15 remaining items

rmg commented on May 26, 2017

iarna commented on May 27, 2017

zkat commented on May 27, 2017

matthew-dean commented on May 29, 2017

zkat commented on May 29, 2017

elyscape commented on May 30, 2017

SimenB commented on May 30, 2017

zkat commented on May 31, 2017

SimenB commented on May 31, 2017

zkat commented on May 31, 2017

zkat commented on May 31, 2017

janl commented on Jun 3, 2017

zkat commented on Jun 5, 2017

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions