@ -1,3 +1,200 @@
### v2.15.11 (2016-09-08):
On we go with our monthly release cadence! This week is pretty much all
dependency updates and some documentation changes, as can be expected by now.
Note that `npm@4` will almost certainly be released next month! It's not final
what we'll end up doing as far as LTS support goes, but the current thinking is
that, considering how small and resource-constrained our team is, support for
`npm@2` will be reduced to essentially maintenance, so we can better focus on
`npm@3` as the new LTS version (which will go into `node@6` ), and `npm@4` as our
next main development version.
#### DOCUMENTATION UPDATES
* [`8f71038` ](https://github.com/npm/npm/commit/8f71038310501ad5bc7445b2fa2ff0eaa377919a )
[#13892 ](https://github.com/npm/npm/pull/13892 )
Update `LICENSE` file to match license on `master` .
([@rvagg](https://github.com/rvagg))
* [`e81b4f1` ](https://github.com/npm/npm/commit/e81b4f1d18a4d79b7af8342747f2ed7dc3e84f0a )
[#12438 ](https://github.com/npm/npm/issues/12438 )
Remind folks to use `#!/usr/bin/env node` in their `bin` scripts to make files
executable directly.
([@mxstbr](https://github.com/mxstbr))
* [`f89789f` ](https://github.com/npm/npm/commit/f89789f43d65bfc74f64f15a99356841377e1af3 )
[#13655 ](https://github.com/npm/npm/pull/13655 )
Document line comment syntax for `.npmrc` .
([@mdjasper](https://github.com/mdjasper))
* [`5cd3abc` ](https://github.com/npm/npm/commit/5cd3abc3511515e09b4a1b781c0520e84c267c5b )
[#13493 ](https://github.com/npm/npm/pull/13493 )
Document that the user config file can itself be configured either through the
`$NPM_CONFIG_USERCONFIG` environment variable, or `--userconfig` command line
flag.
([@jasonkarns](https://github.com/jasonkarns))
* [`dd71ca0` ](https://github.com/npm/npm/commit/dd71ca0efc2094b824ccc9e23af0fc915499f2e6 )
[#13911 ](https://github.com/npm/npm/pull/13911 )
Minor documentation reword and cleanup.
([@othiym23](https://github.com/othiym23))
* [`f7a320c` ](https://github.com/npm/npm/commit/f7a320c816947d578a050c97e0fb9878954be0e8 )
[#13682 ](https://github.com/npm/npm/pull/13682 )
Minor grammar fix in documentation for `npm scripts` .
([@Ajedi32](https://github.com/Ajedi32))
* [`e5cb5e8` ](https://github.com/npm/npm/commit/e5cb5e8fcf4642836fedf3f3421c994a8e27e19b )
[#13717 ](https://github.com/npm/npm/pull/13717 )
Document that `npm link` will link the files specified in the `bin` field of
`package.json` to `{prefix}/bin/{name}` .
([@legodude17](https://github.com/legodude17))
#### DEPENDENCY UPDATES
* [`8bef026` ](https://github.com/npm/npm/commit/8bef026603b6da888edf0d41308d9e532abfcd54 )
`graceful-fs@4.1.6`
([@francescoinfante](https://github.com/francescoinfante))
* [`9f73f4a` ](https://github.com/npm/npm/commit/9f73f4aab5f56b256c5cf9e461e81abfa2844945 )
`glob@7.0.6`
([@isaacs](https://github.com/isaacs))
* [`5391b7e` ](https://github.com/npm/npm/commit/5391b7e8cd4401fbadbf54e810fdc965a3662a21 )
`which@1.2.1`
([@isaacs](https://github.com/isaacs))
* [`43bfec8` ](https://github.com/npm/npm/commit/43bfec8376dd8ded7d56a8dabd6139919544760e )
`retry@0.10.0`
([@tim-kos](https://github.com/tim-kos))
* [`39305f1` ](https://github.com/npm/npm/commit/39305f1c76f74bf9789c769ef72a94ea9a81d119 )
`readable-stream@2.1.5`
([@calvinmetcalf](https://github.com/calvinmetcalf))
* [`a5512fa` ](https://github.com/npm/npm/commit/a5512fafd72e23755e77e28f1122b008bc12a733 )
`once@1.4.0`
([@zkochan](https://github.com/zkochan))
* [`06a208b` ](https://github.com/npm/npm/commit/06a208b178c1de3d0da58bc35a854d200fea8ef0 )
`npm-registry-client@7.2.1` :
* [npm/npm-registry-client#142 ](https://github.com/npm/npm-registry-client/pull/142 ) Fix `EventEmitter` warning spam from error handlers on socket. ([@addaleax](https://github.com/addaleax))
* [npm/npm-registry-client#131 ](https://github.com/npm/npm-registry-client/pull/131 ) Adds support for streaming request bodies. ([@aredridel](https://github.com/aredridel))
* Fixes [#13656 ](https://github.com/npm/npm/issues/13656 ).
* Dependency updates.
* Documentation improvements.
([@othiym23](https://github.com/othiym23))
* [`4f759be` ](https://github.com/npm/npm/commit/4f759be1fb5e23180b970350e58f40a513daa680 )
`inherits@2.0.3`
([@isaacs](https://github.com/isaacs))
* [`4258b76` ](https://github.com/npm/npm/commit/4258b764e2565f6294ae1e34a5653895290b62e3 )
`tap@7.1.1`
([@isaacs](https://github.com/isaacs))
### v2.15.10 (2016-08-11):
Hi all, today's our first release coming out of the new monthly release
cadence. See below for details. We're all recovered from conferences now and
raring to go! For LTS we see some bug fixes, documentation improvements and
a host of dependency updates.
The most dramatic bug fix is probably the inclusion of scoped modules in
bundled dependencies. Prior to this release and
[v3.10.7 ](https://github.com/npm/npm/releases/v3.10.7 ), npm had ignored
scoped modules found in `bundleDependencies` entirely.
#### NEW RELEASE CADENCE
Releasing npm has been, for the most part, a very prominent part of our
weekly process process. As part of our efforts to find the most effective
ways to allocate our team's resources, we decided last month that we would
try and slow our releases down to a monthly cadence, and see if we found
ourselves with as much extra time and attention as we expected to have.
Process experiments are useful for finding more effective ways to do our
work, and we're at least going to keep doing this for a whole quarter, and
then measure how well it worked out. It's entirely likely that we'll switch
back to a more frequent cadence, specially if we find that the value that
weekly cadence was providing the community is not worth sacrificing for a
bit of extra time. Does this affect you significantly? Let us know!
#### WINDOWS CORNER CASES
* [`405c404` ](https://github.com/npm/npm/commit/405c4048c69c14d66e6179aba0c8a35e504e8041 )
[#13023 ](https://github.com/npm/npm/pull/13023 )
Fixed a Windows issue with the cache where callbacks could be called more than once.
([@zkat](https://github.com/zkat))
* [`bf348dc` ](https://github.com/npm/npm/commit/bf348dcfb944dc4b9f71b779bf172f86a2e1f474 )
[#13023 ](https://github.com/npm/npm/pull/13023 )
Fixed a Windows corner case with correct-mkdir where if SUDO_UID or
SUDO_GID were set then we would try to chown things even though that can't
work on Windows.
([@zkat](https://github.com/zkat))
#### RACES IN THE CACHE
* [`68f29f1` ](https://github.com/npm/npm/commit/68f29f18f65c7a7e1c58eb6933af41d786971379 )
[#12669 ](https://github.com/npm/npm/issues/12669 )
Ignore ENOENT errors on chownr while adding packages to cache. This change
works around problems with race conditions and local packages.
([@julianduque](https://github.com/julianduque))
#### BETTER GIT ENVIRONMENT WHITELISTING
* [`5e96566` ](https://github.com/npm/npm/commit/5e96566088f0d88c1ed10c5a9cbb7c0cd4aa2aee )
[#13358 ](https://github.com/npm/npm/pull/13358 )
Add GIT_EXEC_PATH to Git environment whitelist.
([@mhart](https://github.com/mhart))
#### DOCUMENTATION
* [`363e381` ](https://github.com/npm/npm/commit/363e381a4076ead89707a00cc4a447b1d59df3bc )
[#13319 ](https://github.com/npm/npm/pull/13319 )
As Node.js 0.8 is no longer supported, remove mention of it from the README.
([@watilde](https://github.com/watilde))
* [`e8fafa8` ](https://github.com/npm/npm/commit/e8fafa887c60eb8842c76c4b3dffe85eb49fa434 )
[#10167 ](https://github.com/npm/npm/pull/10167 )
Clarify in scope documentation that npm@2 is required for scoped packages.
([@danpaz](https://github.com/danpaz))
#### DEPENDENCIES
* [`66ef279` ](https://github.com/npm/npm/commit/66ef279b7c3b3e4f9454474dddd057cc1f21873b )
[npm/fstream-npm#22 ](https://github.com/npm/fstream-npm/pull/22 )
`fstream@1.1.1` :
Always include NOTICE files now. Fix inclusion of scoped modules as bundled dependencies.
([@kemitchell](https://github.com/kemitchell))
([@forivall](https://github.com/forivall))
* [`fe8385b` ](https://github.com/npm/npm/commit/fe8385bd655502feb175eed175a6a06cafb2247a )
`glob@7.0.5` :
Update minimatch dep for security fix. See the minimatch update below for details.
([@isaacs](https://github.com/isaacs))
* [`51d49d2` ](https://github.com/npm/npm/commit/51d49d2f79b4c69264de73a492ed54f87188d554 )
[isaacs/node-graceful-fs#71 ](https://github.com/isaacs/node-graceful-fs/pull/71 )
`graceful-fs@4.1.5` :
`graceful-fs` had a [bug fix ](https://github.com/isaacs/node-graceful-fs/pull/71 ) which
fixes a problem ([nodejs/node#7846](https://github.com/nodejs/node/pull/7846)) exposed
by recent changes to Node.js.
([@thefourtheye](https://github.com/thefourtheye))
* [`5c8f39d` ](https://github.com/npm/npm/commit/5c8f39d152c43e96b9006ffe865646a36a433a8a )
`minimatch@3.0.3` :
Handle extremely long and terrible patterns more gracefully.
There were some magic numbers that assumed that every extglob pattern starts
and ends with a specific number of characters in the regular expression.
Since !(||) patterns are a little bit more complicated, this led to creating
an invalid regular expression and throwing.
([@isaacs](https://github.com/isaacs))
* [`d681e16` ](https://github.com/npm/npm/commit/d681e16a475a49d6196af9a5cedaaf88712f3a9f )
[npm/npm-user-validate#9 ](https://github.com/npm/npm-user-validate/pull/9 )
`npm-user-validate@0.1.5` :
Use correct, lower username length limit.
([@aredridel](https://github.com/aredridel))
* [`f918994` ](https://github.com/npm/npm/commit/f918994bd05ca965766cd573606ac35fb3032d6e )
`request@2.74.0` :
Update `request` dependency `tough-cookie` to `2.3.0` to
to address [https://nodesecurity.io/advisories/130 ](https://nodesecurity.io/advisories/130 ).
Versions 0.9.7 through 2.2.2 contain a vulnerable regular expression that,
under certain conditions involving long strings of semicolons in the
"Set-Cookie" header, causes the event loop to block for excessive amounts of
time.
([@stash-sfdc](https://github.com/stash-sfdc))
* [`5540cc4` ](https://github.com/npm/npm/commit/5540cc4d6bde65071fb6fc2cb074e8598bd1276f )
[isaacs/rimraf#111 ](https://github.com/isaacs/rimraf/issues/111 )
`rimraf@2.5.4` : Clarify assertions: cb is required, options are not.
([@isaacs](https://github.com/isaacs))
* [`6357928` ](https://github.com/npm/npm/commit/6357928673be85f520dae2104fea58c35742bd65 )
`spdx-license-ids@1.2.2` :
New licenses synced from spdx.org.
([@shinnn](https://github.com/shinnn))
### v2.15.9 (2016-06-30):
What's this? An LTS release? Yes, that is indeed so. Small, as usual, and as
Kat Marchán
8 years ago
Myles Borins