Skip to content

deps: upgrade npm to 7.21.0#39813

Closed
npm-robot wants to merge 1 commit intonodejs:masterfrom
npm:npm-7.21.0
Closed

deps: upgrade npm to 7.21.0#39813
npm-robot wants to merge 1 commit intonodejs:masterfrom
npm:npm-7.21.0

Conversation

@npm-robot
Copy link
Contributor

@npm-robot npm-robot commented Aug 19, 2021 •
edited by lpinca
Loading

v7.21.0 (2021-08-19)

FEATURES

BUG FIXES

DEPENDENCIES

v7.20.6 (2021-08-12)

DEPENDENCIES

DOCUMENTATION

v7.20.5 (2021-08-05)

DEPENDENCIES

v7.20.4 (2021-08-05)

BUG FIXES

DEPENDENCIES

  • 15fae4941 [email protected]:
    • fix: properly handle top-level files when using strip
    • Avoid an unlikely but theoretically possible redos
    • WriteEntry backpressure
    • fix(unpack): always resume parsing after an entry error
    • fix(unpack): fix hang on large file on open() fail
    • fix: properly prefix hard links
  • 745326de0 [email protected]:
    • Clear progress bar which overlays confirm prompt
  • e82bcd4e8 [email protected]:
    • fix: start retrying immediately, stop after 10 attempts

@nodejs-github-bot nodejs-github-bot added dont-land-on-v12.x fast-track PRs that do not need to wait for 72 hours to land. needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry. labels Aug 19, 2021
@github-actions
Copy link
Contributor

github-actions bot commented Aug 19, 2021

Fast-track has been requested by @nodejs-github-bot. Please 👍 to approve.

@lpinca lpinca mentioned this pull request Aug 19, 2021
Closed
@npm-robot
Copy link
Contributor Author

npm-robot commented Aug 19, 2021

Supersedes #39681

@lpinca lpinca mentioned this pull request Aug 19, 2021
Closed
@nodejs-github-bot
Copy link
Collaborator

nodejs-github-bot commented Aug 19, 2021

CI: https://ci.nodejs.org/job/node-test-pull-request/39602/

MylesBorins
MylesBorins approved these changes Aug 19, 2021
View reviewed changes
Copy link
Contributor

@MylesBorins MylesBorins left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@nodejs-github-bot
Copy link
Collaborator

nodejs-github-bot commented Aug 20, 2021

CI: https://ci.nodejs.org/job/node-test-pull-request/39604/

lpinca pushed a commit that referenced this pull request Aug 20, 2021
@npm-robot @lpinca
deps: upgrade npm to 7.21.0
248f4c3 
PR-URL: #39813
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Myles Borins <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
@lpinca
Copy link
Member

lpinca commented Aug 20, 2021

Landed in 248f4c3.

@lpinca lpinca closed this Aug 20, 2021
@targos
Copy link
Member

targos commented Aug 22, 2021 •
edited
Loading

@nodejs/npm this doesn't land cleanly on v16.x-staging. Can you please backport (if possible, in a way that future updates can be cherry-picked from master)?

MylesBorins added a commit that referenced this pull request Aug 23, 2021
@MylesBorins
deps: upgrade npm to 7.21.0
cce95c4 
PR-URL: #39813
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Myles Borins <[email protected]>
Reviewed-By: Tobias Nießen <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
@MylesBorins
Copy link
Contributor

MylesBorins commented Aug 23, 2021 •
edited
Loading

@targos I've landed the change in cce95c4

Will double check with team to ensure it is correct (I'm running the update script to ensure the output is expected / consistent)

edit: I've manually confirmed that the release is exactly what is expectd 🎉

@targos
Copy link
Member

targos commented Aug 23, 2021

@MylesBorins awesome, thanks!

@redick-simon
Copy link

redick-simon commented Aug 25, 2021

Hi team,
When we can expect this to be shipped with node 16.x, current npm 7.20.3 has some vulnerability issue due to tar 6.1.0

Please let me know in case we can expect a node release in this week.

Thanks!!

@targos targos mentioned this pull request Aug 25, 2021
Merged
@targos
Copy link
Member

targos commented Aug 25, 2021

Expect a release in the next 24 hours: #39875

@Trott
Copy link
Member

Trott commented Aug 25, 2021

Hi team,
When we can expect this to be shipped with node 16.x, current npm 7.20.3 has some vulnerability issue due to tar 6.1.0

Please let me know in case we can expect a node release in this week.

Thanks!!

@redick-simon npm install -g npm will install the updated version on your system. You don't need to wait for a Node.js release to get the update. (You might already know this and you want/need a release with it for a specific use case, in which case this comment is for the benefit of other readers/observers.)

@redick-simon
Copy link

redick-simon commented Aug 25, 2021

Thanks @Trott ! Actually I'm waiting for node docker image free of tar vulnerability issue.

@darcyclarke darcyclarke mentioned this pull request Aug 26, 2021
Closed
1 task
@wraithgar wraithgar deleted the npm-7.21.0 branch June 26, 2025 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Trott Trott Trott approved these changes

@lpinca lpinca lpinca approved these changes

@tniessen tniessen tniessen approved these changes

+1 more reviewer

@MylesBorins MylesBorins MylesBorins approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

fast-track PRs that do not need to wait for 72 hours to land. needs-ci PRs that need a full CI run. npm Issues and PRs related to the npm client dependency or the npm registry.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@npm-robot @nodejs-github-bot @lpinca @targos @MylesBorins @redick-simon @Trott @tniessen

Comments