Bump npm from 6.4.1 to 6.10.3

[dependabot-preview]

Bumps npm from 6.4.1 to 6.10.3.

Release notes

Sourced from npm's releases.

v6.10.3 (2019-08-06):

BUGFIXES

• 27cccfbda #223 vulns → vulnerabilities in npm audit output (@​sapegin)
• d5e865eb7 #222 #226 install, doctor: don't crash if registry unset (@​dmitrydvorkin, @​isaacs)
• 5b3890226 #227 npm.community#9167 Handle unhandledRejections, tell user what to do when encountering an EACCES error in the cache. (@​isaacs)

DEPENDENCIES

• 77516df6e licensee@7.0.3 (@​isaacs)
• ceb993590 query-string@6.8.2 (@​isaacs)
• 4050b9189 hosted-git-info@2.8.2
  • #46 #43 #47 #44 Add support for GitLab subgroups (@​mterrel, @​isaacs, @​ybiquitous)
  • 3b1d629 #48 fix http protocol using sshurl by default (@​fengmk2)
  • 5d4a8d7 ignore noCommittish on tarball url generation (@​isaacs)
  • 1692435 use gist tarball url that works for anonymous gists (@​isaacs)
  • d5cf830 Do not allow invalid gist urls (@​isaacs)
  • e518222 Use LRU cache to prevent unbounded memory consumption (@​iarna)

v6.10.2 (2019-07-23):

tl;dr - Fixes several issues with the cache when npm is run as sudo on Unix systems.

TESTING

• 2a78b96f8 check test cache for root-owned files (@​isaacs)
• 108646ebc run sudo tests on Travis-CI (@​isaacs)
• cf984e946 set --no-esm tap flag (@​isaacs)
• 8e0a3100d add script to run tests and leave fixtures for inspection and debugging (@​isaacs)

BUGFIXES

• 25f4f73f6 add a util for writing arbitrary files to cache This prevents metrics timing and debug logs from becoming root-owned. (@​isaacs)
• 2c61ce65d infer cache owner from parent dir in correct-mkdir util (@​isaacs)
• 235e5d6df ensure correct owner on cached all-packages metadata (@​isaacs)
• e2d377bb6 npm.community#8540 audit: report server error on failure (@​isaacs)
• 52576a39e #216 npm.community#5385 npm.community#6076 Fix npm ci with file: dependencies. Partially reverts #40/#86, recording dependencies of linked deps in order for npm ci to work. (@​jfirebaugh)

DEPENDENCIES

• 0fefdee13 cacache@12.0.2 (@​isaacs)
  • infer uid/gid instead of accepting as options, preventing the overwhelming majority of cases where root-owned files end up in the cache folder. (ac84d14) (@​isaacs) (#1)
  • i18n: add another error message (676cb32) (@​zkat)
• e1d87a392 pacote@9.5.4 (@​isaacs)
  • git: ensure stream failures are reported (7f07b5d) #1 (@​lddubeau)
• 3f035bf09 infer-owner@1.0.4 (@​isaacs)
• ba3283112 npm-registry-fetch@4.0.0 (@​isaacs)
• ee90c334d libnpm@3.0.1 (@​isaacs)
• 1e480c384 libnpmaccess@3.0.2 (@​isaacs)

... (truncated)

Changelog

Sourced from npm's changelog.

v6.10.3 (2019-08-06):

BUGFIXES

• 27cccfbda
  #223 vulns → vulnerabilities in
  npm audit output (@​sapegin)
• d5e865eb7
  #222
  #226 install, doctor: don't crash
  if registry unset (@​dmitrydvorkin,
  @​isaacs)
• 5b3890226
  #227
  npm.community#9167
  Handle unhandledRejections, tell user what to do when encountering an
  EACCES error in the cache. (@​isaacs)

DEPENDENCIES

• 77516df6e
licensee@7.0.3 (@​isaacs)
• ceb993590
query-string@6.8.2 (@​isaacs)
• 4050b9189
hosted-git-info@2.8.2
  • #46
    #43
    #47
    #44 Add support for
    GitLab subgroups (@​mterrel,
    @​isaacs,
    @​ybiquitous)
  • 3b1d629
    #48 fix http
    protocol using sshurl by default
    (@​fengmk2)
  • 5d4a8d7
    ignore noCommittish on tarball url generation
    (@​isaacs)
  • 1692435
    use gist tarball url that works for anonymous gists
    (@​isaacs)
  • d5cf830
    Do not allow invalid gist urls (@​isaacs)
  • e518222
    Use LRU cache to prevent unbounded memory consumption
    (@​iarna)

v6.10.2 (2019-07-23):

... (truncated)

Commits

• 897537a 6.10.3
• d2eaf0b update AUTHORS
• 586c938 doc: changelog 6.10.3 update
• 4050b91 hosted-git-info@2.8.2
• 46181cb dev: make the pr script a little friendlier with conflicts
• 0f980f5 doc: changelog 6.10.3
• 5b38902 Handle unhandledRejections, help with cache eacces
• 99edd49 test: clean up some unnecessary setup/cleanup
• 9bb66e1 docs: changelog for 6.10.3
• ceb9935 query-string@6.8.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this ['minor'|'major'] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it). To ignore the specific version in this PR you can just close it
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[dependabot-preview]

Superseded by #21.