MINI-EPIC: next steps for v7 integration 2020-03-03

[isaacs]

• (feat/publish #1000) npm publish, npm unpublish, and libnpmpublish (@claudiahdz)
• use @npmcli/arborist in:
  • ([v7] update npm ci command #1025) npm ci
  • npm update
  • npm shrinkwrap
  • npm audit (somewhat extensive, as this currently uses the v6 Installer class, and so may need Arborist changes to support)
• (feat/publish #1000) leverage pacote more fully in npm pack
• ([v7] Complete npm install command #995) improve install/ci output (may need to revisit the design, since a giant single-color archy representation of the logical tree is not super helpful, even as a silly output log -- if we're going to dump an archy into the log, it should probably be the physical tree, at least). Note that this affects both install and ci.
• ensure deduping of dependencies in node_modules
• Document/RFC (add more to this list as we remember/find/decide them)
  • update is always depth=Infinity
  • --authtype=sso deprecated
  • acceptDependencies
  • --include-staged

[isaacs]

Updated list:

Beta Release Blockers

• npm commands that are a call to Arborist.reify() in some fashion:
  • install
  • ci
  • update
  • link
  • install-test
  • install-ci-test
  • uninstall (easy)
  • prune
  • dedupe (probably needs some work on Arborist.buildIdealTree to actually
    do the deduping bit without completely regenerating it, but should be
    straightforward)
  • audit fix (in progress isaacs)
• Land npm publish PR
  • NB: this and libcipm are the last remaining items holding
    npm-registry-fetch@4 in place.
• Finish Arborist.audit(), and audit integration with
  Arborist.reify()
  • replace npm-audit-report (in progress)
• outdated (in progress - claudiahdz)
• All reify commands above need consistent output at the end of their
  run, including funding, quick audit, and summary results (in progress
  isaacs, pending finishing Arborist.audit)
• shrinkwrap command
• npm install --package-lock-only
• remove lib/fetch-package-metadata.js once nothing is using it
• remove lib/install/*.js once nothing is using it
• npm commands to port to Arborist.loadActual
  • ls
  • fund
• fully remove all uid/gid setting stuff
• update mkdirp to 1.x everywhere
• fully remove these configs which are no longer relevant:
  • user
  • group
  • uid
  • gid
  • umask
  • dev (or convert to alias for --include=dev)
  • onload-script (and actually remove its usage)
  • scripts-prepend-node-path
  • unsafe-perm
• Add support to Arborist for --format-package-lock flag
• do not treat test special in scripts (ie, just go ahead and run and
  fail if no scripts.test present, instead of creating a default fail
  message)
• remove/change these deps (and code using them):
  • uid-number
  • npm-lifecycle
  • gentle-fs
  • figgy-pudding
  • ? detect-indent
  • ? detect-newline
  • fs-vacuum
  • read-package-json -> read-package-json-fast
  • json-parse-better-errors -> json-parse-even-better-errors
  • tar-stream -> tar
  • umask
  • mississippi
  • unpipe
  • lazy-property
  • review all others for usage, and remove if no longer needed

---

7.0.0 release blockers (but not 7.0.0-beta blockers)

• update tar to no longer rely on process.umask()
  • also remove process.umask() everywhere else, but tar is the only hard
    one
• add file-specific unit tests for all files in lib, and enforce 100%
  code coverage with a coverage-map
• Update all dependencies
• review all documentation and correct
• review all failing tests and correct or remove

---

Can be 7.1 or later release

• workspaces integration in CLI
  • Note: work on Arborist support in progress. integration in the CLI
    itself will be more straightforward, but some subtle UX work.
• overrides
• staged publishes
  • installation (partly done, not compliant with RFC yet)
  • server support
  • publishing

[isaacs]

cc: @ethomson @jeremyepling @scottdensmore