@npmcli/config 10.8.1 → 10.9.1

package/lib/definitions/definitions.js

@@ -187,6 +187,36 @@ const definitions = {
   `,
     flatten,
   }),
+  'allow-directory': new Definition('allow-directory', {
+    default: 'all',
+    type: ['all', 'none', 'root'],
+    description: `
+      Limits the ability for npm to install dependencies from directories.
+      That is, dependencies that point to a directory instead of a version or semver range.
+      Please note that this could leave your tree incomplete and some packages may not function as intended or designed.
+      Changing this setting will not remove dependencies that are already installed.
+
+      \`all\` allows any directories to be installed.
+      \`none\` prevents any directories from being installed.
+      \`root\` only allows directories defined in your project's package.json to be installed.  Also allows directory dependencies to be used for other commands like \`npm view\`
+  `,
+    flatten,
+  }),
+  'allow-file': new Definition('allow-file', {
+    default: 'all',
+    type: ['all', 'none', 'root'],
+    description: `
+      Limits the ability for npm to install dependencies from tarball files.
+      That is, dependencies that point to a local tarball file instead of a version or semver range.
+      Please note that this could leave your tree incomplete and some packages may not function as intended or designed.
+      Changing this setting will not remove dependencies that are already installed.
+
+      \`all\` allows any tarball file to be installed.
+      \`none\` prevents any tarball file from being installed.
+      \`root\` only allows tarball files defined in your project's package.json to be installed.  Also allows tarball file dependencies to be used for other commands like \`npm view\`
+  `,
+    flatten,
+  }),
   'allow-git': new Definition('allow-git', {
     default: 'all',
     type: ['all', 'none', 'root'],
@@ -194,10 +224,26 @@ const definitions = {
       Limits the ability for npm to fetch dependencies from git references.
       That is, dependencies that point to a git repo instead of a version or semver range.
       Please note that this could leave your tree incomplete and some packages may not function as intended or designed.
+      Changing this setting will not remove dependencies that are already installed.
 
       \`all\` allows any git dependencies to be fetched and installed.
       \`none\` prevents any git dependencies from being fetched and installed.
-      \`root\` only allows git dependencies defined in your project's package.json to be fetched installed.  Also allows git dependencies to be fetched for other commands like \`npm view\`
+      \`root\` only allows git dependencies defined in your project's package.json to be fetched and installed.  Also allows git dependencies to be fetched for other commands like \`npm view\`
+  `,
+    flatten,
+  }),
+  'allow-remote': new Definition('allow-remote', {
+    default: 'all',
+    type: ['all', 'none', 'root'],
+    description: `
+      Limits the ability for npm to fetch dependencies from urls.
+      That is, dependencies that point to a tarball url instead of a version or semver range.
+      Please note that this could leave your tree incomplete and some packages may not function as intended or designed.
+      Changing this setting will not remove dependencies that are already installed.
+
+      \`all\` allows any url to be installed.
+      \`none\` prevents any url from being installed.
+      \`root\` only allows urls defined in your project's package.json to be installed.  Also allows url dependencies to be used for other commands like \`npm view\`
   `,
     flatten,
   }),
@@ -246,7 +292,6 @@ const definitions = {
     default: null,
     hint: '<date>',
     type: [null, Date],
-    exclusive: ['min-release-age'],
     description: `
       If passed to \`npm install\`, will rebuild the npm tree such that only
       versions that were available **on or before** the given date are
@@ -257,6 +302,12 @@ const definitions = {
       pass the \`--before\` filter, the most recent version less than or equal
       to that tag will be used. For example, \`foo@latest\` might install
       \`foo@1.2\` even though \`latest\` is \`2.0\`.
+
+      If \`before\` and \`min-release-age\` are both set in the same source,
+      \`before\` wins (an explicit absolute date overrides a relative window).
+      Across sources, the standard precedence applies (cli > env > project >
+      user > global), so a higher-priority source can always relax or
+      override a lower-priority one.
     `,
     flatten,
   }),
@@ -1363,7 +1414,6 @@ const definitions = {
     default: null,
     hint: '<days>',
     type: [null, Number],
-    exclusive: ['before'],
     envExport: false,
     description: `
        If set, npm will build the npm tree such that only versions that were
@@ -1372,13 +1422,18 @@ const definitions = {
        command will error.
 
        This flag is a complement to \`before\`, which accepts an exact date
-       instead of a relative number of days.
+       instead of a relative number of days. The two may coexist (e.g.
+       \`min-release-age\` in your \`.npmrc\` is preserved when npm internally
+       spawns a sub-process with \`--before\` while preparing a \`git:\` or
+       \`github:\` dependency); when both apply, \`before\` wins within a
+       single source and across sources the standard precedence rules apply.
     `,
     flatten: (key, obj, flatOptions) => {
-      if (obj['min-release-age'] !== null) {
-        flatOptions.before = new Date(Date.now() - (86400000 * obj['min-release-age']))
-        obj.before = flatOptions.before
-        delete obj['min-release-age']
+      const age = obj['min-release-age']
+      // `hasOwn` so a `before` inherited via ConfigData's prototype chain (lib/index.js) from a lower-priority source doesn't silently win.
+      // The `: null` clear depends on `Config#flat` iterating sources low → high.
+      if (age != null && !Object.hasOwn(obj, 'before')) {
+        flatOptions.before = age ? new Date(Date.now() - (86400000 * age)) : null
       }
     },
   }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/config",
-  "version": "10.8.1",
+  "version": "10.9.1",
   "files": [
     "bin/",
     "lib/"