All notable changes to this project will be documented in this file. See standard-version for commit guidelines.
before as an alias to enjoy-by (75d62b7)tar: this changes the underlying tar library, and thus may introduce some subtle low-level incompatibility. Also:
The tarball packer built into pacote works much closer to how the one npm injects does.
Special characters on Windows will now be escaped the way tar(1) usually does: by replacing them with the 0xf000 masked character on the way out.
Directories won't be chowned.
integrity: This PR replaces a pretty fundamental chunk of pacote.
Caching now follows standard-ish cache rules for http-related requests.
manifest() no longer includes the _shasum field. It's been replaced by _integrity, which is a Subresource Integrity hash string containing equivalent data. These strings can be parsed and managed using https://npm.im/ssri.
Any functions that accepted opts.digest and/or opts.hashAlgorithm now expect opts.integrity instead.
Packuments and finalized manifests are now cached using sha512. Tarballs can start using that hash (or any other more secure hash) once registries start supporting them: packument.dist.integrity will be prioritized over packument.shasum.
If opts.offline is used, a ENOCACHE error will be returned.