npm cli future changes

[wraithgar]

Resetting the old issue so we can consolidate it into a better task list.

These are changes in consideration for future semver major npm releases.

Breaking changes

• [ ] remove npm adduser
• [ ] stop reading process.env.NODE in config for nodeBin
• [ ] remove man pages
• [ ] Remove install scripts support
• [ ] Support for reading stdin across all commands (ie. https://github.com/npm/rfcs/blob/3d5b2130504139bdc8a3b599923aa07d2ff79c96/accepted/0000-dependency-selector-syntax.md#commands-could-read-from-stdin)
• [ ] Support Package Distributions by default
• [x] Consider changing strict-ssl default based on environment variables https://github.com/npm/make-fetch-happen/pull/257
• [x] https://github.com/npm/npm-packlist/pull/168
• [ ] Revert all of the hacks around "globstar" in packlist. Just use node-glob's patterns. This is just a https://github.com/npm/cli/issues/7514 https://github.com/npm/npm-packlist/issues/152 at this point.
• [ ] Make --silent truly silent (eg dont set up any process listeners) and create a net-new way of hiding only logging output. (The opposite could also be done). Then go through and remove all npm.silent checks. https://github.com/npm/cli/issues/4877#issuecomment-2109184464
• [ ] Make run-script banners a log event. They have been swapped to stderr for json mode, but I think they should always be on stderr. I think an open question would be if they should be called with output.error or as an actual log (maybe with a custom META prefix)? https://github.com/npm/cli/issues/3354#issuecomment-2108901091
• [x] Apply --ignore-scripts to the prepare script when packing and publishing https://github.com/npm/cli/issues/3707 https://github.com/npm/cli/issues/7211#issuecomment-2103635859
• [ ] Make pack --json return an object like publish --json instead of an array
• [ ] Dont unwrap any single item arrays in view --json
• [ ] Set all json output on known top-level keys. I think those should be result and error to start (🚲 those names).
• [ ] get rid of "populate deps on init" https://github.com/npm/init-package-json/blob/main/lib/default-input.js#L11-L39
• [ ] add bun.lock to default pack ignorelist https://github.com/npm/npm-packlist/pull/257
• [ ] https://github.com/npm/statusboard/issues/937
• [ ] https://github.com/npm/statusboard/issues/970
• [ ] https://github.com/npm/init-package-json/issues/30

Features

• [ ] New npm link experience
• [ ] Add new "lifecycle events" API - differentiate between scripts & events - user/project & dependency defined usecases)
• [ ] First-class import-maps Support
• [ ] Warn/error on unecessary config items in publishConfig

[wraithgar]

https://github.com/npm/cli/pull/8090

[wraithgar]

Remove url.parse from nopt

[wraithgar]

https://github.com/npm/cmd-shim/pull/164

[kapouer]

Remove url.parse from nopt

This is starting to be a problem, since node 24 complains about it - which in turns logs stuff and make some completely unrelated tests fail.