feat: drop node 10, 11, and programmatic api

[wraithgar]

BREAKING CHANGE: This will drop official support for node versions less
than v12. It also removes the main export as something that will
work, effectively dropping a supported programmatic api via
require('npm')

Dependency changes are all updates to get on the latest node-gyp, and while making that change sync those packages' engines/ci environments with this one. No functional changes.

[wraithgar]

This is an exploratory PR to test CI, discuss if we are ready for this, and start giving people a heads up that this is on our radar.

[ljharb]

Please do give me as much of a heads up as possible before npm 8 being released and marked as latest, so i can update nvm install-latest-npm :-)

[ljharb]

you could also just remove the . section entirely, and modern node will error on require('npm').

[wraithgar]

This way the error shows that it's intentional, and explains when it was dropped.

[ljharb]

Conditional exports weren't added until 12.17, and pattern trailers 12.20; imports was added in 12.19 - in case you want to raise the threshold farther.

[wraithgar]

I think "when that version entered LTS" is the least distruptive and easiest to argue for.

[isaacs]

It seems like we can make the patch a lot smaller by doing something like this

So we wouldn't have to update CI or break the habit of typing node . in the npm project, but require("npm") would still produce the desired explosion.

$ node . --version
7.23.0

$ node -e 'require("./")'
/Users/isaacs/dev/npm/cli/index.js:4
  throw new Error('The programmatic API was removed in npm v8.0.0')
  ^

Error: The programmatic API was removed in npm v8.0.0
    at Object.<anonymous> (/Users/isaacs/dev/npm/cli/index.js:4:9)
    at Module._compile (node:internal/modules/cjs/loader:1095:14)
    at Object.Module._extensions..js (node:internal/modules/cjs/loader:1124:10)
    at Module.load (node:internal/modules/cjs/loader:975:32)
    at Function.Module._load (node:internal/modules/cjs/loader:816:12)
    at Module.require (node:internal/modules/cjs/loader:999:19)
    at require (node:internal/modules/cjs/helpers:93:18)
    at [eval]:1:1
    at Script.runInThisContext (node:vm:129:12)
    at Object.runInThisContext (node:vm:305:38)

[wraithgar]

I still like the idea of leaving the ci changes in there to be extremely explicit

[isaacs]

altho to be fair, the fork should be that "bin" points to the CLI and "main" only points to the programmatic API, rather than using require.main :-)

For external users, sure. But node . <args> is really handy while developing the npm cli.

[fritzy]

I read through the diff, then I ran and explored it locally. I asked questions in slack.

LGTM

[sancarn]

Out of curiosity, why was the API dropped?

[ljharb]

@sancarn ftr, it hasn't worked reliably nor been supported (or under semver) since npm 2 or 3.

[wraithgar]

We are also going to be refactoring and cleaning up npm's internals. Dropping the api support allows us to do this iteratively instead of trying to cram it all into a single semver major release.

cf #3959

[relu91]

@sancarn ftr, it hasn't worked reliably nor been supported (or under semver) since npm 2 or 3.

Well as far as I can tell it worked...(maybe it wasn't a bug but a feature? 😄 ). Also, considering that there are at least 35 packages that are depending on npm API (see global-npm dependents is there any chance that we can have the programmatic API back? Or do you have any suggestions for workarounds? is the child_process.exec() function an option?