chore: release 9.5.0

[github-actions]

🤖 I have created a release beep boop

9.5.0

9.5.0 (2023-02-14)

Features

• 79bfd03 #6153 audit signatures verifies attestations (@feelepxyz)
• 5fc6473 add provenance attestation (@bdehamer)

Bug Fixes

• 53f75a4 #6158 gracefully fallback from auth-type=web (fix: gracefully fallback from auth-type=web #6158) (@MylesBorins)
• ed59aae #6162 refactor error reporting in audit command (@bdehamer)

Dependencies

• fad0473 minipass@4.0.3
• 678c6bf minimatch@6.2.0
• 9b4b366 ci-info@3.8.0
• d20ee2a pacote@15.1.0
• Workspace: libnpmpublish@7.1.0
• Workspace: libnpmteam@5.0.3

libnpmpublish: 7.1.0

7.1.0 (2023-02-14)

Features

• 5fc6473 add provenance attestation (@bdehamer)

libnpmteam: 5.0.3

5.0.3 (2023-02-14)

Bug Fixes

• 11e6cc9 #6161 use npmFetch() instead of npmFetch.json() for team destroy command (fix: use npmFetch() instead of npmFetch.json() for team destroy command #6161) (@heisantosh)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Release Manager

Release workflow run: https://github.com/npm/cli/actions/runs/4177922633

Force CI to Update This Release

This PR will be updated and CI will run for every non-chore: commit that is pushed to latest. To force CI to update this PR, run this command:

gh workflow run release.yml -r latest -R npm/cli -f release-pr=6163

Release Checklist for v9.5.0

• 1. Checkout the release branch

  Ensure git status is not dirty on this branch after resetting deps. If it is, then something is probably wrong with the automated release process.

  gh pr checkout 6163 --force
  node . run resetdeps
  node scripts/git-dirty.js

• 2. Check CI status

  gh pr checks --watch

• 3. Publish the CLI

  Warning:
  This will publish all updated workspaces, and will publish the CLI with the dist-tag set to next-9.

  Note:
  The --test argument can optionally be omitted to run the publish process without running any tests locally.

  node scripts/publish.js --test

• 4. Optionally install and test npm@9.5.0 locally

  npm i -g npm@9.5.0
  npm --version
  npm whoami
  npm help install
  # etc

• 5. Set latest dist-tag to newly published version

  Warning:
  NOT FOR PRERELEASE: Do not run this step for prereleases or if 9 is not being set to latest.

  node . dist-tag add npm@9.5.0 latest

• 6. Trigger docs.npmjs.com update

  gh workflow run update-cli.yml --repo npm/documentation

• 7. Merge release PR

  gh pr merge --rebase
  git checkout latest
  git fetch
  git reset --hard origin/latest
  node . run resetdeps

• 8. Wait For Release Tags

  Warning:
  The remaining steps all require the GitHub tags and releases to be created first.

  Release Please will run on the just merged release commit and create GitHub releases and tags for each package. The release bot will will comment on this PR when the releases and tags are created.

  Note:
  The release workflow also includes the Node integration tests which do not need to finish before continuing.

  You can watch the release workflow in your terminal with the following command:

  gh run watch `gh run list -R npm/cli -w release -b latest -L 1 --json databaseId -q ".[0].databaseId"`
  

• 9. Open nodejs/node PR to update npm to latest

  Warning:
  You must wait for CI to create the release tags before running this step.

  Trigger the Create Node PR action. This will open a PR on nodejs/node to the main branch.

  Note:
  The resulting PR may need to be labelled if it is not intended to land on old Node versions.

  gh repo sync npm/node --source nodejs/node --force
  gh workflow run create-node-pr.yml -f spec=next-9

  If the PR should be opened on a different branch (such as when doing backports) then run it with -f branch=<BRANCH_NAME>. There is also a shortcut to target a specific Node version by specifying a major version number with -f branch=18 (or similar).

  # This will create a PR on nodejs/node to the `v18.x-staging` branch
  gh workflow run create-node-pr.yml -f spec=next-9 -f branch=18

• 10. Label and fast-track nodejs/node PR

  Note:
  This requires being a nodejs collaborator. Currently @lukekarrys is so ping them to do these steps!

  • Thumbs-up reaction on the Fast-track comment
  • Add an LGTM / Approval
  • Add request-ci label to get it running CI
  • Add commit-queue label once everything is green

[MylesBorins]

can we please make sure that #6158 is included in this release 🙏🏼

[wraithgar]

@MylesBorins it's listed right up there in the changelog.

[github-actions]

Release Workflow

• npm@9.5.0 https://github.com/npm/cli/releases/tag/v9.5.0
• libnpmpublish@7.1.0 https://github.com/npm/cli/releases/tag/libnpmpublish-v7.1.0
• libnpmteam@5.0.3 https://github.com/npm/cli/releases/tag/libnpmteam-v5.0.3
• Workflow run: ✅ https://github.com/npm/cli/actions/runs/4186112302