[BUG] npm checks for new version when nobody asks for it

[jkufner]

What / Why

   ╭────────────────────────────────────────────────────────────────╮
   │                                                                │
   │       New minor version of npm available! 6.9.0 → 6.14.2       │
   │   Changelog: https://github.com/npm/cli/releases/tag/v6.14.2   │
   │               Run npm install -g npm to update!                │
   │                                                                │
   ╰────────────────────────────────────────────────────────────────╯

NPM is not supposed to check for a new version. It leaks information about my system to a third-party services and wastes my time by connecting who knows where.

Keeping software up-to-date is job for distribution's package manager and npm cannot upgrade itself because it is installed by admin. Therefore, this entire anti-feature is complete annoying waste of time.

Please remove it.

When

Random.

Where

Anytime when running npm from command line.

How

Current Behavior

npm checks for updates.

Steps to Reproduce

Run npm.

Expected Behavior

npm should do what it is asked to do and nothing more. Especially it should not communicate when not asked to communicate.

Who

• n/a

References

• n/a

[DanielRuf]

NPM is not supposed to check for a new version. It leaks information about my system to a third-party services and wastes my time by connecting who knows where.

It always sends anonymous usage data to npmjs.

Keeping software up-to-date is job for distribution's package manager and npm cannot upgrade itself because it is installed by admin. Therefore, this entire anti-feature is complete annoying waste of time.

Not really, new updates fix bugs and vulnerabilities (like https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/).

If you want to disable it see https://stackoverflow.com/a/60525400/753676
npm config set update-notifier false

But this is a bad idea.

[darcyclarke]

npm v6 is no longer in active development; We will continue to push security releases to v6 at our team's discretion as-per our Support Policy.

If your bug is preproducible on v7, please re-file this issue using our new issue template.

If your issue was a feature request, please consider opening a new RRFC or RFC. If your issue was a question or other idea that was not CLI-specific, consider opening a discussion on our feedback repo

Closing: This is an automated message.