Volta: Handle `notion install npm` correctly

[mikrostew]

After https://github.com/notion-cli/notion/pull/247, it is almost possible to notion install npm, but it works a little differently than package install. It should be installed as part of the platform, i.e. in ~/.notion/tools/image/node/<node-version>/<npm-version>/, instead of as a stand-alone package.

[rwjblue]

FWIW, I ran into an issue because this isn't present. Specifically, if the default npm that is included with a node version is broken in some way (for example Node 12.1.0's npm had issues with npm whoami which is a common validation to run before publishing) the user has _basically_ no recourse but to deactivate or change node versions.

[buschtoens]

I can only reiterate @rwjblue's point. I use np to publish most of my packages, which requires npm@^6.8.0. Unfortunately node@8 only comes with [email protected].

Putting these here as search keywords:

$ volta pin npm@^6.8.0
error: Pinning npm is not supported yet.
$ volta install npm@^6.8.0
error: Installing npm is not supported yet.

[skarger]

I wanted to chime in on this: on Dec. 11 there was a vulnerability announcment for npm, with a fix provided by v6.13.4: https://twitter.com/npmjs/status/1204931230459813889.

Because volta bundles a specific npm version when installing node, I can't update npm itself to remove the vulnerability.

$ volta --version
0.6.8

$ volta install node
success: installed and set [email protected] (with [email protected]) as default

$ npm install -g npm@latest
Volta error: Global package installs are not supported.

Use `volta install npm@latest` to add a package to your toolchain (see `volta help install` for more info).

$ volta install npm@latest
error: Installing npm is not supported yet.

Now I could remove the npm executable volta creates, and install npm separately. That's not an ideal solution though, because I'd rather not put my volta installation into a weird state.

$ which npm
/Users/skarger/.volta/bin/npm

Do you have any suggestions?

[charlespierce]

@skarger This is definitely a big issue and unfortunately there's not a clean solution at the moment. We have an RFC for supporting npm here: https://github.com/volta-cli/rfcs/pull/40, and due to this the implementation of that RFC has definitely jumped to the top of the priority list.

In the interim there are a couple of workarounds: First is that it appears Node will be publishing updated releases of all LTS versions which include the fixed npm, so once those are available you can upgrade to the latest of whichever major Node version you are using. The other would be, as you suggested, to rename the npm shim to something else, and install npm separately. That's not ideal, but if you rename the shim then you should be able to undo the change easily by renaming it back to npm later.

[charlespierce]

To be more specific, Node announced that the new versions will be available on this coming Tuesday, the 17th.