add package-lock modes to query and audit

[wraithgar]

• feat: add package-lock-only mode to npm query
• feat: add no-package-lock mode to npm audit

[wraithgar]

Folks have been asking for this for a LONG time (the audit feature), this should definitely be backported to npm 9.

[npm-cli-bot]

found 18 benchmarks with statistically significant performance improvements

• app-large: clean, lock-only, cache-only, cache-only:peer-deps, modules-only, no-lock, no-cache, no-modules, no-clean, no-clean:audit
• app-medium: cache-only, cache-only:peer-deps, modules-only, no-lock, no-cache, no-modules, no-clean, no-clean:audit

timing results

app-large	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit	show-version	run-script
npm@9	35.348 ±2.17	18.932 ±0.13	18.377 ±0.17	21.134 ±0.98	2.949 ±0.14	2.844 ±0.04	2.424 ±0.07	12.404 ±0.15	2.383 ±0.02	3.518 ±0.15	0.420 ±0.01	0.465 ±0.01
#6732	0.100 ±0.00	0.103 ±0.01	0.100 ±0.00	0.100 ±0.00	0.103 ±0.00	0.109 ±0.01	0.102 ±0.00	0.102 ±0.00	0.106 ±0.01	0.103 ±0.00	0.412 ±0.00	0.462 ±0.01

app-medium	clean	lock-only	cache-only	cache-only peer-deps	modules-only	no-lock	no-cache	no-modules	no-clean	no-clean audit	show-version	run-script
npm@9	24.474 ±1.27	14.102 ±0.08	13.704 ±0.01	14.704 ±0.08	2.567 ±0.02	2.565 ±0.00	2.346 ±0.02	9.200 ±0.03	2.213 ±0.02	3.159 ±0.10	0.417 ±0.01	0.469 ±0.00
#6732	N/A	N/A	0.102 ±0.00	0.104 ±0.00	0.101 ±0.00	0.104 ±0.00	0.102 ±0.00	0.104 ±0.00	0.102 ±0.00	0.103 ±0.00	0.413 ±0.01	0.456 ±0.00

[bdehamer]

For the query command, I noticed that you added the loadVirtual support to the exec function, but not the execWorkspaces function. Was that an oversight, or does the --package-lock-only option not work when using workspaces?

[wraithgar]

That's an oversight. A lot of other commands' execWorkspaces just iterate workspaces and call exec directly. I'll update.

[wraithgar]

Workspaces mode for npm query does not work as expected to begin with and I think adding this mode there gives a false sense of it working. Fixing npm query for workspace mode should be a separate PR.

[lorand-horvath]

NICE !

[ljharb]

Thanks for this; I've now end-of-lifed https://npmjs.com/aud since it's no longer needed.