Stop using process.umask()

[bnoordhuis]

Refs: nodejs/node#32321

Summary: process.umask() (no args) will be deprecated and removed.

I couldn't quite divine what lib/config/defaults.js uses process.umask() for but in most cases you don't need to deal with the umask directly - the operating system will apply it automatically.

Example:

const mode = 0o777 & ~process.umask();
fs.mkdirSync(dir, mode);

Computing the file mode that way is superfluous, it can be replaced with just this:

fs.mkdirSync(dir, 0o777);

[isaacs]

The umask argument defaults to process.umask(). This is passed to pacote, bin-links, and node-tar, which use it to determine the appropriate modes for files and folders in unpacked packages.

For pacote and bin-links, we can default it to 0, since as you say, the process will enforce its own by default. But for node-tar, it's a bit more tricky, as being able to read the default umask allows us to skip a lot of unnecessary stat and chmod calls.

Once the dependencies are no longer using it, we can remove the process.umask() calls from the npm cli without any problem, and just set 0 as the default.

[isaacs]

One extremely hacky solution we could use to make things work for older npm clients where we might not want to do all the work to unwind old deps depending on process.umask() is just shim it at the start of the CLI process if it's not present.

if (typeof process.umask !== 'function')
  process.umask = () => 0o22

Would mean that debian users don't get group-writable files, but safer than accidentally creating world-writable bins, and better than crashing entirely.