@olore some pointers wrt your remaining items, in case it helps:

3. This is super straightforward to do if you use cacache directly. Something like:

const cacache = require('cacache')
const cache = path.join(npm.config.get('cache'), '_cacache') // I know, it's weird. It'll be better soon.

// writing
cacache.put(cache, 'update-notifier:last-check', Date.toUTCString()).then(....)

// reading
cacache.get(cache, 'update-notifier:last-check').then(time => {
  console.log('last check time was', new Date(time.toString('utf8')))
})

4. Just npm rm update-notifier && git add -A package* node_modules && git commit-m 'update-notifier@REMOVED' and you're all set. It'll remove it from bundleDeps and take care of everything for you.

5. I think it's fine to keep the boxen dependency. It'll still be a net loss in package size since it was already there. I have no beef with boxen itself.

Thanks @zkat ! This will definitely help.

4. When I run uninstall there are no changes made to package.json, or anything that I can add/rm/commit

$ npm uninstall update-notifier
npm WARN npm@6.4.0 Non-dependency in bundleDependencies: update-notifier

audited 7968 packages in 8.778s
found 0 vulnerabilities

$ git st
On branch remove-update-notifier
Your branch is up to date with 'olore/remove-update-notifier'.

nothing to commit, working tree clean

I feel like I am just missing something simple 😃

I think I got everything, it's ready for review.

I still don't think I properly removed update-notifier (it's still in node_modules). Any pointers are appreciated.

Would it be possible to have a way to make sure that this doesn't get run, similar to how the --no-update-notifier flag or the NO_UPDATE_NOTIFIER env var can be used today?

@ewanharris - yes the previous flag is still supported

I don't know how to successfully complete the final task (I created for myself!)
Is it possible this gets taken care of by the build?

If so, this should be good to go. Let me know if there is anything else to do here.

Hey, sorry for taking so long to get back to this.

I have one last request: Can you write a basic test for this? I realize it's gotten big enough that I'm anxious about merging without at least a basic stability check.

@zkat yes I will see what I can do. Back when I started this, I was looking for any tests in this area and came up empty. I'll give it another look. Thanks.

@olore we're going to address this in npm@7.x. Our initial thought is to gut that dep out of the cli. We're really focused on performance in npm@7.x, and this seems like some great low hanging fruit!

@olore sorry for the very long wait here for any updates. We're going to review how we approach this prompt in the next ~month & so I'm going to closing this PR for not but will be reference your work in a net-new issue: #1592

@darcyclarke it's all good! Thanks for the link to the new issue