Update npm to v6.11.3 and pacote to v9.5.8.

History.md

@@ -24,9 +24,9 @@ N/A
 * Node has been updated to version
   [8.16.1](https://nodejs.org/en/blog/release/v8.16.1/).
 
-* The `npm` npm package has been updated to version 6.10.2, and our
-  [fork](https://github.com/meteor/pacote/tree/v9.5.4-meteor) of its
-  `pacote` dependency has been updated to version 9.5.4.
+* The `npm` npm package has been updated to version 6.11.3, and our
+  [fork](https://github.com/meteor/pacote/tree/v9.5.8-meteor) of its
+  `pacote` dependency has been updated to version 9.5.8.
 
 * When bundling client code, the Meteor module system now prefers the
   `"module"` field in `package.json`, if defined.

scripts/build-dev-bundle-common.sh

@@ -8,7 +8,7 @@ ARCH=$(uname -m)
 NODE_VERSION=8.16.1
 MONGO_VERSION_64BIT=4.0.6
 MONGO_VERSION_32BIT=3.2.22
-NPM_VERSION=6.10.2
+NPM_VERSION=6.11.3
 
 # If we built Node from source on Jenkins, this is the build number.
 NODE_BUILD_NUMBER=

scripts/dev-bundle-tool-package.js

@@ -10,8 +10,8 @@ var packageJson = {
   dependencies: {
     // Explicit dependency because we are replacing it with a bundled version
     // and we want to make sure there are no dependencies on a higher version
-    npm: "6.10.2",
-    pacote: "https://github.com/meteor/pacote/tarball/bdd1a189f71142c9eb87c4298784e2f17746a5d7",
+    npm: "6.11.3",
+    pacote: "https://github.com/meteor/pacote/tarball/00b3b094e6074e45fc221d5bd96419d07ea34c6a",
     "node-gyp": "5.0.1",
     "node-pre-gyp": "0.13.0",
     typescript: "3.5.3",