From af51b8160ce443e0bf46b9a801cb2068eaf85a21 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Fri, 4 Nov 2016 16:34:51 -0400
Subject: [PATCH 01/16] Use absolute paths for external symlinks in
 Builder#copyDirectory.

Thanks to @worldsayshi for reporting this issue with a reproduction.

Fixes #8005.
Fixes #2876.
Fixes #7154.
---
 tools/isobuild/builder.js | 63 +++++++++++++++++++++++++++++++++++----
 1 file changed, 57 insertions(+), 6 deletions(-)

diff --git a/tools/isobuild/builder.js b/tools/isobuild/builder.js
index a864ba6f9f..df753e93b0 100644
--- a/tools/isobuild/builder.js
+++ b/tools/isobuild/builder.js
@@ -1,3 +1,4 @@
+import assert from "assert";
 import {WatchSet, readAndWatchFile, sha1} from '../fs/watch.js';
 import files from '../fs/files.js';
 import NpmDiscards from './npm-discards.js';
@@ -65,6 +66,8 @@ export default class Builder {
     this.writtenHashes = {};
     this.previousWrittenHashes = {};
 
+    this._realpathCache = Object.create(null);
+
     // foo/bar => foo/.build1234.bar
     // Should we include a random number? The advantage is that multiple
     // builds can run in parallel. The disadvantage is that stale build
@@ -443,7 +446,11 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
       });
     }
 
-    let walk = (absFrom, relTo) => {
+    const walk = (
+      absFrom,
+      relTo,
+      _currentRealRootDir = absFrom
+    ) => {
       if (symlink && ! (relTo in this.usedAsFile)) {
         this._ensureDirectory(files.pathDirname(relTo));
         const absTo = files.pathResolve(this.buildPath, relTo);
@@ -454,14 +461,55 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
       this._ensureDirectory(relTo);
 
       optimisticReaddir(absFrom).forEach(item => {
-        const thisAbsFrom = files.pathResolve(absFrom, item);
+        let thisAbsFrom = files.pathResolve(absFrom, item);
         const thisRelTo = files.pathJoin(relTo, item);
 
         if (specificPaths && !(thisRelTo in specificPaths)) {
           return;
         }
 
-        const fileStatus = optimisticLStat(thisAbsFrom);
+        // Returns files.realpath(thisAbsFrom), iff it is external to
+        // _currentRealRootDir, using caching because this function might
+        // be called more than once.
+        let cachedExternalPath;
+        const getExternalPath = () => {
+          if (typeof cachedExternalPath !== "undefined") {
+            return cachedExternalPath;
+          }
+
+          const real = files.realpath(thisAbsFrom, this._realpathCache);
+          const isExternal =
+            files.pathRelative(_currentRealRootDir, real).startsWith("..");
+
+          // Now cachedExternalPath is either a string or false.
+          return cachedExternalPath = isExternal && real;
+        };
+
+        let fileStatus = optimisticLStat(thisAbsFrom);
+
+        if (! symlink && fileStatus.isSymbolicLink()) {
+          // If copyDirectory is not allowed to create symbolic links to
+          // external files, and this file is a symbolic link that points
+          // to an external file, update fileStatus so that we copy this
+          // file as a normal file rather than as a symbolic link.
+
+          const externalPath = getExternalPath();
+          if (externalPath) {
+            // Copy from the real path rather than the link path.
+            thisAbsFrom = externalPath;
+
+            // Update fileStatus to match the actual file rather than the
+            // symbolic link, thus forcing the file to be copied below.
+            fileStatus = optimisticLStat(externalPath);
+
+            if (fileStatus.isDirectory()) {
+              // Update _currentRealRootDir so that we can judge
+              // isExternal relative to this new root directory when
+              // traversing nested directories.
+              _currentRealRootDir = externalPath;
+            }
+          }
+        }
 
         let itemForMatch = item;
         const isDirectory = fileStatus.isDirectory();
@@ -482,12 +530,15 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
         if (isDirectory) {
           if (typeof directoryFilter !== "function" ||
               directoryFilter(thisAbsFrom)) {
-            walk(thisAbsFrom, thisRelTo);
+            walk(thisAbsFrom, thisRelTo, _currentRealRootDir);
           }
 
         } else if (fileStatus.isSymbolicLink()) {
           symlinkWithOverwrite(
-            files.readlink(thisAbsFrom),
+            // Symbolic links pointing to relative external paths are less
+            // portable than absolute links, so getExternalPath() is
+            // preferred if it returns a path.
+            getExternalPath() || files.readlink(thisAbsFrom),
             files.pathResolve(this.buildPath, thisRelTo)
           );
 
@@ -518,7 +569,7 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
       });
     };
 
-    walk(from, to);
+    walk(files.realpath(from, this._realpathCache), to);
   }
 
   // Returns a new Builder-compatible object that works just like a

From 7f35e947134f89f6fcaed9c2dab091bdb57339d2 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Fri, 4 Nov 2016 18:14:09 -0400
Subject: [PATCH 02/16] Tolerate files.realpath throwing ENOENT exceptions.

---
 tools/isobuild/builder.js | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/tools/isobuild/builder.js b/tools/isobuild/builder.js
index df753e93b0..33c16bb8e9 100644
--- a/tools/isobuild/builder.js
+++ b/tools/isobuild/builder.js
@@ -477,7 +477,16 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
             return cachedExternalPath;
           }
 
-          const real = files.realpath(thisAbsFrom, this._realpathCache);
+          try {
+            var real = files.realpath(
+              thisAbsFrom,
+              this._realpathCache
+            );
+          } catch (e) {
+            if (e.code !== "ENOENT") throw e;
+            return cachedExternalPath = false;
+          }
+
           const isExternal =
             files.pathRelative(_currentRealRootDir, real).startsWith("..");
 

From 52697c71676356c7b2aac898721839c99ec3444d Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Fri, 4 Nov 2016 18:25:00 -0400
Subject: [PATCH 03/16] Cache getProdPackageNames optimistically.

---
 tools/isobuild/meteor-npm.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tools/isobuild/meteor-npm.js b/tools/isobuild/meteor-npm.js
index 71451e0a1c..90bd3ef028 100644
--- a/tools/isobuild/meteor-npm.js
+++ b/tools/isobuild/meteor-npm.js
@@ -22,6 +22,7 @@ import {
   convert as convertColonsInPath
 } from "../utils/colon-converter.js";
 
+import { wrap as wrapOptimistic } from "optimism";
 import {
   dirtyNodeModulesDirectory,
   optimisticLStat,
@@ -133,7 +134,7 @@ meteorNpm.updateDependencies = function (packageName,
 
 // Returns a flattened dictionary of npm package names used in production,
 // or false if there is no package.json file in the parent directory.
-export function getProdPackageNames(nodeModulesDir) {
+export const getProdPackageNames = wrapOptimistic(nodeModulesDir => {
   const names = Object.create(null);
   const dirs = Object.create(null);
   const nodeModulesDirStack = [];
@@ -208,7 +209,7 @@ export function getProdPackageNames(nodeModulesDir) {
   // Concretely, this means your app needs to have a package.json file if
   // you want any npm packages to be excluded in production.
   return walk(files.pathDirname(nodeModulesDir)) && names;
-}
+});
 
 const lastRebuildJSONFilename = ".meteor-last-rebuild-version.json";
 

From ad460e0d7d3cd0ad43075fefcc4f542af069b198 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Fri, 4 Nov 2016 18:45:29 -0400
Subject: [PATCH 04/16] Tolerate files.realpath throwing ELOOP exceptions.

---
 tools/isobuild/builder.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/isobuild/builder.js b/tools/isobuild/builder.js
index 33c16bb8e9..8136e3d2fd 100644
--- a/tools/isobuild/builder.js
+++ b/tools/isobuild/builder.js
@@ -483,7 +483,10 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
               this._realpathCache
             );
           } catch (e) {
-            if (e.code !== "ENOENT") throw e;
+            if (e.code !== "ENOENT" &&
+                e.code !== "ELOOP") {
+              throw e;
+            }
             return cachedExternalPath = false;
           }
 

From 6ce7891d9bed3badd82c3a8c5a8515a800a82eff Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Fri, 4 Nov 2016 18:41:01 -0400
Subject: [PATCH 05/16] Bump package versions for 1.4.2.1-rc.1 release.

---
 packages/accounts-oauth/package.js             | 2 +-
 packages/accounts-password/package.js          | 2 +-
 packages/babel-runtime/package.js              | 2 +-
 packages/caching-compiler/package.js           | 2 +-
 packages/coffeescript/package.js               | 2 +-
 packages/ddp-common/package.js                 | 2 +-
 packages/ddp-server/package.js                 | 2 +-
 packages/less/package.js                       | 2 +-
 packages/meteor-tool/package.js                | 2 +-
 packages/stylus/package.js                     | 2 +-
 scripts/admin/meteor-release-experimental.json | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/packages/accounts-oauth/package.js b/packages/accounts-oauth/package.js
index 184ecb8a8b..140ce0a4cd 100644
--- a/packages/accounts-oauth/package.js
+++ b/packages/accounts-oauth/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Common code for OAuth-based login services",
-  version: "1.1.15-rc.0"
+  version: "1.1.15-rc.1"
 });
 
 Package.onUse(function (api) {
diff --git a/packages/accounts-password/package.js b/packages/accounts-password/package.js
index 9a4f9a593b..bf2ac35c63 100644
--- a/packages/accounts-password/package.js
+++ b/packages/accounts-password/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Password support for accounts",
-  version: "1.3.2-rc.0"
+  version: "1.3.2-rc.1"
 });
 
 Package.onUse(function(api) {
diff --git a/packages/babel-runtime/package.js b/packages/babel-runtime/package.js
index 31df3ec5e3..d58d1c4c6b 100644
--- a/packages/babel-runtime/package.js
+++ b/packages/babel-runtime/package.js
@@ -1,7 +1,7 @@
 Package.describe({
   name: "babel-runtime",
   summary: "Runtime support for output of Babel transpiler",
-  version: '1.0.0-rc.0',
+  version: '1.0.0-rc.1',
   documentation: 'README.md'
 });
 
diff --git a/packages/caching-compiler/package.js b/packages/caching-compiler/package.js
index 78abb3c474..2cf9ddc115 100644
--- a/packages/caching-compiler/package.js
+++ b/packages/caching-compiler/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   name: 'caching-compiler',
-  version: '1.1.9-rc.0',
+  version: '1.1.9-rc.1',
   summary: 'An easy way to make compiler plugins cache',
   documentation: 'README.md'
 });
diff --git a/packages/coffeescript/package.js b/packages/coffeescript/package.js
index c4c6a4f7a2..dbbd90b258 100644
--- a/packages/coffeescript/package.js
+++ b/packages/coffeescript/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Javascript dialect with fewer braces and semicolons",
-  version: "1.11.1-3-rc.0"
+  version: "1.11.1-3-rc.1"
 });
 
 Package.registerBuildPlugin({
diff --git a/packages/ddp-common/package.js b/packages/ddp-common/package.js
index d167e4c623..1e711aea8f 100644
--- a/packages/ddp-common/package.js
+++ b/packages/ddp-common/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Code shared beween ddp-client and ddp-server",
-  version: '1.2.8-rc.0',
+  version: '1.2.8-rc.1',
   documentation: null
 });
 
diff --git a/packages/ddp-server/package.js b/packages/ddp-server/package.js
index 40e65bb6bb..35c691e56a 100644
--- a/packages/ddp-server/package.js
+++ b/packages/ddp-server/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Meteor's latency-compensated distributed data server",
-  version: '1.3.12-rc.0',
+  version: '1.3.12-rc.1',
   documentation: null
 });
 
diff --git a/packages/less/package.js b/packages/less/package.js
index f12e82dbee..168aaa2448 100644
--- a/packages/less/package.js
+++ b/packages/less/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   name: 'less',
-  version: '2.7.7-rc.0',
+  version: '2.7.7-rc.1',
   summary: 'Leaner CSS language',
   documentation: 'README.md'
 });
diff --git a/packages/meteor-tool/package.js b/packages/meteor-tool/package.js
index 071a89cffd..8fa61dfc30 100644
--- a/packages/meteor-tool/package.js
+++ b/packages/meteor-tool/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "The Meteor command-line tool",
-  version: '1.4.2-1-rc.0'
+  version: '1.4.2-1-rc.1'
 });
 
 Package.includeTool();
diff --git a/packages/stylus/package.js b/packages/stylus/package.js
index a5d296621f..33176db063 100644
--- a/packages/stylus/package.js
+++ b/packages/stylus/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: 'Expressive, dynamic, robust CSS',
-  version: "2.513.7-rc.0"
+  version: "2.513.7-rc.1"
 });
 
 Package.registerBuildPlugin({
diff --git a/scripts/admin/meteor-release-experimental.json b/scripts/admin/meteor-release-experimental.json
index 895b657dd8..d95555ff74 100644
--- a/scripts/admin/meteor-release-experimental.json
+++ b/scripts/admin/meteor-release-experimental.json
@@ -1,6 +1,6 @@
 {
  "track": "METEOR",
- "version": "1.4.2.1-rc.0",
+ "version": "1.4.2.1-rc.1",
  "recommended": false,
  "official": false,
  "description": "Meteor"

From a7ac32e00a87384956fdf65dfdf2198c98d73d6f Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 13:33:20 -0500
Subject: [PATCH 06/16] Tolerate ENOENT errors in Builder#copyDirectory.

---
 tools/fs/optimistic.js    |  8 ++++++++
 tools/isobuild/builder.js | 17 ++++++++++++-----
 2 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/tools/fs/optimistic.js b/tools/fs/optimistic.js
index 687016366f..74290628a2 100644
--- a/tools/fs/optimistic.js
+++ b/tools/fs/optimistic.js
@@ -174,6 +174,14 @@ export function dirtyNodeModulesDirectory(nodeModulesDir) {
 
 export const optimisticStatOrNull = makeOptimistic("statOrNull", statOrNull);
 export const optimisticLStat = makeOptimistic("lstat", lstat);
+export const optimisticLStatOrNull = makeOptimistic("lstatOrNull", path => {
+  try {
+    return optimisticLStat(path);
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+    return null;
+  }
+});
 export const optimisticReadFile = makeOptimistic("readFile", readFile);
 export const optimisticReaddir = makeOptimistic("readdir", readdir);
 export const optimisticHashOrNull = makeOptimistic("hashOrNull", (...args) => {
diff --git a/tools/isobuild/builder.js b/tools/isobuild/builder.js
index 8136e3d2fd..f964f2a671 100644
--- a/tools/isobuild/builder.js
+++ b/tools/isobuild/builder.js
@@ -6,7 +6,7 @@ import {Profile} from '../tool-env/profile.js';
 import {
   optimisticReadFile,
   optimisticReaddir,
-  optimisticLStat,
+  optimisticLStatOrNull,
 } from "../fs/optimistic.js";
 
 // Builder is in charge of writing "bundles" to disk, which are
@@ -497,9 +497,11 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
           return cachedExternalPath = isExternal && real;
         };
 
-        let fileStatus = optimisticLStat(thisAbsFrom);
+        let fileStatus = optimisticLStatOrNull(thisAbsFrom);
 
-        if (! symlink && fileStatus.isSymbolicLink()) {
+        if (! symlink &&
+            fileStatus &&
+            fileStatus.isSymbolicLink()) {
           // If copyDirectory is not allowed to create symbolic links to
           // external files, and this file is a symbolic link that points
           // to an external file, update fileStatus so that we copy this
@@ -512,9 +514,9 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
 
             // Update fileStatus to match the actual file rather than the
             // symbolic link, thus forcing the file to be copied below.
-            fileStatus = optimisticLStat(externalPath);
+            fileStatus = optimisticLStatOrNull(externalPath);
 
-            if (fileStatus.isDirectory()) {
+            if (fileStatus && fileStatus.isDirectory()) {
               // Update _currentRealRootDir so that we can judge
               // isExternal relative to this new root directory when
               // traversing nested directories.
@@ -523,6 +525,11 @@ Previous builder: ${previousBuilder.outputPath}, this builder: ${outputPath}`
           }
         }
 
+        if (! fileStatus) {
+          // If the file did not exist, skip it.
+          return;
+        }
+
         let itemForMatch = item;
         const isDirectory = fileStatus.isDirectory();
         if (isDirectory) {

From a43d66991bb6c52e83dacf894a0eea8f26af8ea4 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 13:48:23 -0500
Subject: [PATCH 07/16] Allow watch.sha1 to accept multiple arguments.

---
 tools/fs/watch.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/fs/watch.js b/tools/fs/watch.js
index ded8d3c21e..0a930c545e 100644
--- a/tools/fs/watch.js
+++ b/tools/fs/watch.js
@@ -257,10 +257,10 @@ export function readFile(absPath) {
   }
 };
 
-export function sha1(contents) {
+export function sha1(...args) {
   return Profile("sha1", function () {
     var hash = createHash('sha1');
-    hash.update(contents);
+    args.forEach(arg => hash.update(arg));
     return hash.digest('hex');
   })();
 }

From 940cc4f4d63524bda6d591e2ec76f5d9cfbe4839 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 13:48:48 -0500
Subject: [PATCH 08/16] Add salt to File#hash in bundler.js.

This is what determines, among other things, source map URL names of the
form <hash>.map, so this may help to avoid #7977.
---
 tools/isobuild/bundler.js | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/tools/isobuild/bundler.js b/tools/isobuild/bundler.js
index 022550d6c9..d393918bd2 100644
--- a/tools/isobuild/bundler.js
+++ b/tools/isobuild/bundler.js
@@ -560,9 +560,17 @@ class File {
     return `File: [info=${this.info}]`;
   }
 
+  static _salt() {
+    // Increment this number to force rehashing.
+    return 1;
+  }
+
   hash() {
     if (! this._hash) {
-      this._hash = watch.sha1(this.contents());
+      this._hash = watch.sha1(
+        String(File._salt()),
+        this.contents(),
+      );
     }
     return this._hash;
   }

From 4ada5c8a17a6b4f36c4fb47158ea006e1d5dcb77 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 13:50:26 -0500
Subject: [PATCH 09/16] Bump LINKER_CACHE_SALT and compiler.BUILT_BY for good
 measure.

This will trigger recompilation and relinking, which should help prevent
various stale caching issues, e.g. #7977.
---
 tools/isobuild/compiler-plugin.js | 2 +-
 tools/isobuild/compiler.js        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/isobuild/compiler-plugin.js b/tools/isobuild/compiler-plugin.js
index c13be9eca7..8e493a3d22 100644
--- a/tools/isobuild/compiler-plugin.js
+++ b/tools/isobuild/compiler-plugin.js
@@ -62,7 +62,7 @@ import { isTestFilePath } from './test-files.js';
 // Cache the (slightly post-processed) results of linker.fullLink.
 const CACHE_SIZE = process.env.METEOR_LINKER_CACHE_SIZE || 1024*1024*100;
 const CACHE_DEBUG = !! process.env.METEOR_TEST_PRINT_LINKER_CACHE_DEBUG;
-const LINKER_CACHE_SALT = 11; // Increment this number to force relinking.
+const LINKER_CACHE_SALT = 12; // Increment this number to force relinking.
 const LINKER_CACHE = new LRU({
   max: CACHE_SIZE,
   // Cache is measured in bytes. We don't care about servePath.
diff --git a/tools/isobuild/compiler.js b/tools/isobuild/compiler.js
index 23afa1417e..3006b93896 100644
--- a/tools/isobuild/compiler.js
+++ b/tools/isobuild/compiler.js
@@ -34,7 +34,7 @@ var compiler = exports;
 // dependencies. (At least for now, packages only used in target creation (eg
 // minifiers) don't require you to update BUILT_BY, though you will need to quit
 // and rerun "meteor run".)
-compiler.BUILT_BY = 'meteor/24';
+compiler.BUILT_BY = 'meteor/25';
 
 // This is a list of all possible architectures that a build can target. (Client
 // is expanded into 'web.browser' and 'web.cordova')

From 932115120fb98cfe86a83647c5dc65af37614266 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 14:06:33 -0500
Subject: [PATCH 10/16] Don't let options.hash override File#hash() salting.

---
 tools/isobuild/bundler.js | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/tools/isobuild/bundler.js b/tools/isobuild/bundler.js
index d393918bd2..218de26b6e 100644
--- a/tools/isobuild/bundler.js
+++ b/tools/isobuild/bundler.js
@@ -553,7 +553,8 @@ class File {
     this.assets = null;
 
     this._contents = options.data || null; // contents, if known, as a Buffer
-    this._hash = options.hash || null; // hash, if known, as a hex string
+    this._hashOfContents = options.hash || null;
+    this._hash = null;
   }
 
   toString() {
@@ -567,11 +568,16 @@ class File {
 
   hash() {
     if (! this._hash) {
+      if (! this._hashOfContents) {
+        this._hashOfContents = watch.sha1(this.contents());
+      }
+
       this._hash = watch.sha1(
         String(File._salt()),
-        this.contents(),
+        this._hashOfContents,
       );
     }
+
     return this._hash;
   }
 
@@ -595,7 +601,7 @@ class File {
     }
     this._contents = b;
     // Un-cache hash.
-    this._hash = null;
+    this._hashOfContents = this._hash = null;
   }
 
   size() {

From 7abaa56b1a17f114129d3d600b8ecc9676618948 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 13:57:42 -0500
Subject: [PATCH 11/16] Bump package versions for 1.4.2.1-rc.2 release.

---
 packages/accounts-oauth/package.js             | 2 +-
 packages/accounts-password/package.js          | 2 +-
 packages/babel-runtime/package.js              | 2 +-
 packages/caching-compiler/package.js           | 2 +-
 packages/coffeescript/package.js               | 2 +-
 packages/ddp-common/package.js                 | 2 +-
 packages/ddp-server/package.js                 | 2 +-
 packages/less/package.js                       | 2 +-
 packages/meteor-tool/package.js                | 2 +-
 packages/stylus/package.js                     | 2 +-
 scripts/admin/meteor-release-experimental.json | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/packages/accounts-oauth/package.js b/packages/accounts-oauth/package.js
index 140ce0a4cd..fced2af9f4 100644
--- a/packages/accounts-oauth/package.js
+++ b/packages/accounts-oauth/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Common code for OAuth-based login services",
-  version: "1.1.15-rc.1"
+  version: "1.1.15-rc.2"
 });
 
 Package.onUse(function (api) {
diff --git a/packages/accounts-password/package.js b/packages/accounts-password/package.js
index bf2ac35c63..1eb3f415e8 100644
--- a/packages/accounts-password/package.js
+++ b/packages/accounts-password/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Password support for accounts",
-  version: "1.3.2-rc.1"
+  version: "1.3.2-rc.2"
 });
 
 Package.onUse(function(api) {
diff --git a/packages/babel-runtime/package.js b/packages/babel-runtime/package.js
index d58d1c4c6b..e416285c72 100644
--- a/packages/babel-runtime/package.js
+++ b/packages/babel-runtime/package.js
@@ -1,7 +1,7 @@
 Package.describe({
   name: "babel-runtime",
   summary: "Runtime support for output of Babel transpiler",
-  version: '1.0.0-rc.1',
+  version: '1.0.0-rc.2',
   documentation: 'README.md'
 });
 
diff --git a/packages/caching-compiler/package.js b/packages/caching-compiler/package.js
index 2cf9ddc115..cd65338167 100644
--- a/packages/caching-compiler/package.js
+++ b/packages/caching-compiler/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   name: 'caching-compiler',
-  version: '1.1.9-rc.1',
+  version: '1.1.9-rc.2',
   summary: 'An easy way to make compiler plugins cache',
   documentation: 'README.md'
 });
diff --git a/packages/coffeescript/package.js b/packages/coffeescript/package.js
index dbbd90b258..2e547a5658 100644
--- a/packages/coffeescript/package.js
+++ b/packages/coffeescript/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Javascript dialect with fewer braces and semicolons",
-  version: "1.11.1-3-rc.1"
+  version: "1.11.1-3-rc.2"
 });
 
 Package.registerBuildPlugin({
diff --git a/packages/ddp-common/package.js b/packages/ddp-common/package.js
index 1e711aea8f..6f4a8ddeac 100644
--- a/packages/ddp-common/package.js
+++ b/packages/ddp-common/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Code shared beween ddp-client and ddp-server",
-  version: '1.2.8-rc.1',
+  version: '1.2.8-rc.2',
   documentation: null
 });
 
diff --git a/packages/ddp-server/package.js b/packages/ddp-server/package.js
index 35c691e56a..c0d6948a2d 100644
--- a/packages/ddp-server/package.js
+++ b/packages/ddp-server/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Meteor's latency-compensated distributed data server",
-  version: '1.3.12-rc.1',
+  version: '1.3.12-rc.2',
   documentation: null
 });
 
diff --git a/packages/less/package.js b/packages/less/package.js
index 168aaa2448..ed13590342 100644
--- a/packages/less/package.js
+++ b/packages/less/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   name: 'less',
-  version: '2.7.7-rc.1',
+  version: '2.7.7-rc.2',
   summary: 'Leaner CSS language',
   documentation: 'README.md'
 });
diff --git a/packages/meteor-tool/package.js b/packages/meteor-tool/package.js
index 8fa61dfc30..97686a5f37 100644
--- a/packages/meteor-tool/package.js
+++ b/packages/meteor-tool/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "The Meteor command-line tool",
-  version: '1.4.2-1-rc.1'
+  version: '1.4.2-1-rc.2'
 });
 
 Package.includeTool();
diff --git a/packages/stylus/package.js b/packages/stylus/package.js
index 33176db063..38ad22140f 100644
--- a/packages/stylus/package.js
+++ b/packages/stylus/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: 'Expressive, dynamic, robust CSS',
-  version: "2.513.7-rc.1"
+  version: "2.513.7-rc.2"
 });
 
 Package.registerBuildPlugin({
diff --git a/scripts/admin/meteor-release-experimental.json b/scripts/admin/meteor-release-experimental.json
index d95555ff74..2f1bc59a03 100644
--- a/scripts/admin/meteor-release-experimental.json
+++ b/scripts/admin/meteor-release-experimental.json
@@ -1,6 +1,6 @@
 {
  "track": "METEOR",
- "version": "1.4.2.1-rc.1",
+ "version": "1.4.2.1-rc.2",
  "recommended": false,
  "official": false,
  "description": "Meteor"

From e1e3c89c6a940859a1dc1428f863a982dff2697b Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 14:32:29 -0500
Subject: [PATCH 12/16] Link to a few more fixed bugs in History.md.

---
 History.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/History.md b/History.md
index 5cca124c04..d2e4046baf 100644
--- a/History.md
+++ b/History.md
@@ -34,8 +34,11 @@
   [#7978](https://github.com/meteor/meteor/issues/7978)
 
 * Miscellaneous fixed bugs:
-  [#7974](https://github.com/meteor/meteor/issues/7974)
+  [#2876](https://github.com/meteor/meteor/issues/2876)
+  [#7154](https://github.com/meteor/meteor/issues/7154)
   [#7956](https://github.com/meteor/meteor/issues/7956)
+  [#7974](https://github.com/meteor/meteor/issues/7974)
+  [#8005](https://github.com/meteor/meteor/issues/8005)
   [#8007](https://github.com/meteor/meteor/issues/8007)
 
 ## v1.4.2

From 8f07a87bd554ad01aea7cd903d68a5216c7a3a27 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 15:22:43 -0500
Subject: [PATCH 13/16] Give package test modules access to Npm.depends
 dependencies.

Similar in spirit to bbac2725302cf820eddbfea8e3c550a42bdfcf89.

Fixes #7999.
---
 History.md                                             |  1 +
 tools/isobuild/import-scanner.js                       |  7 ++++++-
 tools/tests/apps/modules/package.json                  |  3 ++-
 .../modules/packages/modules-test-package/package.js   | 10 +++++++++-
 .../modules/packages/modules-test-package/tests.js     |  9 +++++++++
 5 files changed, 27 insertions(+), 3 deletions(-)
 create mode 100644 tools/tests/apps/modules/packages/modules-test-package/tests.js

diff --git a/History.md b/History.md
index d2e4046baf..b7472a6474 100644
--- a/History.md
+++ b/History.md
@@ -38,6 +38,7 @@
   [#7154](https://github.com/meteor/meteor/issues/7154)
   [#7956](https://github.com/meteor/meteor/issues/7956)
   [#7974](https://github.com/meteor/meteor/issues/7974)
+  [#7999](https://github.com/meteor/meteor/issues/7999)
   [#8005](https://github.com/meteor/meteor/issues/8005)
   [#8007](https://github.com/meteor/meteor/issues/8007)
 
diff --git a/tools/isobuild/import-scanner.js b/tools/isobuild/import-scanner.js
index 1649e37567..9f49737b27 100644
--- a/tools/isobuild/import-scanner.js
+++ b/tools/isobuild/import-scanner.js
@@ -648,7 +648,12 @@ export default class ImportScanner {
     if (this.name) {
       // If we're bundling a package, prefix path with
       // node_modules/<package name>/.
-      path = pathJoin("node_modules", "meteor", this.name, path);
+      path = pathJoin(
+        "node_modules",
+        "meteor",
+        this.name.replace(/^local-test[:_]/, ""),
+        path,
+      );
     }
 
     // Install paths should always be delimited by /.
diff --git a/tools/tests/apps/modules/package.json b/tools/tests/apps/modules/package.json
index 48935553db..8d2f07e96d 100644
--- a/tools/tests/apps/modules/package.json
+++ b/tools/tests/apps/modules/package.json
@@ -16,6 +16,7 @@
     "winston": "^2.2.0"
   },
   "scripts": {
-    "test": "METEOR_PROFILE=100 ../../../../meteor test --full-app --driver-package avital:mocha"
+    "test": "METEOR_PROFILE=100 ../../../../meteor test --full-app --driver-package avital:mocha",
+    "test-packages": "../../../../meteor test-packages --driver-package avital:mocha packages/modules-test-package"
   }
 }
diff --git a/tools/tests/apps/modules/packages/modules-test-package/package.js b/tools/tests/apps/modules/packages/modules-test-package/package.js
index efb8aba134..3e708129ad 100644
--- a/tools/tests/apps/modules/packages/modules-test-package/package.js
+++ b/tools/tests/apps/modules/packages/modules-test-package/package.js
@@ -7,7 +7,8 @@ Package.describe({
 
 Npm.depends({
   "os-browserify": "0.2.0",
-  "assert": "1.3.0"
+  "assert": "1.3.0",
+  "cheerio": "0.22.0"
 });
 
 Package.onUse(function(api) {
@@ -17,3 +18,10 @@ Package.onUse(function(api) {
   api.mainModule("server.js", "server");
   api.export("ModulesTestPackage");
 });
+
+Package.onTest(function (api) {
+  api.use("ecmascript");
+  api.use("tinytest");
+  api.use("modules-test-package");
+  api.mainModule("tests.js");
+});
diff --git a/tools/tests/apps/modules/packages/modules-test-package/tests.js b/tools/tests/apps/modules/packages/modules-test-package/tests.js
new file mode 100644
index 0000000000..67378a6352
--- /dev/null
+++ b/tools/tests/apps/modules/packages/modules-test-package/tests.js
@@ -0,0 +1,9 @@
+import assert from "assert";
+
+describe("cheerio", () => {
+  it("should be importable", () => {
+    import cheerio from "cheerio";
+    assert.strictEqual(typeof cheerio, "object");
+    assert.deepEqual(Object.keys(cheerio), ["cheerio"]);
+  });
+});

From 45b01ba8093ca207fe546a5db26f942cc3c5c188 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 15:42:56 -0500
Subject: [PATCH 14/16] Bump package versions for the official 1.4.2.1 release.

---
 packages/accounts-oauth/package.js         | 2 +-
 packages/accounts-password/package.js      | 2 +-
 packages/babel-runtime/package.js          | 2 +-
 packages/caching-compiler/package.js       | 2 +-
 packages/coffeescript/package.js           | 2 +-
 packages/ddp-common/package.js             | 2 +-
 packages/ddp-server/package.js             | 2 +-
 packages/less/package.js                   | 2 +-
 packages/meteor-tool/package.js            | 2 +-
 packages/stylus/package.js                 | 2 +-
 scripts/admin/meteor-release-official.json | 3 ++-
 11 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/packages/accounts-oauth/package.js b/packages/accounts-oauth/package.js
index fced2af9f4..41e5f9d9e4 100644
--- a/packages/accounts-oauth/package.js
+++ b/packages/accounts-oauth/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Common code for OAuth-based login services",
-  version: "1.1.15-rc.2"
+  version: "1.1.15"
 });
 
 Package.onUse(function (api) {
diff --git a/packages/accounts-password/package.js b/packages/accounts-password/package.js
index 1eb3f415e8..42bf1c7298 100644
--- a/packages/accounts-password/package.js
+++ b/packages/accounts-password/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Password support for accounts",
-  version: "1.3.2-rc.2"
+  version: "1.3.2"
 });
 
 Package.onUse(function(api) {
diff --git a/packages/babel-runtime/package.js b/packages/babel-runtime/package.js
index e416285c72..54b3b2db82 100644
--- a/packages/babel-runtime/package.js
+++ b/packages/babel-runtime/package.js
@@ -1,7 +1,7 @@
 Package.describe({
   name: "babel-runtime",
   summary: "Runtime support for output of Babel transpiler",
-  version: '1.0.0-rc.2',
+  version: '1.0.0',
   documentation: 'README.md'
 });
 
diff --git a/packages/caching-compiler/package.js b/packages/caching-compiler/package.js
index cd65338167..470e4d04be 100644
--- a/packages/caching-compiler/package.js
+++ b/packages/caching-compiler/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   name: 'caching-compiler',
-  version: '1.1.9-rc.2',
+  version: '1.1.9',
   summary: 'An easy way to make compiler plugins cache',
   documentation: 'README.md'
 });
diff --git a/packages/coffeescript/package.js b/packages/coffeescript/package.js
index 2e547a5658..22828ffe22 100644
--- a/packages/coffeescript/package.js
+++ b/packages/coffeescript/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Javascript dialect with fewer braces and semicolons",
-  version: "1.11.1-3-rc.2"
+  version: "1.11.1_3"
 });
 
 Package.registerBuildPlugin({
diff --git a/packages/ddp-common/package.js b/packages/ddp-common/package.js
index 6f4a8ddeac..42a831899b 100644
--- a/packages/ddp-common/package.js
+++ b/packages/ddp-common/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Code shared beween ddp-client and ddp-server",
-  version: '1.2.8-rc.2',
+  version: '1.2.8',
   documentation: null
 });
 
diff --git a/packages/ddp-server/package.js b/packages/ddp-server/package.js
index c0d6948a2d..99e29c6daf 100644
--- a/packages/ddp-server/package.js
+++ b/packages/ddp-server/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "Meteor's latency-compensated distributed data server",
-  version: '1.3.12-rc.2',
+  version: '1.3.12',
   documentation: null
 });
 
diff --git a/packages/less/package.js b/packages/less/package.js
index ed13590342..3111131fb2 100644
--- a/packages/less/package.js
+++ b/packages/less/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   name: 'less',
-  version: '2.7.7-rc.2',
+  version: '2.7.7',
   summary: 'Leaner CSS language',
   documentation: 'README.md'
 });
diff --git a/packages/meteor-tool/package.js b/packages/meteor-tool/package.js
index 97686a5f37..4ab26584dd 100644
--- a/packages/meteor-tool/package.js
+++ b/packages/meteor-tool/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: "The Meteor command-line tool",
-  version: '1.4.2-1-rc.2'
+  version: '1.4.2_1'
 });
 
 Package.includeTool();
diff --git a/packages/stylus/package.js b/packages/stylus/package.js
index 38ad22140f..89e0ed22a5 100644
--- a/packages/stylus/package.js
+++ b/packages/stylus/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   summary: 'Expressive, dynamic, robust CSS',
-  version: "2.513.7-rc.2"
+  version: "2.513.7"
 });
 
 Package.registerBuildPlugin({
diff --git a/scripts/admin/meteor-release-official.json b/scripts/admin/meteor-release-official.json
index 71219f1d08..0a21c31d02 100644
--- a/scripts/admin/meteor-release-official.json
+++ b/scripts/admin/meteor-release-official.json
@@ -1,6 +1,7 @@
 {
   "track": "METEOR",
-  "version": "1.4.2",
+  "version": "1.4.2.1",
+  "patchFrom": ["1.4.2"],
   "recommended": false,
   "official": true,
   "description": "The Official Meteor Distribution"

From 51bb575e0055205a4cd3ffd51afe2b4c558a7565 Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 17:38:18 -0500
Subject: [PATCH 15/16] Bump ecmascript version to 0.6.0 to republish.

Temporarily adding version constraints so that we can publish
independently from the Meteor release.
---
 packages/ecmascript/package.js | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/packages/ecmascript/package.js b/packages/ecmascript/package.js
index 1678e3063f..c6cb515e41 100644
--- a/packages/ecmascript/package.js
+++ b/packages/ecmascript/package.js
@@ -1,6 +1,6 @@
 Package.describe({
   name: 'ecmascript',
-  version: '0.5.9',
+  version: '0.6.0',
   summary: 'Compiler plugin that supports ES2015+ in all .js files',
   documentation: 'README.md'
 });
@@ -13,14 +13,14 @@ Package.registerBuildPlugin({
 
 Package.onUse(function (api) {
   api.use('isobuild:compiler-plugin@1.0.0');
-  api.use('babel-compiler');
+  api.use('babel-compiler@6.13.0');
 
   // The following api.imply calls should match those in
   // ../coffeescript/package.js.
-  api.imply('modules');
-  api.imply('ecmascript-runtime');
-  api.imply('babel-runtime');
-  api.imply('promise');
+  api.imply('modules@0.7.7');
+  api.imply('ecmascript-runtime@0.3.15');
+  api.imply('babel-runtime@1.0.0');
+  api.imply('promise@0.8.8');
 
   api.addFiles("ecmascript.js", "server");
   api.export("ECMAScript", "server");

From 2d8f187cc92d152a010a7862dc5fa2a677a6b5ea Mon Sep 17 00:00:00 2001
From: Ben Newman <ben@meteor.com>
Date: Tue, 8 Nov 2016 17:38:51 -0500
Subject: [PATCH 16/16] Remove version constraints from ecmascript/package.js.

These constraints are only helpful when publishing the package apart
from a Meteor release, and are hard to maintain otherwise.
---
 packages/ecmascript/package.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/packages/ecmascript/package.js b/packages/ecmascript/package.js
index c6cb515e41..4b4f0cdd87 100644
--- a/packages/ecmascript/package.js
+++ b/packages/ecmascript/package.js
@@ -13,14 +13,14 @@ Package.registerBuildPlugin({
 
 Package.onUse(function (api) {
   api.use('isobuild:compiler-plugin@1.0.0');
-  api.use('babel-compiler@6.13.0');
+  api.use('babel-compiler');
 
   // The following api.imply calls should match those in
   // ../coffeescript/package.js.
-  api.imply('modules@0.7.7');
-  api.imply('ecmascript-runtime@0.3.15');
-  api.imply('babel-runtime@1.0.0');
-  api.imply('promise@0.8.8');
+  api.imply('modules');
+  api.imply('ecmascript-runtime');
+  api.imply('babel-runtime');
+  api.imply('promise');
 
   api.addFiles("ecmascript.js", "server");
   api.export("ECMAScript", "server");