feat: use system npm bin by default

BREAKING CHANGE: dropped npm dependency

closes #200
closes #199

README.md

@@ -102,7 +102,7 @@ success Already up-to-date.
 |`--help/-h`| Print help message |
 |`--legacy-peer-deps` | Accept an incorrect (potentially broken) deps resolution |  | ✔
 |`--loglevel` | Set custom [log level](https://docs.npmjs.com/cli/v7/using-npm/config#loglevel) | | ✔
-|`--npm-path` | Define npm path: switch to system **npm** version instead of default package's own. Or provide a custom path. `system / local / <custom path>` | `local`
+|`--npm-path` | Switch to project's local **npm** version instead of system default. Or provide a custom path. `system / local / <custom path>` | `system`
 |`--only` | Set package [update scope](https://docs.npmjs.com/cli/v7/using-npm/config#only): `dev`/`prod`
 |`--package-lock-only` | Run audit fix without modifying `node_modules`. Highly recommended to **enable**. | `true` | ✔ |
 |`--registry` | Custom registry url | | ✔ |
@@ -162,6 +162,11 @@ await run({}, flow)
 ```
 
 ## Migration notes
+### ^8.0.0
+From v8 the library does not contain **npm** dependency, so the system default is used instead. If necessary you can:
+* Install the required npm version and provide a custom path via [CLI](#cli) / [ENV](#env) / [JS API](#js-api)
+* Use a pinch of **npx** magic: `npm_config_yes=true YAF_NPM_PATH=local npx -p yarn-audit-fix -p npm@8 -c yarn-audit-fix`
+
 ### ^7.0.0
 Following the deps, converted to ESM. So legacy `require` API has been dropped since v7.0.0. Use the shiny new `import` instead or try your luck with [esm-hook](https://www.npmjs.com/package/@qiwi/esm). CLI works as before.
 ```js

package.json

@@ -81,30 +81,30 @@
     "find-up": "^6.2.0",
     "globby": "^12.0.2",
     "lodash-es": "^4.17.21",
-    "npm": "8.1.4",
     "pkg-dir": "^6.0.1",
     "semver": "^7.3.5",
     "synp": "^1.9.8",
     "tslib": "^2.3.1"
   },
   "devDependencies": {
-    "@jest/globals": "^27.3.1",
+    "@jest/globals": "^27.4.2",
     "@qiwi/libdefkit": "^3.1.1",
     "@qiwi/npm-run-all": "^4.1.7",
     "@types/jest": "^27.0.3",
-    "@types/node": "^16.11.10",
+    "@types/node": "^16.11.11",
     "cpy-cli": "^3.1.1",
     "eslint": "^8.3.0",
     "eslint-config-prettier": "^8.3.0",
     "eslint-config-qiwi": "^1.15.2",
-    "jest": "^27.3.1",
+    "jest": "^27.4.3",
     "mkdirp": "^1.0.4",
     "prettier": "^2.5.0",
     "terser": "^5.10.0",
     "ts-jest": "^27.0.7",
     "tsc-esm-fix": "^2.7.4",
     "typedoc": "^0.22.10",
-    "typescript": "4.5.2"
+    "typescript": "4.5.2",
+    "npm": "^8.1.4"
   },
   "repository": {
     "type": "git",

src/main/ts/util.ts

@@ -130,7 +130,7 @@ export const getClosestBin = (cmd: string): string =>
     ),
   )
 
-export const getNpm = (npmPath = 'local', isWin = isWindows()): string => {
+export const getNpm = (npmPath = 'system', isWin = isWindows()): string => {
   const cmd = isWin ? 'npm.cmd' : 'npm'
 
   if (npmPath === 'system') {