v10 deps updates

DEPENDENCIES.md

@@ -321,6 +321,7 @@ graph LR;
   isaacs-cliui-->strip-ansi;
   isaacs-cliui-->wrap-ansi-cjs;
   isaacs-cliui-->wrap-ansi;
+  isaacs-fs-minipass-->minipass;
   jackspeak-->isaacs-cliui["@isaacs/cliui"];
   jackspeak-->pkgjs-parseargs["@pkgjs/parseargs"];
   libnpmaccess-->nock;
@@ -766,6 +767,7 @@ graph LR;
   strip-ansi-->ansi-regex;
   tar-->chownr;
   tar-->fs-minipass;
+  tar-->isaacs-fs-minipass["@isaacs/fs-minipass"];
   tar-->minipass;
   tar-->minizlib;
   tar-->mkdirp;
@@ -799,9 +801,9 @@ packages higher up the chain.
  - @npmcli/arborist
  - @npmcli/metavuln-calculator
  - pacote, @npmcli/config, libnpmversion
- - @npmcli/run-script, @npmcli/map-workspaces, libnpmhook, libnpmorg, libnpmsearch, libnpmteam, init-package-json, npm-profile
+ - @npmcli/map-workspaces, @npmcli/run-script, libnpmhook, libnpmorg, libnpmsearch, libnpmteam, init-package-json, npm-profile
  - @npmcli/package-json, npm-registry-fetch
  - @npmcli/git, make-fetch-happen
- - npm-pick-manifest, @npmcli/installed-package-contents, cacache, promzard
- - @npmcli/docs, npm-package-arg, npm-install-checks, npm-bundled, normalize-package-data, @npmcli/fs, unique-filename, npm-packlist, @npmcli/mock-globals, bin-links, nopt, parse-conflict-json, read-package-json-fast, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/promise-spawn, ini, npm-normalize-package-bin, json-parse-even-better-errors, @npmcli/node-gyp, fs-minipass, ssri, unique-slug, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/name-from-folder, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate
+ - @npmcli/installed-package-contents, npm-pick-manifest, cacache, promzard
+ - @npmcli/docs, @npmcli/fs, npm-bundled, npm-install-checks, npm-package-arg, normalize-package-data, unique-filename, npm-packlist, bin-links, nopt, parse-conflict-json, read-package-json-fast, @npmcli/mock-globals, read
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, @npmcli/promise-spawn, ini, hosted-git-info, proc-log, validate-npm-package-name, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate

mock-registry/package.json

@@ -46,7 +46,7 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/arborist": "^7.1.0",
+    "@npmcli/arborist": "^8.0.0",
     "@npmcli/eslint-config": "^5.0.1",
     "@npmcli/template-oss": "4.23.3",
     "json-stringify-safe": "^5.0.1",

node_modules/.gitignore

@@ -22,6 +22,9 @@
 !/@npmcli/installed-package-contents
 !/@npmcli/map-workspaces
 !/@npmcli/metavuln-calculator
+!/@npmcli/metavuln-calculator/node_modules/
+/@npmcli/metavuln-calculator/node_modules/*
+!/@npmcli/metavuln-calculator/node_modules/pacote
 !/@npmcli/name-from-folder
 !/@npmcli/node-gyp
 !/@npmcli/package-json
@@ -34,29 +37,11 @@
 !/@pkgjs/parseargs
 !/@sigstore/
 /@sigstore/*
-!/@sigstore/bundle
-!/@sigstore/core
 !/@sigstore/protobuf-specs
-!/@sigstore/sign
-!/@sigstore/sign/node_modules/
-/@sigstore/sign/node_modules/*
-!/@sigstore/sign/node_modules/@npmcli/
-/@sigstore/sign/node_modules/@npmcli/*
-!/@sigstore/sign/node_modules/@npmcli/agent
-!/@sigstore/sign/node_modules/@npmcli/fs
-!/@sigstore/sign/node_modules/cacache
-!/@sigstore/sign/node_modules/make-fetch-happen
-!/@sigstore/sign/node_modules/minipass-fetch
-!/@sigstore/sign/node_modules/proc-log
-!/@sigstore/sign/node_modules/ssri
-!/@sigstore/sign/node_modules/unique-filename
-!/@sigstore/sign/node_modules/unique-slug
 !/@sigstore/tuf
-!/@sigstore/verify
 !/@tufjs/
 /@tufjs/*
 !/@tufjs/canonical-json
-!/@tufjs/models
 !/abbrev
 !/agent-base
 !/aggregate-error
@@ -93,9 +78,6 @@
 !/cross-spawn/node_modules/which
 !/cssesc
 !/debug
-!/debug/node_modules/
-/debug/node_modules/*
-!/debug/node_modules/ms
 !/diff
 !/eastasianwidth
 !/emoji-regex
@@ -133,6 +115,9 @@
 !/just-diff
 !/lru-cache
 !/make-fetch-happen
+!/make-fetch-happen/node_modules/
+/make-fetch-happen/node_modules/*
+!/make-fetch-happen/node_modules/negotiator
 !/minimatch
 !/minipass-collect
 !/minipass-fetch
@@ -222,6 +207,14 @@
 !/shebang-regex
 !/signal-exit
 !/sigstore
+!/sigstore/node_modules/
+/sigstore/node_modules/*
+!/sigstore/node_modules/@sigstore/
+/sigstore/node_modules/@sigstore/*
+!/sigstore/node_modules/@sigstore/bundle
+!/sigstore/node_modules/@sigstore/core
+!/sigstore/node_modules/@sigstore/sign
+!/sigstore/node_modules/@sigstore/verify
 !/smart-buffer
 !/socks-proxy-agent
 !/socks
@@ -253,17 +246,9 @@
 !/tuf-js
 !/tuf-js/node_modules/
 /tuf-js/node_modules/*
-!/tuf-js/node_modules/@npmcli/
-/tuf-js/node_modules/@npmcli/*
-!/tuf-js/node_modules/@npmcli/agent
-!/tuf-js/node_modules/@npmcli/fs
-!/tuf-js/node_modules/cacache
-!/tuf-js/node_modules/make-fetch-happen
-!/tuf-js/node_modules/minipass-fetch
-!/tuf-js/node_modules/proc-log
-!/tuf-js/node_modules/ssri
-!/tuf-js/node_modules/unique-filename
-!/tuf-js/node_modules/unique-slug
+!/tuf-js/node_modules/@tufjs/
+/tuf-js/node_modules/@tufjs/*
+!/tuf-js/node_modules/@tufjs/models
 !/unique-filename
 !/unique-slug
 !/util-deprecate

node_modules/@isaacs/cliui/node_modules/ansi-regex/index.js

@@ -1,7 +1,9 @@
 export default function ansiRegex({onlyFirst = false} = {}) {
+	// Valid string terminator sequences are BEL, ESC\, and 0x9c
+	const ST = '(?:\\u0007|\\u001B\\u005C|\\u009C)';
 	const pattern = [
-	    '[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
-		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'
+		`[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]+)*|[a-zA-Z\\d]+(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?${ST})`,
+		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-nq-uy=><~]))',
 	].join('|');
 
 	return new RegExp(pattern, onlyFirst ? undefined : 'g');

node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "ansi-regex",
-	"version": "6.0.1",
+	"version": "6.1.0",
 	"description": "Regular expression for matching ANSI escape codes",
 	"license": "MIT",
 	"repository": "chalk/ansi-regex",
@@ -12,6 +12,8 @@
 	},
 	"type": "module",
 	"exports": "./index.js",
+	"types": "./index.d.ts",
+	"sideEffects": false,
 	"engines": {
 		"node": ">=12"
 	},
@@ -51,8 +53,9 @@
 		"pattern"
 	],
 	"devDependencies": {
+		"ansi-escapes": "^5.0.0",
 		"ava": "^3.15.0",
-		"tsd": "^0.14.0",
-		"xo": "^0.38.2"
+		"tsd": "^0.21.0",
+		"xo": "^0.54.2"
 	}
 }

node_modules/tuf-js/node_modules/proc-log/LICENSE → node_modules/@npmcli/metavuln-calculator/node_modules/pacote/LICENSE

@@ -1,6 +1,6 @@
 The ISC License
 
-Copyright (c) GitHub, Inc.
+Copyright (c) Isaac Z. Schlueter, Kat Marchán, npm, Inc., and Contributors
 
 Permission to use, copy, modify, and/or distribute this software for any
 purpose with or without fee is hereby granted, provided that the above

node_modules/@npmcli/metavuln-calculator/node_modules/pacote/bin/index.js

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+
+const run = conf => {
+  const pacote = require('../')
+  switch (conf._[0]) {
+    case 'resolve':
+    case 'manifest':
+    case 'packument':
+      if (conf._[0] === 'resolve' && conf.long) {
+        return pacote.manifest(conf._[1], conf).then(mani => ({
+          resolved: mani._resolved,
+          integrity: mani._integrity,
+          from: mani._from,
+        }))
+      }
+      return pacote[conf._[0]](conf._[1], conf)
+
+    case 'tarball':
+      if (!conf._[2] || conf._[2] === '-') {
+        return pacote.tarball.stream(conf._[1], stream => {
+          stream.pipe(
+            conf.testStdout ||
+            /* istanbul ignore next */
+            process.stdout
+          )
+          // make sure it resolves something falsey
+          return stream.promise().then(() => {
+            return false
+          })
+        }, conf)
+      } else {
+        return pacote.tarball.file(conf._[1], conf._[2], conf)
+      }
+
+    case 'extract':
+      return pacote.extract(conf._[1], conf._[2], conf)
+
+    default: /* istanbul ignore next */ {
+      throw new Error(`bad command: ${conf._[0]}`)
+    }
+  }
+}
+
+const version = require('../package.json').version
+const usage = () =>
+`Pacote - The JavaScript Package Handler, v${version}
+
+Usage:
+
+  pacote resolve <spec>
+    Resolve a specifier and output the fully resolved target
+    Returns integrity and from if '--long' flag is set.
+
+  pacote manifest <spec>
+    Fetch a manifest and print to stdout
+
+  pacote packument <spec>
+    Fetch a full packument and print to stdout
+
+  pacote tarball <spec> [<filename>]
+    Fetch a package tarball and save to <filename>
+    If <filename> is missing or '-', the tarball will be streamed to stdout.
+
+  pacote extract <spec> <folder>
+    Extract a package to the destination folder.
+
+Configuration values all match the names of configs passed to npm, or
+options passed to Pacote.  Additional flags for this executable:
+
+  --long     Print an object from 'resolve', including integrity and spec.
+  --json     Print result objects as JSON rather than node's default.
+             (This is the default if stdout is not a TTY.)
+  --help -h  Print this helpful text.
+
+For example '--cache=/path/to/folder' will use that folder as the cache.
+`
+
+const shouldJSON = (conf, result) =>
+  conf.json ||
+  !process.stdout.isTTY &&
+  conf.json === undefined &&
+  result &&
+  typeof result === 'object'
+
+const pretty = (conf, result) =>
+  shouldJSON(conf, result) ? JSON.stringify(result, 0, 2) : result
+
+let addedLogListener = false
+const main = args => {
+  const conf = parse(args)
+  if (conf.help || conf.h) {
+    return console.log(usage())
+  }
+
+  if (!addedLogListener) {
+    process.on('log', console.error)
+    addedLogListener = true
+  }
+
+  try {
+    return run(conf)
+      .then(result => result && console.log(pretty(conf, result)))
+      .catch(er => {
+        console.error(er)
+        process.exit(1)
+      })
+  } catch (er) {
+    console.error(er.message)
+    console.error(usage())
+  }
+}
+
+const parseArg = arg => {
+  const split = arg.slice(2).split('=')
+  const k = split.shift()
+  const v = split.join('=')
+  const no = /^no-/.test(k) && !v
+  const key = (no ? k.slice(3) : k)
+    .replace(/^tag$/, 'defaultTag')
+    .replace(/-([a-z])/g, (_, c) => c.toUpperCase())
+  const value = v ? v.replace(/^~/, process.env.HOME) : !no
+  return { key, value }
+}
+
+const parse = args => {
+  const conf = {
+    _: [],
+    cache: process.env.HOME + '/.npm/_cacache',
+  }
+  let dashdash = false
+  args.forEach(arg => {
+    if (dashdash) {
+      conf._.push(arg)
+    } else if (arg === '--') {
+      dashdash = true
+    } else if (arg === '-h') {
+      conf.help = true
+    } else if (/^--/.test(arg)) {
+      const { key, value } = parseArg(arg)
+      conf[key] = value
+    } else {
+      conf._.push(arg)
+    }
+  })
+  return conf
+}
+
+if (module === require.main) {
+  main(process.argv.slice(2))
+} else {
+  module.exports = {
+    main,
+    run,
+    usage,
+    parseArg,
+    parse,
+  }
+}