deps: upgrade npm to 10.5.2

PR-URL: #52458
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Mohammed Keyvanzadeh <[email protected]>

deps/npm/docs/content/commands/npm-audit.md

@@ -90,7 +90,7 @@ The `sig` is generated using the following template: `${package.name}@${package.
 
 Keys response:
 
-- `expires`: null or a simplified extended [ISO 8601 format](https://en.wikipedia.org/wiki/ISO_8601"): `YYYY-MM-DDTHH:mm:ss.sssZ`
+- `expires`: null or a simplified extended [ISO 8601 format](https://en.wikipedia.org/wiki/ISO_8601): `YYYY-MM-DDTHH:mm:ss.sssZ`
 - `keydid`: sha256 fingerprint of the public key
 - `keytype`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
 - `scheme`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI

deps/npm/docs/content/commands/npm-ls.md

@@ -27,7 +27,7 @@ packages will *also* show the paths to the specified packages.  For
 example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-[email protected].1 /path/to/npm
+[email protected].2 /path/to/npm
 └─┬ [email protected]
   └── [email protected]
 ```

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-10.5.1
+10.5.2
 
 ### Description
 

deps/npm/docs/output/commands/npm-audit.html

@@ -209,7 +209,7 @@ <h3 id="audit-signatures">Audit Signatures</h3>
 </code></pre>
 <p>Keys response:</p>
 <ul>
-<li><code>expires</code>: null or a simplified extended <a href="https://en.wikipedia.org/wiki/ISO_8601%22">ISO 8601 format</a>: <code>YYYY-MM-DDTHH:mm:ss.sssZ</code></li>
+<li><code>expires</code>: null or a simplified extended <a href="https://en.wikipedia.org/wiki/ISO_8601">ISO 8601 format</a>: <code>YYYY-MM-DDTHH:mm:ss.sssZ</code></li>
 <li><code>keydid</code>: sha256 fingerprint of the public key</li>
 <li><code>keytype</code>: only <code>ecdsa-sha2-nistp256</code> is currently supported by the npm CLI</li>
 <li><code>scheme</code>: only <code>ecdsa-sha2-nistp256</code> is currently supported by the npm CLI</li>

deps/npm/docs/output/commands/npm-ls.html

@@ -160,7 +160,7 @@ <h3 id="description">Description</h3>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">[email protected].1 /path/to/npm
+<pre><code class="language-bash">[email protected].2 /path/to/npm
 └─┬ [email protected]
   └── [email protected]
 </code></pre>

deps/npm/docs/output/commands/npm.html

@@ -150,7 +150,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>10.5.1</p>
+<p>10.5.2</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/lib/base-command.js

@@ -3,7 +3,6 @@
 const { relative } = require('path')
 
 const { definitions } = require('@npmcli/config/lib/definitions')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const { aliases: cmdAliases } = require('./utils/cmd-list')
 const log = require('./utils/log-shim.js')
 
@@ -170,6 +169,7 @@ class BaseCommand {
     const relativeFrom = prefixInsideCwd ? this.npm.localPrefix : process.cwd()
 
     const filters = this.npm.config.get('workspace')
+    const getWorkspaces = require('./workspaces/get-workspaces.js')
     const ws = await getWorkspaces(filters, {
       path: this.npm.localPrefix,
       includeWorkspaceRoot,

deps/npm/lib/commands/owner.js

@@ -5,6 +5,7 @@ const log = require('../utils/log-shim')
 const otplease = require('../utils/otplease.js')
 const pkgJson = require('@npmcli/package-json')
 const BaseCommand = require('../base-command.js')
+const { redact } = require('@npmcli/redact')
 
 const readJson = async (path) => {
   try {
@@ -119,7 +120,7 @@ class Owner extends BaseCommand {
         this.npm.output(maintainers.map(m => `${m.name} <${m.email}>`).join('\n'))
       }
     } catch (err) {
-      log.error('owner ls', "Couldn't get owner data", npmFetch.cleanUrl(pkg))
+      log.error('owner ls', "Couldn't get owner data", redact(pkg))
       throw err
     }
   }

deps/npm/lib/commands/ping.js

@@ -1,4 +1,4 @@
-const { cleanUrl } = require('npm-registry-fetch')
+const { redact } = require('@npmcli/redact')
 const log = require('../utils/log-shim')
 const pingUtil = require('../utils/ping.js')
 const BaseCommand = require('../base-command.js')
@@ -9,7 +9,7 @@ class Ping extends BaseCommand {
   static name = 'ping'
 
   async exec (args) {
-    const cleanRegistry = cleanUrl(this.npm.config.get('registry'))
+    const cleanRegistry = redact(this.npm.config.get('registry'))
     log.notice('PING', cleanRegistry)
     const start = Date.now()
     const details = await pingUtil({ ...this.npm.flatOptions })

deps/npm/lib/commands/publish.js

@@ -220,7 +220,12 @@ class Publish extends BaseCommand {
       })
     }
     if (manifest.publishConfig) {
-      flatten(manifest.publishConfig, opts)
+      const cliFlags = this.npm.config.data.get('cli').raw
+      // Filter out properties set in CLI flags to prioritize them over
+      // corresponding `publishConfig` settings
+      const filteredPublishConfig = Object.fromEntries(
+        Object.entries(manifest.publishConfig).filter(([key]) => !(key in cliFlags)))
+      flatten(filteredPublishConfig, opts)
     }
     return manifest
   }

deps/npm/lib/commands/unpublish.js

@@ -141,7 +141,12 @@ class Unpublish extends BaseCommand {
     // If localPrefix has a package.json with a name that matches the package
     // being unpublished, load up the publishConfig
     if (manifest?.name === spec.name && manifest.publishConfig) {
-      flatten(manifest.publishConfig, opts)
+      const cliFlags = this.npm.config.data.get('cli').raw
+      // Filter out properties set in CLI flags to prioritize them over
+      // corresponding `publishConfig` settings
+      const filteredPublishConfig = Object.fromEntries(
+        Object.entries(manifest.publishConfig).filter(([key]) => !(key in cliFlags)))
+      flatten(filteredPublishConfig, opts)
     }
 
     const versions = await Unpublish.getKeysOfVersions(spec.name, opts)

deps/npm/lib/utils/error-message.js

@@ -1,6 +1,5 @@
 const { format } = require('util')
 const { resolve } = require('path')
-const nameValidator = require('validate-npm-package-name')
 const { redactLog: replaceInfo } = require('@npmcli/redact')
 const { report } = require('./explain-eresolve.js')
 const log = require('./log-shim')
@@ -215,6 +214,7 @@ const errorMessage = (er, npm) => {
         detail.push(['404', ''])
         detail.push(['404', '', `'${replaceInfo(er.pkgid)}' is not in this registry.`])
 
+        const nameValidator = require('validate-npm-package-name')
         const valResult = nameValidator(pkg)
 
         if (!valResult.validForNewPackages) {

deps/npm/lib/utils/log-file.js

@@ -1,15 +1,13 @@
 const os = require('os')
 const { join, dirname, basename } = require('path')
 const { format } = require('util')
-const { glob } = require('glob')
 const { Minipass } = require('minipass')
 const fsMiniPass = require('fs-minipass')
 const fs = require('fs/promises')
 const log = require('./log-shim')
 const Display = require('./display')
 
 const padZero = (n, length) => n.toString().padStart(length.toString().length, '0')
-const globify = pattern => pattern.split('\\').join('/')
 
 class LogFiles {
   // Default to a plain minipass stream so we can buffer
@@ -199,25 +197,49 @@ class LogFiles {
 
     try {
       const logPath = this.#getLogFilePath()
-      const logGlob = join(dirname(logPath), basename(logPath)
+      const patternFileName = basename(logPath)
         // tell glob to only match digits
-        .replace(/\d/g, '[0123456789]')
+        .replace(/\d/g, 'd')
         // Handle the old (prior to 8.2.0) log file names which did not have a
         // counter suffix
-        .replace(/-\.log$/, '*.log')
-      )
+        .replace('-.log', '')
+
+      let files = await fs.readdir(
+        dirname(logPath), {
+          withFileTypes: true,
+          encoding: 'utf-8',
+        })
+      files = files.sort((a, b) => basename(a.name).localeCompare(basename(b.name), 'en'))
+
+      const logFiles = []
+
+      for (const file of files) {
+        if (!file.isFile()) {
+          continue
+        }
+
+        const genericFileName = file.name.replace(/\d/g, 'd')
+        const filePath = join(dirname(logPath), basename(file.name))
+
+        // Always ignore the currently written files
+        if (
+          genericFileName.includes(patternFileName)
+          && genericFileName.endsWith('.log')
+          && !this.#files.includes(filePath)
+        ) {
+          logFiles.push(filePath)
+        }
+      }
 
-      // Always ignore the currently written files
-      const files = await glob(globify(logGlob), { ignore: this.#files.map(globify), silent: true })
-      const toDelete = files.length - this.#logsMax
+      const toDelete = logFiles.length - this.#logsMax
 
       if (toDelete <= 0) {
         return
       }
 
       log.silly('logfile', `start cleaning logs, removing ${toDelete} files`)
 
-      for (const file of files.slice(0, toDelete)) {
+      for (const file of logFiles.slice(0, toDelete)) {
         try {
           await fs.rm(file, { force: true })
         } catch (e) {

deps/npm/lib/utils/update-notifier.js

@@ -3,7 +3,9 @@
 // Check daily for betas, and weekly otherwise.
 
 const ciInfo = require('ci-info')
-const semver = require('semver')
+const gt = require('semver/functions/gt')
+const gte = require('semver/functions/gte')
+const parse = require('semver/functions/parse')
 const { stat, writeFile } = require('fs/promises')
 const { resolve } = require('path')
 
@@ -38,12 +40,12 @@ const updateCheck = async (npm, spec, version, current) => {
   // and should get the updates from that release train.
   // Note that this isn't another http request over the network, because
   // the packument will be cached by pacote from previous request.
-  if (semver.gt(version, latest) && spec === 'latest') {
+  if (gt(version, latest) && spec === 'latest') {
     return updateNotifier(npm, `^${version}`)
   }
 
   // if we already have something >= the desired spec, then we're done
-  if (semver.gte(version, latest)) {
+  if (gte(version, latest)) {
     return null
   }
 
@@ -53,7 +55,7 @@ const updateCheck = async (npm, spec, version, current) => {
   // ok!  notify the user about this update they should get.
   // The message is saved for printing at process exit so it will not get
   // lost in any other messages being printed as part of the command.
-  const update = semver.parse(mani.version)
+  const update = parse(mani.version)
   const type = update.major !== current.major ? 'major'
     : update.minor !== current.minor ? 'minor'
     : update.patch !== current.patch ? 'patch'
@@ -79,7 +81,7 @@ const updateNotifier = async (npm, spec = 'latest') => {
   // if we're on a prerelease train, then updates are coming fast
   // check for a new one daily.  otherwise, weekly.
   const { version } = npm
-  const current = semver.parse(version)
+  const current = parse(version)
 
   // if we're on a beta train, always get the next beta
   if (current.prerelease.length) {

deps/npm/man/man1/npm-audit.1

@@ -80,7 +80,7 @@ Public signing keys are provided at \fBregistry-host.tld/-/npm/v1/keys\fR in the
 Keys response:
 .RS 0
 .IP \(bu 4
-\fBexpires\fR: null or a simplified extended \fBISO 8601 format\fR \fI\(lahttps://en.wikipedia.org/wiki/ISO_8601"\(ra\fR: \fBYYYY-MM-DDTHH:mm:ss.sssZ\fR
+\fBexpires\fR: null or a simplified extended \fBISO 8601 format\fR \fI\(lahttps://en.wikipedia.org/wiki/ISO_8601\(ra\fR: \fBYYYY-MM-DDTHH:mm:ss.sssZ\fR
 .IP \(bu 4
 \fBkeydid\fR: sha256 fingerprint of the public key
 .IP \(bu 4

deps/npm/man/man1/npm-ls.1

@@ -20,7 +20,7 @@ Positional arguments are \fBname@version-range\fR identifiers, which will limit
 .P
 .RS 2
 .nf
-[email protected].1 /path/to/npm
+[email protected].2 /path/to/npm
 └─┬ [email protected]
   └── [email protected]
 .fi

deps/npm/man/man1/npm.1

@@ -12,7 +12,7 @@ npm
 Note: This command is unaware of workspaces.
 .SS "Version"
 .P
-10.5.1
+10.5.2
 .SS "Description"
 .P
 npm is the package manager for the Node JavaScript platform. It puts modules in place so that node can find them, and manages dependency conflicts intelligently.