deps: update @npmcli/[email protected]

node_modules/.gitignore

@@ -24,30 +24,38 @@
 /@npmcli/map-workspaces/node_modules/*
 !/@npmcli/map-workspaces/node_modules/@npmcli/
 /@npmcli/map-workspaces/node_modules/@npmcli/*
-!/@npmcli/map-workspaces/node_modules/@npmcli/git
 !/@npmcli/map-workspaces/node_modules/@npmcli/name-from-folder
-!/@npmcli/map-workspaces/node_modules/@npmcli/package-json
-!/@npmcli/map-workspaces/node_modules/@npmcli/promise-spawn
-!/@npmcli/map-workspaces/node_modules/hosted-git-info
-!/@npmcli/map-workspaces/node_modules/ini
-!/@npmcli/map-workspaces/node_modules/isexe
-!/@npmcli/map-workspaces/node_modules/json-parse-even-better-errors
-!/@npmcli/map-workspaces/node_modules/normalize-package-data
-!/@npmcli/map-workspaces/node_modules/npm-install-checks
-!/@npmcli/map-workspaces/node_modules/npm-normalize-package-bin
-!/@npmcli/map-workspaces/node_modules/npm-package-arg
-!/@npmcli/map-workspaces/node_modules/npm-pick-manifest
-!/@npmcli/map-workspaces/node_modules/proc-log
-!/@npmcli/map-workspaces/node_modules/validate-npm-package-name
-!/@npmcli/map-workspaces/node_modules/which
 !/@npmcli/metavuln-calculator
 !/@npmcli/name-from-folder
 !/@npmcli/node-gyp
 !/@npmcli/package-json
+!/@npmcli/package-json/node_modules/
+/@npmcli/package-json/node_modules/*
+!/@npmcli/package-json/node_modules/@npmcli/
+/@npmcli/package-json/node_modules/@npmcli/*
+!/@npmcli/package-json/node_modules/@npmcli/git
+!/@npmcli/package-json/node_modules/@npmcli/promise-spawn
+!/@npmcli/package-json/node_modules/hosted-git-info
+!/@npmcli/package-json/node_modules/ini
+!/@npmcli/package-json/node_modules/isexe
+!/@npmcli/package-json/node_modules/json-parse-even-better-errors
+!/@npmcli/package-json/node_modules/normalize-package-data
+!/@npmcli/package-json/node_modules/npm-install-checks
+!/@npmcli/package-json/node_modules/npm-normalize-package-bin
+!/@npmcli/package-json/node_modules/npm-package-arg
+!/@npmcli/package-json/node_modules/npm-pick-manifest
+!/@npmcli/package-json/node_modules/proc-log
+!/@npmcli/package-json/node_modules/validate-npm-package-name
+!/@npmcli/package-json/node_modules/which
 !/@npmcli/promise-spawn
 !/@npmcli/query
 !/@npmcli/redact
 !/@npmcli/run-script
+!/@npmcli/run-script/node_modules/
+/@npmcli/run-script/node_modules/*
+!/@npmcli/run-script/node_modules/@npmcli/
+/@npmcli/run-script/node_modules/@npmcli/*
+!/@npmcli/run-script/node_modules/@npmcli/package-json
 !/@pkgjs/
 /@pkgjs/*
 !/@pkgjs/parseargs
@@ -121,6 +129,11 @@
 !/indent-string
 !/ini
 !/init-package-json
+!/init-package-json/node_modules/
+/init-package-json/node_modules/*
+!/init-package-json/node_modules/@npmcli/
+/init-package-json/node_modules/@npmcli/*
+!/init-package-json/node_modules/@npmcli/package-json
 !/ip-address
 !/ip-regex
 !/is-cidr
@@ -176,6 +189,11 @@
 !/p-map
 !/package-json-from-dist
 !/pacote
+!/pacote/node_modules/
+/pacote/node_modules/*
+!/pacote/node_modules/@npmcli/
+/pacote/node_modules/@npmcli/*
+!/pacote/node_modules/@npmcli/package-json
 !/parse-conflict-json
 !/path-key
 !/path-scurry

node_modules/@npmcli/package-json/lib/normalize.js

@@ -127,13 +127,9 @@ function unixifyPath (ref) {
   return ref.replace(/\\|:/g, '/')
 }
 
-function securePath (ref) {
-  const secured = path.join('.', path.join('/', unixifyPath(ref)))
-  return secured.startsWith('.') ? '' : secured
-}
-
 function secureAndUnixifyPath (ref) {
-  return unixifyPath(securePath(ref))
+  const secured = unixifyPath(path.join('.', path.join('/', unixifyPath(ref))))
+  return secured.startsWith('./') ? '' : secured
 }
 
 // We don't want the `changes` array in here by default because this is a hot
@@ -376,7 +372,7 @@ const normalize = async (pkg, { strict, steps, root, changes, allowLegacyCase })
 
   // expand "directories.bin"
   if (steps.includes('binDir') && data.directories?.bin && !data.bin) {
-    const binsDir = path.resolve(pkg.path, securePath(data.directories.bin))
+    const binsDir = path.resolve(pkg.path, secureAndUnixifyPath(data.directories.bin))
     const bins = await lazyLoadGlob()('**', { cwd: binsDir })
     data.bin = bins.reduce((acc, binFile) => {
       if (binFile && !binFile.startsWith('.')) {

node_modules/@npmcli/package-json/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/package-json",
-  "version": "5.2.0",
+  "version": "6.0.1",
   "description": "Programmatic API to update package.json",
   "main": "lib/index.js",
   "files": [
@@ -10,12 +10,13 @@
   "scripts": {
     "snap": "tap",
     "test": "tap",
-    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
-    "lintfix": "npm run lint -- --fix",
+    "lint": "npm run eslint",
+    "lintfix": "npm run eslint -- --fix",
     "posttest": "npm run lint",
     "postsnap": "npm run lintfix --",
     "postlint": "template-oss-check",
-    "template-oss-apply": "template-oss-apply --force"
+    "template-oss-apply": "template-oss-apply --force",
+    "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
   "keywords": [
     "npm",
@@ -24,31 +25,31 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.22.0",
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.23.3",
     "read-package-json": "^7.0.0",
-    "read-package-json-fast": "^3.0.2",
+    "read-package-json-fast": "^4.0.0",
     "tap": "^16.0.1"
   },
   "dependencies": {
-    "@npmcli/git": "^5.0.0",
+    "@npmcli/git": "^6.0.0",
     "glob": "^10.2.2",
-    "hosted-git-info": "^7.0.0",
-    "json-parse-even-better-errors": "^3.0.0",
-    "normalize-package-data": "^6.0.0",
-    "proc-log": "^4.0.0",
+    "hosted-git-info": "^8.0.0",
+    "json-parse-even-better-errors": "^4.0.0",
+    "normalize-package-data": "^7.0.0",
+    "proc-log": "^5.0.0",
     "semver": "^7.5.3"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/npm/package-json.git"
   },
   "engines": {
-    "node": "^16.14.0 || >=18.0.0"
+    "node": "^18.17.0 || >=20.5.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.22.0",
+    "version": "4.23.3",
     "publish": "true"
   },
   "tap": {

node_modules/@npmcli/map-workspaces/node_modules/@npmcli/package-json/package.json → node_modules/@npmcli/run-script/node_modules/@npmcli/package-json/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/package-json",
-  "version": "6.0.1",
+  "version": "5.2.1",
   "description": "Programmatic API to update package.json",
   "main": "lib/index.js",
   "files": [
@@ -25,27 +25,27 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "devDependencies": {
-    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/eslint-config": "^4.0.0",
     "@npmcli/template-oss": "4.23.3",
     "read-package-json": "^7.0.0",
-    "read-package-json-fast": "^4.0.0",
+    "read-package-json-fast": "^3.0.2",
     "tap": "^16.0.1"
   },
   "dependencies": {
-    "@npmcli/git": "^6.0.0",
+    "@npmcli/git": "^5.0.0",
     "glob": "^10.2.2",
-    "hosted-git-info": "^8.0.0",
-    "json-parse-even-better-errors": "^4.0.0",
-    "normalize-package-data": "^7.0.0",
-    "proc-log": "^5.0.0",
+    "hosted-git-info": "^7.0.0",
+    "json-parse-even-better-errors": "^3.0.0",
+    "normalize-package-data": "^6.0.0",
+    "proc-log": "^4.0.0",
     "semver": "^7.5.3"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/npm/package-json.git"
   },
   "engines": {
-    "node": "^18.17.0 || >=20.5.0"
+    "node": "^16.14.0 || >=18.0.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",

node_modules/init-package-json/node_modules/@npmcli/package-json/LICENSE

@@ -0,0 +1,18 @@
+ISC License
+
+Copyright GitHub Inc.
+
+Permission to use, copy, modify, and/or distribute this
+software for any purpose with or without fee is hereby
+granted, provided that the above copyright notice and this
+permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO
+EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.