feat!: adds --ignore-scripts flag to pack

lib/commands/pack.js

@@ -15,6 +15,7 @@ class Pack extends BaseCommand {
     'workspace',
     'workspaces',
     'include-workspace-root',
+    'ignore-scripts',
   ]
 
   static usage = ['<package-spec>']

mock-registry/package.json

@@ -52,7 +52,7 @@
     "json-stringify-safe": "^5.0.1",
     "nock": "^13.3.3",
     "npm-package-arg": "^12.0.0",
-    "pacote": "^19.0.0",
+    "pacote": "^20.0.0",
     "tap": "^16.3.8"
   }
 }

node_modules/@npmcli/metavuln-calculator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/metavuln-calculator",
-  "version": "8.0.0",
+  "version": "8.0.1",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -41,7 +41,7 @@
   "dependencies": {
     "cacache": "^19.0.0",
     "json-parse-even-better-errors": "^4.0.0",
-    "pacote": "^19.0.0",
+    "pacote": "^20.0.0",
     "proc-log": "^5.0.0",
     "semver": "^7.3.5"
   },

node_modules/pacote/lib/dir.js

@@ -32,6 +32,9 @@ class DirFetcher extends Fetcher {
       if (!mani.scripts || !mani.scripts.prepare) {
         return
       }
+      if (this.opts.ignoreScripts) {
+        return
+      }
 
       // we *only* run prepare.
       // pre/post-pack is run by the npm CLI for publish and pack,

node_modules/pacote/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "19.0.1",
+  "version": "20.0.0",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {

package-lock.json

@@ -135,7 +135,7 @@
         "npm-registry-fetch": "^18.0.1",
         "npm-user-validate": "^3.0.0",
         "p-map": "^4.0.0",
-        "pacote": "^19.0.1",
+        "pacote": "^20.0.0",
         "parse-conflict-json": "^4.0.0",
         "proc-log": "^5.0.0",
         "qrcode-terminal": "^0.12.0",
@@ -2012,45 +2012,13 @@
         "json-stringify-safe": "^5.0.1",
         "nock": "^13.3.3",
         "npm-package-arg": "^12.0.0",
-        "pacote": "^19.0.0",
+        "pacote": "^20.0.0",
         "tap": "^16.3.8"
       },
       "engines": {
         "node": "^20.17.0 || >=22.9.0"
       }
     },
-    "mock-registry/node_modules/pacote": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-20.0.0.tgz",
-      "integrity": "sha512-pRjC5UFwZCgx9kUFDVM9YEahv4guZ1nSLqwmWiLUnDbGsjs+U5w7z6Uc8HNR1a6x8qnu5y9xtGE6D1uAuYz+0A==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "@npmcli/git": "^6.0.0",
-        "@npmcli/installed-package-contents": "^3.0.0",
-        "@npmcli/package-json": "^6.0.0",
-        "@npmcli/promise-spawn": "^8.0.0",
-        "@npmcli/run-script": "^9.0.0",
-        "cacache": "^19.0.0",
-        "fs-minipass": "^3.0.0",
-        "minipass": "^7.0.2",
-        "npm-package-arg": "^12.0.0",
-        "npm-packlist": "^9.0.0",
-        "npm-pick-manifest": "^10.0.0",
-        "npm-registry-fetch": "^18.0.0",
-        "proc-log": "^5.0.0",
-        "promise-retry": "^2.0.1",
-        "sigstore": "^3.0.0",
-        "ssri": "^12.0.0",
-        "tar": "^6.1.11"
-      },
-      "bin": {
-        "pacote": "bin/index.js"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/@actions/core": {
       "version": "1.10.1",
       "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
@@ -3433,14 +3401,14 @@
       }
     },
     "node_modules/@npmcli/metavuln-calculator": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-8.0.0.tgz",
-      "integrity": "sha512-zR2TGfhR8fH1u4VRz9fuC7r1nI9dweViRDsFnMH8J89OA90lJNwF6idTttEzYSWaOTW4NVoAIB6+ujV+/wI+kg==",
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/@npmcli/metavuln-calculator/-/metavuln-calculator-8.0.1.tgz",
+      "integrity": "sha512-WXlJx9cz3CfHSt9W9Opi1PTFc4WZLFomm5O8wekxQZmkyljrBRwATwDxfC9iOXJwYVmfiW1C1dUe0W2aN0UrSg==",
       "license": "ISC",
       "dependencies": {
         "cacache": "^19.0.0",
         "json-parse-even-better-errors": "^4.0.0",
-        "pacote": "^19.0.0",
+        "pacote": "^20.0.0",
         "proc-log": "^5.0.0",
         "semver": "^7.3.5"
       },
@@ -12916,9 +12884,9 @@
       "license": "BlueOak-1.0.0"
     },
     "node_modules/pacote": {
-      "version": "19.0.1",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-19.0.1.tgz",
-      "integrity": "sha512-zIpxWAsr/BvhrkSruspG8aqCQUUrWtpwx0GjiRZQhEM/pZXrigA32ElN3vTcCPUDOFmHr6SFxwYrvVUs5NTEUg==",
+      "version": "20.0.0",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-20.0.0.tgz",
+      "integrity": "sha512-pRjC5UFwZCgx9kUFDVM9YEahv4guZ1nSLqwmWiLUnDbGsjs+U5w7z6Uc8HNR1a6x8qnu5y9xtGE6D1uAuYz+0A==",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
@@ -18439,7 +18407,7 @@
         "npm-package-arg": "^12.0.0",
         "npm-pick-manifest": "^10.0.0",
         "npm-registry-fetch": "^18.0.1",
-        "pacote": "^19.0.0",
+        "pacote": "^20.0.0",
         "parse-conflict-json": "^4.0.0",
         "proc-log": "^5.0.0",
         "proggy": "^3.0.0",
@@ -18520,7 +18488,7 @@
         "diff": "^5.1.0",
         "minimatch": "^9.0.4",
         "npm-package-arg": "^12.0.0",
-        "pacote": "^19.0.0",
+        "pacote": "^20.0.0",
         "tar": "^6.2.1"
       },
       "devDependencies": {
@@ -18540,7 +18508,7 @@
         "@npmcli/run-script": "^9.0.1",
         "ci-info": "^4.0.0",
         "npm-package-arg": "^12.0.0",
-        "pacote": "^19.0.0",
+        "pacote": "^20.0.0",
         "proc-log": "^5.0.0",
         "read": "^4.0.0",
         "read-package-json-fast": "^4.0.0",
@@ -18601,7 +18569,7 @@
         "@npmcli/arborist": "^8.0.0",
         "@npmcli/run-script": "^9.0.1",
         "npm-package-arg": "^12.0.0",
-        "pacote": "^19.0.0"
+        "pacote": "^20.0.0"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^5.0.1",

package.json

@@ -102,7 +102,7 @@
     "npm-registry-fetch": "^18.0.1",
     "npm-user-validate": "^3.0.0",
     "p-map": "^4.0.0",
-    "pacote": "^19.0.1",
+    "pacote": "^20.0.0",
     "parse-conflict-json": "^4.0.0",
     "proc-log": "^5.0.0",
     "qrcode-terminal": "^0.12.0",

tap-snapshots/test/lib/docs.js.test.cjs

@@ -3680,7 +3680,7 @@ npm pack <package-spec>
 Options:
 [--dry-run] [--json] [--pack-destination <pack-destination>]
 [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
-[-ws|--workspaces] [--include-workspace-root]
+[-ws|--workspaces] [--include-workspace-root] [--ignore-scripts]
 
 Run "npm help pack" for more info
 
@@ -3694,6 +3694,7 @@ npm pack <package-spec>
 #### \`workspace\`
 #### \`workspaces\`
 #### \`include-workspace-root\`
+#### \`ignore-scripts\`
 `
 
 exports[`test/lib/docs.js TAP usage ping > must match snapshot 1`] = `

workspaces/arborist/lib/arborist/rebuild.js

@@ -154,7 +154,9 @@ module.exports = cls => class Builder extends cls {
 
     // links should run prepare scripts and only link bins after that
     if (type === 'links') {
-      await this.#runScripts('prepare')
+      if (!this.options.ignoreScripts) {
+        await this.#runScripts('prepare')
+      }
     }
     if (this.options.binLinks) {
       await this.#linkAllBins()

workspaces/arborist/package.json

@@ -26,7 +26,7 @@
     "npm-package-arg": "^12.0.0",
     "npm-pick-manifest": "^10.0.0",
     "npm-registry-fetch": "^18.0.1",
-    "pacote": "^19.0.0",
+    "pacote": "^20.0.0",
     "parse-conflict-json": "^4.0.0",
     "proc-log": "^5.0.0",
     "proggy": "^3.0.0",

workspaces/arborist/test/arborist/rebuild.js

@@ -812,3 +812,38 @@ t.test('no workspaces', async t => {
     },
   ])
 })
+
+t.test('do not run lifecycle scripts of linked deps twice', async t => {
+  const testdir = t.testdir({
+    project: {
+      'package.json': JSON.stringify({
+        name: 'my-project',
+        version: '1.0.0',
+        dependencies: {
+          foo: 'file:../foo',
+        },
+      }),
+      node_modules: {
+        foo: t.fixture('symlink', '../../foo'),
+      },
+    },
+    foo: {
+      'package.json': JSON.stringify({
+        name: 'foo',
+        version: '1.0.0',
+        scripts: {
+          postinstall: 'echo "ok"',
+        },
+      }),
+    },
+  })
+
+  const path = resolve(testdir, 'project')
+  const Arborist = t.mock('../../lib/arborist/index.js', {
+    '@npmcli/run-script': () => {
+      throw new Error('should not run any scripts')
+    },
+  })
+  const arb = new Arborist({ path, ignoreScripts: true })
+  await arb.rebuild()
+})

workspaces/libnpmdiff/package.json

@@ -53,7 +53,7 @@
     "diff": "^5.1.0",
     "minimatch": "^9.0.4",
     "npm-package-arg": "^12.0.0",
-    "pacote": "^19.0.0",
+    "pacote": "^20.0.0",
     "tar": "^6.2.1"
   },
   "templateOSS": {

workspaces/libnpmexec/package.json

@@ -64,7 +64,7 @@
     "@npmcli/run-script": "^9.0.1",
     "ci-info": "^4.0.0",
     "npm-package-arg": "^12.0.0",
-    "pacote": "^19.0.0",
+    "pacote": "^20.0.0",
     "proc-log": "^5.0.0",
     "read": "^4.0.0",
     "read-package-json-fast": "^4.0.0",

workspaces/libnpmpack/package.json

@@ -40,7 +40,7 @@
     "@npmcli/arborist": "^8.0.0",
     "@npmcli/run-script": "^9.0.1",
     "npm-package-arg": "^12.0.0",
-    "pacote": "^19.0.0"
+    "pacote": "^20.0.0"
   },
   "engines": {
     "node": "^20.17.0 || >=22.9.0"