deps: update @npmcli/[email protected]

Author: reggi

DEPENDENCIES.md

@@ -207,7 +207,7 @@ graph LR;
   npmcli-installed-package-contents-->npm-bundled;
   npmcli-installed-package-contents-->npm-normalize-package-bin;
   npmcli-map-workspaces-->npmcli-name-from-folder["@npmcli/name-from-folder"];
-  npmcli-map-workspaces-->read-package-json-fast;
+  npmcli-map-workspaces-->npmcli-package-json["@npmcli/package-json"];
   npmcli-metavuln-calculator-->cacache;
   npmcli-metavuln-calculator-->json-parse-even-better-errors;
   npmcli-metavuln-calculator-->pacote;
@@ -655,7 +655,7 @@ graph LR;
   npmcli-map-workspaces-->glob;
   npmcli-map-workspaces-->minimatch;
   npmcli-map-workspaces-->npmcli-name-from-folder["@npmcli/name-from-folder"];
-  npmcli-map-workspaces-->read-package-json-fast;
+  npmcli-map-workspaces-->npmcli-package-json["@npmcli/package-json"];
   npmcli-metavuln-calculator-->cacache;
   npmcli-metavuln-calculator-->json-parse-even-better-errors;
   npmcli-metavuln-calculator-->pacote;
@@ -794,10 +794,10 @@ packages higher up the chain.
  - @npmcli/mock-registry, libnpmdiff, libnpmfund, libnpmpack
  - @npmcli/arborist
  - @npmcli/metavuln-calculator
- - pacote, libnpmversion
- - @npmcli/run-script, @npmcli/config, libnpmhook, libnpmorg, libnpmsearch, libnpmteam, init-package-json, npm-profile
+ - pacote, @npmcli/config, libnpmversion
+ - @npmcli/map-workspaces, @npmcli/run-script, libnpmhook, libnpmorg, libnpmsearch, libnpmteam, init-package-json, npm-profile
  - @npmcli/package-json, npm-registry-fetch
  - @npmcli/git, make-fetch-happen
- - @npmcli/installed-package-contents, @npmcli/map-workspaces, cacache, npm-pick-manifest, promzard
- - @npmcli/docs, @npmcli/fs, npm-bundled, read-package-json-fast, unique-filename, npm-install-checks, npm-package-arg, normalize-package-data, npm-packlist, bin-links, nopt, parse-conflict-json, @npmcli/mock-globals, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/promise-spawn, ini, hosted-git-info, proc-log, validate-npm-package-name, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate
+ - @npmcli/installed-package-contents, npm-pick-manifest, cacache, promzard
+ - @npmcli/docs, @npmcli/fs, npm-bundled, npm-install-checks, npm-package-arg, normalize-package-data, unique-filename, npm-packlist, bin-links, nopt, parse-conflict-json, read-package-json-fast, @npmcli/mock-globals, read
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, @npmcli/promise-spawn, ini, hosted-git-info, proc-log, validate-npm-package-name, json-parse-even-better-errors, fs-minipass, ssri, unique-slug, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate

node_modules/.gitignore

@@ -20,6 +20,26 @@
 !/@npmcli/git
 !/@npmcli/installed-package-contents
 !/@npmcli/map-workspaces
+!/@npmcli/map-workspaces/node_modules/
+/@npmcli/map-workspaces/node_modules/*
+!/@npmcli/map-workspaces/node_modules/@npmcli/
+/@npmcli/map-workspaces/node_modules/@npmcli/*
+!/@npmcli/map-workspaces/node_modules/@npmcli/git
+!/@npmcli/map-workspaces/node_modules/@npmcli/name-from-folder
+!/@npmcli/map-workspaces/node_modules/@npmcli/package-json
+!/@npmcli/map-workspaces/node_modules/@npmcli/promise-spawn
+!/@npmcli/map-workspaces/node_modules/hosted-git-info
+!/@npmcli/map-workspaces/node_modules/ini
+!/@npmcli/map-workspaces/node_modules/isexe
+!/@npmcli/map-workspaces/node_modules/json-parse-even-better-errors
+!/@npmcli/map-workspaces/node_modules/normalize-package-data
+!/@npmcli/map-workspaces/node_modules/npm-install-checks
+!/@npmcli/map-workspaces/node_modules/npm-normalize-package-bin
+!/@npmcli/map-workspaces/node_modules/npm-package-arg
+!/@npmcli/map-workspaces/node_modules/npm-pick-manifest
+!/@npmcli/map-workspaces/node_modules/proc-log
+!/@npmcli/map-workspaces/node_modules/validate-npm-package-name
+!/@npmcli/map-workspaces/node_modules/which
 !/@npmcli/metavuln-calculator
 !/@npmcli/name-from-folder
 !/@npmcli/node-gyp

node_modules/@npmcli/map-workspaces/lib/index.js

@@ -2,7 +2,7 @@ const path = require('path')
 
 const getName = require('@npmcli/name-from-folder')
 const { minimatch } = require('minimatch')
-const rpj = require('read-package-json-fast')
+const pkgJson = require('@npmcli/package-json')
 const { glob } = require('glob')
 
 function appendNegatedPatterns (allPatterns) {
@@ -67,15 +67,7 @@ function getPatterns (workspaces) {
 }
 
 function getPackageName (pkg, pathname) {
-  const { name } = pkg
-  return name || getName(pathname)
-}
-
-function pkgPathmame (opts) {
-  return (...args) => {
-    const cwd = opts.cwd ? opts.cwd : process.cwd()
-    return path.join.apply(null, [cwd, ...args])
-  }
+  return pkg.name || getName(pathname)
 }
 
 // make sure glob pattern only matches folders
@@ -101,16 +93,19 @@ async function mapWorkspaces (opts = {}) {
       code: 'EMAPWORKSPACESPKG',
     })
   }
+  if (!opts.cwd) {
+    opts.cwd = process.cwd()
+  }
 
   const { workspaces = [] } = opts.pkg
   const { patterns, negatedPatterns } = getPatterns(workspaces)
   const results = new Map()
-  const seen = new Map()
 
   if (!patterns.length && !negatedPatterns.length) {
     return results
   }
 
+  const seen = new Map()
   const getGlobOpts = () => ({
     ...opts,
     ignore: [
@@ -121,8 +116,6 @@ async function mapWorkspaces (opts = {}) {
     ],
   })
 
-  const getPackagePathname = pkgPathmame(opts)
-
   let matches = await glob(patterns.map((p) => getGlobPattern(p)), getGlobOpts())
   // preserves glob@8 behavior
   matches = matches.sort((a, b) => a.localeCompare(b, 'en'))
@@ -138,10 +131,8 @@ async function mapWorkspaces (opts = {}) {
 
   for (const match of orderedMatches) {
     let pkg
-    const packageJsonPathname = getPackagePathname(match, 'package.json')
-
     try {
-      pkg = await rpj(packageJsonPathname)
+      pkg = await pkgJson.normalize(path.join(opts.cwd, match))
     } catch (err) {
       if (err.code === 'ENOENT') {
         continue
@@ -150,15 +141,14 @@ async function mapWorkspaces (opts = {}) {
       }
     }
 
-    const packagePathname = path.dirname(packageJsonPathname)
-    const name = getPackageName(pkg, packagePathname)
+    const name = getPackageName(pkg.content, pkg.path)
 
     let seenPackagePathnames = seen.get(name)
     if (!seenPackagePathnames) {
       seenPackagePathnames = new Set()
       seen.set(name, seenPackagePathnames)
     }
-    seenPackagePathnames.add(packagePathname)
+    seenPackagePathnames.add(pkg.path)
   }
 
   const errorMessageArray = ['must not have multiple workspaces with the same name']
@@ -200,6 +190,9 @@ mapWorkspaces.virtual = function (opts = {}) {
       code: 'EMAPWORKSPACESLOCKFILE',
     })
   }
+  if (!opts.cwd) {
+    opts.cwd = process.cwd()
+  }
 
   const { packages = {} } = opts.lockfile
   const { workspaces = [] } = packages[''] || {}
@@ -218,10 +211,9 @@ mapWorkspaces.virtual = function (opts = {}) {
     }
   }
 
-  const getPackagePathname = pkgPathmame(opts)
   for (const pattern of patterns) {
     for (const packageKey of minimatch.match(packageKeys, pattern)) {
-      const packagePathname = getPackagePathname(packageKey)
+      const packagePathname = path.join(opts.cwd, packageKey)
       const name = getPackageName(packages[packageKey], packagePathname)
       results.set(packagePathname, name)
     }

node_modules/@npmcli/map-workspaces/node_modules/@npmcli/git/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE NPM DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE NPM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT,
+OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
+DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+SOFTWARE.

node_modules/@npmcli/map-workspaces/node_modules/@npmcli/git/lib/clone.js

@@ -0,0 +1,172 @@
+// The goal here is to minimize both git workload and
+// the number of refs we download over the network.
+//
+// Every method ends up with the checked out working dir
+// at the specified ref, and resolves with the git sha.
+
+// Only certain whitelisted hosts get shallow cloning.
+// Many hosts (including GHE) don't always support it.
+// A failed shallow fetch takes a LOT longer than a full
+// fetch in most cases, so we skip it entirely.
+// Set opts.gitShallow = true/false to force this behavior
+// one way or the other.
+const shallowHosts = new Set([
+  'github.com',
+  'gist.github.com',
+  'gitlab.com',
+  'bitbucket.com',
+  'bitbucket.org',
+])
+// we have to use url.parse until we add the same shim that hosted-git-info has
+// to handle scp:// urls
+const { parse } = require('url') // eslint-disable-line node/no-deprecated-api
+const path = require('path')
+
+const getRevs = require('./revs.js')
+const spawn = require('./spawn.js')
+const { isWindows } = require('./utils.js')
+
+const pickManifest = require('npm-pick-manifest')
+const fs = require('fs/promises')
+
+module.exports = (repo, ref = 'HEAD', target = null, opts = {}) =>
+  getRevs(repo, opts).then(revs => clone(
+    repo,
+    revs,
+    ref,
+    resolveRef(revs, ref, opts),
+    target || defaultTarget(repo, opts.cwd),
+    opts
+  ))
+
+const maybeShallow = (repo, opts) => {
+  if (opts.gitShallow === false || opts.gitShallow) {
+    return opts.gitShallow
+  }
+  return shallowHosts.has(parse(repo).host)
+}
+
+const defaultTarget = (repo, /* istanbul ignore next */ cwd = process.cwd()) =>
+  path.resolve(cwd, path.basename(repo.replace(/[/\\]?\.git$/, '')))
+
+const clone = (repo, revs, ref, revDoc, target, opts) => {
+  if (!revDoc) {
+    return unresolved(repo, ref, target, opts)
+  }
+  if (revDoc.sha === revs.refs.HEAD.sha) {
+    return plain(repo, revDoc, target, opts)
+  }
+  if (revDoc.type === 'tag' || revDoc.type === 'branch') {
+    return branch(repo, revDoc, target, opts)
+  }
+  return other(repo, revDoc, target, opts)
+}
+
+const resolveRef = (revs, ref, opts) => {
+  const { spec = {} } = opts
+  ref = spec.gitCommittish || ref
+  /* istanbul ignore next - will fail anyway, can't pull */
+  if (!revs) {
+    return null
+  }
+  if (spec.gitRange) {
+    return pickManifest(revs, spec.gitRange, opts)
+  }
+  if (!ref) {
+    return revs.refs.HEAD
+  }
+  if (revs.refs[ref]) {
+    return revs.refs[ref]
+  }
+  if (revs.shas[ref]) {
+    return revs.refs[revs.shas[ref][0]]
+  }
+  return null
+}
+
+// pull request or some other kind of advertised ref
+const other = (repo, revDoc, target, opts) => {
+  const shallow = maybeShallow(repo, opts)
+
+  const fetchOrigin = ['fetch', 'origin', revDoc.rawRef]
+    .concat(shallow ? ['--depth=1'] : [])
+
+  const git = (args) => spawn(args, { ...opts, cwd: target })
+  return fs.mkdir(target, { recursive: true })
+    .then(() => git(['init']))
+    .then(() => isWindows(opts)
+      ? git(['config', '--local', '--add', 'core.longpaths', 'true'])
+      : null)
+    .then(() => git(['remote', 'add', 'origin', repo]))
+    .then(() => git(fetchOrigin))
+    .then(() => git(['checkout', revDoc.sha]))
+    .then(() => updateSubmodules(target, opts))
+    .then(() => revDoc.sha)
+}
+
+// tag or branches.  use -b
+const branch = (repo, revDoc, target, opts) => {
+  const args = [
+    'clone',
+    '-b',
+    revDoc.ref,
+    repo,
+    target,
+    '--recurse-submodules',
+  ]
+  if (maybeShallow(repo, opts)) {
+    args.push('--depth=1')
+  }
+  if (isWindows(opts)) {
+    args.push('--config', 'core.longpaths=true')
+  }
+  return spawn(args, opts).then(() => revDoc.sha)
+}
+
+// just the head.  clone it
+const plain = (repo, revDoc, target, opts) => {
+  const args = [
+    'clone',
+    repo,
+    target,
+    '--recurse-submodules',
+  ]
+  if (maybeShallow(repo, opts)) {
+    args.push('--depth=1')
+  }
+  if (isWindows(opts)) {
+    args.push('--config', 'core.longpaths=true')
+  }
+  return spawn(args, opts).then(() => revDoc.sha)
+}
+
+const updateSubmodules = async (target, opts) => {
+  const hasSubmodules = await fs.stat(`${target}/.gitmodules`)
+    .then(() => true)
+    .catch(() => false)
+  if (!hasSubmodules) {
+    return null
+  }
+  return spawn([
+    'submodule',
+    'update',
+    '-q',
+    '--init',
+    '--recursive',
+  ], { ...opts, cwd: target })
+}
+
+const unresolved = (repo, ref, target, opts) => {
+  // can't do this one shallowly, because the ref isn't advertised
+  // but we can avoid checking out the working dir twice, at least
+  const lp = isWindows(opts) ? ['--config', 'core.longpaths=true'] : []
+  const cloneArgs = ['clone', '--mirror', '-q', repo, target + '/.git']
+  const git = (args) => spawn(args, { ...opts, cwd: target })
+  return fs.mkdir(target, { recursive: true })
+    .then(() => git(cloneArgs.concat(lp)))
+    .then(() => git(['init']))
+    .then(() => git(['checkout', ref]))
+    .then(() => updateSubmodules(target, opts))
+    .then(() => git(['rev-parse', '--revs-only', 'HEAD']))
+    .then(({ stdout }) => stdout.trim())
+}

node_modules/@npmcli/map-workspaces/node_modules/@npmcli/git/lib/errors.js

@@ -0,0 +1,36 @@
+
+const maxRetry = 3
+
+class GitError extends Error {
+  shouldRetry () {
+    return false
+  }
+}
+
+class GitConnectionError extends GitError {
+  constructor () {
+    super('A git connection error occurred')
+  }
+
+  shouldRetry (number) {
+    return number < maxRetry
+  }
+}
+
+class GitPathspecError extends GitError {
+  constructor () {
+    super('The git reference could not be found')
+  }
+}
+
+class GitUnknownError extends GitError {
+  constructor () {
+    super('An unknown git error occurred')
+  }
+}
+
+module.exports = {
+  GitConnectionError,
+  GitPathspecError,
+  GitUnknownError,
+}