deps: npm-package-arg@9.1.0

node_modules/npm-package-arg/lib/npa.js

@@ -9,6 +9,7 @@ const semver = require('semver')
 const path = global.FAKE_WINDOWS ? require('path').win32 : require('path')
 const validatePackageName = require('validate-npm-package-name')
 const { homedir } = require('os')
+const log = require('proc-log')
 
 const isWindows = process.platform === 'win32' || global.FAKE_WINDOWS
 const hasSlashes = isWindows ? /\\|[/]/ : /[/]/
@@ -120,6 +121,7 @@ function Result (opts) {
   }
   this.gitRange = opts.gitRange
   this.gitCommittish = opts.gitCommittish
+  this.gitSubdir = opts.gitSubdir
   this.hosted = opts.hosted
 }
 
@@ -155,11 +157,45 @@ Result.prototype.toJSON = function () {
 }
 
 function setGitCommittish (res, committish) {
-  if (committish != null && committish.length >= 7 && committish.slice(0, 7) === 'semver:') {
-    res.gitRange = decodeURIComponent(committish.slice(7))
+  if (!committish) {
     res.gitCommittish = null
-  } else {
-    res.gitCommittish = committish === '' ? null : committish
+    return res
+  }
+
+  // for each :: separated item:
+  for (const part of committish.split('::')) {
+    // if the item has no : the n it is a commit-ish
+    if (!part.includes(':')) {
+      if (res.gitRange) {
+        throw new Error('cannot override existing semver range with a committish')
+      }
+      if (res.gitCommittish) {
+        throw new Error('cannot override existing committish with a second committish')
+      }
+      res.gitCommittish = part
+      continue
+    }
+    // split on name:value
+    const [name, value] = part.split(':')
+    // if name is semver do semver lookup of ref or tag
+    if (name === 'semver') {
+      if (res.gitCommittish) {
+        throw new Error('cannot override existing committish with a semver range')
+      }
+      if (res.gitRange) {
+        throw new Error('cannot override existing semver range with a second semver range')
+      }
+      res.gitRange = decodeURIComponent(value)
+      continue
+    }
+    if (name === 'path') {
+      if (res.gitSubdir) {
+        throw new Error('cannot override existing path with a second path')
+      }
+      res.gitSubdir = `/${value}`
+      continue
+    }
+    log.warn('npm-package-arg', `ignoring unknown key "${name}"`)
   }
 
   return res

node_modules/npm-package-arg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npm-package-arg",
-  "version": "9.0.2",
+  "version": "9.1.0",
   "description": "Parse the things that can be arguments to `npm install`",
   "main": "./lib/npa.js",
   "directories": {
@@ -12,12 +12,13 @@
   ],
   "dependencies": {
     "hosted-git-info": "^5.0.0",
+    "proc-log": "^2.0.1",
     "semver": "^7.3.5",
     "validate-npm-package-name": "^4.0.0"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.2.1",
+    "@npmcli/template-oss": "3.5.0",
     "tap": "^16.0.1"
   },
   "scripts": {
@@ -52,6 +53,6 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.2.1"
+    "version": "3.5.0"
   }
 }

package-lock.json

@@ -132,7 +132,7 @@
         "nopt": "^5.0.0",
         "npm-audit-report": "^3.0.0",
         "npm-install-checks": "^5.0.0",
-        "npm-package-arg": "^9.0.2",
+        "npm-package-arg": "^9.1.0",
         "npm-pick-manifest": "^7.0.1",
         "npm-profile": "^6.1.0",
         "npm-registry-fetch": "^13.1.1",
@@ -5131,12 +5131,13 @@
       "license": "ISC"
     },
     "node_modules/npm-package-arg": {
-      "version": "9.0.2",
-      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-9.0.2.tgz",
-      "integrity": "sha512-v/miORuX8cndiOheW8p2moNuPJ7QhcFh9WGlTorruG8hXSA23vMTEp5hTCmDxic0nD8KHhj/NQgFuySD3GYY3g==",
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-9.1.0.tgz",
+      "integrity": "sha512-4J0GL+u2Nh6OnhvUKXRr2ZMG4lR8qtLp+kv7UiV00Y+nGiSxtttCyIRHCt5L5BNkXQld/RceYItau3MDOoGiBw==",
       "inBundle": true,
       "dependencies": {
         "hosted-git-info": "^5.0.0",
+        "proc-log": "^2.0.1",
         "semver": "^7.3.5",
         "validate-npm-package-name": "^4.0.0"
       },

package.json

@@ -100,7 +100,7 @@
     "nopt": "^5.0.0",
     "npm-audit-report": "^3.0.0",
     "npm-install-checks": "^5.0.0",
-    "npm-package-arg": "^9.0.2",
+    "npm-package-arg": "^9.1.0",
     "npm-pick-manifest": "^7.0.1",
     "npm-profile": "^6.1.0",
     "npm-registry-fetch": "^13.1.1",