will filter out a small subset of non-URL-safe characters that still
parse properly with `new URL`

PR-URL: #3804
Credit: @isaacs
Close: #3804
Reviewed-by: @wraithgar

closes: #2556
xref: #1750

The xref'ed PR apparently dropped this behavior
without any explanation.

PR-URL: #3799
Credit: @gfyoung
Close: #3799
Reviewed-by: @wraithgar

  * fix: avoid infinite loops in peer dep replacements
  * fix: use Intl.Collator for string sorting when available
  * feat(vuln): expose isDirect

The npm/cli form of npm/arborist#324

Required adding options support to package used for this.

PR-URL: #3809
Credit: @isaacs
Close: #3809
Reviewed-by: @wraithgar

PR-URL: #3805
Credit: @ethomson
Close: #3805
Reviewed-by: @lukekarrys

PR-URL: #3699
Credit: @behnammodi
Close: #3699
Reviewed-by: @wraithgar

  * includeWorkspaceRoot support
  * workspacesEnabled=false support

PR-URL: #3815
Credit: @wraithgar
Close: #3815
Reviewed-by: @isaacs

Adds a new config item that includes the workspace root when running
non-arborist commands (i.e. repo, version, publish).  Arborist will need
to be udpated to look for this flag to change its behavior to include
the workspace root for its functions.

This also changes --workspaces to a trinary, so that setting it to false
will explicitly exclude workspaces altogether.  This is also going to
require an arborist change so that it ignores workspaces altogether.

Co-author: @fritzy

PR-URL: #3816
Credit: @isaacs
Close: #3816
Reviewed-by: @wraithgar

This reverts commit f17dfa0.

This reverts commit 8349c3c.

PR-URL: #3817
Credit: @lukekarrys
Close: #3817
Reviewed-by: @wraithgar