deps updates

node_modules/@npmcli/config/lib/index.js

@@ -296,6 +296,7 @@ class Config {
     // might be a security hazard, which was the intention.
     try {
       this.setCredentialsByURI(reg, creds)
+    // eslint-disable-next-line no-empty
     } catch (_) {}
     process.emit('timeEnd', 'config:load:credentials')
 
@@ -366,9 +367,11 @@ class Config {
       if (!/^npm_config_/i.test(envKey) || envVal === '') {
         continue
       }
-      const key = envKey.slice('npm_config_'.length)
-        .replace(/(?!^)_/g, '-') // don't replace _ at the start of the key
-        .toLowerCase()
+      let key = envKey.slice('npm_config_'.length)
+      if (!key.startsWith('//')) { // don't normalize nerf-darted keys
+        key = key.replace(/(?!^)_/g, '-') // don't replace _ at the start of the key
+          .toLowerCase()
+      }
       conf[key] = envVal
     }
     this[_loadObject](conf, 'env', 'environment')
@@ -654,6 +657,7 @@ class Config {
       // saved back to the .npmrc file, so we're good.
       try {
         this.setCredentialsByURI(reg, creds)
+      // eslint-disable-next-line no-empty
       } catch (_) {}
     }
 
@@ -691,8 +695,6 @@ class Config {
       this.delete(`_password`, 'user')
       this.delete(`username`, 'user')
     }
-    this.delete(`${nerfed}:-authtoken`, 'user')
-    this.delete(`${nerfed}:_authtoken`, 'user')
     this.delete(`${nerfed}:_authToken`, 'user')
     this.delete(`${nerfed}:_auth`, 'user')
     this.delete(`${nerfed}:_password`, 'user')
@@ -732,8 +734,6 @@ class Config {
     // send auth if we have it, only to the URIs under the nerf dart.
     this.delete(`${nerfed}:always-auth`, 'user')
 
-    this.delete(`${nerfed}:-authtoken`, 'user')
-    this.delete(`${nerfed}:_authtoken`, 'user')
     this.delete(`${nerfed}:email`, 'user')
     if (certfile && keyfile) {
       this.set(`${nerfed}:certfile`, certfile, 'user')
@@ -781,8 +781,6 @@ class Config {
     }
 
     const tokenReg = this.get(`${nerfed}:_authToken`) ||
-      this.get(`${nerfed}:_authtoken`) ||
-      this.get(`${nerfed}:-authtoken`) ||
       nerfed === nerfDart(this.get('registry')) && this.get('_authToken')
 
     if (tokenReg) {

node_modules/@npmcli/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/config",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "files": [
     "bin/",
     "lib/"
@@ -38,7 +38,7 @@
     "@npmcli/map-workspaces": "^2.0.2",
     "ini": "^3.0.0",
     "mkdirp-infer-owner": "^2.0.0",
-    "nopt": "^5.0.0",
+    "nopt": "^6.0.0",
     "proc-log": "^2.0.0",
     "read-package-json-fast": "^2.0.3",
     "semver": "^7.3.5",

node_modules/@npmcli/map-workspaces/lib/index.js

@@ -12,7 +12,7 @@ function appendNegatedPatterns (patterns) {
   for (let pattern of patterns) {
     const excl = pattern.match(/^!+/)
     if (excl) {
-      pattern = pattern.substr(excl[0].length)
+      pattern = pattern.slice(excl[0].length)
     }
 
     // strip off any / from the start of the pattern.  /foo => foo

node_modules/@npmcli/map-workspaces/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/map-workspaces",
-  "version": "2.0.3",
+  "version": "2.0.4",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.4.1",
+    "@npmcli/template-oss": "3.5.0",
     "tap": "^16.0.1"
   },
   "dependencies": {
@@ -53,6 +53,6 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.4.1"
+    "version": "3.5.0"
   }
 }

node_modules/@npmcli/run-script/lib/escape.js

@@ -36,14 +36,11 @@ const cmd = (input, doubleEscape) => {
   }
 
   // and finally, prefix shell meta chars with a ^
-  result = result.replace(/[ !^&()<>|"]/g, '^$&')
+  result = result.replace(/[ !%^&()<>|"]/g, '^$&')
   if (doubleEscape) {
-    result = result.replace(/[ !^&()<>|"]/g, '^$&')
+    result = result.replace(/[ !%^&()<>|"]/g, '^$&')
   }
 
-  // except for % which is escaped with another %, and only once
-  result = result.replace(/%/g, '%%')
-
   return result
 }
 
@@ -65,13 +62,7 @@ const sh = (input) => {
   return result
 }
 
-// disabling the no-control-regex rule for this line as we very specifically _do_ want to
-// replace those characters if they somehow exist at this point, which is highly unlikely
-// eslint-disable-next-line no-control-regex
-const filename = (input) => input.replace(/[<>:"/\\|?*\x00-\x1F]/g, '')
-
 module.exports = {
   cmd,
   sh,
-  filename,
 }

node_modules/@npmcli/run-script/lib/make-spawn-args.js

@@ -1,19 +1,10 @@
 /* eslint camelcase: "off" */
 const isWindows = require('./is-windows.js')
 const setPATH = require('./set-path.js')
-const { unlinkSync: unlink, writeFileSync: writeFile } = require('fs')
-const { tmpdir } = require('os')
 const { resolve } = require('path')
 const which = require('which')
 const npm_config_node_gyp = require.resolve('node-gyp/bin/node-gyp.js')
 const escape = require('./escape.js')
-const { randomBytes } = require('crypto')
-
-const translateWinPathToPosix = (path) => {
-  return path
-    .replace(/^([A-z]):/, '/$1')
-    .replace(/\\/g, '/')
-}
 
 const makeSpawnArgs = options => {
   const {
@@ -38,10 +29,7 @@ const makeSpawnArgs = options => {
     npm_config_node_gyp,
   })
 
-  const fileName = escape.filename(`${event}-${randomBytes(4).toString('hex')}`)
-  let scriptFile
-  let script = ''
-
+  let doubleEscape = false
   const isCmd = /(?:^|\\)cmd(?:\.exe)?$/i.test(scriptShell)
   if (isCmd) {
     let initialCmd = ''
@@ -68,26 +56,18 @@ const makeSpawnArgs = options => {
       pathToInitial = initialCmd.toLowerCase()
     }
 
-    const doubleEscape = pathToInitial.endsWith('.cmd') || pathToInitial.endsWith('.bat')
-
-    scriptFile = resolve(tmpdir(), `${fileName}.cmd`)
-    script += '@echo off\n'
-    script += cmd
-    if (args.length) {
-      script += ` ${args.map((arg) => escape.cmd(arg, doubleEscape)).join(' ')}`
-    }
-  } else {
-    scriptFile = resolve(tmpdir(), `${fileName}.sh`)
-    script = cmd
-    if (args.length) {
-      script += ` ${args.map((arg) => escape.sh(arg)).join(' ')}`
-    }
+    doubleEscape = pathToInitial.endsWith('.cmd') || pathToInitial.endsWith('.bat')
   }
 
-  writeFile(scriptFile, script)
+  let script = cmd
+  for (const arg of args) {
+    script += isCmd
+      ? ` ${escape.cmd(arg, doubleEscape)}`
+      : ` ${escape.sh(arg)}`
+  }
   const spawnArgs = isCmd
-    ? ['/d', '/s', '/c', escape.cmd(scriptFile)]
-    : [isWindows ? translateWinPathToPosix(scriptFile) : scriptFile]
+    ? ['/d', '/s', '/c', script]
+    : ['-c', '--', script]
 
   const spawnOpts = {
     env: spawnEnv,
@@ -97,16 +77,7 @@ const makeSpawnArgs = options => {
     ...(isCmd ? { windowsVerbatimArguments: true } : {}),
   }
 
-  const cleanup = () => {
-    // delete the script, this is just a best effort
-    try {
-      unlink(scriptFile)
-    } catch (err) {
-      // ignore errors
-    }
-  }
-
-  return [scriptShell, spawnArgs, spawnOpts, cleanup]
+  return [scriptShell, spawnArgs, spawnOpts]
 }
 
 module.exports = makeSpawnArgs

node_modules/@npmcli/run-script/lib/run-script-pkg.js

@@ -6,8 +6,17 @@ const signalManager = require('./signal-manager.js')
 const isServerPackage = require('./is-server-package.js')
 
 // you wouldn't like me when I'm angry...
-const bruce = (id, event, cmd) =>
-  `\n> ${id ? id + ' ' : ''}${event}\n> ${cmd.trim().replace(/\n/g, '\n> ')}\n`
+const bruce = (id, event, cmd, args) => {
+  let banner = id
+    ? `\n> ${id} ${event}\n`
+    : `\n> ${event}\n`
+  banner += `> ${cmd.trim().replace(/\n/g, '\n> ')}`
+  if (args.length) {
+    banner += ` ${args.join(' ')}`
+  }
+  banner += '\n'
+  return banner
+}
 
 const runScriptPkg = async options => {
   const {
@@ -52,10 +61,10 @@ const runScriptPkg = async options => {
 
   if (stdio === 'inherit' && banner !== false) {
     // we're dumping to the parent's stdout, so print the banner
-    console.log(bruce(pkg._id, event, cmd))
+    console.log(bruce(pkg._id, event, cmd, args))
   }
 
-  const [spawnShell, spawnArgs, spawnOpts, cleanup] = makeSpawnArgs({
+  const [spawnShell, spawnArgs, spawnOpts] = makeSpawnArgs({
     event,
     path,
     scriptShell,
@@ -93,7 +102,7 @@ const runScriptPkg = async options => {
     } else {
       throw er
     }
-  }).finally(cleanup)
+  })
 }
 
 module.exports = runScriptPkg

node_modules/@npmcli/run-script/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/run-script",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "Run a lifecycle script for a package (descendant of npm-lifecycle)",
   "author": "GitHub Inc.",
   "license": "ISC",

node_modules/are-we-there-yet/lib/tracker-group.js

@@ -103,7 +103,7 @@ TrackerGroup.prototype.finish = function () {
 var buffer = '                                  '
 TrackerGroup.prototype.debug = function (depth) {
   depth = depth || 0
-  var indent = depth ? buffer.substr(0, depth) : ''
+  var indent = depth ? buffer.slice(0, depth) : ''
   var output = indent + (this.name || 'top') + ': ' + this.completed() + '\n'
   this.trackers.forEach(function (tracker) {
     if (tracker instanceof TrackerGroup) {

node_modules/are-we-there-yet/package.json

@@ -1,21 +1,21 @@
 {
   "name": "are-we-there-yet",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Keep track of the overall completion of many disparate processes",
   "main": "lib/index.js",
   "scripts": {
     "test": "tap",
     "npmclilint": "npmcli-lint",
-    "lint": "eslint '**/*.js'",
+    "lint": "eslint \"**/*.js\"",
     "lintfix": "npm run lint -- --fix",
     "posttest": "npm run lint",
     "postsnap": "npm run lintfix --",
     "preversion": "npm test",
     "postversion": "npm publish",
     "prepublishOnly": "git push origin --follow-tags",
     "snap": "tap",
-    "postlint": "npm-template-check",
-    "template-copy": "npm-template-copy --force"
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force"
   },
   "repository": {
     "type": "git",
@@ -28,22 +28,20 @@
   },
   "homepage": "https://github.com/npm/are-we-there-yet",
   "devDependencies": {
-    "@npmcli/eslint-config": "^2.0.0",
-    "@npmcli/template-oss": "^2.7.1",
-    "eslint": "^8.8.0",
-    "eslint-plugin-node": "^11.1.0",
-    "tap": "^15.0.9"
+    "@npmcli/eslint-config": "^3.0.1",
+    "@npmcli/template-oss": "3.5.0",
+    "tap": "^16.0.1"
   },
   "dependencies": {
     "delegates": "^1.0.0",
     "readable-stream": "^3.6.0"
   },
   "files": [
-    "bin",
-    "lib"
+    "bin/",
+    "lib/"
   ],
   "engines": {
-    "node": "^12.13.0 || ^14.15.0 || >=16"
+    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
   },
   "tap": {
     "branches": 68,
@@ -52,6 +50,7 @@
     "lines": 92
   },
   "templateOSS": {
-    "version": "2.7.1"
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "3.5.0"
   }
 }