deps: upgrade npm to 7.18.1

PR-URL: https://github.com/nodejs/node/pull/39065
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruy Adorno <ruyadorno@github.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Myles Borins <myles.borins@gmail.com>

deps/npm/docs/content/commands/npm-audit.md

@@ -250,8 +250,14 @@ Not supported by all npm commands.
 * Default: false
 * Type: Boolean
 
-If set to true, it will update only the `package-lock.json`, instead of
-checking `node_modules` and downloading dependencies.
+If set to true, the current operation will only use the `package-lock.json`,
+ignoring `node_modules`.
+
+For `update` this means only the `package-lock.json` will be updated,
+instead of checking `node_modules` and downloading dependencies.
+
+For `list` this means the output will be based on the tree described by the
+`package-lock.json`, rather than the contents of `node_modules`.
 
 #### `omit`
 

deps/npm/docs/content/commands/npm-ls.md

@@ -155,18 +155,21 @@ variable will be set to `'production'` for all lifecycle scripts.
 * Default: false
 * Type: Boolean
 
-If true, then local installs will link if there is a suitable globally
-installed package.
+Used with `npm ls`, limiting output to only those packages that are linked.
 
-Note that this means that local installs can cause things to be installed
-into the global space at the same time. The link is only done if one of the
-two conditions are met:
+#### `package-lock-only`
 
-* The package is not already installed globally, or
-* the globally installed version is identical to the version that is being
-  installed locally.
+* Default: false
+* Type: Boolean
 
-When used with `npm ls`, only show packages that are linked.
+If set to true, the current operation will only use the `package-lock.json`,
+ignoring `node_modules`.
+
+For `update` this means only the `package-lock.json` will be updated,
+instead of checking `node_modules` and downloading dependencies.
+
+For `list` this means the output will be based on the tree described by the
+`package-lock.json`, rather than the contents of `node_modules`.
 
 #### `unicode`
 

deps/npm/docs/content/commands/npm-pack.md

@@ -36,6 +36,13 @@ Whether or not to output JSON data, rather than the normal output.
 
 Not supported by all npm commands.
 
+#### `pack-destination`
+
+* Default: "."
+* Type: String
+
+Directory in which `npm pack` will save tarballs.
+
 #### `workspace`
 
 * Default:

deps/npm/docs/content/using-npm/config.md

@@ -743,18 +743,7 @@ Use of `legacy-peer-deps` is not recommended, as it will not enforce the
 * Default: false
 * Type: Boolean
 
-If true, then local installs will link if there is a suitable globally
-installed package.
-
-Note that this means that local installs can cause things to be installed
-into the global space at the same time. The link is only done if one of the
-two conditions are met:
-
-* The package is not already installed globally, or
-* the globally installed version is identical to the version that is being
-  installed locally.
-
-When used with `npm ls`, only show packages that are linked.
+Used with `npm ls`, limiting output to only those packages that are linked.
 
 #### `local-address`
 
@@ -878,6 +867,13 @@ when publishing or changing package permissions with `npm access`.
 If not set, and a registry response fails with a challenge for a one-time
 password, npm will prompt on the command line for one.
 
+#### `pack-destination`
+
+* Default: "."
+* Type: String
+
+Directory in which `npm pack` will save tarballs.
+
 #### `package`
 
 * Default:
@@ -902,8 +898,14 @@ package-locks disabled use `npm prune`.
 * Default: false
 * Type: Boolean
 
-If set to true, it will update only the `package-lock.json`, instead of
-checking `node_modules` and downloading dependencies.
+If set to true, the current operation will only use the `package-lock.json`,
+ignoring `node_modules`.
+
+For `update` this means only the `package-lock.json` will be updated,
+instead of checking `node_modules` and downloading dependencies.
+
+For `list` this means the output will be based on the tree described by the
+`package-lock.json`, rather than the contents of `node_modules`.
 
 #### `parseable`
 

deps/npm/docs/output/commands/npm-audit.html

@@ -324,8 +324,12 @@ recommended that you do not use this option!</p>
 <li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
-<p>If set to true, it will update only the <code>package-lock.json</code>, instead of
-checking <code>node_modules</code> and downloading dependencies.</p>
+<p>If set to true, the current operation will only use the <code>package-lock.json</code>,
+ignoring <code>node_modules</code>.</p>
+<p>For <code>update</code> this means only the <code>package-lock.json</code> will be updated,
+instead of checking <code>node_modules</code> and downloading dependencies.</p>
+<p>For <code>list</code> this means the output will be based on the tree described by the
+<code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
 <h4 id="omit"><code>omit</code></h4>
 <ul>
 <li>Default: ‘dev’ if the <code>NODE_ENV</code> environment variable is set to

deps/npm/docs/output/commands/npm-ls.html

@@ -141,7 +141,7 @@ npm command-line interface
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#note-design-changes-pending">Note: Design Changes Pending</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#all"><code>all</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#long"><code>long</code></a></li><li><a href="#parseable"><code>parseable</code></a></li><li><a href="#global"><code>global</code></a></li><li><a href="#depth"><code>depth</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#link"><code>link</code></a></li><li><a href="#unicode"><code>unicode</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
+<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#description">Description</a></li><li><a href="#note-design-changes-pending">Note: Design Changes Pending</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#all"><code>all</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#long"><code>long</code></a></li><li><a href="#parseable"><code>parseable</code></a></li><li><a href="#global"><code>global</code></a></li><li><a href="#depth"><code>depth</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#link"><code>link</code></a></li><li><a href="#package-lock-only"><code>package-lock-only</code></a></li><li><a href="#unicode"><code>unicode</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li></ul><li><a href="#see-also">See Also</a></li></ul></div>
 </section>
 
 <div id="_content"><h3 id="synopsis">Synopsis</h3>
@@ -159,7 +159,7 @@ tree at all, use <a href="../commands/npm-explain.html"><code>npm explain</code>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm’s source tree will show:</p>
-<pre lang="bash"><code>npm@7.17.0 /path/to/npm
+<pre lang="bash"><code>npm@7.18.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>
@@ -263,17 +263,18 @@ variable will be set to <code>'production'</code> for all lifecycle scripts.</p>
 <li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
-<p>If true, then local installs will link if there is a suitable globally
-installed package.</p>
-<p>Note that this means that local installs can cause things to be installed
-into the global space at the same time. The link is only done if one of the
-two conditions are met:</p>
+<p>Used with <code>npm ls</code>, limiting output to only those packages that are linked.</p>
+<h4 id="package-lock-only"><code>package-lock-only</code></h4>
 <ul>
-<li>The package is not already installed globally, or</li>
-<li>the globally installed version is identical to the version that is being
-installed locally.</li>
+<li>Default: false</li>
+<li>Type: Boolean</li>
 </ul>
-<p>When used with <code>npm ls</code>, only show packages that are linked.</p>
+<p>If set to true, the current operation will only use the <code>package-lock.json</code>,
+ignoring <code>node_modules</code>.</p>
+<p>For <code>update</code> this means only the <code>package-lock.json</code> will be updated,
+instead of checking <code>node_modules</code> and downloading dependencies.</p>
+<p>For <code>list</code> this means the output will be based on the tree described by the
+<code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
 <h4 id="unicode"><code>unicode</code></h4>
 <ul>
 <li>Default: false on windows, true on mac/unix systems with a unicode locale,

deps/npm/docs/output/commands/npm-pack.html

@@ -141,7 +141,7 @@ npm command-line interface
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li></ul><li><a href="#description">Description</a></li><li><a href="#see-also">See Also</a></li></ul></div>
+<div id="_table_of_contents"><ul><li><a href="#synopsis">Synopsis</a></li><li><a href="#configuration">Configuration</a></li><ul><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#pack-destination"><code>pack-destination</code></a></li><li><a href="#workspace"><code>workspace</code></a></li><li><a href="#workspaces"><code>workspaces</code></a></li></ul><li><a href="#description">Description</a></li><li><a href="#see-also">See Also</a></li></ul></div>
 </section>
 
 <div id="_content"><h3 id="synopsis">Synopsis</h3>
@@ -168,6 +168,12 @@ commands that modify your local installation, eg, <code>install</code>, <code>up
 </ul>
 <p>Whether or not to output JSON data, rather than the normal output.</p>
 <p>Not supported by all npm commands.</p>
+<h4 id="pack-destination"><code>pack-destination</code></h4>
+<ul>
+<li>Default: “.”</li>
+<li>Type: String</li>
+</ul>
+<p>Directory in which <code>npm pack</code> will save tarballs.</p>
 <h4 id="workspace"><code>workspace</code></h4>
 <ul>
 <li>Default:</li>

deps/npm/docs/output/commands/npm.html

@@ -148,7 +148,7 @@ npm command-line interface
 <pre lang="bash"><code>npm &lt;command&gt; [args]
 </code></pre>
 <h3 id="version">Version</h3>
-<p>7.17.0</p>
+<p>7.18.1</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/docs/output/using-npm/config.html

@@ -141,7 +141,7 @@ npm command-line interface
 
 <section id="table_of_contents">
 <h2 id="table-of-contents">Table of contents</h2>
-<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><ul><li><a href="#command-line-flags">Command Line Flags</a></li><li><a href="#environment-variables">Environment Variables</a></li><li><a href="#npmrc-files">npmrc Files</a></li><li><a href="#default-configs">Default Configs</a></li></ul><li><a href="#shorthands-and-other-cli-niceties">Shorthands and Other CLI Niceties</a></li><li><a href="#config-settings">Config Settings</a></li><ul><li><a href="#auth"><code>_auth</code></a></li><li><a href="#access"><code>access</code></a></li><li><a href="#all"><code>all</code></a></li><li><a href="#allow-same-version"><code>allow-same-version</code></a></li><li><a href="#audit"><code>audit</code></a></li><li><a href="#audit-level"><code>audit-level</code></a></li><li><a href="#before"><code>before</code></a></li><li><a href="#bin-links"><code>bin-links</code></a></li><li><a href="#browser"><code>browser</code></a></li><li><a href="#ca"><code>ca</code></a></li><li><a href="#cache"><code>cache</code></a></li><li><a href="#cafile"><code>cafile</code></a></li><li><a href="#call"><code>call</code></a></li><li><a href="#cert"><code>cert</code></a></li><li><a href="#ci-name"><code>ci-name</code></a></li><li><a href="#cidr"><code>cidr</code></a></li><li><a href="#color"><code>color</code></a></li><li><a href="#commit-hooks"><code>commit-hooks</code></a></li><li><a href="#depth"><code>depth</code></a></li><li><a href="#description2"><code>description</code></a></li><li><a href="#diff"><code>diff</code></a></li><li><a href="#diff-dst-prefix"><code>diff-dst-prefix</code></a></li><li><a href="#diff-ignore-all-space"><code>diff-ignore-all-space</code></a></li><li><a href="#diff-name-only"><code>diff-name-only</code></a></li><li><a href="#diff-no-prefix"><code>diff-no-prefix</code></a></li><li><a href="#diff-src-prefix"><code>diff-src-prefix</code></a></li><li><a href="#diff-text"><code>diff-text</code></a></li><li><a href="#diff-unified"><code>diff-unified</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#editor"><code>editor</code></a></li><li><a href="#engine-strict"><code>engine-strict</code></a></li><li><a href="#fetch-retries"><code>fetch-retries</code></a></li><li><a href="#fetch-retry-factor"><code>fetch-retry-factor</code></a></li><li><a href="#fetch-retry-maxtimeout"><code>fetch-retry-maxtimeout</code></a></li><li><a href="#fetch-retry-mintimeout"><code>fetch-retry-mintimeout</code></a></li><li><a href="#fetch-timeout"><code>fetch-timeout</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#foreground-scripts"><code>foreground-scripts</code></a></li><li><a href="#format-package-lock"><code>format-package-lock</code></a></li><li><a href="#fund"><code>fund</code></a></li><li><a href="#git"><code>git</code></a></li><li><a href="#git-tag-version"><code>git-tag-version</code></a></li><li><a href="#global"><code>global</code></a></li><li><a href="#global-style"><code>global-style</code></a></li><li><a href="#globalconfig"><code>globalconfig</code></a></li><li><a href="#heading"><code>heading</code></a></li><li><a href="#https-proxy"><code>https-proxy</code></a></li><li><a href="#if-present"><code>if-present</code></a></li><li><a href="#ignore-scripts"><code>ignore-scripts</code></a></li><li><a href="#include"><code>include</code></a></li><li><a href="#include-staged"><code>include-staged</code></a></li><li><a href="#init-author-email"><code>init-author-email</code></a></li><li><a href="#init-author-name"><code>init-author-name</code></a></li><li><a href="#init-author-url"><code>init-author-url</code></a></li><li><a href="#init-license"><code>init-license</code></a></li><li><a href="#init-module"><code>init-module</code></a></li><li><a href="#init-version"><code>init-version</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#key"><code>key</code></a></li><li><a href="#legacy-bundling"><code>legacy-bundling</code></a></li><li><a href="#legacy-peer-deps"><code>legacy-peer-deps</code></a></li><li><a href="#link"><code>link</code></a></li><li><a href="#local-address"><code>local-address</code></a></li><li><a href="#loglevel"><code>loglevel</code></a></li><li><a href="#logs-max"><code>logs-max</code></a></li><li><a href="#long"><code>long</code></a></li><li><a href="#maxsockets"><code>maxsockets</code></a></li><li><a href="#message"><code>message</code></a></li><li><a href="#node-options"><code>node-options</code></a></li><li><a href="#node-version"><code>node-version</code></a></li><li><a href="#noproxy"><code>noproxy</code></a></li><li><a href="#npm-version"><code>npm-version</code></a></li><li><a href="#offline"><code>offline</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#otp"><code>otp</code></a></li><li><a href="#package"><code>package</code></a></li><li><a href="#package-lock"><code>package-lock</code></a></li><li><a href="#package-lock-only"><code>package-lock-only</code></a></li><li><a href=Line truncated
+<div id="_table_of_contents"><ul><li><a href="#description">Description</a></li><ul><li><a href="#command-line-flags">Command Line Flags</a></li><li><a href="#environment-variables">Environment Variables</a></li><li><a href="#npmrc-files">npmrc Files</a></li><li><a href="#default-configs">Default Configs</a></li></ul><li><a href="#shorthands-and-other-cli-niceties">Shorthands and Other CLI Niceties</a></li><li><a href="#config-settings">Config Settings</a></li><ul><li><a href="#auth"><code>_auth</code></a></li><li><a href="#access"><code>access</code></a></li><li><a href="#all"><code>all</code></a></li><li><a href="#allow-same-version"><code>allow-same-version</code></a></li><li><a href="#audit"><code>audit</code></a></li><li><a href="#audit-level"><code>audit-level</code></a></li><li><a href="#before"><code>before</code></a></li><li><a href="#bin-links"><code>bin-links</code></a></li><li><a href="#browser"><code>browser</code></a></li><li><a href="#ca"><code>ca</code></a></li><li><a href="#cache"><code>cache</code></a></li><li><a href="#cafile"><code>cafile</code></a></li><li><a href="#call"><code>call</code></a></li><li><a href="#cert"><code>cert</code></a></li><li><a href="#ci-name"><code>ci-name</code></a></li><li><a href="#cidr"><code>cidr</code></a></li><li><a href="#color"><code>color</code></a></li><li><a href="#commit-hooks"><code>commit-hooks</code></a></li><li><a href="#depth"><code>depth</code></a></li><li><a href="#description2"><code>description</code></a></li><li><a href="#diff"><code>diff</code></a></li><li><a href="#diff-dst-prefix"><code>diff-dst-prefix</code></a></li><li><a href="#diff-ignore-all-space"><code>diff-ignore-all-space</code></a></li><li><a href="#diff-name-only"><code>diff-name-only</code></a></li><li><a href="#diff-no-prefix"><code>diff-no-prefix</code></a></li><li><a href="#diff-src-prefix"><code>diff-src-prefix</code></a></li><li><a href="#diff-text"><code>diff-text</code></a></li><li><a href="#diff-unified"><code>diff-unified</code></a></li><li><a href="#dry-run"><code>dry-run</code></a></li><li><a href="#editor"><code>editor</code></a></li><li><a href="#engine-strict"><code>engine-strict</code></a></li><li><a href="#fetch-retries"><code>fetch-retries</code></a></li><li><a href="#fetch-retry-factor"><code>fetch-retry-factor</code></a></li><li><a href="#fetch-retry-maxtimeout"><code>fetch-retry-maxtimeout</code></a></li><li><a href="#fetch-retry-mintimeout"><code>fetch-retry-mintimeout</code></a></li><li><a href="#fetch-timeout"><code>fetch-timeout</code></a></li><li><a href="#force"><code>force</code></a></li><li><a href="#foreground-scripts"><code>foreground-scripts</code></a></li><li><a href="#format-package-lock"><code>format-package-lock</code></a></li><li><a href="#fund"><code>fund</code></a></li><li><a href="#git"><code>git</code></a></li><li><a href="#git-tag-version"><code>git-tag-version</code></a></li><li><a href="#global"><code>global</code></a></li><li><a href="#global-style"><code>global-style</code></a></li><li><a href="#globalconfig"><code>globalconfig</code></a></li><li><a href="#heading"><code>heading</code></a></li><li><a href="#https-proxy"><code>https-proxy</code></a></li><li><a href="#if-present"><code>if-present</code></a></li><li><a href="#ignore-scripts"><code>ignore-scripts</code></a></li><li><a href="#include"><code>include</code></a></li><li><a href="#include-staged"><code>include-staged</code></a></li><li><a href="#init-author-email"><code>init-author-email</code></a></li><li><a href="#init-author-name"><code>init-author-name</code></a></li><li><a href="#init-author-url"><code>init-author-url</code></a></li><li><a href="#init-license"><code>init-license</code></a></li><li><a href="#init-module"><code>init-module</code></a></li><li><a href="#init-version"><code>init-version</code></a></li><li><a href="#json"><code>json</code></a></li><li><a href="#key"><code>key</code></a></li><li><a href="#legacy-bundling"><code>legacy-bundling</code></a></li><li><a href="#legacy-peer-deps"><code>legacy-peer-deps</code></a></li><li><a href="#link"><code>link</code></a></li><li><a href="#local-address"><code>local-address</code></a></li><li><a href="#loglevel"><code>loglevel</code></a></li><li><a href="#logs-max"><code>logs-max</code></a></li><li><a href="#long"><code>long</code></a></li><li><a href="#maxsockets"><code>maxsockets</code></a></li><li><a href="#message"><code>message</code></a></li><li><a href="#node-options"><code>node-options</code></a></li><li><a href="#node-version"><code>node-version</code></a></li><li><a href="#noproxy"><code>noproxy</code></a></li><li><a href="#npm-version"><code>npm-version</code></a></li><li><a href="#offline"><code>offline</code></a></li><li><a href="#omit"><code>omit</code></a></li><li><a href="#otp"><code>otp</code></a></li><li><a href="#pack-destination"><code>pack-destination</code></a></li><li><a href="#package"><code>package</code></a></li><li><a href="#package-lock"><code>package-lock</code></a></li><li><a href="#Line truncated
 </section>
 
 <div id="_content"><h3 id="description">Description</h3>
@@ -765,17 +765,7 @@ that collide, it provides a way to move forward resolving the situation.</p>
 <li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
-<p>If true, then local installs will link if there is a suitable globally
-installed package.</p>
-<p>Note that this means that local installs can cause things to be installed
-into the global space at the same time. The link is only done if one of the
-two conditions are met:</p>
-<ul>
-<li>The package is not already installed globally, or</li>
-<li>the globally installed version is identical to the version that is being
-installed locally.</li>
-</ul>
-<p>When used with <code>npm ls</code>, only show packages that are linked.</p>
+<p>Used with <code>npm ls</code>, limiting output to only those packages that are linked.</p>
 <h4 id="local-address"><code>local-address</code></h4>
 <ul>
 <li>Default: null</li>
@@ -877,6 +867,12 @@ variable will be set to <code>'production'</code> for all lifecycle scripts.</p>
 when publishing or changing package permissions with <code>npm access</code>.</p>
 <p>If not set, and a registry response fails with a challenge for a one-time
 password, npm will prompt on the command line for one.</p>
+<h4 id="pack-destination"><code>pack-destination</code></h4>
+<ul>
+<li>Default: “.”</li>
+<li>Type: String</li>
+</ul>
+<p>Directory in which <code>npm pack</code> will save tarballs.</p>
 <h4 id="package"><code>package</code></h4>
 <ul>
 <li>Default:</li>
@@ -898,8 +894,12 @@ package-locks disabled use <code>npm prune</code>.</p>
 <li>Default: false</li>
 <li>Type: Boolean</li>
 </ul>
-<p>If set to true, it will update only the <code>package-lock.json</code>, instead of
-checking <code>node_modules</code> and downloading dependencies.</p>
+<p>If set to true, the current operation will only use the <code>package-lock.json</code>,
+ignoring <code>node_modules</code>.</p>
+<p>For <code>update</code> this means only the <code>package-lock.json</code> will be updated,
+instead of checking <code>node_modules</code> and downloading dependencies.</p>
+<p>For <code>list</code> this means the output will be based on the tree described by the
+<code>package-lock.json</code>, rather than the contents of <code>node_modules</code>.</p>
 <h4 id="parseable"><code>parseable</code></h4>
 <ul>
 <li>Default: false</li>

deps/npm/lib/audit.js

@@ -58,7 +58,7 @@ class Audit extends ArboristWorkspaceCmd {
       audit: true,
       path: this.npm.prefix,
       reporter,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
 
     const arb = new Arborist(opts)

deps/npm/lib/base-command.js

@@ -1,6 +1,7 @@
 // Base class for npm.commands[cmd]
 const usageUtil = require('./utils/usage.js')
 const ConfigDefinitions = require('./utils/config/definitions.js')
+const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 class BaseCommand {
   constructor (npm) {
@@ -72,5 +73,13 @@ class BaseCommand {
       { code: 'ENOWORKSPACES' }
     )
   }
+
+  async setWorkspaces (filters) {
+    // TODO npm guards workspaces/global mode so we should use this.npm.prefix?
+    const ws = await getWorkspaces(filters, { path: this.npm.localPrefix })
+    this.workspaces = ws
+    this.workspaceNames = [...ws.keys()]
+    this.workspacePaths = [...ws.values()]
+  }
 }
 module.exports = BaseCommand

deps/npm/lib/ci.js

@@ -55,7 +55,7 @@ class CI extends ArboristWorkspaceCmd {
       path: where,
       log: this.npm.log,
       save: false, // npm ci should never modify the lockfile or package.json
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
 
     const arb = new Arborist(opts)

deps/npm/lib/cli.js

@@ -20,6 +20,7 @@ module.exports = (process) => {
 
   const npm = require('../lib/npm.js')
   const errorHandler = require('../lib/utils/error-handler.js')
+  errorHandler.setNpm(npm)
 
   // if npm is called as "npmg" or "npm_g", then
   // run in global mode.

deps/npm/lib/dedupe.js

@@ -50,7 +50,7 @@ class Dedupe extends ArboristWorkspaceCmd {
       log: this.npm.log,
       path: where,
       dryRun,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
     const arb = new Arborist(opts)
     await arb.dedupe(opts)

deps/npm/lib/diff.js

@@ -8,7 +8,6 @@ const npmlog = require('npmlog')
 const pacote = require('pacote')
 const pickManifest = require('npm-pick-manifest')
 
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const readPackageName = require('./utils/read-package-name.js')
 const BaseCommand = require('./base-command.js')
 
@@ -90,9 +89,8 @@ class Diff extends BaseCommand {
   }
 
   async diffWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    for (const workspacePath of workspaces.values()) {
+    await this.setWorkspaces(filters)
+    for (const workspacePath of this.workspacePaths) {
       this.top = workspacePath
       this.prefix = workspacePath
       await this.diff(args)
@@ -104,7 +102,6 @@ class Diff extends BaseCommand {
   async packageName (path) {
     let name
     try {
-      // TODO this won't work as expected in global mode
       name = await readPackageName(this.prefix)
     } catch (e) {
       npmlog.verbose('diff', 'could not read project dir package.json')

deps/npm/lib/dist-tag.js

@@ -5,7 +5,6 @@ const semver = require('semver')
 
 const otplease = require('./utils/otplease.js')
 const readPackageName = require('./utils/read-package-name.js')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const BaseCommand = require('./base-command.js')
 
 class DistTag extends BaseCommand {
@@ -180,10 +179,9 @@ class DistTag extends BaseCommand {
   }
 
   async listWorkspaces (filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
 
-    for (const [name] of workspaces) {
+    for (const name of this.workspaceNames) {
       try {
         this.npm.output(`${name}:`)
         await this.list(npa(name), this.npm.flatOptions)

deps/npm/lib/docs.js

@@ -2,7 +2,6 @@ const log = require('npmlog')
 const pacote = require('pacote')
 const openUrl = require('./utils/open-url.js')
 const hostedFromMani = require('./utils/hosted-git-info-from-manifest.js')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 const BaseCommand = require('./base-command.js')
 class Docs extends BaseCommand {
@@ -42,9 +41,8 @@ class Docs extends BaseCommand {
   }
 
   async docsWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    return this.docs([...workspaces.values()])
+    await this.setWorkspaces(filters)
+    return this.docs(this.workspacePaths)
   }
 
   async getDocs (pkg) {

deps/npm/lib/exec.js

@@ -1,7 +1,6 @@
 const libexec = require('libnpmexec')
 const BaseCommand = require('./base-command.js')
 const getLocationMsg = require('./exec/get-workspace-location-msg.js')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 // it's like this:
 //
@@ -68,7 +67,6 @@ class Exec extends BaseCommand {
   // can be named correctly
   async _exec (_args, { locationMsg, path, runPath }) {
     const args = [..._args]
-    const cache = this.npm.config.get('cache')
     const call = this.npm.config.get('call')
     const color = this.npm.config.get('color')
     const {
@@ -89,7 +87,6 @@ class Exec extends BaseCommand {
       ...flatOptions,
       args,
       call,
-      cache,
       color,
       localBin,
       locationMsg,
@@ -105,16 +102,15 @@ class Exec extends BaseCommand {
   }
 
   async _execWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
     const color = this.npm.config.get('color')
 
-    for (const workspacePath of workspaces.values()) {
-      const locationMsg = await getLocationMsg({ color, path: workspacePath })
+    for (const path of this.workspacePaths) {
+      const locationMsg = await getLocationMsg({ color, path })
       await this._exec(args, {
         locationMsg,
-        path: workspacePath,
-        runPath: workspacePath,
+        path,
+        runPath: path,
       })
     }
   }

deps/npm/lib/explain.js

@@ -46,8 +46,8 @@ class Explain extends ArboristWorkspaceCmd {
     const arb = new Arborist({ path: this.npm.prefix, ...this.npm.flatOptions })
     const tree = await arb.loadActual()
 
-    if (this.workspaces && this.workspaces.length)
-      this.filterSet = arb.workspaceDependencySet(tree, this.workspaces)
+    if (this.workspaceNames && this.workspaceNames.length)
+      this.filterSet = arb.workspaceDependencySet(tree, this.workspaceNames)
 
     const nodes = new Set()
     for (const arg of args) {

deps/npm/lib/fund.js

@@ -95,7 +95,7 @@ class Fund extends ArboristWorkspaceCmd {
     const fundingInfo = getFundingInfo(tree, {
       ...this.flatOptions,
       log: this.npm.log,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     })
 
     if (this.npm.config.get('json'))

deps/npm/lib/init.js

@@ -106,7 +106,6 @@ class Init extends BaseCommand {
     }
 
     const newArgs = [packageName, ...otherArgs]
-    const cache = this.npm.config.get('cache')
     const { color } = this.npm.flatOptions
     const {
       flatOptions,
@@ -128,7 +127,6 @@ class Init extends BaseCommand {
     await libexec({
       ...flatOptions,
       args: newArgs,
-      cache,
       color,
       localBin,
       locationMsg,

deps/npm/lib/install.js

@@ -144,7 +144,7 @@ class Install extends ArboristWorkspaceCmd {
       auditLevel: null,
       path: where,
       add: args,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
     const arb = new Arborist(opts)
     await arb.reify(opts)

deps/npm/lib/link.js

@@ -134,17 +134,19 @@ class Link extends ArboristWorkspaceCmd {
     // reify all the pending names as symlinks there
     const localArb = new Arborist({
       ...this.npm.flatOptions,
+      prune: false,
       log: this.npm.log,
       path: this.npm.prefix,
       save,
     })
     await localArb.reify({
       ...this.npm.flatOptions,
+      prune: false,
       path: this.npm.prefix,
       log: this.npm.log,
       add: names.map(l => `file:${resolve(globalTop, 'node_modules', l)}`),
       save,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     })
 
     await reifyFinish(this.npm, localArb)

deps/npm/lib/ls.js

@@ -36,7 +36,7 @@ class LS extends ArboristWorkspaceCmd {
 
   /* istanbul ignore next - see test/lib/load-all-commands.js */
   static get usage () {
-    return ['npm ls [[<@scope>/]<pkg> ...]']
+    return ['[[<@scope>/]<pkg> ...]']
   }
 
   /* istanbul ignore next - see test/lib/load-all-commands.js */
@@ -50,6 +50,7 @@ class LS extends ArboristWorkspaceCmd {
       'depth',
       'omit',
       'link',
+      'package-lock-only',
       'unicode',
       ...super.params,
     ]
@@ -79,6 +80,7 @@ class LS extends ArboristWorkspaceCmd {
     const prod = this.npm.config.get('prod')
     const production = this.npm.config.get('production')
     const unicode = this.npm.config.get('unicode')
+    const packageLockOnly = this.npm.config.get('package-lock-only')
 
     const path = global ? resolve(this.npm.globalDir, '..') : this.npm.prefix
 
@@ -88,14 +90,14 @@ class LS extends ArboristWorkspaceCmd {
       legacyPeerDeps: false,
       path,
     })
-    const tree = await this.initTree({arb, args })
+    const tree = await this.initTree({arb, args, packageLockOnly })
 
     // filters by workspaces nodes when using -w <workspace-name>
     // We only have to filter the first layer of edges, so we don't
     // explore anything that isn't part of the selected workspace set.
     let wsNodes
-    if (this.workspaces && this.workspaces.length)
-      wsNodes = arb.workspaceNodes(tree, this.workspaces)
+    if (this.workspaceNames && this.workspaceNames.length)
+      wsNodes = arb.workspaceNodes(tree, this.workspaceNames)
     const filterBySelectedWorkspaces = edge => {
       if (!wsNodes || !wsNodes.length)
         return true
@@ -139,6 +141,7 @@ class LS extends ArboristWorkspaceCmd {
           : [...(node.target || node).edgesOut.values()]
             .filter(filterBySelectedWorkspaces)
             .filter(filterByEdgesTypes({
+              currentDepth,
               dev,
               development,
               link,
@@ -216,8 +219,13 @@ class LS extends ArboristWorkspaceCmd {
     }
   }
 
-  async initTree ({ arb, args }) {
-    const tree = await arb.loadActual()
+  async initTree ({ arb, args, packageLockOnly }) {
+    const tree = await (
+      packageLockOnly
+        ? arb.loadVirtual()
+        : arb.loadActual()
+    )
+
     tree[_include] = args.length === 0
     tree[_depth] = 0
 
@@ -380,6 +388,7 @@ const getJsonOutputItem = (node, { global, long }) => {
 }
 
 const filterByEdgesTypes = ({
+  currentDepth,
   dev,
   development,
   link,
@@ -391,11 +400,11 @@ const filterByEdgesTypes = ({
 }) => {
   // filter deps by type, allows for: `npm ls --dev`, `npm ls --prod`,
   // `npm ls --link`, `npm ls --only=dev`, etc
-  const filterDev = node === tree &&
+  const filterDev = currentDepth === 0 &&
     (dev || development || /^dev(elopment)?$/.test(only))
-  const filterProd = node === tree &&
+  const filterProd = currentDepth === 0 &&
     (prod || production || /^prod(uction)?$/.test(only))
-  const filterLink = node === tree && link
+  const filterLink = currentDepth === 0 && link
 
   return (edge) =>
     (filterDev ? edge.dev : true) &&

deps/npm/lib/npm.js

@@ -108,6 +108,9 @@ const npm = module.exports = new class extends EventEmitter {
       this.output(impl.usage)
       cb()
     } else if (filterByWorkspaces) {
+      if (this.config.get('global'))
+        return cb(new Error('Workspaces not supported for global packages'))
+
       impl.execWorkspaces(args, this.config.get('workspace'), er => {
         process.emit('timeEnd', `command:${cmd}`)
         cb(er)

deps/npm/lib/outdated.js

@@ -59,8 +59,10 @@ class Outdated extends ArboristWorkspaceCmd {
     this.list = []
     this.tree = await arb.loadActual()
 
-    if (this.workspaces && this.workspaces.length)
-      this.filterSet = arb.workspaceDependencySet(this.tree, this.workspaces)
+    if (this.workspaceNames && this.workspaceNames.length) {
+      this.filterSet =
+        arb.workspaceDependencySet(this.tree, this.workspaceNames)
+    }
 
     if (args.length !== 0) {
       // specific deps

deps/npm/lib/pack.js

@@ -3,7 +3,7 @@ const log = require('npmlog')
 const pacote = require('pacote')
 const libpack = require('libnpmpack')
 const npa = require('npm-package-arg')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
+const path = require('path')
 
 const { getContents, logTar } = require('./utils/tar.js')
 
@@ -24,7 +24,13 @@ class Pack extends BaseCommand {
 
   /* istanbul ignore next - see test/lib/load-all-commands.js */
   static get params () {
-    return ['dry-run', 'json', 'workspace', 'workspaces']
+    return [
+      'dry-run',
+      'json',
+      'pack-destination',
+      'workspace',
+      'workspaces',
+    ]
   }
 
   /* istanbul ignore next - see test/lib/load-all-commands.js */
@@ -68,9 +74,10 @@ class Pack extends BaseCommand {
     for (const { arg, filename, manifest } of manifests) {
       const tarballData = await libpack(arg, this.npm.flatOptions)
       const pkgContents = await getContents(manifest, tarballData)
+      const tarballFilename = path.resolve(this.npm.config.get('pack-destination'), filename)
 
       if (!dryRun)
-        await writeFile(filename, tarballData)
+        await writeFile(tarballFilename, tarballData)
 
       tarballs.push(pkgContents)
     }
@@ -97,9 +104,8 @@ class Pack extends BaseCommand {
       return this.pack(args)
     }
 
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    return this.pack([...workspaces.values(), ...args.filter(a => a !== '.')])
+    await this.setWorkspaces(filters)
+    return this.pack([...this.workspacePaths, ...args.filter(a => a !== '.')])
   }
 }
 module.exports = Pack

deps/npm/lib/prune.js

@@ -34,7 +34,7 @@ class Prune extends ArboristWorkspaceCmd {
       ...this.npm.flatOptions,
       path: where,
       log: this.npm.log,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
     const arb = new Arborist(opts)
     await arb.prune(opts)

deps/npm/lib/publish.js

@@ -11,7 +11,6 @@ const chalk = require('chalk')
 
 const otplease = require('./utils/otplease.js')
 const { getContents, logTar } = require('./utils/tar.js')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 // for historical reasons, publishConfig in package.json can contain ANY config
 // keys that npm supports in .npmrc files and elsewhere.  We *may* want to
@@ -138,7 +137,7 @@ class Publish extends BaseCommand {
       })
     }
 
-    if (!this.workspaces) {
+    if (!this.suppressOutput) {
       if (!silent && json)
         this.npm.output(JSON.stringify(pkgContents, null, 2))
       else if (!silent)
@@ -150,17 +149,16 @@ class Publish extends BaseCommand {
 
   async publishWorkspaces (args, filters) {
     // Suppresses JSON output in publish() so we can handle it here
-    this.workspaces = true
+    this.suppressOutput = true
 
     const results = {}
     const json = this.npm.config.get('json')
     const silent = log.level === 'silent'
     const noop = a => a
     const color = this.npm.color ? chalk : { green: noop, bold: noop }
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
 
-    for (const [name, workspace] of workspaces.entries()) {
+    for (const [name, workspace] of this.workspaces.entries()) {
       let pkgContents
       try {
         pkgContents = await this.publish([workspace])

deps/npm/lib/rebuild.js

@@ -47,7 +47,7 @@ class Rebuild extends ArboristWorkspaceCmd {
       ...this.npm.flatOptions,
       path: where,
       // TODO when extending ReifyCmd
-      // workspaces: this.workspaces,
+      // workspaces: this.workspaceNames,
     })
 
     if (args.length) {

deps/npm/lib/repo.js

@@ -1,6 +1,5 @@
 const log = require('npmlog')
 const pacote = require('pacote')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const { URL } = require('url')
 
 const hostedFromMani = require('./utils/hosted-git-info-from-manifest.js')
@@ -44,9 +43,8 @@ class Repo extends BaseCommand {
   }
 
   async repoWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    return this.repo([...workspaces.values()])
+    await this.setWorkspaces(filters)
+    return this.repo(this.workspacePaths)
   }
 
   async get (pkg) {

deps/npm/lib/run-script.js

@@ -6,7 +6,6 @@ const rpj = require('read-package-json-fast')
 const log = require('npmlog')
 const didYouMean = require('./utils/did-you-mean.js')
 const isWindowsShell = require('./utils/is-windows-shell.js')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 const cmdList = [
   'publish',
@@ -195,10 +194,9 @@ class RunScript extends BaseCommand {
 
   async runWorkspaces (args, filters) {
     const res = []
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
 
-    for (const workspacePath of workspaces.values()) {
+    for (const workspacePath of this.workspacePaths) {
       const pkg = await rpj(`${workspacePath}/package.json`)
       const runResult = await this.run(args, {
         path: workspacePath,
@@ -227,15 +225,14 @@ class RunScript extends BaseCommand {
   }
 
   async listWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
 
     if (log.level === 'silent')
       return
 
     if (this.npm.config.get('json')) {
       const res = {}
-      for (const workspacePath of workspaces.values()) {
+      for (const workspacePath of this.workspacePaths) {
         const { scripts, name } = await rpj(`${workspacePath}/package.json`)
         res[name] = { ...scripts }
       }
@@ -244,7 +241,7 @@ class RunScript extends BaseCommand {
     }
 
     if (this.npm.config.get('parseable')) {
-      for (const workspacePath of workspaces.values()) {
+      for (const workspacePath of this.workspacePaths) {
         const { scripts, name } = await rpj(`${workspacePath}/package.json`)
         for (const [script, cmd] of Object.entries(scripts || {}))
           this.npm.output(`${name}:${script}:${cmd}`)
@@ -252,7 +249,7 @@ class RunScript extends BaseCommand {
       return
     }
 
-    for (const workspacePath of workspaces.values())
+    for (const workspacePath of this.workspacePaths)
       await this.list(args, workspacePath)
   }
 }

deps/npm/lib/set-script.js

@@ -3,7 +3,6 @@ const fs = require('fs')
 const parseJSON = require('json-parse-even-better-errors')
 const rpj = require('read-package-json-fast')
 const { resolve } = require('path')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 const BaseCommand = require('./base-command.js')
 class SetScript extends BaseCommand {
@@ -47,28 +46,27 @@ class SetScript extends BaseCommand {
   }
 
   exec (args, cb) {
-    this.set(args).then(() => cb()).catch(cb)
+    this.setScript(args).then(() => cb()).catch(cb)
   }
 
-  async set (args) {
+  async setScript (args) {
     this.validate(args)
-    const warn = this.setScript(this.npm.localPrefix, args[0], args[1])
+    const warn = this.doSetScript(this.npm.localPrefix, args[0], args[1])
     if (warn)
       log.warn('set-script', `Script "${args[0]}" was overwritten`)
   }
 
   execWorkspaces (args, filters, cb) {
-    this.setWorkspaces(args, filters).then(() => cb()).catch(cb)
+    this.setScriptWorkspaces(args, filters).then(() => cb()).catch(cb)
   }
 
-  async setWorkspaces (args, filters) {
+  async setScriptWorkspaces (args, filters) {
     this.validate(args)
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
 
-    for (const [name, path] of workspaces) {
+    for (const [name, path] of this.workspaces) {
       try {
-        const warn = this.setScript(path, args[0], args[1])
+        const warn = this.doSetScript(path, args[0], args[1])
         if (warn) {
           log.warn('set-script', `Script "${args[0]}" was overwritten`)
           log.warn(`  in workspace: ${name}`)
@@ -86,7 +84,7 @@ class SetScript extends BaseCommand {
   // returns a Boolean that will be true if
   // the requested script was overwritten
   // and false if it was set as a new script
-  setScript (path, name, value) {
+  doSetScript (path, name, value) {
     // Set the script
     let manifest
     let warn = false

deps/npm/lib/uninstall.js

@@ -66,7 +66,7 @@ class Uninstall extends ArboristWorkspaceCmd {
       path,
       log: this.npm.log,
       rm: args,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     }
     const arb = new Arborist(opts)
     await arb.reify(opts)

deps/npm/lib/unpublish.js

@@ -6,7 +6,6 @@ const npmFetch = require('npm-registry-fetch')
 const libunpub = require('libnpmpublish').unpublish
 const readJson = util.promisify(require('read-package-json'))
 
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const otplease = require('./utils/otplease.js')
 const getIdentity = require('./utils/get-identity.js')
 
@@ -129,8 +128,7 @@ class Unpublish extends BaseCommand {
   }
 
   async unpublishWorkspaces (args, filters) {
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
+    await this.setWorkspaces(filters)
 
     const force = this.npm.config.get('force')
     if (!force) {
@@ -140,7 +138,7 @@ class Unpublish extends BaseCommand {
       )
     }
 
-    for (const [name] of workspaces.entries())
+    for (const name of this.workspaceNames)
       await this.unpublish([name])
   }
 }

deps/npm/lib/update.js

@@ -66,7 +66,7 @@ class Update extends ArboristWorkspaceCmd {
       ...this.npm.flatOptions,
       log: this.npm.log,
       path: where,
-      workspaces: this.workspaces,
+      workspaces: this.workspaceNames,
     })
 
     await arb.reify({ update })

deps/npm/lib/utils/cache-file.js

@@ -1,66 +0,0 @@
-const npm = require('../npm.js')
-const path = require('path')
-const chownr = require('chownr')
-const writeFileAtomic = require('write-file-atomic')
-const mkdirp = require('mkdirp-infer-owner')
-const fs = require('graceful-fs')
-
-let cache = null
-let cacheUid = null
-let cacheGid = null
-let needChown = typeof process.getuid === 'function'
-
-const getCacheOwner = () => {
-  let st
-  try {
-    st = fs.lstatSync(cache)
-  } catch (er) {
-    if (er.code !== 'ENOENT')
-      throw er
-
-    st = fs.lstatSync(path.dirname(cache))
-  }
-
-  cacheUid = st.uid
-  cacheGid = st.gid
-
-  needChown = st.uid !== process.getuid() ||
-    st.gid !== process.getgid()
-}
-
-const writeOrAppend = (method, file, data) => {
-  if (!cache)
-    cache = npm.config.get('cache')
-
-  // redundant if already absolute, but prevents non-absolute files
-  // from being written as if they're part of the cache.
-  file = path.resolve(cache, file)
-
-  if (cacheUid === null && needChown)
-    getCacheOwner()
-
-  const dir = path.dirname(file)
-  const firstMade = mkdirp.sync(dir)
-
-  if (!needChown)
-    return method(file, data)
-
-  let methodThrew = true
-  try {
-    method(file, data)
-    methodThrew = false
-  } finally {
-    // always try to leave it in the right ownership state, even on failure
-    // let the method error fail it instead of the chownr error, though
-    if (!methodThrew)
-      chownr.sync(firstMade || file, cacheUid, cacheGid)
-    else {
-      try {
-        chownr.sync(firstMade || file, cacheUid, cacheGid)
-      } catch (_) {}
-    }
-  }
-}
-
-exports.append = (file, data) => writeOrAppend(fs.appendFileSync, file, data)
-exports.write = (file, data) => writeOrAppend(writeFileAtomic.sync, file, data)

deps/npm/lib/utils/config/definitions.js

@@ -322,6 +322,7 @@ define('cache', {
   `,
   flatten (key, obj, flatOptions) {
     flatOptions.cache = join(obj.cache, '_cacache')
+    flatOptions.npxCache = join(obj.cache, '_npx')
   },
 })
 
@@ -1086,18 +1087,8 @@ define('link', {
   default: false,
   type: Boolean,
   description: `
-    If true, then local installs will link if there is a suitable globally
-    installed package.
-
-    Note that this means that local installs can cause things to be installed
-    into the global space at the same time.  The link is only done if one of
-    the two conditions are met:
-
-    * The package is not already installed globally, or
-    * the globally installed version is identical to the version that is
-      being installed locally.
-
-    When used with \`npm ls\`, only show packages that are linked.
+    Used with \`npm ls\`, limiting output to only those packages that are
+    linked.
   `,
 })
 
@@ -1333,12 +1324,26 @@ define('package-lock-only', {
   default: false,
   type: Boolean,
   description: `
-    If set to true, it will update only the \`package-lock.json\`, instead of
-    checking \`node_modules\` and downloading dependencies.
+    If set to true, the current operation will only use the \`package-lock.json\`,
+    ignoring \`node_modules\`.
+
+    For \`update\` this means only the \`package-lock.json\` will be updated,
+    instead of checking \`node_modules\` and downloading dependencies.
+
+    For \`list\` this means the output will be based on the tree described by the
+    \`package-lock.json\`, rather than the contents of \`node_modules\`.
   `,
   flatten,
 })
 
+define('pack-destination', {
+  default: '.',
+  type: String,
+  description: `
+    Directory in which \`npm pack\` will save tarballs.
+  `,
+})
+
 define('parseable', {
   default: false,
   type: Boolean,

deps/npm/lib/utils/error-handler.js

@@ -1,28 +1,27 @@
+let npm // set by the cli
 let cbCalled = false
 const log = require('npmlog')
-const npm = require('../npm.js')
 let itWorked = false
 const path = require('path')
+const writeFileAtomic = require('write-file-atomic')
+const mkdirp = require('mkdirp-infer-owner')
+const fs = require('graceful-fs')
 let wroteLogFile = false
 let exitCode = 0
 const errorMessage = require('./error-message.js')
 const replaceInfo = require('./replace-info.js')
 
-const cacheFile = require('./cache-file.js')
-
 let logFileName
 const getLogFile = () => {
+  // we call this multiple times, so we need to treat it as a singleton because
+  // the date is part of the name
   if (!logFileName)
     logFileName = path.resolve(npm.config.get('cache'), '_logs', (new Date()).toISOString().replace(/[.:]/g, '_') + '-debug.log')
 
   return logFileName
 }
 
-const timings = {
-  version: npm.version,
-  command: process.argv.slice(2),
-  logfile: null,
-}
+const timings = {}
 process.on('timing', (name, value) => {
   if (timings[name])
     timings[name] += value
@@ -35,9 +34,21 @@ process.on('exit', code => {
   log.disableProgress()
   if (npm.config && npm.config.loaded && npm.config.get('timing')) {
     try {
-      timings.logfile = getLogFile()
-      cacheFile.append('_timing.json', JSON.stringify(timings) + '\n')
-    } catch (_) {
+      const file = path.resolve(npm.config.get('cache'), '_timing.json')
+      const dir = path.dirname(npm.config.get('cache'))
+      mkdirp.sync(dir)
+
+      fs.appendFileSync(file, JSON.stringify({
+        command: process.argv.slice(2),
+        logfile: getLogFile(),
+        version: npm.version,
+        ...timings,
+      }) + '\n')
+
+      const st = fs.lstatSync(path.dirname(npm.config.get('cache')))
+      fs.chownSync(dir, st.uid, st.gid)
+      fs.chownSync(file, st.uid, st.gid)
+    } catch (ex) {
       // ignore
     }
   }
@@ -174,7 +185,7 @@ const errorHandler = (er) => {
       log.error(k, v)
   }
 
-  const msg = errorMessage(er)
+  const msg = errorMessage(er, npm)
   for (const errline of [...msg.summary, ...msg.detail])
     log.error(...errline)
 
@@ -214,7 +225,15 @@ const writeLogFile = () => {
           logOutput += line + os.EOL
         })
     })
-    cacheFile.write(getLogFile(), logOutput)
+
+    const file = getLogFile()
+    const dir = path.dirname(file)
+    mkdirp.sync(dir)
+    writeFileAtomic.sync(file, logOutput)
+
+    const st = fs.lstatSync(path.dirname(npm.config.get('cache')))
+    fs.chownSync(dir, st.uid, st.gid)
+    fs.chownSync(file, st.uid, st.gid)
 
     // truncate once it's been written.
     log.record.length = 0
@@ -226,3 +245,6 @@ const writeLogFile = () => {
 
 module.exports = errorHandler
 module.exports.exit = exit
+module.exports.setNpm = (n) => {
+  npm = n
+}

deps/npm/lib/utils/error-message.js

@@ -1,12 +1,11 @@
-const npm = require('../npm.js')
 const { format } = require('util')
 const { resolve } = require('path')
 const nameValidator = require('validate-npm-package-name')
 const npmlog = require('npmlog')
 const replaceInfo = require('./replace-info.js')
-const { report: explainEresolve } = require('./explain-eresolve.js')
+const { report } = require('./explain-eresolve.js')
 
-module.exports = (er) => {
+module.exports = (er, npm) => {
   const short = []
   const detail = []
 
@@ -19,7 +18,7 @@ module.exports = (er) => {
     case 'ERESOLVE':
       short.push(['ERESOLVE', er.message])
       detail.push(['', ''])
-      detail.push(['', explainEresolve(er)])
+      detail.push(['', report(er, npm.color, resolve(npm.cache, 'eresolve-report.txt'))])
       break
 
     case 'ENOLOCK': {

deps/npm/lib/utils/explain-eresolve.js

@@ -1,20 +1,14 @@
 // this is called when an ERESOLVE error is caught in the error-handler,
 // or when there's a log.warn('eresolve', msg, explanation), to turn it
 // into a human-intelligible explanation of what's wrong and how to fix.
-//
-// TODO: abstract out the explainNode methods into a separate util for
-// use by a future `npm explain <path || spec>` command.
-
-const npm = require('../npm.js')
 const { writeFileSync } = require('fs')
-const { resolve } = require('path')
 const { explainEdge, explainNode, printNode } = require('./explain-dep.js')
 
 // expl is an explanation object that comes from Arborist.  It looks like:
 // Depth is how far we want to want to descend into the object making a report.
 // The full report (ie, depth=Infinity) is always written to the cache folder
 // at ${cache}/eresolve-report.txt along with full json.
-const explainEresolve = (expl, color, depth) => {
+const explain = (expl, color, depth) => {
   const { edge, current, peerConflict, currentEdge } = expl
 
   const out = []
@@ -42,9 +36,7 @@ const explainEresolve = (expl, color, depth) => {
 }
 
 // generate a full verbose report and tell the user how to fix it
-const report = (expl, depth = 4) => {
-  const fullReport = resolve(npm.cache, 'eresolve-report.txt')
-
+const report = (expl, color, fullReport) => {
   const orNoStrict = expl.strictPeerDeps ? '--no-strict-peer-deps, ' : ''
   const fix = `Fix the upstream dependency conflict, or retry
 this command with ${orNoStrict}--force, or --legacy-peer-deps
@@ -54,7 +46,7 @@ to accept an incorrect (and potentially broken) dependency resolution.`
 
 ${new Date().toISOString()}
 
-${explainEresolve(expl, false, Infinity)}
+${explain(expl, false, Infinity)}
 
 ${fix}
 
@@ -63,13 +55,10 @@ Raw JSON explanation object:
 ${JSON.stringify(expl, null, 2)}
 `, 'utf8')
 
-  return explainEresolve(expl, npm.color, depth) +
+  return explain(expl, color, 4) +
     `\n\n${fix}\n\nSee ${fullReport} for a full report.`
 }
 
-// the terser explain method for the warning when using --force
-const explain = (expl, depth = 2) => explainEresolve(expl, npm.color, depth)
-
 module.exports = {
   explain,
   report,

deps/npm/lib/utils/setup-log.js

@@ -14,10 +14,22 @@ module.exports = (config) => {
 
   const { warn } = log
 
+  const stdoutTTY = process.stdout.isTTY
+  const stderrTTY = process.stderr.isTTY
+  const dumbTerm = process.env.TERM === 'dumb'
+  const stderrNotDumb = stderrTTY && !dumbTerm
+  const enableColorStderr = color === 'always' ? true
+    : color === false ? false
+    : stderrTTY
+
+  const enableColorStdout = color === 'always' ? true
+    : color === false ? false
+    : stdoutTTY
+
   log.warn = (heading, ...args) => {
     if (heading === 'ERESOLVE' && args[1] && typeof args[1] === 'object') {
       warn(heading, args[0])
-      return warn('', explain(args[1]))
+      return warn('', explain(args[1], enableColorStdout, 2))
     }
     return warn(heading, ...args)
   }
@@ -29,19 +41,6 @@ module.exports = (config) => {
 
   log.heading = config.get('heading') || 'npm'
 
-  const stdoutTTY = process.stdout.isTTY
-  const stderrTTY = process.stderr.isTTY
-  const dumbTerm = process.env.TERM === 'dumb'
-  const stderrNotDumb = stderrTTY && !dumbTerm
-
-  const enableColorStderr = color === 'always' ? true
-    : color === false ? false
-    : stderrTTY
-
-  const enableColorStdout = color === 'always' ? true
-    : color === false ? false
-    : stdoutTTY
-
   if (enableColorStderr)
     log.enableColor()
   else

deps/npm/lib/version.js

@@ -3,7 +3,6 @@ const { resolve } = require('path')
 const { promisify } = require('util')
 const readFile = promisify(require('fs').readFile)
 
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const BaseCommand = require('./base-command.js')
 
 class Version extends BaseCommand {
@@ -93,9 +92,8 @@ class Version extends BaseCommand {
 
   async changeWorkspaces (args, filters) {
     const prefix = this.npm.config.get('tag-version-prefix')
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    for (const [name, path] of workspaces) {
+    await this.setWorkspaces(filters)
+    for (const [name, path] of this.workspaces) {
       this.npm.output(name)
       const version = await libnpmversion(args[0], {
         ...this.npm.flatOptions,
@@ -128,11 +126,10 @@ class Version extends BaseCommand {
 
   async listWorkspaces (filters) {
     const results = {}
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    for (const [, path] of workspaces) {
+    await this.setWorkspaces(filters)
+    for (const path of this.workspacePaths) {
       const pj = resolve(path, 'package.json')
-      // getWorkspaces has already parsed this so we know it won't error
+      // setWorkspaces has already parsed package.json so we know it won't error
       const pkg = await readFile(pj, 'utf8')
         .then(data => JSON.parse(data))
 

deps/npm/lib/view.js

@@ -13,7 +13,6 @@ const semver = require('semver')
 const style = require('ansistyles')
 const { inspect, promisify } = require('util')
 const { packument } = require('pacote')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 
 const readFile = promisify(fs.readFile)
 const readJson = async file => jsonParse(await readFile(file, 'utf8'))
@@ -160,10 +159,9 @@ class View extends BaseCommand {
       args = [''] // getData relies on this
     }
     const results = {}
-    const workspaces =
-      await getWorkspaces(filters, { path: this.npm.localPrefix })
-    for (const workspace of [...workspaces.entries()]) {
-      const wsPkg = `${workspace[0]}${pkg.slice(1)}`
+    await this.setWorkspaces(filters)
+    for (const name of this.workspaceNames) {
+      const wsPkg = `${name}${pkg.slice(1)}`
       const [pckmnt, data] = await this.getData(wsPkg, args)
 
       let reducedData = data.reduce(reducer, {})
@@ -177,7 +175,7 @@ class View extends BaseCommand {
         if (wholePackument)
           data.map((v) => this.prettyView(pckmnt, v[Object.keys(v)[0]]['']))
         else {
-          console.log(`${workspace[0]}:`)
+          console.log(`${name}:`)
           const msg = await this.jsonData(reducedData, pckmnt._id)
           if (msg !== '')
             console.log(msg)
@@ -185,7 +183,7 @@ class View extends BaseCommand {
       } else {
         const msg = await this.jsonData(reducedData, pckmnt._id)
         if (msg !== '')
-          results[workspace[0]] = JSON.parse(msg)
+          results[name] = JSON.parse(msg)
       }
     }
     if (Object.keys(results).length > 0)

deps/npm/lib/workspaces/arborist-cmd.js

@@ -3,7 +3,6 @@
 // be able to run a filtered Arborist.reify() at some point.
 
 const BaseCommand = require('../base-command.js')
-const getWorkspaces = require('./get-workspaces.js')
 class ArboristCmd extends BaseCommand {
   /* istanbul ignore next - see test/lib/load-all-commands.js */
   static get params () {
@@ -14,10 +13,8 @@ class ArboristCmd extends BaseCommand {
   }
 
   execWorkspaces (args, filters, cb) {
-    getWorkspaces(filters, { path: this.npm.localPrefix })
-      .then(workspaces => {
-        this.workspaces = [...workspaces.keys()]
-        this.workspacePaths = [...workspaces.values()]
+    this.setWorkspaces(filters)
+      .then(() => {
         this.exec(args, cb)
       })
       .catch(er => cb(er))

deps/npm/man/man1/npm-audit.1

@@ -289,8 +289,14 @@ Type: Boolean
 
 .RE
 .P
-If set to true, it will update only the \fBpackage\-lock\.json\fP, instead of
-checking \fBnode_modules\fP and downloading dependencies\.
+If set to true, the current operation will only use the \fBpackage\-lock\.json\fP,
+ignoring \fBnode_modules\fP\|\.
+.P
+For \fBupdate\fP this means only the \fBpackage\-lock\.json\fP will be updated,
+instead of checking \fBnode_modules\fP and downloading dependencies\.
+.P
+For \fBlist\fP this means the output will be based on the tree described by the
+\fBpackage\-lock\.json\fP, rather than the contents of \fBnode_modules\fP\|\.
 .SS \fBomit\fP
 .RS 0
 .IP \(bu 2

deps/npm/man/man1/npm-ls.1

@@ -26,7 +26,7 @@ example, running \fBnpm ls promzard\fP in npm's source tree will show:
 .P
 .RS 2
 .nf
-npm@7\.17\.0 /path/to/npm
+npm@7\.18\.1 /path/to/npm
 └─┬ init\-package\-json@0\.0\.4
   └── promzard@0\.1\.5
 .fi
@@ -182,22 +182,24 @@ Type: Boolean
 
 .RE
 .P
-If true, then local installs will link if there is a suitable globally
-installed package\.
-.P
-Note that this means that local installs can cause things to be installed
-into the global space at the same time\. The link is only done if one of the
-two conditions are met:
+Used with \fBnpm ls\fP, limiting output to only those packages that are linked\.
+.SS \fBpackage\-lock\-only\fP
 .RS 0
 .IP \(bu 2
-The package is not already installed globally, or
+Default: false
 .IP \(bu 2
-the globally installed version is identical to the version that is being
-installed locally\.
+Type: Boolean
 
 .RE
 .P
-When used with \fBnpm ls\fP, only show packages that are linked\.
+If set to true, the current operation will only use the \fBpackage\-lock\.json\fP,
+ignoring \fBnode_modules\fP\|\.
+.P
+For \fBupdate\fP this means only the \fBpackage\-lock\.json\fP will be updated,
+instead of checking \fBnode_modules\fP and downloading dependencies\.
+.P
+For \fBlist\fP this means the output will be based on the tree described by the
+\fBpackage\-lock\.json\fP, rather than the contents of \fBnode_modules\fP\|\.
 .SS \fBunicode\fP
 .RS 0
 .IP \(bu 2

deps/npm/man/man1/npm-pack.1

@@ -39,6 +39,16 @@ Type: Boolean
 Whether or not to output JSON data, rather than the normal output\.
 .P
 Not supported by all npm commands\.
+.SS \fBpack\-destination\fP
+.RS 0
+.IP \(bu 2
+Default: "\."
+.IP \(bu 2
+Type: String
+
+.RE
+.P
+Directory in which \fBnpm pack\fP will save tarballs\.
 .SS \fBworkspace\fP
 .RS 0
 .IP \(bu 2

deps/npm/man/man1/npm.1

@@ -10,7 +10,7 @@ npm <command> [args]
 .RE
 .SS Version
 .P
-7\.17\.0
+7\.18\.1
 .SS Description
 .P
 npm is the package manager for the Node JavaScript platform\.  It puts

deps/npm/man/man7/config.7

@@ -995,22 +995,7 @@ Type: Boolean
 
 .RE
 .P
-If true, then local installs will link if there is a suitable globally
-installed package\.
-.P
-Note that this means that local installs can cause things to be installed
-into the global space at the same time\. The link is only done if one of the
-two conditions are met:
-.RS 0
-.IP \(bu 2
-The package is not already installed globally, or
-.IP \(bu 2
-the globally installed version is identical to the version that is being
-installed locally\.
-
-.RE
-.P
-When used with \fBnpm ls\fP, only show packages that are linked\.
+Used with \fBnpm ls\fP, limiting output to only those packages that are linked\.
 .SS \fBlocal\-address\fP
 .RS 0
 .IP \(bu 2
@@ -1172,6 +1157,16 @@ when publishing or changing package permissions with \fBnpm access\fP\|\.
 .P
 If not set, and a registry response fails with a challenge for a one\-time
 password, npm will prompt on the command line for one\.
+.SS \fBpack\-destination\fP
+.RS 0
+.IP \(bu 2
+Default: "\."
+.IP \(bu 2
+Type: String
+
+.RE
+.P
+Directory in which \fBnpm pack\fP will save tarballs\.
 .SS \fBpackage\fP
 .RS 0
 .IP \(bu 2
@@ -1206,8 +1201,14 @@ Type: Boolean
 
 .RE
 .P
-If set to true, it will update only the \fBpackage\-lock\.json\fP, instead of
-checking \fBnode_modules\fP and downloading dependencies\.
+If set to true, the current operation will only use the \fBpackage\-lock\.json\fP,
+ignoring \fBnode_modules\fP\|\.
+.P
+For \fBupdate\fP this means only the \fBpackage\-lock\.json\fP will be updated,
+instead of checking \fBnode_modules\fP and downloading dependencies\.
+.P
+For \fBlist\fP this means the output will be based on the tree described by the
+\fBpackage\-lock\.json\fP, rather than the contents of \fBnode_modules\fP\|\.
 .SS \fBparseable\fP
 .RS 0
 .IP \(bu 2

deps/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js

@@ -7,7 +7,7 @@ const semver = require('semver')
 const promiseCallLimit = require('promise-call-limit')
 const getPeerSet = require('../peer-set.js')
 const realpath = require('../../lib/realpath.js')
-const { resolve } = require('path')
+const { resolve, dirname } = require('path')
 const { promisify } = require('util')
 const treeCheck = require('../tree-check.js')
 const readdir = promisify(require('readdir-scoped-modules'))
@@ -661,7 +661,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
     const ancient = meta.ancientLockfile
     const old = meta.loadedFromDisk && !(meta.originalLockfileVersion >= 2)
 
-    if (inventory.size === 0 || !ancient && !(old && this[_complete]))
+    if (inventory.size === 0 || !ancient && !old)
       return
 
     // if the lockfile is from node v5 or earlier, then we'll have to reload
@@ -688,10 +688,12 @@ This is a one-time fix-up, please be patient...
         this.log.silly('inflate', node.location)
         const { resolved, version, path, name, location, integrity } = node
         // don't try to hit the registry for linked deps
-        const useResolved = !version ||
-          resolved && resolved.startsWith('file:')
-        const id = useResolved ? resolved : version
-        const spec = npa.resolve(name, id, path)
+        const useResolved = resolved && (
+          !version || resolved.startsWith('file:')
+        )
+        const id = useResolved ? resolved
+          : version || `file:${node.path}`
+        const spec = npa.resolve(name, id, dirname(path))
         const sloc = location.substr('node_modules/'.length)
         const t = `idealTree:inflate:${sloc}`
         this.addTracker(t)

deps/npm/node_modules/@npmcli/arborist/lib/arborist/index.js

@@ -28,7 +28,7 @@
 
 const {resolve} = require('path')
 const {homedir} = require('os')
-const procLog = require('../proc-log.js')
+const procLog = require('proc-log')
 const { saveTypeMap } = require('../add-rm-pkg-deps.js')
 
 const mixins = [

deps/npm/node_modules/@npmcli/arborist/lib/arborist/load-actual.js

@@ -22,6 +22,7 @@ const _loadFSTree = Symbol('loadFSTree')
 const _loadFSChildren = Symbol('loadFSChildren')
 const _findMissingEdges = Symbol('findMissingEdges')
 const _findFSParents = Symbol('findFSParents')
+const _resetDepFlags = Symbol('resetDepFlags')
 
 const _actualTreeLoaded = Symbol('actualTreeLoaded')
 const _rpcache = Symbol.for('realpathCache')
@@ -74,6 +75,19 @@ module.exports = cls => class ActualLoader extends cls {
     this[_topNodes] = new Set()
   }
 
+  [_resetDepFlags] (tree, root) {
+    // reset all deps to extraneous prior to recalc
+    if (!root) {
+      for (const node of tree.inventory.values())
+        node.extraneous = true
+    }
+
+    // only reset root flags if we're not re-rooting,
+    // otherwise leave as-is
+    calcDepFlags(tree, !root)
+    return tree
+  }
+
   // public method
   async loadActual (options = {}) {
     // allow the user to set options on the ctor as well.
@@ -88,6 +102,7 @@ module.exports = cls => class ActualLoader extends cls {
     return this.actualTree ? this.actualTree
       : this[_actualTreePromise] ? this[_actualTreePromise]
       : this[_actualTreePromise] = this[_loadActual](options)
+        .then(tree => this[_resetDepFlags](tree, options.root))
         .then(tree => this.actualTree = treeCheck(tree))
   }
 
@@ -152,8 +167,7 @@ module.exports = cls => class ActualLoader extends cls {
       root: this[_actualTree],
     })
     await this[_loadWorkspaces](this[_actualTree])
-    if (this[_actualTree].workspaces && this[_actualTree].workspaces.size)
-      calcDepFlags(this[_actualTree], !root)
+
     this[_transplant](root)
     return this[_actualTree]
   }
@@ -178,8 +192,6 @@ module.exports = cls => class ActualLoader extends cls {
         dependencies[name] = dependencies[name] || '*'
       actualRoot.package = { ...actualRoot.package, dependencies }
     }
-    // only reset root flags if we're not re-rooting, otherwise leave as-is
-    calcDepFlags(this[_actualTree], !root)
     return this[_actualTree]
   }
 

deps/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js

@@ -2,7 +2,6 @@
 
 const onExit = require('../signal-handling.js')
 const pacote = require('pacote')
-const rpj = require('read-package-json-fast')
 const AuditReport = require('../audit-report.js')
 const {subset, intersects} = require('semver')
 const npa = require('npm-package-arg')
@@ -57,7 +56,6 @@ const _extractOrLink = Symbol('extractOrLink')
 const _checkBins = Symbol.for('checkBins')
 const _symlink = Symbol('symlink')
 const _warnDeprecated = Symbol('warnDeprecated')
-const _loadAncientPackageDetails = Symbol('loadAncientPackageDetails')
 const _loadBundlesAndUpdateTrees = Symbol.for('loadBundlesAndUpdateTrees')
 const _submitQuickAudit = Symbol('submitQuickAudit')
 const _awaitQuickAudit = Symbol('awaitQuickAudit')
@@ -522,7 +520,6 @@ module.exports = cls => class Reifier extends cls {
         await this[_checkBins](node)
         await this[_extractOrLink](node)
         await this[_warnDeprecated](node)
-        await this[_loadAncientPackageDetails](node)
       })
 
     return this[_handleOptionalFailure](node, p)
@@ -583,32 +580,6 @@ module.exports = cls => class Reifier extends cls {
       this.log.warn('deprecated', `${_id}: ${deprecated}`)
   }
 
-  async [_loadAncientPackageDetails] (node, forceReload = false) {
-    // If we're loading from a v1 lockfile, load details from the package.json
-    // that weren't recorded in the old format.
-    const {meta} = this.idealTree
-    const ancient = meta.ancientLockfile
-    const old = meta.loadedFromDisk && !(meta.originalLockfileVersion >= 2)
-
-    // already replaced with the manifest if it's truly ancient
-    if (node.path && (forceReload || (old && !ancient))) {
-      // XXX should have a shared location where package.json is read,
-      // so we don't ever read the same pj more than necessary.
-      let pkg
-      try {
-        pkg = await rpj(node.path + '/package.json')
-      } catch (err) {}
-
-      if (pkg) {
-        node.package.bin = pkg.bin
-        node.package.os = pkg.os
-        node.package.cpu = pkg.cpu
-        node.package.engines = pkg.engines
-        meta.add(node)
-      }
-    }
-  }
-
   // if the node is optional, then the failure of the promise is nonfatal
   // just add it and its optional set to the trash list.
   [_handleOptionalFailure] (node, p) {
@@ -1079,12 +1050,6 @@ module.exports = cls => class Reifier extends cls {
 
     const { meta } = this.idealTree
 
-    // might have to update metadata for bins and stuff that gets lost
-    if (meta.loadedFromDisk && !(meta.originalLockfileVersion >= 2)) {
-      for (const node of this.idealTree.inventory.values())
-        await this[_loadAncientPackageDetails](node, true)
-    }
-
     return meta.save(saveOpt)
   }
 

deps/npm/node_modules/@npmcli/arborist/lib/audit-report.js

@@ -12,7 +12,7 @@ const _fixAvailable = Symbol('fixAvailable')
 const _checkTopNode = Symbol('checkTopNode')
 const _init = Symbol('init')
 const _omit = Symbol('omit')
-const procLog = require('./proc-log.js')
+const procLog = require('proc-log')
 
 const fetch = require('npm-registry-fetch')
 

deps/npm/node_modules/@npmcli/arborist/lib/calc-dep-flags.js

@@ -22,6 +22,11 @@ const calcDepFlagsStep = (node) => {
   // Since we're only walking through deps that are not already flagged
   // as non-dev/non-optional, it's typically a very shallow traversal
   node.extraneous = false
+  resetParents(node, 'extraneous')
+  resetParents(node, 'dev')
+  resetParents(node, 'peer')
+  resetParents(node, 'devOptional')
+  resetParents(node, 'optional')
 
   // for links, map their hierarchy appropriately
   if (node.target) {
@@ -29,8 +34,7 @@ const calcDepFlagsStep = (node) => {
     node.target.optional = node.optional
     node.target.devOptional = node.devOptional
     node.target.peer = node.peer
-    node.target.extraneous = false
-    node = node.target
+    return calcDepFlagsStep(node.target)
   }
 
   node.edgesOut.forEach(({peer, optional, dev, to}) => {
@@ -71,6 +75,14 @@ const calcDepFlagsStep = (node) => {
   return node
 }
 
+const resetParents = (node, flag) => {
+  if (node[flag])
+    return
+
+  for (let p = node; p && (p === node || p[flag]); p = p.resolveParent)
+    p[flag] = false
+}
+
 // typically a short walk, since it only traverses deps that
 // have the flag set.
 const unsetFlag = (node, flag) => {

deps/npm/node_modules/@npmcli/arborist/lib/inventory.js

@@ -7,6 +7,20 @@ const _index = Symbol('_index')
 const defaultKeys = ['name', 'license', 'funding', 'realpath', 'packageName']
 const { hasOwnProperty } = Object.prototype
 const debug = require('./debug.js')
+
+// handling for the outdated "licenses" array, just pick the first one
+// also support the alternative spelling "licence"
+const getLicense = pkg => {
+  if (pkg) {
+    const lic = pkg.license || pkg.licence
+    if (lic)
+      return lic
+    const lics = pkg.licenses || pkg.licences
+    if (Array.isArray(lics))
+      return lics[0]
+  }
+}
+
 class Inventory extends Map {
   constructor (opt = {}) {
     const { primary, keys } = opt
@@ -56,7 +70,9 @@ class Inventory extends Map {
     for (const [key, map] of this[_index].entries()) {
       // if the node has the value, but it's false, then use that
       const val_ = hasOwnProperty.call(node, key) ? node[key]
-        : node[key] || (node.package && node.package[key])
+        : key === 'license' ? getLicense(node.package)
+        : node[key] ? node[key]
+        : node.package && node.package[key]
       const val = typeof val_ === 'string' ? val_
         : !val_ || typeof val_ !== 'object' ? val_
         : key === 'license' ? val_.type

deps/npm/node_modules/@npmcli/arborist/lib/node.js

@@ -547,6 +547,8 @@ class Node {
 
       // try to find our parent/fsParent in the new root inventory
       for (const p of walkUp(dirname(this.path))) {
+        if (p === this.path)
+          continue
         const ploc = relpath(root.realpath, p)
         const parent = root.inventory.get(ploc)
         if (parent) {
@@ -783,7 +785,13 @@ class Node {
   }
 
   get fsParent () {
-    return this[_fsParent]
+    const parent = this[_fsParent]
+    /* istanbul ignore next - should be impossible */
+    debug(() => {
+      if (parent === this)
+        throw new Error('node set to its own fsParent')
+    })
+    return parent
   }
 
   set fsParent (fsParent) {
@@ -1009,7 +1017,13 @@ class Node {
   }
 
   get parent () {
-    return this[_parent]
+    const parent = this[_parent]
+    /* istanbul ignore next - should be impossible */
+    debug(() => {
+      if (parent === this)
+        throw new Error('node set to its own parent')
+    })
+    return parent
   }
 
   // This setter keeps everything in order when we move a node from

deps/npm/node_modules/@npmcli/arborist/lib/proc-log.js

@@ -1,21 +0,0 @@
-// default logger.
-// emits 'log' events on the process
-const LEVELS = [
-  'notice',
-  'error',
-  'warn',
-  'info',
-  'verbose',
-  'http',
-  'silly',
-  'pause',
-  'resume',
-]
-
-const log = level => (...args) => process.emit('log', level, ...args)
-
-const logger = {}
-for (const level of LEVELS)
-  logger[level] = log(level)
-
-module.exports = logger

deps/npm/node_modules/@npmcli/arborist/lib/shrinkwrap.js

@@ -32,7 +32,7 @@ const mismatch = (a, b) => a && b && a !== b
 // After calling this.commit(), any nodes not present in the tree will have
 // been removed from the shrinkwrap data as well.
 
-const procLog = require('./proc-log.js')
+const procLog = require('proc-log')
 const YarnLock = require('./yarn-lock.js')
 const {promisify} = require('util')
 const rimraf = promisify(require('rimraf'))

deps/npm/node_modules/@npmcli/arborist/lib/tracker.js

@@ -1,6 +1,6 @@
 const _progress = Symbol('_progress')
 const _onError = Symbol('_onError')
-const procLog = require('./proc-log.js')
+const procLog = require('proc-log')
 
 module.exports = cls => class Tracker extends cls {
   constructor (options = {}) {

deps/npm/node_modules/@npmcli/arborist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "2.6.2",
+  "version": "2.6.3",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@npmcli/installed-package-contents": "^1.0.7",
@@ -22,6 +22,7 @@
     "npm-registry-fetch": "^11.0.0",
     "pacote": "^11.2.6",
     "parse-conflict-json": "^1.1.1",
+    "proc-log": "^1.0.0",
     "promise-all-reject-late": "^1.0.0",
     "promise-call-limit": "^1.0.1",
     "read-package-json-fast": "^2.0.2",

deps/npm/node_modules/libnpmdiff/.eslintrc.json

@@ -0,0 +1,207 @@
+{
+  "parserOptions": {
+    "ecmaVersion": 2018,
+    "ecmaFeatures": {},
+    "sourceType": "script"
+  },
+
+  "env": {
+    "es6": true,
+    "node": true
+  },
+
+  "plugins": [
+    "import",
+    "node",
+    "promise",
+    "standard"
+  ],
+
+  "globals": {
+    "document": "readonly",
+    "navigator": "readonly",
+    "window": "readonly"
+  },
+
+  "rules": {
+    "accessor-pairs": "error",
+    "array-bracket-spacing": ["error", "never"],
+    "arrow-spacing": ["error", { "before": true, "after": true }],
+    "block-spacing": ["error", "always"],
+    "brace-style": ["error", "1tbs", { "allowSingleLine": false }],
+    "camelcase": ["error", { "properties": "never" }],
+    "comma-dangle": ["error", {
+      "arrays": "always-multiline",
+      "objects": "always-multiline",
+      "imports": "always-multiline",
+      "exports": "always-multiline",
+      "functions": "never"
+    }],
+    "comma-spacing": ["error", { "before": false, "after": true }],
+    "comma-style": ["error", "last"],
+    "computed-property-spacing": ["error", "never"],
+    "constructor-super": "error",
+    "curly": ["error", "multi-or-nest"],
+    "dot-location": ["error", "property"],
+    "dot-notation": ["error", { "allowKeywords": true }],
+    "eol-last": "error",
+    "eqeqeq": ["error", "always", { "null": "ignore" }],
+    "func-call-spacing": ["error", "never"],
+    "generator-star-spacing": ["error", { "before": true, "after": true }],
+    "handle-callback-err": ["error", "^(err|error)$" ],
+    "indent": ["error", 2, {
+      "SwitchCase": 1,
+      "VariableDeclarator": 1,
+      "outerIIFEBody": 1,
+      "MemberExpression": 1,
+      "FunctionDeclaration": { "parameters": 1, "body": 1 },
+      "FunctionExpression": { "parameters": 1, "body": 1 },
+      "CallExpression": { "arguments": 1 },
+      "ArrayExpression": 1,
+      "ObjectExpression": 1,
+      "ImportDeclaration": 1,
+      "flatTernaryExpressions": true,
+      "ignoreComments": false,
+      "ignoredNodes": ["TemplateLiteral *"]
+    }],
+    "key-spacing": ["error", { "beforeColon": false, "afterColon": true }],
+    "keyword-spacing": ["error", { "before": true, "after": true }],
+    "lines-between-class-members": ["error", "always", { "exceptAfterSingleLine": true }],
+    "new-cap": ["error", { "newIsCap": true, "capIsNew": false, "properties": true }],
+    "new-parens": "error",
+    "no-array-constructor": "error",
+    "no-async-promise-executor": "error",
+    "no-caller": "error",
+    "no-case-declarations": "error",
+    "no-class-assign": "error",
+    "no-compare-neg-zero": "error",
+    "no-cond-assign": "off",
+    "no-const-assign": "error",
+    "no-constant-condition": ["error", { "checkLoops": false }],
+    "no-control-regex": "error",
+    "no-debugger": "error",
+    "no-delete-var": "error",
+    "no-dupe-args": "error",
+    "no-dupe-class-members": "error",
+    "no-dupe-keys": "error",
+    "no-duplicate-case": "error",
+    "no-empty-character-class": "error",
+    "no-empty-pattern": "error",
+    "no-eval": "error",
+    "no-ex-assign": "error",
+    "no-extend-native": "error",
+    "no-extra-bind": "error",
+    "no-extra-boolean-cast": "error",
+    "no-extra-parens": ["error", "functions"],
+    "no-fallthrough": "error",
+    "no-floating-decimal": "error",
+    "no-func-assign": "error",
+    "no-global-assign": "error",
+    "no-implied-eval": "error",
+    "no-inner-declarations": ["error", "functions"],
+    "no-invalid-regexp": "error",
+    "no-irregular-whitespace": "error",
+    "no-iterator": "error",
+    "no-labels": ["error", { "allowLoop": true, "allowSwitch": false }],
+    "no-lone-blocks": "error",
+    "no-misleading-character-class": "error",
+    "no-prototype-builtins": "error",
+    "no-useless-catch": "error",
+    "no-mixed-operators": "off",
+    "no-mixed-spaces-and-tabs": "error",
+    "no-multi-spaces": "error",
+    "no-multi-str": "error",
+    "no-multiple-empty-lines": ["error", { "max": 1, "maxEOF": 0 }],
+    "no-negated-in-lhs": "error",
+    "no-new": "off",
+    "no-new-func": "error",
+    "no-new-object": "error",
+    "no-new-require": "error",
+    "no-new-symbol": "error",
+    "no-new-wrappers": "error",
+    "no-obj-calls": "error",
+    "no-octal": "error",
+    "no-octal-escape": "error",
+    "no-path-concat": "error",
+    "no-proto": "error",
+    "no-redeclare": ["error", { "builtinGlobals": false }],
+    "no-regex-spaces": "error",
+    "no-return-assign": "off",
+    "no-self-assign": "off",
+    "no-self-compare": "error",
+    "no-sequences": "error",
+    "no-shadow-restricted-names": "error",
+    "no-sparse-arrays": "error",
+    "no-tabs": "error",
+    "no-template-curly-in-string": "error",
+    "no-this-before-super": "error",
+    "no-throw-literal": "off",
+    "no-trailing-spaces": "error",
+    "no-undef": "error",
+    "no-undef-init": "error",
+    "no-unexpected-multiline": "error",
+    "no-unmodified-loop-condition": "error",
+    "no-unneeded-ternary": ["error", { "defaultAssignment": false }],
+    "no-unreachable": "error",
+    "no-unsafe-finally": 0,
+    "no-unsafe-negation": "error",
+    "no-unused-expressions": ["error", { "allowShortCircuit": true, "allowTernary": true, "allowTaggedTemplates": true }],
+    "no-unused-vars": ["error", { "vars": "all", "args": "none", "ignoreRestSiblings": true }],
+    "no-use-before-define": ["error", { "functions": false, "classes": false, "variables": false }],
+    "no-useless-call": "error",
+    "no-useless-computed-key": "error",
+    "no-useless-constructor": "error",
+    "no-useless-escape": "error",
+    "no-useless-rename": "error",
+    "no-useless-return": "error",
+    "no-void": "error",
+    "no-whitespace-before-property": "error",
+    "no-with": "error",
+    "nonblock-statement-body-position": [2, "below"],
+    "object-curly-newline": "off",
+    "object-curly-spacing": "off",
+    "object-property-newline": ["error", { "allowMultiplePropertiesPerLine": true }],
+    "one-var": ["error", { "initialized": "never" }],
+    "operator-linebreak": "off",
+    "padded-blocks": ["error", { "blocks": "never", "switches": "never", "classes": "never" }],
+    "prefer-const": ["error", {"destructuring": "all"}],
+    "prefer-promise-reject-errors": "error",
+    "quote-props": ["error", "as-needed"],
+    "quotes": ["error", "single", { "avoidEscape": true, "allowTemplateLiterals": true }],
+    "rest-spread-spacing": ["error", "never"],
+    "semi": ["error", "never"],
+    "semi-spacing": ["error", { "before": false, "after": true }],
+    "space-before-blocks": ["error", "always"],
+    "space-before-function-paren": ["error", "always"],
+    "space-in-parens": ["error", "never"],
+    "space-infix-ops": "error",
+    "space-unary-ops": ["error", { "words": true, "nonwords": false }],
+    "spaced-comment": ["error", "always", {
+      "line": { "markers": ["*package", "!", "/", ",", "="] },
+      "block": { "balanced": true, "markers": ["*package", "!", ",", ":", "::", "flow-include"], "exceptions": ["*"] }
+    }],
+    "symbol-description": "error",
+    "template-curly-spacing": ["error", "never"],
+    "template-tag-spacing": ["error", "never"],
+    "unicode-bom": ["error", "never"],
+    "use-isnan": "error",
+    "valid-typeof": ["error", { "requireStringLiterals": true }],
+    "wrap-iife": ["error", "any", { "functionPrototypeMethods": true }],
+    "yield-star-spacing": ["error", "both"],
+    "yoda": ["error", "never"],
+
+    "import/export": "error",
+    "import/first": "error",
+    "import/no-absolute-path": ["error", { "esmodule": true, "commonjs": true, "amd": false }],
+    "import/no-duplicates": "error",
+    "import/no-named-default": "error",
+    "import/no-webpack-loader-syntax": "error",
+
+    "node/no-deprecated-api": "error",
+    "node/process-exit-as-throw": "error",
+
+    "promise/param-names": "off",
+
+    "standard/no-callback-literal": "error"
+  }
+}

deps/npm/node_modules/libnpmdiff/.gitignore

@@ -0,0 +1,99 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+lerna-debug.log*
+
+# Diagnostic reports (https://nodejs.org/api/report.html)
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage (https://gruntjs.com/creating-plugins#storing-task-files)
+.grunt
+
+# Bower dependency directory (https://bower.io/)
+bower_components
+
+# node-waf configuration
+.lock-wscript
+
+# Compiled binary addons (https://nodejs.org/api/addons.html)
+build/Release
+
+# Dependency directories
+node_modules/
+jspm_packages/
+
+# TypeScript v1 declaration files
+typings/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Microbundle cache
+.rpt2_cache/
+.rts2_cache_cjs/
+.rts2_cache_es/
+.rts2_cache_umd/
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# dotenv environment variables file
+.env
+.env.test
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+
+# next.js build output
+.next
+
+# nuxt.js build output
+.nuxt
+
+# gatsby files
+.cache/
+public
+
+# vuepress build output
+.vuepress/dist
+
+# Serverless directories
+.serverless/
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# Editors
+Session.vim

deps/npm/node_modules/libnpmdiff/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+## 2.0.3
+
+- fix name of options sent by the npm cli
+
+## 2.0.2
+
+- fix matching basename file filter
+
+## 2.0.1
+
+- fix for tarballs not listing folder names
+
+## 2.0.0
+
+- API rewrite:
+  - normalized all options
+  - specs to compare are now an array
+- fix context=0
+- added support to filtering by folder names
+
+## 1.0.1
+
+- fixed nameOnly option
+
+## 1.0.0
+
+- Initial release

deps/npm/node_modules/libnpmdiff/README.md

@@ -0,0 +1,97 @@
+# libnpmdiff
+
+[![npm version](https://img.shields.io/npm/v/libnpmdiff.svg)](https://npm.im/libnpmdiff)
+[![license](https://img.shields.io/npm/l/libnpmdiff.svg)](https://npm.im/libnpmdiff)
+[![GitHub Actions](https://github.com/npm/libnpmdiff/workflows/node-ci/badge.svg)](https://github.com/npm/libnpmdiff/actions?query=workflow%3Anode-ci)
+[![Coverage Status](https://coveralls.io/repos/github/npm/libnpmdiff/badge.svg?branch=main)](https://coveralls.io/github/npm/libnpmdiff?branch=main)
+
+The registry diff lib.
+
+## Table of Contents
+
+* [Example](#example)
+* [Install](#install)
+* [Contributing](#contributing)
+* [API](#api)
+* [LICENSE](#license)
+
+## Example
+
+```js
+const libdiff = require('libnpmdiff')
+
+const patch = await libdiff([
+  'abbrev@1.1.0',
+  'abbrev@1.1.1'
+])
+console.log(
+  patch
+)
+```
+
+Returns:
+
+```patch
+diff --git a/package.json b/package.json
+index v1.1.0..v1.1.1 100644
+--- a/package.json
++++ b/package.json
+@@ -1,6 +1,6 @@
+ {
+   "name": "abbrev",
+-  "version": "1.1.0",
++  "version": "1.1.1",
+   "description": "Like ruby's abbrev module, but in js",
+   "author": "Isaac Z. Schlueter <i@izs.me>",
+   "main": "abbrev.js",
+
+```
+
+## Install
+
+`$ npm install libnpmdiff`
+
+### Contributing
+
+The npm team enthusiastically welcomes contributions and project participation!
+There's a bunch of things you can do if you want to contribute! The
+[Contributor Guide](https://github.com/npm/cli/blob/latest/CONTRIBUTING.md)
+outlines the process for community interaction and contribution. Please don't
+hesitate to jump in if you'd like to, or even ask us questions if something
+isn't clear.
+
+All participants and maintainers in this project are expected to follow the
+[npm Code of Conduct](https://www.npmjs.com/policies/conduct), and just
+generally be excellent to each other.
+
+Please refer to the [Changelog](CHANGELOG.md) for project history details, too.
+
+Happy hacking!
+
+### API
+
+#### `> libnpmdif([ a, b ], [opts]) -> Promise<String>`
+
+Fetches the registry tarballs and compare files between a spec `a` and spec `b`. **npm** spec types are usually described in `<pkg-name>@<version>` form but multiple other types are alsos supported, for more info on valid specs take a look at [`npm-package-arg`](https://github.com/npm/npm-package-arg).
+
+**Options**:
+
+- `color <Boolean>`: Should add ANSI colors to string output? Defaults to `false`.
+- `tagVersionPrefix <Sring>`: What prefix should be used to define version numbers. Defaults to `v`
+- `diffUnified <Number>`: How many lines of code to print before/after each diff. Defaults to `3`.
+- `diffFiles <Array<String>>`: If set only prints patches for the files listed in this array (also accepts globs). Defaults to `undefined`.
+- `diffIgnoreAllSpace <Boolean>`: Whether or not should ignore changes in whitespace (very useful to avoid indentation changes extra diff lines). Defaults to `false`.
+- `diffNameOnly <Boolean>`: Prints only file names and no patch diffs. Defaults to `false`.
+- `diffNoPrefix <Boolean>`: If true then skips printing any prefixes in filenames. Defaults to `false`.
+- `diffSrcPrefix <String>`: Prefix to be used in the filenames from `a`. Defaults to `a/`.
+- `diffDstPrefix <String>`: Prefix to be used in the filenames from `b`. Defaults to `b/`.
+- `diffText <Boolean>`: Should treat all files as text and try to print diff for binary files. Defaults to `false`.
+- ...`cache`, `registry`, `where` and other common options accepted by [pacote](https://github.com/npm/pacote#options)
+
+Returns a `Promise` that fullfils with a `String` containing the resulting patch diffs.
+
+Throws an error if either `a` or `b` are missing or if trying to diff more than two specs.
+
+## LICENSE
+
+[ISC](./LICENSE)

deps/npm/node_modules/libnpmdiff/package.json

@@ -46,12 +46,12 @@
     ]
   },
   "devDependencies": {
-    "eslint": "^7.18.0",
-    "eslint-plugin-import": "^2.22.1",
+    "eslint": "^7.28.0",
+    "eslint-plugin-import": "^2.23.4",
     "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-promise": "^4.2.1",
+    "eslint-plugin-promise": "^5.1.0",
     "eslint-plugin-standard": "^5.0.0",
-    "tap": "^14.11.0"
+    "tap": "^15.0.9"
   },
   "dependencies": {
     "@npmcli/disparity-colors": "^1.0.1",
@@ -59,8 +59,8 @@
     "binary-extensions": "^2.2.0",
     "diff": "^5.0.0",
     "minimatch": "^3.0.4",
-    "npm-package-arg": "^8.1.1",
-    "pacote": "^11.3.0",
+    "npm-package-arg": "^8.1.4",
+    "pacote": "^11.3.4",
     "tar": "^6.1.0"
   }
 }

deps/npm/node_modules/libnpmdiff/tap-snapshots/test/format-diff.js.test.cjs

@@ -0,0 +1,152 @@
+/* IMPORTANT
+ * This snapshot file is auto-generated, but designed for humans.
+ * It should be checked into source control and tracked carefully.
+ * Re-generate by setting TAP_SNAPSHOT=1 and running tests.
+ * Make sure to inspect the output below.  Do not ignore changes!
+ */
+'use strict'
+exports[`test/format-diff.js TAP added file > should output expected added file diff result 1`] = `
+diff --git a/foo.js b/foo.js
+new file mode 100755
+index v1.0.0..v2.0.0
+--- a/foo.js
++++ b/foo.js
+@@ -0,0 +1,2 @@
++"use strict"
++module.exports = "foo"
+`
+
+exports[`test/format-diff.js TAP binary file > should output expected bin file diff result 1`] = `
+diff --git a/foo.jpg b/foo.jpg
+index v1.0.0..v2.0.0 100644
+--- a/foo.jpg
++++ b/foo.jpg
+`
+
+exports[`test/format-diff.js TAP changed file mode > should output expected changed file mode diff result 1`] = `
+diff --git a/foo.js b/foo.js
+old mode 100644
+new mode 100755
+index v1.0.0..v2.0.0
+--- a/foo.js
++++ b/foo.js
+`
+
+exports[`test/format-diff.js TAP colored output > should output expected colored diff result 1`] = `
+diff --git a/foo.js b/foo.js
+index v1.0.0..v2.0.0 100644
+--- a/foo.js
++++ b/foo.js
+@@ -1,2 +1,2 @@
+ "use strict"
+-module.exports = "foo"
++module.exports = "foobar"
+`
+
+exports[`test/format-diff.js TAP diff options > should output expected diff result 1`] = `
+diff --git before/foo.js after/foo.js
+index v1.0.0..v2.0.0 100644
+--- before/foo.js
++++ after/foo.js
+@@ -4,4 +4,6 @@
+ const c = "c"
++const d = "d"
+ module.exports = () => a+
+ b+
+-c
++c+
++d
+`
+
+exports[`test/format-diff.js TAP diffUnified=0 > should output no context lines in output 1`] = `
+diff --git a/foo.js b/foo.js
+index v1.0.0..v2.0.0 100644
+--- a/foo.js
++++ b/foo.js
+@@ -3,2 +3,3 @@
+-const b = "b"
+-const c = "c"
++  const b = "b"
++  const c = "c"
++  const d = "d"
+@@ -7,1 +8,2 @@
+-c
++c+
++d
+`
+
+exports[`test/format-diff.js TAP format multiple files patch > should output expected result for multiple files 1`] = `
+diff --git a/foo.js b/foo.js
+index v1.0.0..v1.1.1 100644
+--- a/foo.js
++++ b/foo.js
+@@ -1,2 +1,2 @@
+ "use strict"
+-module.exports = "foo"
++module.exports = "foobar"
+diff --git a/lib/utils.js b/lib/utils.js
+index v1.0.0..v1.1.1 100644
+--- a/lib/utils.js
++++ b/lib/utils.js
+@@ -1,3 +1,4 @@
+ "use strict"
+ const bar = require("./bar.js")
+-module.exports = () => bar
++module.exports =
++  () => bar + "util"
+`
+
+exports[`test/format-diff.js TAP format removed file > should output expected removed file diff result 1`] = `
+diff --git a/foo.js b/foo.js
+deleted file mode 100644
+index v1.0.0..v2.0.0
+--- a/foo.js
++++ b/foo.js
+@@ -1,2 +0,0 @@
+-"use strict"
+-module.exports = "foo"
+/ No newline at end of file
+`
+
+exports[`test/format-diff.js TAP format simple diff > should output expected diff result 1`] = `
+diff --git a/foo.js b/foo.js
+index v1.0.0..v2.0.0 100644
+--- a/foo.js
++++ b/foo.js
+@@ -1,2 +1,2 @@
+ "use strict"
+-module.exports = "foo"
++module.exports = "foobar"
+`
+
+exports[`test/format-diff.js TAP noPrefix > should output result with no prefixes 1`] = `
+diff --git foo.js foo.js
+index v1.0.0..v2.0.0 100644
+Index: foo.js
+--- foo.js
++++ foo.js
+@@ -1,2 +1,2 @@
+ "use strict"
+-module.exports = "foo"
++module.exports = "foobar"
+`
+
+exports[`test/format-diff.js TAP nothing to diff > should output empty result 1`] = `
+
+`
+
+exports[`test/format-diff.js TAP respect --tag-version-prefix option > should output expected diff result 1`] = `
+diff --git a/foo.js b/foo.js
+index b1.0.0..b2.0.0 100644
+--- a/foo.js
++++ b/foo.js
+@@ -1,2 +1,2 @@
+ "use strict"
+-module.exports = "foo"
++module.exports = "foobar"
+`
+
+exports[`test/format-diff.js TAP using --name-only option > should output expected diff result 1`] = `
+foo.js
+lib/utils.js
+`

deps/npm/node_modules/libnpmdiff/tap-snapshots/test/index.js.test.cjs

@@ -0,0 +1,115 @@
+/* IMPORTANT
+ * This snapshot file is auto-generated, but designed for humans.
+ * It should be checked into source control and tracked carefully.
+ * Re-generate by setting TAP_SNAPSHOT=1 and running tests.
+ * Make sure to inspect the output below.  Do not ignore changes!
+ */
+'use strict'
+exports[`test/index.js TAP compare two diff specs > should output expected diff 1`] = `
+diff --git a/index.js b/index.js
+index v1.0.0..v2.0.0 100644
+--- a/index.js
++++ b/index.js
+@@ -1,2 +1,2 @@
+ module.exports =
+-  "a1"
++  "a2"
+diff --git a/package.json b/package.json
+index v1.0.0..v2.0.0 100644
+--- a/package.json
++++ b/package.json
+@@ -1,4 +1,4 @@
+ {
+   "name": "a",
+-  "version": "1.0.0"
++  "version": "2.0.0"
+ }
+`
+
+exports[`test/index.js TAP folder in node_modules nested, absolute path > should output expected diff 1`] = `
+diff --git a/package.json b/package.json
+index v2.0.0..v2.0.1 100644
+--- a/package.json
++++ b/package.json
+@@ -1,6 +1,6 @@
+ {
+   "name": "b",
+-  "version": "2.0.0",
++  "version": "2.0.1",
+   "scripts": {
+     "prepare": "node prepare.js"
+   }
+diff --git a/prepare.js b/prepare.js
+index v2.0.0..v2.0.1 100644
+--- a/prepare.js
++++ b/prepare.js
+@@ -1,1 +0,0 @@
+-throw new Error("ERR")
+/ No newline at end of file
+`
+
+exports[`test/index.js TAP folder in node_modules nested, relative path > should output expected diff 1`] = `
+diff --git a/package.json b/package.json
+index v2.0.0..v2.0.1 100644
+--- a/package.json
++++ b/package.json
+@@ -1,6 +1,6 @@
+ {
+   "name": "b",
+-  "version": "2.0.0",
++  "version": "2.0.1",
+   "scripts": {
+     "prepare": "node prepare.js"
+   }
+diff --git a/prepare.js b/prepare.js
+index v2.0.0..v2.0.1 100644
+--- a/prepare.js
++++ b/prepare.js
+@@ -1,1 +0,0 @@
+-throw new Error("ERR")
+/ No newline at end of file
+`
+
+exports[`test/index.js TAP folder in node_modules top-level, absolute path > should output expected diff 1`] = `
+diff --git a/package.json b/package.json
+index v1.0.0..v1.0.1 100644
+--- a/package.json
++++ b/package.json
+@@ -1,6 +1,6 @@
+ {
+   "name": "a",
+-  "version": "1.0.0",
++  "version": "1.0.1",
+   "scripts": {
+     "prepare": "node prepare.js"
+   }
+diff --git a/prepare.js b/prepare.js
+index v1.0.0..v1.0.1 100644
+--- a/prepare.js
++++ b/prepare.js
+@@ -1,1 +0,0 @@
+-throw new Error("ERR")
+/ No newline at end of file
+`
+
+exports[`test/index.js TAP folder in node_modules top-level, relative path > should output expected diff 1`] = `
+diff --git a/package.json b/package.json
+index v1.0.0..v1.0.1 100644
+--- a/package.json
++++ b/package.json
+@@ -1,6 +1,6 @@
+ {
+   "name": "a",
+-  "version": "1.0.0",
++  "version": "1.0.1",
+   "scripts": {
+     "prepare": "node prepare.js"
+   }
+diff --git a/prepare.js b/prepare.js
+index v1.0.0..v1.0.1 100644
+--- a/prepare.js
++++ b/prepare.js
+@@ -1,1 +0,0 @@
+-throw new Error("ERR")
+/ No newline at end of file
+`

deps/npm/node_modules/libnpmdiff/tap-snapshots/test/untar.js.test.cjs

@@ -0,0 +1,134 @@
+/* IMPORTANT
+ * This snapshot file is auto-generated, but designed for humans.
+ * It should be checked into source control and tracked carefully.
+ * Re-generate by setting TAP_SNAPSHOT=1 and running tests.
+ * Make sure to inspect the output below.  Do not ignore changes!
+ */
+'use strict'
+exports[`test/untar.js TAP filter files > should return list of filenames 1`] = `
+LICENSE
+README.md
+`
+
+exports[`test/untar.js TAP filter files > should return map of filenames with valid contents 1`] = `
+a/LICENSE: true
+a/README.md: true
+`
+
+exports[`test/untar.js TAP filter files by exact filename > should return no filenames 1`] = `
+
+`
+
+exports[`test/untar.js TAP filter files by exact filename > should return no filenames 2`] = `
+
+`
+
+exports[`test/untar.js TAP filter files using glob expressions > should return list of filenames 1`] = `
+lib/index.js
+lib/utils/b.js
+package-lock.json
+test/index.js
+`
+
+exports[`test/untar.js TAP filter files using glob expressions > should return map of filenames with valid contents 1`] = `
+a/lib/index.js: true
+a/lib/utils/b.js: true
+a/package-lock.json: true
+a/test/index.js: true
+`
+
+exports[`test/untar.js TAP match files by end of filename > should return list of filenames 1`] = `
+lib/index.js
+lib/utils/b.js
+test/index.js
+test/utils/b.js
+`
+
+exports[`test/untar.js TAP match files by end of filename > should return map of filenames with valid contents 1`] = `
+a/lib/index.js: true
+a/lib/utils/b.js: true
+a/test/index.js: true
+a/test/utils/b.js: true
+`
+
+exports[`test/untar.js TAP match files by simple folder name > should return list of filenames 1`] = `
+lib/index.js
+lib/utils/b.js
+`
+
+exports[`test/untar.js TAP match files by simple folder name > should return map of filenames with valid contents 1`] = `
+a/lib/index.js: true
+a/lib/utils/b.js: true
+`
+
+exports[`test/untar.js TAP match files by simple folder name variation > should return list of filenames 1`] = `
+test/index.js
+test/utils/b.js
+`
+
+exports[`test/untar.js TAP match files by simple folder name variation > should return map of filenames with valid contents 1`] = `
+a/test/index.js: true
+a/test/utils/b.js: true
+`
+
+exports[`test/untar.js TAP untar package with folders > should have read contents 1`] = `
+module.exports = 'b'
+
+`
+
+exports[`test/untar.js TAP untar package with folders > should return list of filenames 1`] = `
+lib/index.js
+lib/utils/b.js
+package-lock.json
+package.json
+test/index.js
+test/utils/b.js
+`
+
+exports[`test/untar.js TAP untar package with folders > should return map of filenames to its contents 1`] = `
+a/lib/index.js: true
+a/lib/utils/b.js: true
+a/package-lock.json: true
+a/package.json: true
+a/test/index.js: true
+a/test/utils/b.js: true
+`
+
+exports[`test/untar.js TAP untar simple package > should have read contents 1`] = `
+The MIT License (MIT)
+
+Copyright (c) Ruy Adorno (ruyadorno.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+`
+
+exports[`test/untar.js TAP untar simple package > should return list of filenames 1`] = `
+LICENSE
+index.js
+package.json
+README.md
+`
+
+exports[`test/untar.js TAP untar simple package > should return map of filenames to its contents 1`] = `
+a/LICENSE: true
+a/index.js: true
+a/package.json: true
+a/README.md: true
+`

deps/npm/node_modules/libnpmdiff/test/format-diff.js

@@ -0,0 +1,483 @@
+const t = require('tap')
+
+const formatDiff = require('../lib/format-diff.js')
+
+const normalizeWin = (str) => str
+  .replace(/\\+/g, '/')
+  .replace(/\r\n/g, '\n')
+
+t.cleanSnapshot = (str) => normalizeWin(str)
+
+t.test('format simple diff', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foobar"\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+    }),
+    'should output expected diff result'
+  )
+  t.end()
+})
+
+t.test('nothing to diff', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '1.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+    }),
+    'should output empty result'
+  )
+  t.end()
+})
+
+t.test('format removed file', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+    }),
+    'should output expected removed file diff result'
+  )
+  t.end()
+})
+
+t.test('changed file mode', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100755',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+    }),
+    'should output expected changed file mode diff result'
+  )
+  t.end()
+})
+
+t.test('added file', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100755',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+    }),
+    'should output expected added file diff result'
+  )
+  t.end()
+})
+
+t.test('binary file', t => {
+  const files = new Set([
+    'foo.jpg',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.jpg': {
+      content: Buffer.from(''),
+      mode: '100644',
+    },
+    'b/foo.jpg': {
+      content: Buffer.from(''),
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+    }),
+    'should output expected bin file diff result'
+  )
+  t.end()
+})
+
+t.test('nothing to compare', t => {
+  const files = new Set([
+    'foo.jpg',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.jpg': {},
+    'b/foo.jpg': {},
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.equal(
+    formatDiff({
+      files,
+      refs,
+      versions,
+    }),
+    '',
+    'should have no output'
+  )
+  t.end()
+})
+
+t.test('colored output', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foobar"\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+      opts: {
+        color: true,
+      },
+    }),
+    'should output expected colored diff result'
+  )
+  t.end()
+})
+
+t.test('using --name-only option', t => {
+  const files = new Set([
+    'foo.js',
+    'lib/bar.js',
+    'lib/utils.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foobar"\n',
+      mode: '100644',
+    },
+    'a/lib/bar.js': {
+      content: '"use strict"\nmodule.exports = "bar"\n',
+      mode: '100644',
+    },
+    'b/lib/bar.js': {
+      content: '"use strict"\nmodule.exports = "bar"\n',
+      mode: '100644',
+    },
+    'a/lib/utils.js': {
+      content: '"use strict"\nconst bar = require("./bar.js")\n'
+        + 'module.exports = () => bar\n',
+      mode: '100644',
+    },
+    'b/lib/utils.js': {
+      content: '"use strict"\nconst bar = require("./bar.js")\n'
+        + 'module.exports =\n  () => bar + "util"\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+      opts: {
+        diffNameOnly: true,
+      },
+    }),
+    'should output expected diff result'
+  )
+  t.end()
+})
+
+t.test('respect --tag-version-prefix option', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foobar"\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+      opts: {
+        tagVersionPrefix: 'b',
+      },
+    }),
+    'should output expected diff result'
+  )
+  t.end()
+})
+
+t.test('diff options', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nconst a = "a"\nconst b = "b"\n'
+        + 'const c = "c"\nmodule.exports = () => a+\nb+\nc\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nconst a = "a"\n  const b = "b"\n'
+        + '  const c = "c"\n  const d = "d"\n'
+        + 'module.exports = () => a+\nb+\nc+\nd\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+      opts: {
+        diffUnified: 1,
+        diffIgnoreAllSpace: true,
+        diffSrcPrefix: 'before/',
+        diffDstPrefix: 'after/',
+      },
+    }),
+    'should output expected diff result'
+  )
+  t.end()
+})
+
+t.test('diffUnified=0', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nconst a = "a"\nconst b = "b"\n'
+        + 'const c = "c"\nmodule.exports = () => a+\nb+\nc\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nconst a = "a"\n  const b = "b"\n'
+        + '  const c = "c"\n  const d = "d"\n'
+        + 'module.exports = () => a+\nb+\nc+\nd\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+      opts: {
+        diffUnified: 0,
+      },
+    }),
+    'should output no context lines in output'
+  )
+  t.end()
+})
+
+t.test('noPrefix', t => {
+  const files = new Set([
+    'foo.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foobar"\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '2.0.0',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+      opts: {
+        diffNoPrefix: true,
+      },
+    }),
+    'should output result with no prefixes'
+  )
+  t.end()
+})
+
+t.test('format multiple files patch', t => {
+  const files = new Set([
+    'foo.js',
+    'lib/bar.js',
+    'lib/utils.js',
+  ])
+  const refs = new Map(Object.entries({
+    'a/foo.js': {
+      content: '"use strict"\nmodule.exports = "foo"\n',
+      mode: '100644',
+    },
+    'b/foo.js': {
+      content: '"use strict"\nmodule.exports = "foobar"\n',
+      mode: '100644',
+    },
+    'a/lib/bar.js': {
+      content: '"use strict"\nmodule.exports = "bar"\n',
+      mode: '100644',
+    },
+    'b/lib/bar.js': {
+      content: '"use strict"\nmodule.exports = "bar"\n',
+      mode: '100644',
+    },
+    'a/lib/utils.js': {
+      content: '"use strict"\nconst bar = require("./bar.js")\n'
+        + 'module.exports = () => bar\n',
+      mode: '100644',
+    },
+    'b/lib/utils.js': {
+      content: '"use strict"\nconst bar = require("./bar.js")\n'
+        + 'module.exports =\n  () => bar + "util"\n',
+      mode: '100644',
+    },
+  }))
+  const versions = {
+    a: '1.0.0',
+    b: '1.1.1',
+  }
+
+  t.matchSnapshot(
+    formatDiff({
+      files,
+      refs,
+      versions,
+    }),
+    'should output expected result for multiple files'
+  )
+  t.end()
+})

deps/npm/node_modules/libnpmdiff/test/index.js

@@ -0,0 +1,147 @@
+const { resolve } = require('path')
+
+const t = require('tap')
+
+const diff = require('../index.js')
+
+const normalizePath = p => p
+  .replace(/\\+/g, '/')
+  .replace(/\r\n/g, '\n')
+
+t.cleanSnapshot = (str) => normalizePath(str)
+  .replace(normalizePath(process.execPath), 'node')
+
+const json = (obj) => `${JSON.stringify(obj, null, 2)}\n`
+
+t.test('compare two diff specs', async t => {
+  const path = t.testdir({
+    a1: {
+      'package.json': json({
+        name: 'a',
+        version: '1.0.0',
+      }),
+      'index.js': 'module.exports =\n  "a1"\n',
+    },
+    a2: {
+      'package.json': json({
+        name: 'a',
+        version: '2.0.0',
+      }),
+      'index.js': 'module.exports =\n  "a2"\n',
+    },
+  })
+
+  const a = `file:${resolve(path, 'a1')}`
+  const b = `file:${resolve(path, 'a2')}`
+
+  t.resolveMatchSnapshot(diff([a, b], {}), 'should output expected diff')
+})
+
+t.test('using single arg', async t => {
+  await t.rejects(
+    diff(['abbrev@1.0.3']),
+    /libnpmdiff needs two arguments to compare/,
+    'should throw EDIFFARGS error'
+  )
+})
+
+t.test('too many args', async t => {
+  const args = ['abbrev@1.0.3', 'abbrev@1.0.4', 'abbrev@1.0.5']
+  await t.rejects(
+    diff(args),
+    /libnpmdiff needs two arguments to compare/,
+    'should output diff against cwd files'
+  )
+})
+
+t.test('folder in node_modules', async t => {
+  const path = t.testdir({
+    node_modules: {
+      a: {
+        'package.json': json({
+          name: 'a',
+          version: '1.0.0',
+          scripts: {
+            prepare: `${process.execPath} prepare.js`,
+          },
+        }),
+        'prepare.js': 'throw new Error("ERR")',
+        node_modules: {
+          b: {
+            'package.json': json({
+              name: 'b',
+              version: '2.0.0',
+              scripts: {
+                prepare: `${process.execPath} prepare.js`,
+              },
+            }),
+            'prepare.js': 'throw new Error("ERR")',
+          },
+        },
+      },
+    },
+    packages: {
+      a: {
+        'package.json': json({
+          name: 'a',
+          version: '1.0.1',
+          scripts: {
+            prepare: `${process.execPath} prepare.js`,
+          },
+        }),
+        'prepare.js': '',
+      },
+      b: {
+        'package.json': json({
+          name: 'b',
+          version: '2.0.1',
+          scripts: {
+            prepare: `${process.execPath} prepare.js`,
+          },
+        }),
+        'prepare.js': '',
+      },
+    },
+    'package.json': json({
+      name: 'my-project',
+      version: '1.0.0',
+    }),
+  })
+
+  t.test('top-level, absolute path', async t => {
+    t.resolveMatchSnapshot(diff([
+      `file:${resolve(path, 'node_modules/a')}`,
+      `file:${resolve(path, 'packages/a')}`,
+    ], { where: path }), 'should output expected diff')
+  })
+  t.test('top-level, relative path', async t => {
+    const _cwd = process.cwd()
+    process.chdir(path)
+    t.teardown(() => {
+      process.chdir(_cwd)
+    })
+
+    t.resolveMatchSnapshot(diff([
+      'file:./node_modules/a',
+      'file:./packages/a',
+    ], { where: path }), 'should output expected diff')
+  })
+  t.test('nested, absolute path', async t => {
+    t.resolveMatchSnapshot(diff([
+      `file:${resolve(path, 'node_modules/a/node_modules/b')}`,
+      `file:${resolve(path, 'packages/b')}`,
+    ], { where: path}), 'should output expected diff')
+  })
+  t.test('nested, relative path', async t => {
+    const _cwd = process.cwd()
+    process.chdir(path)
+    t.teardown(() => {
+      process.chdir(_cwd)
+    })
+
+    t.resolveMatchSnapshot(diff([
+      'file:./node_modules/a/node_modules/b',
+      'file:./packages/b',
+    ], { where: path }), 'should output expected diff')
+  })
+})

deps/npm/node_modules/libnpmdiff/test/should-print-patch.js

@@ -0,0 +1,28 @@
+const t = require('tap')
+const shouldPrintPatch = require('../lib/should-print-patch.js')
+
+t.test('valid filenames', t => {
+  t.ok(shouldPrintPatch('LICENSE'))
+  t.ok(shouldPrintPatch('.gitignore'))
+  t.ok(shouldPrintPatch('foo.md'))
+  t.ok(shouldPrintPatch('./bar.txt'))
+  t.ok(shouldPrintPatch('/a/b/c/bar.html'))
+  t.end()
+})
+
+t.test('invalid filenames', t => {
+  t.notOk(shouldPrintPatch('foo.exe'))
+  t.notOk(shouldPrintPatch('./foo.jpg'))
+  t.notOk(shouldPrintPatch('/a/b/c/bar.bin'))
+  t.end()
+})
+
+t.test('using --text/-a option', t => {
+  const opts = {
+    diffText: true,
+  }
+  t.ok(shouldPrintPatch('foo.exe', opts))
+  t.ok(shouldPrintPatch('./foo.jpg', opts))
+  t.ok(shouldPrintPatch('/a/b/c/bar.bin', opts))
+  t.end()
+})

deps/npm/node_modules/libnpmdiff/test/tarball.js

@@ -0,0 +1,96 @@
+const { resolve } = require('path')
+
+const t = require('tap')
+const tar = require('tar')
+const pacote = require('pacote')
+pacote.tarball = () => {
+  throw new Error('Failed to detect node_modules tarball')
+}
+
+const tarball = require('../lib/tarball.js')
+
+const json = (obj) => `${JSON.stringify(obj, null, 2)}\n`
+
+t.test('returns a tarball from node_modules', t => {
+  t.plan(2)
+
+  const path = t.testdir({
+    node_modules: {
+      a: {
+        'package.json': json({
+          name: 'a',
+          version: '1.0.0',
+          bin: { a: 'index.js' },
+        }),
+        'index.js': '',
+      },
+    },
+  })
+
+  const _cwd = process.cwd()
+  process.chdir(path)
+  t.teardown(() => {
+    process.chdir(_cwd)
+  })
+
+  tarball({ bin: { a: 'index.js' }, _resolved: resolve(path, 'node_modules/a') }, { where: path })
+    .then(res => {
+      tar.list({
+        filter: path => {
+          t.match(
+            path,
+            /package.json|index.js/,
+            'should return tarball with expected files'
+          )
+        },
+      })
+        .on('error', e => {
+          throw e
+        })
+        .end(res)
+    })
+})
+
+t.test('node_modules folder within a linked dir', async t => {
+  const path = t.testdir({
+    node_modules: {
+      a: t.fixture('symlink', '../packages/a'),
+    },
+    packages: {
+      a: {
+        node_modules: {
+          b: {
+            'package.json': json({
+              name: 'a',
+              version: '1.0.0',
+            }),
+          },
+        },
+      },
+    },
+  })
+
+  const link = await tarball({ _resolved: resolve(path, 'node_modules/a/node_modules/b') }, {})
+  t.ok(link, 'should retrieve tarball from reading link')
+
+  const target = await tarball({ _resolved: resolve(path, 'packages/a/node_modules/b') }, {})
+  t.ok(target, 'should retrieve tarball from reading target')
+})
+
+t.test('pkg not in a node_modules folder', async t => {
+  const path = t.testdir({
+    packages: {
+      a: {
+        'package.json': json({
+          name: 'a',
+          version: '1.0.0',
+        }),
+      },
+    },
+  })
+
+  t.throws(
+    () => tarball({ _resolved: resolve(path, 'packages/a') }, {}),
+    'should call regular pacote.tarball method instead'
+  )
+})

deps/npm/node_modules/libnpmdiff/test/untar.js

@@ -0,0 +1,231 @@
+const { resolve } = require('path')
+const t = require('tap')
+const pacote = require('pacote')
+const untar = require('../lib/untar.js')
+
+t.test('untar simple package', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/simple-output-2.2.1.tgz'))
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  })
+
+  t.matchSnapshot([...files].join('\n'), 'should return list of filenames')
+  t.matchSnapshot(
+    [...refs.entries()].map(([k, v]) => `${k}: ${!!v}`).join('\n'),
+    'should return map of filenames to its contents'
+  )
+  t.matchSnapshot(refs.get('a/LICENSE').content, 'should have read contents')
+})
+
+t.test('untar package with folders', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/archive.tgz'))
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  })
+
+  t.matchSnapshot([...files].join('\n'), 'should return list of filenames')
+  t.matchSnapshot(
+    [...refs.entries()].map(([k, v]) => `${k}: ${!!v}`).join('\n'),
+    'should return map of filenames to its contents'
+  )
+  t.matchSnapshot(
+    refs.get('a/lib/utils/b.js').content,
+    'should have read contents'
+  )
+})
+
+t.test('filter files', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/simple-output-2.2.1.tgz'))
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  }, {
+    diffFiles: [
+      './LICENSE',
+      'missing-file',
+      'README.md',
+    ],
+  })
+
+  t.matchSnapshot([...files].join('\n'), 'should return list of filenames')
+  t.matchSnapshot(
+    [...refs.entries()].map(([k, v]) => `${k}: ${!!v.content}`).join('\n'),
+    'should return map of filenames with valid contents'
+  )
+})
+
+t.test('filter files using glob expressions', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/archive.tgz'))
+  const cwd = t.testdir({
+    lib: {
+      'index.js': '',
+      utils: {
+        '/b.js': '',
+      },
+    },
+    'package-lock.json': '',
+    'package.json': '',
+    test: {
+      '/index.js': '',
+      utils: {
+        'b.js': '',
+      },
+    },
+  })
+
+  const _cwd = process.cwd()
+  process.chdir(cwd)
+  t.teardown(() => {
+    process.chdir(_cwd)
+  })
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  }, {
+    diffFiles: [
+      './lib/**',
+      '*-lock.json',
+      'test\\*', // windows-style sep should be normalized
+    ],
+  })
+
+  t.matchSnapshot([...files].join('\n'), 'should return list of filenames')
+  t.matchSnapshot(
+    [...refs.entries()].map(([k, v]) => `${k}: ${!!v.content}`).join('\n'),
+    'should return map of filenames with valid contents'
+  )
+})
+
+t.test('match files by end of filename', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/archive.tgz'))
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  }, {
+    diffFiles: [
+      '*.js',
+    ],
+  })
+
+  t.matchSnapshot([...files].join('\n'), 'should return list of filenames')
+  t.matchSnapshot(
+    [...refs.entries()].map(([k, v]) => `${k}: ${!!v.content}`).join('\n'),
+    'should return map of filenames with valid contents'
+  )
+})
+
+t.test('filter files by exact filename', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/archive.tgz'))
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  }, {
+    diffFiles: [
+      'index.js',
+    ],
+  })
+
+  t.matchSnapshot([...files].join('\n'), 'should return no filenames')
+  t.matchSnapshot(
+    [...refs.entries()].map(([k, v]) => `${k}: ${!!v.content}`).join('\n'),
+    'should return no filenames'
+  )
+})
+
+t.test('match files by simple folder name', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/archive.tgz'))
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  }, {
+    diffFiles: [
+      'lib',
+    ],
+  })
+
+  t.matchSnapshot([...files].join('\n'), 'should return list of filenames')
+  t.matchSnapshot(
+    [...refs.entries()].map(([k, v]) => `${k}: ${!!v.content}`).join('\n'),
+    'should return map of filenames with valid contents'
+  )
+})
+
+t.test('match files by simple folder name variation', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/archive.tgz'))
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  }, {
+    diffFiles: [
+      './test/',
+    ],
+  })
+
+  t.matchSnapshot([...files].join('\n'), 'should return list of filenames')
+  t.matchSnapshot(
+    [...refs.entries()].map(([k, v]) => `${k}: ${!!v.content}`).join('\n'),
+    'should return map of filenames with valid contents'
+  )
+})
+
+t.test('filter out all files', async t => {
+  const item =
+    await pacote.tarball(resolve('./test/fixtures/simple-output-2.2.1.tgz'))
+
+  const {
+    files,
+    refs,
+  } = await untar({
+    item,
+    prefix: 'a/',
+  }, {
+    diffFiles: [
+      'non-matching-pattern',
+    ],
+  })
+
+  t.equal(files.size, 0, 'should have no files')
+  t.equal(refs.size, 0, 'should have no refs')
+})

deps/npm/node_modules/libnpmexec/lib/cache-install-dir.js

@@ -2,12 +2,12 @@ const crypto = require('crypto')
 
 const { resolve } = require('path')
 
-const cacheInstallDir = ({ cache, packages }) => {
-  if (!cache)
-    throw new Error('Must provide a valid cache path')
+const cacheInstallDir = ({ npxCache, packages }) => {
+  if (!npxCache)
+    throw new Error('Must provide a valid npxCache path')
 
   // only packages not found in ${prefix}/node_modules
-  return resolve(cache, '_npx', getHash(packages))
+  return resolve(npxCache, getHash(packages))
 }
 
 const getHash = (packages) =>

deps/npm/node_modules/libnpmexec/lib/index.js

@@ -124,8 +124,8 @@ const exec = async (opts) => {
     manis.some(manifest => manifestMissing({ tree, manifest }))
 
   if (needInstall) {
-    const { cache } = flatOptions
-    const installDir = cacheInstallDir({ cache, packages })
+    const { npxCache } = flatOptions
+    const installDir = cacheInstallDir({ npxCache, packages })
     await mkdirp(installDir)
     const arb = new Arborist({
       ...flatOptions,

deps/npm/node_modules/libnpmexec/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmexec",
-  "version": "1.2.0",
+  "version": "2.0.0",
   "files": [
     "lib"
   ],

deps/npm/node_modules/libnpmversion/lib/retrieve-tag.js

@@ -2,7 +2,7 @@ const { spawn } = require('@npmcli/git')
 const semver = require('semver')
 
 module.exports = async opts => {
-  const tag = (await spawn(['describe', '--tags', '--abbrev=0', '--match=\'*.*.*\''], opts)).stdout.trim()
+  const tag = (await spawn(['describe', '--tags', '--abbrev=0', '--match=*.*.*'], opts)).stdout.trim()
   const ver = semver.coerce(tag, { loose: true })
   if (ver) {
     return ver.version

deps/npm/node_modules/libnpmversion/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmversion",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "main": "lib/index.js",
   "files": [
     "lib/*.js"

deps/npm/node_modules/make-fetch-happen/lib/cache/entry.js

@@ -145,6 +145,12 @@ class CacheEntry {
       return
     }
 
+    // a cache mode of 'reload' means to behave as though we have no cache
+    // on the way to the network. return undefined to allow cacheFetch to
+    // create a brand new request no matter what.
+    if (options.cache === 'reload')
+      return
+
     // find the specific entry that satisfies the request
     let match
     for (const entry of matches) {

deps/npm/node_modules/make-fetch-happen/lib/cache/index.js

@@ -7,7 +7,7 @@ const cacheFetch = async (request, options) => {
   // try to find a cached entry that satisfies this request
   const entry = await CacheEntry.find(request, options)
   if (!entry) {
-    // no cached result, if the cache mode is only-if-cached that's a failure
+    // no cached result, if the cache mode is 'only-if-cached' that's a failure
     if (options.cache === 'only-if-cached')
       throw new NotCachedError(request.url)
 
@@ -17,22 +17,21 @@ const cacheFetch = async (request, options) => {
     return entry.store('miss')
   }
 
-  // we have a cached response that satisfies this request, however
-  // if the cache mode is reload the user explicitly wants us to revalidate
-  if (options.cache === 'reload')
+  // we have a cached response that satisfies this request, however if the cache
+  // mode is 'no-cache' then we send the revalidation request no matter what
+  if (options.cache === 'no-cache')
     return entry.revalidate(request, options)
 
-  // if the cache mode is either force-cache or only-if-cached we will only
-  // respond with a cached entry, even if it's stale. set the status to the
-  // appropriate value based on whether revalidation is needed and respond
-  // from the cache
+  // if the cached entry is not stale, or if the cache mode is 'force-cache' or
+  // 'only-if-cached' we can respond with the cached entry. set the status
+  // based on the result of needsRevalidation and respond
   const _needsRevalidation = entry.policy.needsRevalidation(request)
   if (options.cache === 'force-cache' ||
       options.cache === 'only-if-cached' ||
       !_needsRevalidation)
     return entry.respond(request.method, options, _needsRevalidation ? 'stale' : 'hit')
 
-  // cache entry might be stale, revalidate it and return a response
+  // if we got here, the cache entry is stale so revalidate it
   return entry.revalidate(request, options)
 }
 

deps/npm/node_modules/make-fetch-happen/package.json

@@ -1,6 +1,6 @@
 {
   "name": "make-fetch-happen",
-  "version": "9.0.2",
+  "version": "9.0.3",
   "description": "Opinionated, caching, retrying fetch client",
   "main": "lib/index.js",
   "files": [

deps/npm/node_modules/npm-package-arg/npa.js

@@ -6,7 +6,7 @@ module.exports.Result = Result
 const url = require('url')
 const HostedGit = require('hosted-git-info')
 const semver = require('semver')
-const path = require('path')
+const path = global.FAKE_WINDOWS ? require('path').win32 : require('path')
 const validatePackageName = require('validate-npm-package-name')
 const { homedir } = require('os')
 
@@ -151,42 +151,86 @@ function setGitCommittish (res, committish) {
   return res
 }
 
-const isAbsolutePath = /^[/]|^[A-Za-z]:/
-
-function resolvePath (where, spec) {
-  if (isAbsolutePath.test(spec))
-    return spec
-  return path.resolve(where, spec)
-}
-
-function isAbsolute (dir) {
-  if (dir[0] === '/')
-    return true
-  if (/^[A-Za-z]:/.test(dir))
-    return true
-  return false
-}
-
 function fromFile (res, where) {
   if (!where)
     where = process.cwd()
   res.type = isFilename.test(res.rawSpec) ? 'file' : 'directory'
   res.where = where
 
-  const spec = res.rawSpec.replace(/\\/g, '/')
-    .replace(/^file:[/]*([A-Za-z]:)/, '$1') // drive name paths on windows
-    .replace(/^file:(?:[/]*(~\/|\.*\/|[/]))?/, '$1')
-  if (/^~[/]/.test(spec)) {
-    // this is needed for windows and for file:~/foo/bar
-    res.fetchSpec = resolvePath(homedir(), spec.slice(2))
-    res.saveSpec = 'file:' + spec
-  } else {
-    res.fetchSpec = resolvePath(where, spec)
-    if (isAbsolute(spec))
-      res.saveSpec = 'file:' + spec
-    else
-      res.saveSpec = 'file:' + path.relative(where, res.fetchSpec)
+  // always put the '/' on where when resolving urls, or else
+  // file:foo from /path/to/bar goes to /path/to/foo, when we want
+  // it to be /path/to/foo/bar
+
+  let specUrl
+  let resolvedUrl
+  const prefix = (!/^file:/.test(res.rawSpec) ? 'file:' : '')
+  const rawWithPrefix = prefix + res.rawSpec
+  let rawNoPrefix = rawWithPrefix.replace(/^file:/, '')
+  try {
+    resolvedUrl = new url.URL(rawWithPrefix, `file://${path.resolve(where)}/`)
+    specUrl = new url.URL(rawWithPrefix)
+  } catch (originalError) {
+    const er = new Error('Invalid file: URL, must comply with RFC 8909')
+    throw Object.assign(er, {
+      raw: res.rawSpec,
+      spec: res,
+      where,
+      originalError,
+    })
   }
+
+  // environment switch for testing
+  if (process.env.NPM_PACKAGE_ARG_8909_STRICT !== '1') {
+    // XXX backwards compatibility lack of compliance with 8909
+    // Remove when we want a breaking change to come into RFC compliance.
+    if (resolvedUrl.host && resolvedUrl.host !== 'localhost') {
+      const rawSpec = res.rawSpec.replace(/^file:\/\//, 'file:///')
+      resolvedUrl = new url.URL(rawSpec, `file://${path.resolve(where)}/`)
+      specUrl = new url.URL(rawSpec)
+      rawNoPrefix = rawSpec.replace(/^file:/, '')
+    }
+    // turn file:/../foo into file:../foo
+    if (/^\/\.\.?(\/|$)/.test(rawNoPrefix)) {
+      const rawSpec = res.rawSpec.replace(/^file:\//, 'file:')
+      resolvedUrl = new url.URL(rawSpec, `file://${path.resolve(where)}/`)
+      specUrl = new url.URL(rawSpec)
+      rawNoPrefix = rawSpec.replace(/^file:/, '')
+    }
+    // XXX end 8909 violation backwards compatibility section
+  }
+
+  // file:foo - relative url to ./foo
+  // file:/foo - absolute path /foo
+  // file:///foo - absolute path to /foo, no authority host
+  // file://localhost/foo - absolute path to /foo, on localhost
+  // file://foo - absolute path to / on foo host (error!)
+  if (resolvedUrl.host && resolvedUrl.host !== 'localhost') {
+    const msg = `Invalid file: URL, must be absolute if // present`
+    throw Object.assign(new Error(msg), {
+      raw: res.rawSpec,
+      parsed: resolvedUrl,
+    })
+  }
+
+  // turn /C:/blah into just C:/blah on windows
+  let specPath = decodeURIComponent(specUrl.pathname)
+  let resolvedPath = decodeURIComponent(resolvedUrl.pathname)
+  if (isWindows) {
+    specPath = specPath.replace(/^\/+([a-z]:\/)/i, '$1')
+    resolvedPath = resolvedPath.replace(/^\/+([a-z]:\/)/i, '$1')
+  }
+
+  // replace ~ with homedir, but keep the ~ in the saveSpec
+  // otherwise, make it relative to where param
+  if (/^\/~(\/|$)/.test(specPath)) {
+    res.saveSpec = `file:${specPath.substr(1)}`
+    resolvedPath = path.resolve(homedir(), specPath.substr(3))
+  } else if (!path.isAbsolute(rawNoPrefix))
+    res.saveSpec = `file:${path.relative(where, resolvedPath)}`
+  else
+    res.saveSpec = `file:${path.resolve(resolvedPath)}`
+
+  res.fetchSpec = path.resolve(where, resolvedPath)
   return res
 }
 

deps/npm/node_modules/npm-package-arg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npm-package-arg",
-  "version": "8.1.4",
+  "version": "8.1.5",
   "description": "Parse the things that can be arguments to `npm install`",
   "main": "npa.js",
   "directories": {

deps/npm/package.json

@@ -1,9 +1,10 @@
 {
-  "version": "7.17.0",
+  "version": "7.18.1",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
-    "docs"
+    "docs",
+    "packages/*"
   ],
   "files": [
     "bin",
@@ -52,7 +53,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@npmcli/arborist": "^2.6.1",
+    "@npmcli/arborist": "^2.6.3",
     "@npmcli/ci-detect": "^1.2.0",
     "@npmcli/config": "^2.2.0",
     "@npmcli/run-script": "^1.8.5",
@@ -77,7 +78,7 @@
     "leven": "^3.1.0",
     "libnpmaccess": "^4.0.2",
     "libnpmdiff": "^2.0.4",
-    "libnpmexec": "^1.2.0",
+    "libnpmexec": "^2.0.0",
     "libnpmfund": "^1.1.0",
     "libnpmhook": "^6.0.2",
     "libnpmorg": "^2.0.2",
@@ -85,8 +86,8 @@
     "libnpmpublish": "^4.0.1",
     "libnpmsearch": "^3.1.1",
     "libnpmteam": "^2.0.3",
-    "libnpmversion": "^1.2.0",
-    "make-fetch-happen": "^9.0.1",
+    "libnpmversion": "^1.2.1",
+    "make-fetch-happen": "^9.0.3",
     "minipass": "^3.1.3",
     "minipass-pipeline": "^1.2.4",
     "mkdirp": "^1.0.4",
@@ -95,7 +96,7 @@
     "node-gyp": "^7.1.2",
     "nopt": "^5.0.0",
     "npm-audit-report": "^2.1.5",
-    "npm-package-arg": "^8.1.4",
+    "npm-package-arg": "^8.1.5",
     "npm-pick-manifest": "^6.1.1",
     "npm-profile": "^5.0.3",
     "npm-registry-fetch": "^11.0.0",

deps/npm/tap-snapshots/test/lib/load-all-commands.js.test.cjs

@@ -538,7 +538,7 @@ npm ll [[<@scope>/]<pkg> ...]
 Options:
 [-a|--all] [--json] [-l|--long] [-p|--parseable] [-g|--global] [--depth <depth>]
 [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]] [--link]
-[--unicode]
+[--package-lock-only] [--unicode]
 [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
 [-ws|--workspaces]
 
@@ -583,12 +583,12 @@ npm ls
 List installed packages
 
 Usage:
-npm ls npm ls [[<@scope>/]<pkg> ...]
+npm ls [[<@scope>/]<pkg> ...]
 
 Options:
 [-a|--all] [--json] [-l|--long] [-p|--parseable] [-g|--global] [--depth <depth>]
 [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]] [--link]
-[--unicode]
+[--package-lock-only] [--unicode]
 [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
 [-ws|--workspaces]
 
@@ -657,7 +657,7 @@ Usage:
 npm pack [[<@scope>/]<pkg>...]
 
 Options:
-[--dry-run] [--json]
+[--dry-run] [--json] [--pack-destination <pack-destination>]
 [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
 [-ws|--workspaces]
 

deps/npm/tap-snapshots/test/lib/ls.js.test.cjs

@@ -496,6 +496,7 @@ workspaces-tree@1.0.0 {CWD}/tap-testdir-ls-ls-loading-a-tree-containing-workspac
 exports[`test/lib/ls.js TAP ls loading a tree containing workspaces > should filter using workspace config 1`] = `
 workspaces-tree@1.0.0 {CWD}/tap-testdir-ls-ls-loading-a-tree-containing-workspaces
 \`-- a@1.0.0 -> ./a
+  +-- baz@1.0.0
   +-- c@1.0.0
   \`-- d@1.0.0 -> ./d
     \`-- foo@1.1.1
@@ -506,6 +507,21 @@ workspaces-tree@1.0.0 {CWD}/tap-testdir-ls-ls-loading-a-tree-containing-workspac
 exports[`test/lib/ls.js TAP ls loading a tree containing workspaces > should list --all workspaces properly 1`] = `
 workspaces-tree@1.0.0 {CWD}/tap-testdir-ls-ls-loading-a-tree-containing-workspaces
 +-- a@1.0.0 -> ./a
+| +-- baz@1.0.0
+| +-- c@1.0.0
+| \`-- d@1.0.0 deduped -> ./d
++-- b@1.0.0 -> ./b
++-- d@1.0.0 -> ./d
+| \`-- foo@1.1.1
+|   \`-- bar@1.0.0
++-- e@1.0.0 -> ./group/e
+\`-- f@1.0.0 -> ./group/f
+
+`
+
+exports[`test/lib/ls.js TAP ls loading a tree containing workspaces > should list only prod deps of workspaces 1`] = `
+workspaces-tree@1.0.0 {CWD}/tap-testdir-ls-ls-loading-a-tree-containing-workspaces
++-- a@1.0.0 -> ./a
 | +-- c@1.0.0
 | \`-- d@1.0.0 deduped -> ./d
 +-- b@1.0.0 -> ./b
@@ -520,6 +536,7 @@ workspaces-tree@1.0.0 {CWD}/tap-testdir-ls-ls-loading-a-tree-containing-workspac
 exports[`test/lib/ls.js TAP ls loading a tree containing workspaces > should list workspaces properly with default configs 1`] = `
 workspaces-tree@1.0.0 {CWD}/tap-testdir-ls-ls-loading-a-tree-containing-workspaces
 +-- a@1.0.0 -> ./a
+| +-- baz@1.0.0
 | +-- c@1.0.0
 | \`-- d@1.0.0 deduped -> ./d
 +-- b@1.0.0 -> ./b

deps/npm/tap-snapshots/test/lib/utils/config/definitions.js.test.cjs

@@ -98,6 +98,7 @@ Array [
   "package",
   "package-lock",
   "package-lock-only",
+  "pack-destination",
   "parseable",
   "prefer-offline",
   "prefer-online",

deps/npm/tap-snapshots/test/lib/utils/config/describe-all.js.test.cjs

@@ -622,18 +622,7 @@ Use of \`legacy-peer-deps\` is not recommended, as it will not enforce the
 * Default: false
 * Type: Boolean
 
-If true, then local installs will link if there is a suitable globally
-installed package.
-
-Note that this means that local installs can cause things to be installed
-into the global space at the same time. The link is only done if one of the
-two conditions are met:
-
-* The package is not already installed globally, or
-* the globally installed version is identical to the version that is being
-  installed locally.
-
-When used with \`npm ls\`, only show packages that are linked.
+Used with \`npm ls\`, limiting output to only those packages that are linked.
 
 #### \`local-address\`
 
@@ -757,6 +746,13 @@ when publishing or changing package permissions with \`npm access\`.
 If not set, and a registry response fails with a challenge for a one-time
 password, npm will prompt on the command line for one.
 
+#### \`pack-destination\`
+
+* Default: "."
+* Type: String
+
+Directory in which \`npm pack\` will save tarballs.
+
 #### \`package\`
 
 * Default:
@@ -781,8 +777,14 @@ package-locks disabled use \`npm prune\`.
 * Default: false
 * Type: Boolean
 
-If set to true, it will update only the \`package-lock.json\`, instead of
-checking \`node_modules\` and downloading dependencies.
+If set to true, the current operation will only use the \`package-lock.json\`,
+ignoring \`node_modules\`.
+
+For \`update\` this means only the \`package-lock.json\` will be updated,
+instead of checking \`node_modules\` and downloading dependencies.
+
+For \`list\` this means the output will be based on the tree described by the
+\`package-lock.json\`, rather than the contents of \`node_modules\`.
 
 #### \`parseable\`
 

deps/npm/tap-snapshots/test/lib/utils/error-handler.js.test.cjs

@@ -8,7 +8,7 @@
 exports[`test/lib/utils/error-handler.js TAP handles unknown error > should have expected log contents for unknown error 1`] = `
 0 verbose code 1
 1 error foo A complete log of this run can be found in:
-1 error foo     {CWD}/cachefolder/_logs/expecteddate-debug.log
+1 error foo     {CWD}/test/lib/utils/tap-testdir-error-handler/_logs/expecteddate-debug.log
 2 verbose stack Error: ERROR
 3 verbose cwd {CWD}
 4 verbose Foo 1.0.0

deps/npm/tap-snapshots/test/lib/utils/explain-eresolve.js.test.cjs

@@ -5,7 +5,7 @@
  * Make sure to inspect the output below.  Do not ignore changes!
  */
 'use strict'
-exports[`test/lib/utils/explain-eresolve.js TAP chain-conflict > explain with color 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP chain-conflict > explain with color, depth of 2 1`] = `
 While resolving: project@1.2.3
 Found: @isaacs/testing-peer-dep-conflict-chain-d@2.0.0
 node_modules/@isaacs/testing-peer-dep-conflict-chain-d
@@ -75,25 +75,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP chain-conflict > report with color, depth only 2 1`] = `
-While resolving: project@1.2.3
-Found: @isaacs/testing-peer-dep-conflict-chain-d@2.0.0
-node_modules/@isaacs/testing-peer-dep-conflict-chain-d
-  @isaacs/testing-peer-dep-conflict-chain-d@"2" from the root project
-
-Could not resolve dependency:
-peer @isaacs/testing-peer-dep-conflict-chain-d@"1" from @isaacs/testing-peer-dep-conflict-chain-c@1.0.0
-node_modules/@isaacs/testing-peer-dep-conflict-chain-c
-  @isaacs/testing-peer-dep-conflict-chain-c@"1" from the root project
-
-Fix the upstream dependency conflict, or retry
-this command with --force, or --legacy-peer-deps
-to accept an incorrect (and potentially broken) dependency resolution.
-
-See \${REPORT} for a full report.
-`
-
-exports[`test/lib/utils/explain-eresolve.js TAP chain-conflict > report with no color, depth of 6 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP chain-conflict > report with no color 1`] = `
 While resolving: project@1.2.3
 Found: @isaacs/testing-peer-dep-conflict-chain-d@2.0.0
 node_modules/@isaacs/testing-peer-dep-conflict-chain-d
@@ -111,7 +93,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP cycleNested > explain with color 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP cycleNested > explain with color, depth of 2 1`] = `
 Found: @isaacs/peer-dep-cycle-c@2.0.0
 node_modules/@isaacs/peer-dep-cycle-c
   @isaacs/peer-dep-cycle-c@"2.x" from the root project
@@ -208,31 +190,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP cycleNested > report with color, depth only 2 1`] = `
-Found: @isaacs/peer-dep-cycle-c@2.0.0
-node_modules/@isaacs/peer-dep-cycle-c
-  @isaacs/peer-dep-cycle-c@"2.x" from the root project
-
-Could not resolve dependency:
-peer @isaacs/peer-dep-cycle-b@"1" from @isaacs/peer-dep-cycle-a@1.0.0
-node_modules/@isaacs/peer-dep-cycle-a
-  @isaacs/peer-dep-cycle-a@"1.x" from the root project
-
-Conflicting peer dependency: @isaacs/peer-dep-cycle-c@1.0.0
-node_modules/@isaacs/peer-dep-cycle-c
-  peer @isaacs/peer-dep-cycle-c@"1" from @isaacs/peer-dep-cycle-b@1.0.0
-  node_modules/@isaacs/peer-dep-cycle-b
-    peer @isaacs/peer-dep-cycle-b@"1" from @isaacs/peer-dep-cycle-a@1.0.0
-    node_modules/@isaacs/peer-dep-cycle-a
-
-Fix the upstream dependency conflict, or retry
-this command with --no-strict-peer-deps, --force, or --legacy-peer-deps
-to accept an incorrect (and potentially broken) dependency resolution.
-
-See \${REPORT} for a full report.
-`
-
-exports[`test/lib/utils/explain-eresolve.js TAP cycleNested > report with no color, depth of 6 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP cycleNested > report with no color 1`] = `
 Found: @isaacs/peer-dep-cycle-c@2.0.0
 node_modules/@isaacs/peer-dep-cycle-c
   @isaacs/peer-dep-cycle-c@"2.x" from the root project
@@ -257,7 +215,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP gatsby > explain with color 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP gatsby > explain with color, depth of 2 1`] = `
 While resolving: gatsby-recipes@0.2.31
 Found: ink@3.0.0-7
 node_modules/ink
@@ -366,29 +324,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP gatsby > report with color, depth only 2 1`] = `
-While resolving: gatsby-recipes@0.2.31
-Found: ink@3.0.0-7
-node_modules/ink
-  dev ink@"next" from gatsby-recipes@0.2.31
-  node_modules/gatsby-recipes
-    gatsby-recipes@"^0.2.31" from gatsby-cli@2.12.107
-    node_modules/gatsby-cli
-
-Could not resolve dependency:
-peer ink@">=2.0.0" from ink-box@1.0.0
-node_modules/ink-box
-  ink-box@"^1.0.0" from gatsby-recipes@0.2.31
-  node_modules/gatsby-recipes
-
-Fix the upstream dependency conflict, or retry
-this command with --no-strict-peer-deps, --force, or --legacy-peer-deps
-to accept an incorrect (and potentially broken) dependency resolution.
-
-See \${REPORT} for a full report.
-`
-
-exports[`test/lib/utils/explain-eresolve.js TAP gatsby > report with no color, depth of 6 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP gatsby > report with no color 1`] = `
 While resolving: gatsby-recipes@0.2.31
 Found: ink@3.0.0-7
 node_modules/ink
@@ -409,7 +345,6 @@ node_modules/ink-box
     node_modules/gatsby-cli
       gatsby-cli@"^2.12.107" from gatsby@2.24.74
       node_modules/gatsby
-        gatsby@"" from the root project
 
 Fix the upstream dependency conflict, or retry
 this command with --no-strict-peer-deps, --force, or --legacy-peer-deps
@@ -418,7 +353,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP no current node, but has current edge > explain with color 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP no current node, but has current edge > explain with color, depth of 2 1`] = `
 While resolving: eslint@7.22.0
 Found: dev eslint@"file:." from the root project
 
@@ -480,23 +415,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP no current node, but has current edge > report with color, depth only 2 1`] = `
-While resolving: eslint@7.22.0
-Found: dev eslint@"file:." from the root project
-
-Could not resolve dependency:
-peer eslint@"^6.0.0" from eslint-plugin-jsdoc@22.2.0
-node_modules/eslint-plugin-jsdoc
-  dev eslint-plugin-jsdoc@"^22.1.0" from the root project
-
-Fix the upstream dependency conflict, or retry
-this command with --force, or --legacy-peer-deps
-to accept an incorrect (and potentially broken) dependency resolution.
-
-See \${REPORT} for a full report.
-`
-
-exports[`test/lib/utils/explain-eresolve.js TAP no current node, but has current edge > report with no color, depth of 6 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP no current node, but has current edge > report with no color 1`] = `
 While resolving: eslint@7.22.0
 Found: dev eslint@"file:." from the root project
 
@@ -512,7 +431,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP no current node, no current edge, idk > explain with color 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP no current node, no current edge, idk > explain with color, depth of 2 1`] = `
 While resolving: eslint@7.22.0
 
 Could not resolve dependency:
@@ -570,22 +489,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP no current node, no current edge, idk > report with color, depth only 2 1`] = `
-While resolving: eslint@7.22.0
-
-Could not resolve dependency:
-peer eslint@"^6.0.0" from eslint-plugin-jsdoc@22.2.0
-node_modules/eslint-plugin-jsdoc
-  dev eslint-plugin-jsdoc@"^22.1.0" from the root project
-
-Fix the upstream dependency conflict, or retry
-this command with --force, or --legacy-peer-deps
-to accept an incorrect (and potentially broken) dependency resolution.
-
-See \${REPORT} for a full report.
-`
-
-exports[`test/lib/utils/explain-eresolve.js TAP no current node, no current edge, idk > report with no color, depth of 6 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP no current node, no current edge, idk > report with no color 1`] = `
 While resolving: eslint@7.22.0
 
 Could not resolve dependency:
@@ -600,7 +504,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP withShrinkwrap > explain with color 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP withShrinkwrap > explain with color, depth of 2 1`] = `
 While resolving: @isaacs/peer-dep-cycle-b@1.0.0
 Found: @isaacs/peer-dep-cycle-c@2.0.0
 node_modules/@isaacs/peer-dep-cycle-c
@@ -677,26 +581,7 @@ to accept an incorrect (and potentially broken) dependency resolution.
 See \${REPORT} for a full report.
 `
 
-exports[`test/lib/utils/explain-eresolve.js TAP withShrinkwrap > report with color, depth only 2 1`] = `
-While resolving: @isaacs/peer-dep-cycle-b@1.0.0
-Found: @isaacs/peer-dep-cycle-c@2.0.0
-node_modules/@isaacs/peer-dep-cycle-c
-  @isaacs/peer-dep-cycle-c@"2.x" from the root project
-
-Could not resolve dependency:
-peer @isaacs/peer-dep-cycle-c@"1" from @isaacs/peer-dep-cycle-b@1.0.0
-node_modules/@isaacs/peer-dep-cycle-b
-  peer @isaacs/peer-dep-cycle-b@"1" from @isaacs/peer-dep-cycle-a@1.0.0
-  node_modules/@isaacs/peer-dep-cycle-a
-
-Fix the upstream dependency conflict, or retry
-this command with --no-strict-peer-deps, --force, or --legacy-peer-deps
-to accept an incorrect (and potentially broken) dependency resolution.
-
-See \${REPORT} for a full report.
-`
-
-exports[`test/lib/utils/explain-eresolve.js TAP withShrinkwrap > report with no color, depth of 6 1`] = `
+exports[`test/lib/utils/explain-eresolve.js TAP withShrinkwrap > report with no color 1`] = `
 While resolving: @isaacs/peer-dep-cycle-b@1.0.0
 Found: @isaacs/peer-dep-cycle-c@2.0.0
 node_modules/@isaacs/peer-dep-cycle-c

deps/npm/tap-snapshots/test/lib/utils/npm-usage.js.test.cjs

@@ -639,7 +639,7 @@ All commands:
                     Options:
                     [-a|--all] [--json] [-l|--long] [-p|--parseable] [-g|--global] [--depth <depth>]
                     [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]] [--link]
-                    [--unicode]
+                    [--package-lock-only] [--unicode]
                     [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
                     [-ws|--workspaces]
                     
@@ -678,12 +678,12 @@ All commands:
                     List installed packages
                     
                     Usage:
-                    npm ls npm ls [[<@scope>/]<pkg> ...]
+                    npm ls [[<@scope>/]<pkg> ...]
                     
                     Options:
                     [-a|--all] [--json] [-l|--long] [-p|--parseable] [-g|--global] [--depth <depth>]
                     [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]] [--link]
-                    [--unicode]
+                    [--package-lock-only] [--unicode]
                     [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
                     [-ws|--workspaces]
                     
@@ -744,7 +744,7 @@ All commands:
                     npm pack [[<@scope>/]<pkg>...]
                     
                     Options:
-                    [--dry-run] [--json]
+                    [--dry-run] [--json] [--pack-destination <pack-destination>]
                     [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
                     [-ws|--workspaces]
                     

deps/npm/test/lib/cli.js

@@ -25,6 +25,7 @@ const unsupportedMock = {
 }
 
 let errorHandlerCalled = null
+let errorHandlerNpm = null
 let errorHandlerCb
 const errorHandlerMock = (...args) => {
   errorHandlerCalled = args
@@ -35,6 +36,9 @@ let errorHandlerExitCalled = null
 errorHandlerMock.exit = code => {
   errorHandlerExitCalled = code
 }
+errorHandlerMock.setNpm = npm => {
+  errorHandlerNpm = npm
+}
 
 const logs = []
 const npmlogMock = {
@@ -181,6 +185,7 @@ t.test('gracefully handles error printing usage', t => {
   npmock.argv = []
   errorHandlerCb = () => {
     t.match(errorHandlerCalled, [], 'should call errorHandler with no args')
+    t.match(errorHandlerNpm, npmock, 'errorHandler npm is set')
     t.end()
   }
   cli(proc)

deps/npm/test/lib/diff.js

@@ -549,12 +549,13 @@ t.test('single arg', t => {
   t.test('dir spec type', t => {
     t.plan(2)
 
+    const otherPath = resolve('/path/to/other-dir')
     libnpmdiff = async ([a, b], opts) => {
-      t.equal(a, 'file:/path/to/other-dir', 'should target dir')
+      t.equal(a, `file:${otherPath}`, 'should target dir')
       t.equal(b, `file:${fooPath}`, 'should compare to cwd')
     }
 
-    config.diff = ['/path/to/other-dir']
+    config.diff = [otherPath]
     diff.exec([], err => {
       if (err)
         throw err

deps/npm/test/lib/exec.js

@@ -24,11 +24,13 @@ let PROGRESS_ENABLED = true
 const LOG_WARN = []
 let PROGRESS_IGNORED = false
 const flatOptions = {
+  npxCache: 'npx-cache-dir',
+  cache: 'cache-dir',
   legacyPeerDeps: false,
   package: [],
 }
 const config = {
-  cache: 'cache-dir',
+  cache: 'bad-cache-dir', // this should never show up passed into libnpmexec
   yes: true,
   call: '',
   package: [],
@@ -134,6 +136,8 @@ t.test('npx foo, bin already exists locally', t => {
     t.match(RUN_SCRIPTS, [{
       pkg: { scripts: { npx: 'foo' }},
       args: ['one arg', 'two arg'],
+      cache: flatOptions.cache,
+      npxCache: flatOptions.npxCache,
       banner: false,
       path: process.cwd(),
       stdioString: true,
@@ -325,7 +329,7 @@ t.test('npm exec <noargs>, run interactive shell', t => {
 
 t.test('npm exec foo, not present locally or in central loc', t => {
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/f7fbba6e0636f890')
+  const installDir = resolve('npx-cache-dir/f7fbba6e0636f890')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -365,7 +369,7 @@ t.test('npm exec foo, not present locally or in central loc', t => {
 
 t.test('npm exec foo, not present locally but in central loc', t => {
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/f7fbba6e0636f890')
+  const installDir = resolve('npx-cache-dir/f7fbba6e0636f890')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -405,7 +409,7 @@ t.test('npm exec foo, not present locally but in central loc', t => {
 
 t.test('npm exec foo, present locally but wrong version', t => {
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/2badf4630f1cfaad')
+  const installDir = resolve('npx-cache-dir/2badf4630f1cfaad')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -601,7 +605,7 @@ t.test('run command with 2 packages, need install, verify sort', t => {
       config.package = packages
       const add = packages.map(p => `${p}@`).sort((a, b) => a.localeCompare(b, 'en'))
       const path = t.testdir()
-      const installDir = resolve('cache-dir/_npx/07de77790e5f40f2')
+      const installDir = resolve('npx-cache-dir/07de77790e5f40f2')
       npm.localPrefix = path
       ARB_ACTUAL_TREE[path] = {
         children: new Map(),
@@ -756,7 +760,7 @@ t.test('prompt when installs are needed if not already present and shell is a TT
 
   const add = packages.map(p => `${p}@`).sort((a, b) => a.localeCompare(b, 'en'))
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/07de77790e5f40f2')
+  const installDir = resolve('npx-cache-dir/07de77790e5f40f2')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -825,7 +829,7 @@ t.test('skip prompt when installs are needed if not already present and shell is
 
   const add = packages.map(p => `${p}@`).sort((a, b) => a.localeCompare(b, 'en'))
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/07de77790e5f40f2')
+  const installDir = resolve('npx-cache-dir/07de77790e5f40f2')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -892,7 +896,7 @@ t.test('skip prompt when installs are needed if not already present and shell is
 
   const add = packages.map(p => `${p}@`).sort((a, b) => a.localeCompare(b, 'en'))
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/f7fbba6e0636f890')
+  const installDir = resolve('npx-cache-dir/f7fbba6e0636f890')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -950,7 +954,7 @@ t.test('abort if prompt rejected', t => {
   config.yes = undefined
 
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/07de77790e5f40f2')
+  const installDir = resolve('npx-cache-dir/07de77790e5f40f2')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -1008,7 +1012,7 @@ t.test('abort if prompt false', t => {
   config.yes = undefined
 
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/07de77790e5f40f2')
+  const installDir = resolve('npx-cache-dir/07de77790e5f40f2')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -1065,7 +1069,7 @@ t.test('abort if -n provided', t => {
   config.yes = false
 
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/07de77790e5f40f2')
+  const installDir = resolve('npx-cache-dir/07de77790e5f40f2')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),
@@ -1103,7 +1107,7 @@ t.test('abort if -n provided', t => {
 
 t.test('forward legacyPeerDeps opt', t => {
   const path = t.testdir()
-  const installDir = resolve('cache-dir/_npx/f7fbba6e0636f890')
+  const installDir = resolve('npx-cache-dir/f7fbba6e0636f890')
   npm.localPrefix = path
   ARB_ACTUAL_TREE[path] = {
     children: new Map(),

deps/npm/test/lib/init.js

@@ -12,10 +12,16 @@ const npmLog = {
   silly: () => null,
 }
 const config = {
+  cache: 'bad-cache-dir',
   'init-module': '~/.npm-init.js',
   yes: true,
 }
+const flatOptions = {
+  cache: 'test-config-dir/_cacache',
+  npxCache: 'test-config-dir/_npx',
+}
 const npm = mockNpm({
+  flatOptions,
   config,
   log: npmLog,
 })
@@ -82,16 +88,18 @@ t.test('classic interactive npm init', t => {
 })
 
 t.test('npm init <arg>', t => {
-  t.plan(1)
+  t.plan(3)
   npm.localPrefix = t.testdir({})
 
   const Init = t.mock('../../lib/init.js', {
-    libnpmexec: ({ args }) => {
+    libnpmexec: ({ args, cache, npxCache }) => {
       t.same(
         args,
         ['create-react-app'],
         'should npx with listed packages'
       )
+      t.same(cache, flatOptions.cache)
+      t.same(npxCache, flatOptions.npxCache)
     },
   })
   const init = new Init(npm)

deps/npm/test/lib/link.js

@@ -1,4 +1,5 @@
 const { resolve } = require('path')
+const fs = require('fs')
 
 const Arborist = require('@npmcli/arborist')
 const t = require('tap')
@@ -485,6 +486,55 @@ t.test('link pkg already in global space when prefix is a symlink', (t) => {
   })
 })
 
+t.test('should not prune dependencies when linking packages', async t => {
+  const testdir = t.testdir({
+    'global-prefix': {
+      lib: {
+        node_modules: {
+          linked: t.fixture('symlink', '../../../linked'),
+        },
+      },
+    },
+    linked: {
+      'package.json': JSON.stringify({
+        name: 'linked',
+        version: '1.0.0',
+      }),
+    },
+    'my-project': {
+      node_modules: {
+        foo: {
+          'package.json': JSON.stringify({ name: 'foo', version: '1.0.0' }),
+        },
+      },
+      'package.json': JSON.stringify({
+        name: 'my-project',
+        version: '1.0.0',
+      }),
+    },
+  })
+  npm.globalDir = resolve(testdir, 'global-prefix', 'lib', 'node_modules')
+  npm.prefix = resolve(testdir, 'my-project')
+  reifyOutput = () => {}
+
+  const _cwd = process.cwd()
+  process.chdir(npm.prefix)
+
+  await new Promise((res, rej) => {
+    link.exec(['linked'], (err) => {
+      if (err)
+        rej(err)
+      res()
+    })
+  })
+
+  t.ok(
+    fs.statSync(resolve(testdir, 'my-project/node_modules/foo')),
+    'should not prune any extraneous dep when running npm link'
+  )
+  process.chdir(_cwd)
+})
+
 t.test('completion', async t => {
   const testdir = t.testdir({
     'global-prefix': {

deps/npm/test/lib/load-all.js

@@ -24,6 +24,7 @@ else {
 
   t.test('call the error handle so we dont freak out', t => {
     const errorHandler = require('../../lib/utils/error-handler.js')
+    errorHandler.setNpm(npm)
     errorHandler()
     t.end()
   })

deps/npm/test/lib/ls.js

@@ -107,6 +107,7 @@ const config = {
   only: null,
   parseable: false,
   production: false,
+  'package-lock-only': false,
 }
 const flatOptions = {
 }
@@ -1448,6 +1449,9 @@ t.test('ls', (t) => {
         bar: {
           'package.json': JSON.stringify({ name: 'bar', version: '1.0.0' }),
         },
+        baz: {
+          'package.json': JSON.stringify({ name: 'baz', version: '1.0.0' }),
+        },
       },
       a: {
         'package.json': JSON.stringify({
@@ -1457,6 +1461,9 @@ t.test('ls', (t) => {
             c: '^1.0.0',
             d: '^1.0.0',
           },
+          devDependencies: {
+            baz: '^1.0.0',
+          },
         }),
       },
       b: {
@@ -1519,6 +1526,21 @@ t.test('ls', (t) => {
       })
     })
 
+    // --production
+    await new Promise((res, rej) => {
+      config.production = true
+      ls.exec([], (err) => {
+        if (err)
+          rej(err)
+
+        t.matchSnapshot(redactCwd(result),
+          'should list only prod deps of workspaces')
+
+        config.production = false
+        res()
+      })
+    })
+
     // filter out a single workspace using args
     await new Promise((res, rej) => {
       ls.exec(['d'], (err) => {
@@ -4152,3 +4174,788 @@ t.test('ls --json', (t) => {
 
   t.end()
 })
+
+t.test('ls --package-lock-only', (t) => {
+  config['package-lock-only'] = true
+  t.test('ls --package-lock-only --json', (t) => {
+    t.beforeEach(cleanUpResult)
+    config.json = true
+    config.parseable = false
+    t.test('no args', (t) => {
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            chai: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec([], (err) => {
+        t.error(err, 'npm ls')
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              foo: {
+                version: '1.0.0',
+                dependencies: {
+                  dog: {
+                    version: '1.0.0',
+                  },
+                },
+              },
+              chai: {
+                version: '1.0.0',
+              },
+            },
+          },
+          'should output json representation of dependencies structure'
+        )
+        t.end()
+      })
+    })
+
+    t.test('extraneous deps', (t) => {
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec([], (err) => {
+        t.error(err) // should not error for extraneous
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              foo: {
+                version: '1.0.0',
+                dependencies: {
+                  dog: {
+                    version: '1.0.0',
+                  },
+                },
+              },
+            },
+          },
+          'should output json containing no problem info'
+        )
+        t.end()
+      })
+    })
+
+    t.test('missing deps --long', (t) => {
+      config.long = true
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            dog: '^1.0.0',
+            chai: '^1.0.0',
+            ipsum: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+            ipsum: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec([], (err) => {
+        t.error(err, 'npm ls')
+        t.match(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+          },
+          'should output json containing no problems info'
+        )
+        config.long = false
+        t.end()
+      })
+    })
+
+    t.test('with filter arg', (t) => {
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            chai: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+            ipsum: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec(['chai'], (err) => {
+        t.error(err, 'npm ls')
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              chai: {
+                version: '1.0.0',
+              },
+            },
+          },
+          'should output json contaning only occurrences of filtered by package'
+        )
+        t.equal(
+          process.exitCode,
+          0,
+          'should exit with error code 0'
+        )
+        t.end()
+      })
+    })
+
+    t.test('with filter arg nested dep', (t) => {
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            chai: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+            ipsum: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec(['dog'], (err) => {
+        t.error(err, 'npm ls')
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              foo: {
+                version: '1.0.0',
+                dependencies: {
+                  dog: {
+                    version: '1.0.0',
+                  },
+                },
+              },
+            },
+          },
+          'should output json contaning only occurrences of filtered by package'
+        )
+        t.end()
+      })
+    })
+
+    t.test('with multiple filter args', (t) => {
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            chai: '^1.0.0',
+            ipsum: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+            ipsum: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec(['dog@*', 'chai@1.0.0'], (err) => {
+        t.error(err, 'npm ls')
+        t.same(
+          jsonParse(result),
+          {
+            version: '1.0.0',
+            name: 'test-npm-ls',
+            dependencies: {
+              foo: {
+                version: '1.0.0',
+                dependencies: {
+                  dog: {
+                    version: '1.0.0',
+                  },
+                },
+              },
+              chai: {
+                version: '1.0.0',
+              },
+            },
+          },
+          'should output json contaning only occurrences of multiple filtered packages and their ancestors'
+        )
+        t.end()
+      })
+    })
+
+    t.test('with missing filter arg', (t) => {
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            chai: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec(['notadep'], (err) => {
+        t.error(err, 'npm ls')
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+          },
+          'should output json containing no dependencies info'
+        )
+        t.equal(
+          process.exitCode,
+          1,
+          'should exit with error code 1'
+        )
+        process.exitCode = 0
+        t.end()
+      })
+    })
+
+    t.test('default --depth value should now be 0', (t) => {
+      config.all = false
+      config.depth = undefined
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            chai: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec([], (err) => {
+        t.error(err, 'npm ls')
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              foo: {
+                version: '1.0.0',
+              },
+              chai: {
+                version: '1.0.0',
+              },
+            },
+          },
+          'should output json containing only top-level dependencies'
+        )
+        config.all = true
+        config.depth = Infinity
+        t.end()
+      })
+    })
+
+    t.test('--depth=0', (t) => {
+      config.all = false
+      config.depth = 0
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            chai: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec([], (err) => {
+        t.error(err, 'npm ls')
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              foo: {
+                version: '1.0.0',
+              },
+              chai: {
+                version: '1.0.0',
+              },
+            },
+          },
+          'should output json containing only top-level dependencies'
+        )
+        config.all = true
+        config.depth = Infinity
+        t.end()
+      })
+    })
+
+    t.test('--depth=1', (t) => {
+      config.all = false
+      config.depth = 1
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^1.0.0',
+            chai: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec([], (err) => {
+        t.error(err, 'npm ls')
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              foo: {
+                version: '1.0.0',
+                dependencies: {
+                  dog: {
+                    version: '1.0.0',
+                  },
+                },
+              },
+              chai: {
+                version: '1.0.0',
+              },
+            },
+          },
+          'should output json containing top-level deps and their deps only'
+        )
+        config.all = true
+        config.depth = Infinity
+        t.end()
+      })
+    })
+
+    t.test('missing/invalid/extraneous', (t) => {
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            foo: '^2.0.0',
+            ipsum: '^1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            foo: {
+              version: '1.0.0',
+              requires: {
+                dog: '^1.0.0',
+              },
+            },
+            dog: {
+              version: '1.0.0',
+            },
+            chai: {
+              version: '1.0.0',
+            },
+          },
+        }),
+      })
+      ls.exec([], (err) => {
+        t.match(err, { code: 'ELSPROBLEMS' }, 'should list dep problems')
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            problems: [
+              'invalid: foo@1.0.0 {CWD}/tap-testdir-ls-ls---package-lock-only-ls---package-lock-only---json-missing-invalid-extraneous/node_modules/foo',
+              'missing: ipsum@^1.0.0, required by test-npm-ls@1.0.0',
+            ],
+            dependencies: {
+              foo: {
+                version: '1.0.0',
+                invalid: true,
+                problems: [
+                  'invalid: foo@1.0.0 {CWD}/tap-testdir-ls-ls---package-lock-only-ls---package-lock-only---json-missing-invalid-extraneous/node_modules/foo',
+                ],
+                dependencies: {
+                  dog: {
+                    version: '1.0.0',
+                  },
+                },
+              },
+              ipsum: {
+                required: '^1.0.0',
+                missing: true,
+                problems: [
+                  'missing: ipsum@^1.0.0, required by test-npm-ls@1.0.0',
+                ],
+              },
+            },
+          },
+          'should output json containing top-level deps and their deps only'
+        )
+        t.end()
+      })
+    })
+
+    t.test('from lockfile', (t) => {
+      npm.prefix = t.testdir({
+        'package-lock.json': JSON.stringify({
+          name: 'dedupe-lockfile',
+          version: '1.0.0',
+          lockfileVersion: 2,
+          requires: true,
+          packages: {
+            '': {
+              name: 'dedupe-lockfile',
+              version: '1.0.0',
+              dependencies: {
+                '@isaacs/dedupe-tests-a': '1.0.1',
+                '@isaacs/dedupe-tests-b': '1||2',
+              },
+            },
+            'node_modules/@isaacs/dedupe-tests-a': {
+              name: '@isaacs/dedupe-tests-a',
+              version: '1.0.1',
+              resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-a/-/dedupe-tests-a-1.0.1.tgz',
+              integrity: 'sha512-8AN9lNCcBt5Xeje7fMEEpp5K3rgcAzIpTtAjYb/YMUYu8SbIVF6wz0WqACDVKvpQOUcSfNHZQNLNmue0QSwXOQ==',
+              dependencies: {
+                '@isaacs/dedupe-tests-b': '1',
+              },
+            },
+            'node_modules/@isaacs/dedupe-tests-a/node_modules/@isaacs/dedupe-tests-b': {
+              name: '@isaacs/dedupe-tests-b',
+              version: '1.0.0',
+              resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-b/-/dedupe-tests-b-1.0.0.tgz',
+              integrity: 'sha512-3nmvzIb8QL8OXODzipwoV3U8h9OQD9g9RwOPuSBQqjqSg9JZR1CCFOWNsDUtOfmwY8HFUJV9EAZ124uhqVxq+w==',
+            },
+            'node_modules/@isaacs/dedupe-tests-b': {
+              name: '@isaacs/dedupe-tests-b',
+              version: '2.0.0',
+              resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-b/-/dedupe-tests-b-2.0.0.tgz',
+              integrity: 'sha512-KTYkpRv9EzlmCg4Gsm/jpclWmRYFCXow8GZKJXjK08sIZBlElTZEa5Bw/UQxIvEfcKmWXczSqItD49Kr8Ax4UA==',
+            },
+          },
+          dependencies: {
+            '@isaacs/dedupe-tests-a': {
+              version: '1.0.1',
+              resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-a/-/dedupe-tests-a-1.0.1.tgz',
+              integrity: 'sha512-8AN9lNCcBt5Xeje7fMEEpp5K3rgcAzIpTtAjYb/YMUYu8SbIVF6wz0WqACDVKvpQOUcSfNHZQNLNmue0QSwXOQ==',
+              requires: {
+                '@isaacs/dedupe-tests-b': '1',
+              },
+              dependencies: {
+                '@isaacs/dedupe-tests-b': {
+                  version: '1.0.0',
+                  resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-b/-/dedupe-tests-b-1.0.0.tgz',
+                  integrity: 'sha512-3nmvzIb8QL8OXODzipwoV3U8h9OQD9g9RwOPuSBQqjqSg9JZR1CCFOWNsDUtOfmwY8HFUJV9EAZ124uhqVxq+w==',
+                },
+              },
+            },
+            '@isaacs/dedupe-tests-b': {
+              version: '2.0.0',
+              resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-b/-/dedupe-tests-b-2.0.0.tgz',
+              integrity: 'sha512-KTYkpRv9EzlmCg4Gsm/jpclWmRYFCXow8GZKJXjK08sIZBlElTZEa5Bw/UQxIvEfcKmWXczSqItD49Kr8Ax4UA==',
+            },
+          },
+        }),
+        'package.json': JSON.stringify({
+          name: 'dedupe-lockfile',
+          version: '1.0.0',
+          dependencies: {
+            '@isaacs/dedupe-tests-a': '1.0.1',
+            '@isaacs/dedupe-tests-b': '1||2',
+          },
+        }),
+      })
+      ls.exec([], () => {
+        t.same(
+          jsonParse(result),
+          {
+            version: '1.0.0',
+            name: 'dedupe-lockfile',
+            dependencies: {
+              '@isaacs/dedupe-tests-a': {
+                version: '1.0.1',
+                resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-a/-/dedupe-tests-a-1.0.1.tgz',
+                dependencies: {
+                  '@isaacs/dedupe-tests-b': {
+                    version: '1.0.0',
+                    resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-b/-/dedupe-tests-b-1.0.0.tgz',
+                  },
+                },
+              },
+              '@isaacs/dedupe-tests-b': {
+                version: '2.0.0',
+                resolved: 'https://registry.npmjs.org/@isaacs/dedupe-tests-b/-/dedupe-tests-b-2.0.0.tgz',
+              },
+            },
+          },
+          'should output json containing only prod deps'
+        )
+        t.end()
+      })
+    })
+
+    t.test('using aliases', (t) => {
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            a: 'npm:b@1.0.0',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          dependencies: {
+            a: {
+              version: 'npm:b@1.0.0',
+              resolved: 'https://localhost:8080/abbrev/-/abbrev-1.0.0.tgz',
+            },
+          },
+        }),
+      })
+      ls.exec([], () => {
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              a: {
+                version: '1.0.0',
+                resolved: 'https://localhost:8080/abbrev/-/abbrev-1.0.0.tgz',
+              },
+            },
+          },
+          'should output json containing aliases'
+        )
+        t.end()
+      })
+    })
+
+    t.test('resolved points to git ref', (t) => {
+      config.long = false
+      npm.prefix = t.testdir({
+        'package.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          dependencies: {
+            abbrev: 'git+https://github.com/isaacs/abbrev-js.git',
+          },
+        }),
+        'package-lock.json': JSON.stringify({
+          name: 'test-npm-ls',
+          version: '1.0.0',
+          lockfileVersion: 2,
+          requires: true,
+          dependencies: {
+            abbrev: {
+              version: 'git+ssh://git@github.com/isaacs/abbrev-js.git#b8f3a2fc0c3bb8ffd8b0d0072cc6b5a3667e963c',
+              from: 'abbrev@git+https://github.com/isaacs/abbrev-js.git',
+            },
+          },
+        }
+        ),
+      })
+      ls.exec([], () => {
+        t.same(
+          jsonParse(result),
+          {
+            name: 'test-npm-ls',
+            version: '1.0.0',
+            dependencies: {
+              abbrev: {
+                resolved: 'git+ssh://git@github.com/isaacs/abbrev-js.git#b8f3a2fc0c3bb8ffd8b0d0072cc6b5a3667e963c',
+              },
+            },
+          },
+          'should output json containing git refs'
+        )
+        t.end()
+      })
+    })
+
+    t.end()
+  })
+
+  t.end()
+})