@npmcli/arborist 6.0.0-pre.3 → 6.0.0-pre.5

package/bin/lib/logging.js

@@ -1,5 +1,4 @@
 const log = require('proc-log')
-const mkdirp = require('mkdirp')
 const fs = require('fs')
 const { dirname } = require('path')
 const os = require('os')
@@ -70,7 +69,7 @@ if (options.loglevel !== 'silent') {
 
 if (options.logfile) {
   log.silly('logfile', options.logfile)
-  mkdirp.sync(dirname(options.logfile))
+  fs.mkdirSync(dirname(options.logfile), { recursive: true })
   const fd = fs.openSync(options.logfile, 'a')
   addLogListener((str) => fs.writeSync(fd, str))
 }

package/lib/add-rm-pkg-deps.js

@@ -35,8 +35,8 @@ const add = ({ pkg, add, saveBundle, saveType }) => {
     const depType = saveTypeMap.get(addSaveType)
 
     pkg[depType] = pkg[depType] || {}
-    if (rawSpec !== '' || pkg[depType][name] === undefined) {
-      pkg[depType][name] = rawSpec || '*'
+    if (rawSpec !== '*' || pkg[depType][name] === undefined) {
+      pkg[depType][name] = rawSpec
     }
     if (addSaveType === 'optional') {
       // Affordance for previous npm versions that require this behaviour

package/lib/arborist/build-ideal-tree.js

@@ -10,9 +10,7 @@ const { resolve, dirname } = require('path')
 const { promisify } = require('util')
 const treeCheck = require('../tree-check.js')
 const readdir = promisify(require('readdir-scoped-modules'))
-const fs = require('fs')
-const lstat = promisify(fs.lstat)
-const readlink = promisify(fs.readlink)
+const { lstat, readlink } = require('fs/promises')
 const { depth } = require('treeverse')
 const log = require('proc-log')
 
@@ -48,7 +46,6 @@ const _flagsSuspect = Symbol.for('flagsSuspect')
 const _workspaces = Symbol.for('workspaces')
 const _prune = Symbol('prune')
 const _preferDedupe = Symbol('preferDedupe')
-const _legacyBundling = Symbol('legacyBundling')
 const _parseSettings = Symbol('parseSettings')
 const _initTree = Symbol('initTree')
 const _applyUserRequests = Symbol('applyUserRequests')
@@ -79,7 +76,7 @@ const _loadFailures = Symbol('loadFailures')
 const _pruneFailedOptional = Symbol('pruneFailedOptional')
 const _linkNodes = Symbol('linkNodes')
 const _follow = Symbol('follow')
-const _globalStyle = Symbol('globalStyle')
+const _installStrategy = Symbol('installStrategy')
 const _globalRootNode = Symbol('globalRootNode')
 const _usePackageLock = Symbol.for('usePackageLock')
 const _rpcache = Symbol.for('realpathCache')
@@ -114,7 +111,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
       follow = false,
       force = false,
       global = false,
-      globalStyle = false,
+      installStrategy = 'hoisted',
       idealTree = null,
       includeWorkspaceRoot = false,
       installLinks = false,
@@ -134,7 +131,7 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     this[_usePackageLock] = packageLock
     this[_global] = !!global
-    this[_globalStyle] = this[_global] || globalStyle
+    this[_installStrategy] = global ? 'shallow' : installStrategy
     this[_follow] = !!follow
 
     if (this[_workspaces].length && this[_global]) {
@@ -143,7 +140,6 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     this[_explicitRequests] = new Set()
     this[_preferDedupe] = false
-    this[_legacyBundling] = false
     this[_depsSeen] = new Set()
     this[_depsQueue] = []
     this[_currentDep] = null
@@ -252,20 +248,18 @@ module.exports = cls => class IdealTreeBuilder extends cls {
 
     this[_complete] = !!options.complete
     this[_preferDedupe] = !!options.preferDedupe
-    this[_legacyBundling] = !!options.legacyBundling
 
     // validates list of update names, they must
     // be dep names only, no semver ranges are supported
     for (const name of update.names) {
       const spec = npa(name)
       const validationError =
-        new TypeError(`Update arguments must not contain package version specifiers
-
-Try using the package name instead, e.g:
+        new TypeError(`Update arguments must only contain package names, eg:
     npm update ${spec.name}`)
       validationError.code = 'EUPDATEARGS'
 
-      if (spec.fetchSpec !== 'latest') {
+      // If they gave us anything other than a bare package name
+      if (spec.raw !== spec.name) {
         throw validationError
       }
     }
@@ -330,8 +324,7 @@ Try using the package name instead, e.g:
           if (tree.children.size) {
             root.meta.loadedFromDisk = true
             // set these so that we don't try to ancient lockfile reload it
-            root.meta.originalLockfileVersion = defaultLockfileVersion
-            root.meta.lockfileVersion = defaultLockfileVersion
+            root.meta.originalLockfileVersion = root.meta.lockfileVersion = this.options.lockfileVersion || defaultLockfileVersion
           }
         }
         root.meta.inferFormattingOptions(root.package)
@@ -758,7 +751,9 @@ This is a one-time fix-up, please be patient...
     // yes, yes, this isn't the "original" version, but now that it's been
     // upgraded, we need to make sure we don't do the work to upgrade it
     // again, since it's now as new as can be.
-    meta.originalLockfileVersion = defaultLockfileVersion
+    if (!this.options.lockfileVersion && !meta.hiddenLockfile) {
+      meta.originalLockfileVersion = defaultLockfileVersion
+    }
     this.finishTracker('idealTree:inflate')
     process.emit('timeEnd', 'idealTree:inflate')
   }
@@ -951,11 +946,10 @@ This is a one-time fix-up, please be patient...
         auditReport: this.auditReport,
         force: this[_force],
         preferDedupe: this[_preferDedupe],
-        legacyBundling: this[_legacyBundling],
         strictPeerDeps: this[_strictPeerDeps],
         installLinks: this.installLinks,
         legacyPeerDeps: this.legacyPeerDeps,
-        globalStyle: this[_globalStyle],
+        installStrategy: this[_installStrategy],
       }))
 
     const promises = []

package/lib/arborist/index.js

@@ -76,6 +76,7 @@ class Arborist extends Base {
       workspacesEnabled: options.workspacesEnabled !== false,
       replaceRegistryHost: options.replaceRegistryHost,
       lockfileVersion: lockfileVersion(options.lockfileVersion),
+      installStrategy: options.global ? 'shallow' : (options.installStrategy ? options.installStrategy : 'hoisted'),
     }
     this.replaceRegistryHost = this.options.replaceRegistryHost =
       (!this.options.replaceRegistryHost || this.options.replaceRegistryHost === 'npmjs') ?

package/lib/arborist/reify.js

@@ -12,14 +12,13 @@ const log = require('proc-log')
 
 const { dirname, resolve, relative } = require('path')
 const { depth: dfwalk } = require('treeverse')
-const fs = require('fs')
-const { promisify } = require('util')
-const lstat = promisify(fs.lstat)
-const symlink = promisify(fs.symlink)
-const mkdirp = require('mkdirp-infer-owner')
-const justMkdirp = require('mkdirp')
+const {
+  lstat,
+  mkdir,
+  rm,
+  symlink,
+} = require('fs/promises')
 const moveFile = require('@npmcli/move-file')
-const rimraf = promisify(require('rimraf'))
 const PackageJson = require('@npmcli/package-json')
 const packageContents = require('@npmcli/installed-package-contents')
 const runScript = require('@npmcli/run-script')
@@ -35,6 +34,9 @@ const optionalSet = require('../optional-set.js')
 const calcDepFlags = require('../calc-dep-flags.js')
 const { saveTypeMap, hasSubKey } = require('../add-rm-pkg-deps.js')
 
+const Shrinkwrap = require('../shrinkwrap.js')
+const { defaultLockfileVersion } = Shrinkwrap
+
 const _retiredPaths = Symbol('retiredPaths')
 const _retiredUnchanged = Symbol('retiredUnchanged')
 const _sparseTreeDirs = Symbol('sparseTreeDirs')
@@ -172,7 +174,7 @@ module.exports = cls => class Reifier extends cls {
     // we do NOT want to set ownership on this folder, especially
     // recursively, because it can have other side effects to do that
     // in a project directory.  We just want to make it if it's missing.
-    await justMkdirp(resolve(this.path))
+    await mkdir(resolve(this.path), { recursive: true })
 
     // do not allow the top-level node_modules to be a symlink
     await this[_validateNodeModules](resolve(this.path, 'node_modules'))
@@ -430,10 +432,10 @@ module.exports = cls => class Reifier extends cls {
         // handled the most common cause of ENOENT (dir doesn't exist yet),
         // then just ignore any ENOENT.
         if (er.code === 'ENOENT') {
-          return didMkdirp ? null : mkdirp(dirname(to)).then(() =>
+          return didMkdirp ? null : mkdir(dirname(to), { recursive: true }).then(() =>
             this[_renamePath](from, to, true))
         } else if (er.code === 'EEXIST') {
-          return rimraf(to).then(() => moveFile(from, to))
+          return rm(to, { recursive: true, force: true }).then(() => moveFile(from, to))
         } else {
           throw er
         }
@@ -515,7 +517,7 @@ module.exports = cls => class Reifier extends cls {
           await this[_renamePath](d, retired)
         }
       }
-      const made = await mkdirp(node.path)
+      const made = await mkdir(node.path, { recursive: true })
       this[_sparseTreeDirs].add(node.path)
       this[_sparseTreeRoots].add(made)
     }))
@@ -530,7 +532,7 @@ module.exports = cls => class Reifier extends cls {
     const failures = []
     const targets = [...roots, ...Object.keys(this[_retiredPaths])]
     const unlinks = targets
-      .map(path => rimraf(path).catch(er => failures.push([path, er])))
+      .map(path => rm(path, { recursive: true, force: true }).catch(er => failures.push([path, er])))
     return promiseAllRejectLate(unlinks).then(() => {
       // eslint-disable-next-line promise/always-return
       if (failures.length) {
@@ -627,7 +629,7 @@ module.exports = cls => class Reifier extends cls {
       return
     }
     log.warn('reify', 'Removing non-directory', nm)
-    await rimraf(nm)
+    await rm(nm, { recursive: true, force: true })
   }
 
   async [_extractOrLink] (node) {
@@ -661,7 +663,7 @@ module.exports = cls => class Reifier extends cls {
     await this[_validateNodeModules](nm)
 
     if (node.isLink) {
-      await rimraf(node.path)
+      await rm(node.path, { recursive: true, force: true })
       await this[_symlink](node)
     } else {
       await debug(async () => {
@@ -687,7 +689,7 @@ module.exports = cls => class Reifier extends cls {
     const dir = dirname(node.path)
     const target = node.realpath
     const rel = relative(dir, target)
-    await mkdirp(dir)
+    await mkdir(dir, { recursive: true })
     return symlink(rel, node.path, 'junction')
   }
 
@@ -950,7 +952,7 @@ module.exports = cls => class Reifier extends cls {
 
   // ok!  actually unpack stuff into their target locations!
   // The sparse tree has already been created, so we walk the diff
-  // kicking off each unpack job.  If any fail, we rimraf the sparse
+  // kicking off each unpack job.  If any fail, we rm the sparse
   // tree entirely and try to put everything back where it was.
   [_unpackNewModules] () {
     process.emit('time', 'reify:unpack')
@@ -1031,7 +1033,8 @@ module.exports = cls => class Reifier extends cls {
       return promiseAllRejectLate(diff.unchanged.map(node => {
         // no need to roll back links, since we'll just delete them anyway
         if (node.isLink) {
-          return mkdirp(dirname(node.path)).then(() => this[_reifyNode](node))
+          return mkdir(dirname(node.path), { recursive: true, force: true })
+            .then(() => this[_reifyNode](node))
         }
 
         // will have been moved/unpacked along with bundler
@@ -1047,7 +1050,7 @@ module.exports = cls => class Reifier extends cls {
         // skip it.
         const bd = node.package.bundleDependencies
         const dir = bd && bd.length ? node.path + '/node_modules' : node.path
-        return mkdirp(dir).then(() => this[_moveContents](node, fromPath))
+        return mkdir(dir, { recursive: true }).then(() => this[_moveContents](node, fromPath))
       }))
     }))
       .then(() => process.emit('timeEnd', 'reify:unretire'))
@@ -1121,15 +1124,15 @@ module.exports = cls => class Reifier extends cls {
   // the tree is pretty much built now, so it's cleanup time.
   // remove the retired folders, and any deleted nodes
   // If this fails, there isn't much we can do but tell the user about it.
-  // Thankfully, it's pretty unlikely that it'll fail, since rimraf is a tank.
+  // Thankfully, it's pretty unlikely that it'll fail, since rm is a node builtin.
   async [_removeTrash] () {
     process.emit('time', 'reify:trash')
     const promises = []
     const failures = []
-    const rm = path => rimraf(path).catch(er => failures.push([path, er]))
+    const _rm = path => rm(path, { recursive: true, force: true }).catch(er => failures.push([path, er]))
 
     for (const path of this[_trashList]) {
-      promises.push(rm(path))
+      promises.push(_rm(path))
     }
 
     await promiseAllRejectLate(promises)
@@ -1514,11 +1517,16 @@ module.exports = cls => class Reifier extends cls {
     this.idealTree.meta.filename =
       this.idealTree.realpath + '/node_modules/.package-lock.json'
     this.idealTree.meta.hiddenLockfile = true
+    const resetMeta = this.idealTree.meta && this.idealTree.meta.lockfileVersion !== defaultLockfileVersion
+    this.idealTree.meta.lockfileVersion = defaultLockfileVersion
 
     this.actualTree = this.idealTree
     this.idealTree = null
 
     if (!this[_global]) {
+      if (resetMeta) {
+        await this.actualTree.meta.reset()
+      }
       await this.actualTree.meta.save()
       const ignoreScripts = !!this.options.ignoreScripts
       // if we aren't doing a dry run or ignoring scripts and we actually made changes to the dep

package/lib/consistent-resolve.js

@@ -19,17 +19,23 @@ const consistentResolve = (resolved, fromPath, toPath, relPaths = false) => {
       rawSpec,
       raw,
     } = npa(resolved, fromPath)
-    const isPath = type === 'file' || type === 'directory'
-    return isPath && !relPaths ? `file:${fetchSpec.replace(/#/g, '%23')}`
-      : isPath ? 'file:' + (toPath ? relpath(toPath, fetchSpec.replace(/#/g, '%23')) : fetchSpec.replace(/#/g, '%23'))
-      : hosted ? `git+${
-        hosted.auth ? hosted.https(hostedOpt) : hosted.sshurl(hostedOpt)
-      }`
-      : type === 'git' ? saveSpec
-      // always return something.  'foo' is interpreted as 'foo@' otherwise.
-      : rawSpec === '' && raw.slice(-1) !== '@' ? raw
-      // just strip off the name, but otherwise return as-is
-      : rawSpec
+    if (type === 'file' || type === 'directory') {
+      const cleanFetchSpec = fetchSpec.replace(/#/g, '%23')
+      if (relPaths && toPath) {
+        return `file:${relpath(toPath, cleanFetchSpec)}`
+      }
+      return `file:${cleanFetchSpec}`
+    }
+    if (hosted) {
+      return `git+${hosted.auth ? hosted.https(hostedOpt) : hosted.sshurl(hostedOpt)}`
+    }
+    if (type === 'git') {
+      return saveSpec
+    }
+    if (rawSpec === '*') {
+      return raw
+    }
+    return rawSpec
   } catch (_) {
     // whatever we passed in was not acceptable to npa.
     // leave it 100% untouched.

package/lib/edge.js

@@ -166,7 +166,7 @@ class Edge {
   }
 
   get spec () {
-    if (this.overrides && this.overrides.value && this.overrides.name === this.name) {
+    if (this.overrides?.value && this.overrides.value !== '*' && this.overrides.name === this.name) {
       if (this.overrides.value.startsWith('$')) {
         const ref = this.overrides.value.slice(1)
         // we may be a virtual root, if we are we want to resolve reference overrides

package/lib/override-set.js

@@ -25,7 +25,7 @@ class OverrideSet {
       this.name = spec.name
       spec.name = ''
       this.key = key
-      this.keySpec = spec.rawSpec === '' ? '' : spec.toString()
+      this.keySpec = spec.toString()
       this.value = overrides['.'] || this.keySpec
     }
 
@@ -50,8 +50,7 @@ class OverrideSet {
         continue
       }
 
-      if (rule.keySpec === '' ||
-        semver.intersects(edge.spec, rule.keySpec)) {
+      if (semver.intersects(edge.spec, rule.keySpec)) {
         return rule
       }
     }
@@ -65,8 +64,7 @@ class OverrideSet {
         continue
       }
 
-      if (rule.keySpec === '' ||
-        semver.satisfies(node.version, rule.keySpec) ||
+      if (semver.satisfies(node.version, rule.keySpec) ||
         semver.satisfies(node.version, rule.value)) {
         return rule
       }
@@ -81,8 +79,7 @@ class OverrideSet {
         continue
       }
 
-      if (rule.keySpec === '' ||
-        semver.satisfies(node.version, rule.keySpec) ||
+      if (semver.satisfies(node.version, rule.keySpec) ||
         semver.satisfies(node.version, rule.value)) {
         return rule
       }

package/lib/place-dep.js

@@ -43,11 +43,10 @@ class PlaceDep {
       explicitRequest,
       updateNames,
       auditReport,
-      legacyBundling,
       strictPeerDeps,
       installLinks,
       legacyPeerDeps,
-      globalStyle,
+      installStrategy,
     } = parent || options
     Object.assign(this, {
       preferDedupe,
@@ -55,11 +54,10 @@ class PlaceDep {
       explicitRequest,
       updateNames,
       auditReport,
-      legacyBundling,
       strictPeerDeps,
       installLinks,
+      installStrategy,
       legacyPeerDeps,
-      globalStyle,
     })
 
     this.children = []
@@ -78,10 +76,9 @@ class PlaceDep {
       edge,
       dep,
       preferDedupe,
-      globalStyle,
-      legacyBundling,
       explicitRequest,
       updateNames,
+      installStrategy,
       checks,
     } = this
 
@@ -170,13 +167,13 @@ class PlaceDep {
 
       // nest packages like npm v1 and v2
       // very disk-inefficient
-      if (legacyBundling) {
+      if (installStrategy === 'nested') {
         break
       }
 
       // when installing globally, or just in global style, we never place
       // deps above the first level.
-      if (globalStyle) {
+      if (installStrategy === 'shallow') {
         const rp = target.resolveParent
         if (rp && rp.isProjectRoot) {
           break
@@ -463,7 +460,7 @@ class PlaceDep {
   // prune all the nodes in a branch of the tree that can be safely removed
   // This is only the most basic duplication detection; it finds if there
   // is another satisfying node further up the tree, and if so, dedupes.
-  // Even in legacyBundling mode, we do this amount of deduplication.
+  // Even in installStategy is nested, we do this amount of deduplication.
   pruneDedupable (node, descend = true) {
     if (node.canDedupe(this.preferDedupe)) {
       // gather up all deps that have no valid edges in from outside

package/lib/query-selector-all.js

@@ -120,13 +120,13 @@ class Results {
     this.#pendingCombinator = combinators[String(this.currentAstNode)]
   }
 
-  // name selectors (i.e. #foo, #foo@1.0.0)
+  // name selectors (i.e. #foo)
   // css calls this id, we interpret it as name
   idType () {
-    const spec = npa(this.currentAstNode.value)
+    const name = this.currentAstNode.value
     const nextResults = this.initialItems.filter(node =>
-      (node.name === spec.name || node.package.name === spec.name) &&
-      (semver.satisfies(node.version, spec.fetchSpec) || !spec.rawSpec))
+      (name === node.name) || (name === node.package.name)
+    )
     this.processPendingCombinator(nextResults)
   }
 

package/lib/realpath.js

@@ -5,10 +5,7 @@
 // built-in fs.realpath, because we only care about symbolic links,
 // so we can handle many fewer edge cases.
 
-const fs = require('fs')
-const promisify = require('util').promisify
-const readlink = promisify(fs.readlink)
-const lstat = promisify(fs.lstat)
+const { lstat, readlink } = require('fs/promises')
 const { resolve, basename, dirname } = require('path')
 
 const realpathCached = (path, rpcache, stcache, depth) => {

package/lib/shrinkwrap.js

@@ -10,7 +10,7 @@
 // definitely not before npm v8.
 
 const localeCompare = require('@isaacs/string-locale-compare')('en')
-const defaultLockfileVersion = 2
+const defaultLockfileVersion = 3
 
 // for comparing nodes to yarn.lock entries
 const mismatch = (a, b) => a && b && a !== b
@@ -35,32 +35,16 @@ const mismatch = (a, b) => a && b && a !== b
 
 const log = require('proc-log')
 const YarnLock = require('./yarn-lock.js')
-const { promisify } = require('util')
-const rimraf = promisify(require('rimraf'))
-const fs = require('fs')
-const readFile = promisify(fs.readFile)
-const writeFile = promisify(fs.writeFile)
-const stat = promisify(fs.stat)
-const readdir_ = promisify(fs.readdir)
-const readlink = promisify(fs.readlink)
-
-// XXX remove when drop support for node v10
-const lstat = promisify(fs.lstat)
-/* istanbul ignore next - version specific polyfill */
-const readdir = async (path, opt) => {
-  if (!opt || !opt.withFileTypes) {
-    return readdir_(path, opt)
-  }
-  const ents = await readdir_(path, opt)
-  if (typeof ents[0] === 'string') {
-    return Promise.all(ents.map(async ent => {
-      return Object.assign(await lstat(path + '/' + ent), { name: ent })
-    }))
-  }
-  return ents
-}
-
-const { resolve, basename } = require('path')
+const {
+  readFile,
+  readdir,
+  readlink,
+  rm,
+  stat,
+  writeFile,
+} = require('fs/promises')
+
+const { resolve, basename, relative } = require('path')
 const specFromLock = require('./spec-from-lock.js')
 const versionFromTgz = require('./version-from-tgz.js')
 const npa = require('npm-package-arg')
@@ -224,6 +208,7 @@ const _buildLegacyLockfile = Symbol('_buildLegacyLockfile')
 const _filenameSet = Symbol('_filenameSet')
 const _maybeRead = Symbol('_maybeRead')
 const _maybeStat = Symbol('_maybeStat')
+
 class Shrinkwrap {
   static get defaultLockfileVersion () {
     return defaultLockfileVersion
@@ -252,17 +237,6 @@ class Shrinkwrap {
     s.loadedFromDisk = !!(sw || lock)
     s.type = basename(s.filename)
 
-    try {
-      if (s.loadedFromDisk && !s.lockfileVersion) {
-        const json = parseJSON(await maybeReadFile(s.filename))
-        if (json.lockfileVersion > defaultLockfileVersion) {
-          s.lockfileVersion = json.lockfileVersion
-        }
-      }
-    } catch {
-      // ignore errors
-    }
-
     return s
   }
 
@@ -342,6 +316,7 @@ class Shrinkwrap {
     this.lockfileVersion = hiddenLockfile ? 3
       : lockfileVersion ? parseInt(lockfileVersion, 10)
       : null
+
     this[_awaitingUpdate] = new Map()
     this.tree = null
     this.path = resolve(path || '.')
@@ -398,6 +373,7 @@ class Shrinkwrap {
     this[_awaitingUpdate] = new Map()
     const lockfileVersion = this.lockfileVersion || defaultLockfileVersion
     this.originalLockfileVersion = lockfileVersion
+
     this.data = {
       lockfileVersion,
       requires: true,
@@ -496,8 +472,14 @@ class Shrinkwrap {
       this.ancientLockfile = false
       return {}
     }).then(lock => {
-      const lockfileVersion = this.lockfileVersion ? this.lockfileVersion
-        : Math.max(lock.lockfileVersion || 0, defaultLockfileVersion)
+      // auto convert v1 lockfiles to v3
+      // leave v2 in place unless configured
+      // v3 by default
+      const lockfileVersion =
+        this.lockfileVersion ? this.lockfileVersion
+        : lock.lockfileVersion === 1 ? defaultLockfileVersion
+        : lock.lockfileVersion || defaultLockfileVersion
+
       this.data = {
         ...lock,
         lockfileVersion: lockfileVersion,
@@ -507,6 +489,7 @@ class Shrinkwrap {
       }
 
       this.originalLockfileVersion = lock.lockfileVersion
+
       // use default if it wasn't explicitly set, and the current file is
       // less than our default.  otherwise, keep whatever is in the file,
       // unless we had an explicit setting already.
@@ -1135,7 +1118,17 @@ class Shrinkwrap {
     if (!this.data) {
       throw new Error('run load() before saving data')
     }
+
     const json = this.toString(options)
+    if (
+      !this.hiddenLockfile
+      && this.originalLockfileVersion !== undefined
+      && this.originalLockfileVersion !== this.lockfileVersion
+    ) {
+      log.warn(
+      `Converting lock file (${relative(process.cwd(), this.filename)}) from v${this.originalLockfileVersion} -> v${this.lockfileVersion}`
+      )
+    }
     return Promise.all([
       writeFile(this.filename, json).catch(er => {
         if (this.hiddenLockfile) {
@@ -1144,7 +1137,7 @@ class Shrinkwrap {
           // a node_modules folder, but then the lockfile is not important.
           // Remove the file, so that in case there WERE deps, but we just
           // failed to update the file for some reason, it's not out of sync.
-          return rimraf(this.filename)
+          return rm(this.filename, { recursive: true, force: true })
         }
         throw er
       }),

package/package.json

@@ -1,48 +1,45 @@
 {
   "name": "@npmcli/arborist",
-  "version": "6.0.0-pre.3",
+  "version": "6.0.0-pre.5",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
-    "@npmcli/installed-package-contents": "^1.0.7",
-    "@npmcli/map-workspaces": "^2.0.3",
-    "@npmcli/metavuln-calculator": "^4.0.0-pre.0",
-    "@npmcli/move-file": "^2.0.0",
+    "@npmcli/installed-package-contents": "^2.0.0",
+    "@npmcli/map-workspaces": "^3.0.0",
+    "@npmcli/metavuln-calculator": "^5.0.0",
+    "@npmcli/move-file": "^3.0.0",
     "@npmcli/name-from-folder": "^1.0.1",
-    "@npmcli/node-gyp": "^2.0.0",
-    "@npmcli/package-json": "^2.0.0",
-    "@npmcli/query": "^2.0.0",
-    "@npmcli/run-script": "^4.1.3",
-    "bin-links": "^3.0.3",
-    "cacache": "^16.1.3",
+    "@npmcli/node-gyp": "^3.0.0",
+    "@npmcli/package-json": "^3.0.0",
+    "@npmcli/query": "^3.0.0",
+    "@npmcli/run-script": "^5.0.0",
+    "bin-links": "^4.0.1",
+    "cacache": "^17.0.1",
     "common-ancestor-path": "^1.0.1",
-    "json-parse-even-better-errors": "^2.3.1",
+    "json-parse-even-better-errors": "^3.0.0",
     "json-stringify-nice": "^1.1.4",
     "minimatch": "^5.1.0",
-    "mkdirp": "^1.0.4",
-    "mkdirp-infer-owner": "^2.0.0",
     "nopt": "^6.0.0",
-    "npm-install-checks": "^5.0.0",
-    "npm-package-arg": "^9.0.0",
-    "npm-pick-manifest": "^7.0.2",
-    "npm-registry-fetch": "^13.0.0",
-    "npmlog": "^6.0.2",
-    "pacote": "^14.0.0-pre.3",
-    "parse-conflict-json": "^2.0.1",
-    "proc-log": "^2.0.0",
+    "npm-install-checks": "^6.0.0",
+    "npm-package-arg": "^10.0.0",
+    "npm-pick-manifest": "^8.0.1",
+    "npm-registry-fetch": "^14.0.2",
+    "npmlog": "^7.0.1",
+    "pacote": "^15.0.2",
+    "parse-conflict-json": "^3.0.0",
+    "proc-log": "^3.0.0",
     "promise-all-reject-late": "^1.0.0",
     "promise-call-limit": "^1.0.1",
-    "read-package-json-fast": "^2.0.2",
+    "read-package-json-fast": "^3.0.1",
     "readdir-scoped-modules": "^1.1.0",
-    "rimraf": "^3.0.2",
     "semver": "^7.3.7",
-    "ssri": "^9.0.0",
-    "treeverse": "^2.0.0",
+    "ssri": "^10.0.0",
+    "treeverse": "^3.0.0",
     "walk-up-path": "^1.0.0"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^3.1.0",
-    "@npmcli/template-oss": "4.4.1",
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.6.2",
     "benchmark": "^2.1.4",
     "chalk": "^4.1.0",
     "minify-registry-metadata": "^2.1.0",
@@ -104,7 +101,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.4.1",
+    "version": "4.6.2",
     "content": "../../scripts/template-oss/index.js"
   }
 }