@salesforce/cli 2.158.7 → 2.159.1

package/node_modules/npm/node_modules/ip-address/package.json

@@ -16,13 +16,14 @@
     "bigint",
     "browser"
   ],
-  "version": "10.7.2",
+  "version": "10.7.5",
   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
   "license": "MIT",
   "main": "dist/ip-address.js",
   "types": "dist/ip-address.d.ts",
   "scripts": {
     "docs": "tsx scripts/build-readme.ts",
+    "docs:check": "tsx scripts/build-readme.ts --check",
     "build": "rm -rf dist; mkdir dist; tsc",
     "prepack": "npm run docs && npm run build",
     "prepare": "git config core.hooksPath hooks || true",
@@ -79,7 +80,7 @@
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-sort-imports-es6-autofix": "^0.6.0",
-    "mocha": "^11.7.5",
+    "mocha": "^12.0.3",
     "monocart-coverage-reports": "^2.12.11",
     "prettier": "^3.8.3",
     "source-map-support": "^0.5.21",

package/node_modules/npm/node_modules/libnpmexec/README.md

@@ -28,7 +28,7 @@ await libexec({
 
 - `opts`:
   - `args`: List of pkgs to execute **Array<String>**, defaults to `[]`
-  - `call`: An alternative command to run when using `packages` option **String**, defaults to empty string.
+  - `call`: An alternative shell script to run when using `packages` option **String**, defaults to empty string. Unlike an executable selected from `args` or a package's `bin`, this is intentionally interpreted as shell syntax.
   - `cache`: The path location to where the npm cache folder is placed **String**
   - `npxCache`: The path location to where the npx cache folder is placed **String**
   - `chalk`: Chalk instance to use for colors? **Required**
@@ -42,6 +42,14 @@ await libexec({
   - `yes`: Should skip download confirmation prompt when fetching missing packages from the registry? **Boolean**
   - `registry`, `cache`, and more options that are forwarded to [@npmcli/arborist](https://github.com/npm/cli/blob/latest/workspaces/arborist/README.md) and [pacote](https://github.com/npm/pacote/#options) **Object**
 
+  Executable names are escaped for the selected shell, including POSIX shells and
+  PowerShell used on Windows. For inferred PowerShell invocations, arguments are
+  also escaped as literal strings. With `cmd.exe`, executable names containing double
+  quotes, percent signs, exclamation marks, or control characters are rejected
+  with `EINVALIDCOMMAND`. Use a bin name without these characters. On a matching
+  npx-cache hit, command selection uses the installed package's `bin` rather than
+  the registry's bin metadata.
+
 ## LICENSE
 
 [ISC](./LICENSE)

package/node_modules/npm/node_modules/libnpmexec/lib/index.js

@@ -267,8 +267,8 @@ const exec = async (opts) => {
     })
     const lockPath = join(installDir, 'concurrency.lock')
     const npxTree = await withLock(lockPath, () => npxArb.loadActual())
-    await Promise.all(needInstall.map(async ({ spec }) => {
-      const { manifest } = await missingFromTree({
+    await Promise.all(needInstall.map(async ({ spec, manifest: requestedManifest }) => {
+      const { manifest, node } = await missingFromTree({
         spec,
         tree: npxTree,
         flatOptions,
@@ -281,6 +281,10 @@ const exec = async (opts) => {
         } else {
           add.push(manifest._id)
         }
+      } else if (needPackageCommandSwap && commandManifest === requestedManifest) {
+        // A cache hit must use the installed bin, not mutable registry metadata.
+        commandManifest = node.package
+        args[0] = getBinFromManifest(commandManifest)
       }
     }))
 

package/node_modules/npm/node_modules/libnpmexec/lib/run-script.js

@@ -3,7 +3,10 @@ const runScript = require('@npmcli/run-script')
 const pkgJson = require('@npmcli/package-json')
 const { log, output } = require('proc-log')
 const noTTY = require('./no-tty.js')
-const isWindowsShell = require('./is-windows.js')
+const isWindows = require('./is-windows.js')
+
+const isCmd = shell => /(?:^|[\\/])cmd(?:\.exe)?$/i.test(shell)
+const isPowerShell = shell => /(?:^|[\\/])(?:powershell|pwsh)(?:\.exe)?$/i.test(shell)
 
 const run = async ({
   args,
@@ -15,10 +18,24 @@ const run = async ({
   runPath,
   scriptShell,
 }) => {
-  // escape executable path
-  // necessary for preventing bash/cmd keywords from overriding
-  if (!isWindowsShell) {
-    if (args.length > 0) {
+  if (!call && args.length > 0) {
+    const shell = scriptShell || (isWindows ? process.env.ComSpec || 'cmd' : 'sh')
+    if (isCmd(shell)) {
+      // Variable expansion (including delayed expansion) and embedded quotes
+      // cannot be safely escaped here. Control characters are invalid filenames.
+      if (/["%!]/.test(args[0]) || [...args[0]].some(c => c.charCodeAt(0) < 32)) {
+        throw Object.assign(
+          new Error(`Invalid executable name for cmd.exe: ${JSON.stringify(args[0])}`),
+          { code: 'EINVALIDCOMMAND' }
+        )
+      }
+      // Protect both cmd.exe's metacharacter parsing and executable-name parsing.
+      args[0] = `"${args[0]}"`.replace(/[ ^&()<>|";,*?=@]/g, '^$&')
+    } else if (isPowerShell(shell)) {
+      // Encode the whole invocation to avoid promise-spawn's POSIX argument escaping.
+      const quotedArgs = args.map(arg => `'${arg.replace(/['\u2018-\u201b]/g, '$&$&')}'`)
+      args = [`& ${quotedArgs.join(' ')}`]
+    } else {
       // single-quote so shell metacharacters in the executable name are taken
       // literally; double quotes still expand $(), backticks, $var and "
       args[0] = `'${args[0].replace(/'/g, `'\\''`)}'`

package/node_modules/npm/node_modules/libnpmexec/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libnpmexec",
-  "version": "10.3.4",
+  "version": "10.3.5",
   "files": [
     "bin/",
     "lib/"

package/node_modules/npm/node_modules/pacote/lib/registry.js

@@ -113,6 +113,70 @@ class RegistryFetcher extends Fetcher {
     }
   }
 
+  // Registry signatures and attestations authenticate `name@version`, so the
+  // manifest must claim the requested name and be listed under its own
+  // version.  Otherwise a registry could replay validly signed metadata from
+  // another package (or another version) and have it verify as this one.
+  #verifyManifestIdentity (packument, picked) {
+    const pickedId = `${picked.name}@${picked.version}`
+    if (picked.name !== this.spec.name) {
+      const message = [
+        `${this.spec.name} registry manifest has mismatched package name:`,
+        `expected ${this.spec.name} but got ${pickedId}`,
+      ].join(' ')
+      throw Object.assign(new Error(message), {
+        code: 'EMANIFESTMISMATCH',
+        expected: this.spec.name,
+        found: pickedId,
+      })
+    }
+    if (picked._id && picked._id !== pickedId) {
+      const message = [
+        `${pickedId} registry manifest has mismatched id:`,
+        `expected ${pickedId} but got ${picked._id}`,
+      ].join(' ')
+      throw Object.assign(new Error(message), {
+        code: 'EMANIFESTMISMATCH',
+        expected: pickedId,
+        found: picked._id,
+      })
+    }
+
+    // without dist there are no signatures or attestations to authenticate
+    if (!picked.dist) {
+      return
+    }
+
+    // npm-pick-manifest may return a shallow copy, so match on the dist object
+    const matchesPickedManifest = manifest => manifest.dist === picked.dist
+    const versionCollections = [
+      packument.versions,
+      packument.stagedVersions?.versions,
+      packument.policyRestrictions?.versions,
+    ]
+    const matchingVersionKeys = []
+    for (const manifestsByVersion of versionCollections) {
+      for (const versionKey in manifestsByVersion) {
+        if (Object.hasOwn(manifestsByVersion, versionKey) &&
+            matchesPickedManifest(manifestsByVersion[versionKey])) {
+          matchingVersionKeys.push(versionKey)
+        }
+      }
+    }
+
+    if (matchingVersionKeys.some(versionKey => versionKey !== picked.version)) {
+      const message = [
+        `${pickedId} registry manifest has mismatched version:`,
+        `listed in the packument as ${matchingVersionKeys.join(', ')}`,
+      ].join(' ')
+      throw Object.assign(new Error(message), {
+        code: 'EMANIFESTMISMATCH',
+        expected: matchingVersionKeys,
+        found: pickedId,
+      })
+    }
+  }
+
   async manifest () {
     if (this.package) {
       return this.package
@@ -127,11 +191,16 @@ class RegistryFetcher extends Fetcher {
 
     const packument = await this.packument()
     const steps = PackageJson.normalizeSteps.filter(s => s !== '_attributes')
-    const mani = await new PackageJson().fromContent(pickManifest(packument, this.spec.fetchSpec, {
+    const picked = pickManifest(packument, this.spec.fetchSpec, {
       ...this.opts,
       defaultTag: this.defaultTag,
       before: this.before,
-    })).normalize({ steps }).then(p => p.content)
+    })
+    if (this.opts.verifySignatures || this.opts.verifyAttestations) {
+      this.#verifyManifestIdentity(packument, picked)
+    }
+    const mani = await new PackageJson().fromContent(picked)
+      .normalize({ steps }).then(p => p.content)
 
     /* XXX add ETARGET and E403 revalidation of cached packuments here */
 

package/node_modules/npm/node_modules/pacote/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "21.5.1",
+  "version": "21.5.2",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -75,6 +75,7 @@
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
     "version": "5.1.0",
     "windowsCI": false,
-    "publish": "true"
+    "publish": "true",
+    "backport": 21
   }
 }

package/node_modules/npm/node_modules/semver/classes/range.js

@@ -119,7 +119,7 @@ class Range {
     debug('hyphen replace', range)
 
     // `> 1.2.3 < 1.2.5` => `>1.2.3 <1.2.5`
-    range = range.replace(re[t.COMPARATORTRIM], comparatorTrimReplace)
+    range = trimComparatorWhitespace(range)
     debug('comparator trim', range)
 
     // `~ 1.2.3` => `~1.2.3`
@@ -224,11 +224,11 @@ const parseOptions = require('../internal/parse-options')
 const Comparator = require('./comparator')
 const debug = require('../internal/debug')
 const SemVer = require('./semver')
+const trimComparatorWhitespace = require('../internal/trim-comparator-whitespace')
 const {
   safeRe: re,
   src,
   t,
-  comparatorTrimReplace,
   tildeTrimReplace,
   caretTrimReplace,
 } = require('../internal/re')

package/node_modules/npm/node_modules/semver/internal/constants.js

@@ -15,6 +15,35 @@ const MAX_SAFE_COMPONENT_LENGTH = 16
 // the shortest version with a build 0.0.0+BUILD.
 const MAX_SAFE_BUILD_LENGTH = MAX_LENGTH - 6
 
+// ECMAScript whitespace and line terminators matched by \s.
+const WHITESPACE_CHARACTERS = [
+  '\t',
+  '\n',
+  '\v',
+  '\f',
+  '\r',
+  ' ',
+  '\u00a0',
+  '\u1680',
+  '\u2000',
+  '\u2001',
+  '\u2002',
+  '\u2003',
+  '\u2004',
+  '\u2005',
+  '\u2006',
+  '\u2007',
+  '\u2008',
+  '\u2009',
+  '\u200a',
+  '\u2028',
+  '\u2029',
+  '\u202f',
+  '\u205f',
+  '\u3000',
+  '\ufeff',
+]
+
 const RELEASE_TYPES = [
   'major',
   'premajor',
@@ -30,6 +59,7 @@ module.exports = {
   MAX_SAFE_COMPONENT_LENGTH,
   MAX_SAFE_BUILD_LENGTH,
   MAX_SAFE_INTEGER,
+  WHITESPACE_CHARACTERS,
   RELEASE_TYPES,
   SEMVER_SPEC_VERSION,
   FLAG_INCLUDE_PRERELEASE: 0b001,