@yanglaofish/fishtools 0.5.2 → 0.5.3

package/node_modules/@npmcli/arborist/lib/shrinkwrap.js

@@ -1,4 +1,5 @@
-// a module that manages a lockfile (package-lock.json).
+// a module that manages a shrinkwrap file (npm-shrinkwrap.json or
+// package-lock.json).
 
 // Increment whenever the lockfile version updates
 // v1 - npm <=6
@@ -10,12 +11,6 @@
 
 const localeCompare = require('@isaacs/string-locale-compare')('en')
 const defaultLockfileVersion = 3
-// Bumped to 4 only when a node carries a patch record, so older clients abort.
-const patchedLockfileVersion = 4
-// packageExtensions provenance also forces lockfileVersion 4 so older clients abort rather than silently dropping the repaired graph.
-// Both features share version 4: they are root-owned graph repairs an old npm must not drop.
-const packageExtensionsLockfileVersion = 4
-const maxLockfileVersion = 4
 
 // for comparing nodes to yarn.lock entries
 const mismatch = (a, b) => a && b && a !== b
@@ -103,6 +98,7 @@ const pkgMetaKeys = [
   'libc',
   '_integrity',
   'license',
+  '_hasShrinkwrap',
   'hasInstallScript',
   'bin',
   'deprecated',
@@ -112,10 +108,8 @@ const pkgMetaKeys = [
 const nodeMetaKeys = [
   'integrity',
   'inBundle',
+  'hasShrinkwrap',
   'hasInstallScript',
-  'patched',
-  'packageExtensionsApplied',
-  'npmExtensionApplied',
 ]
 
 const metaFieldFromPkg = (pkg, key) => {
@@ -234,14 +228,17 @@ class Shrinkwrap {
     const s = new Shrinkwrap(options)
     s.reset()
 
-    const [lock] = await s.resetFiles
+    const [sw, lock] = await s.resetFiles
 
+    // XXX this is duplicated in this.load(), but using loadFiles instead of resetFiles
     if (s.hiddenLockfile) {
       s.filename = resolve(s.path, 'node_modules/.package-lock.json')
+    } else if (s.shrinkwrapOnly || sw) {
+      s.filename = resolve(s.path, 'npm-shrinkwrap.json')
     } else {
       s.filename = resolve(s.path, 'package-lock.json')
     }
-    s.loadedFromDisk = !!lock
+    s.loadedFromDisk = !!(sw || lock)
     // TODO what uses this?
     s.type = basename(s.filename)
 
@@ -318,6 +315,7 @@ class Shrinkwrap {
       path,
       indent = 2,
       newline = '\n',
+      shrinkwrapOnly = false,
       hiddenLockfile = false,
       lockfileVersion,
       resolveOptions = {},
@@ -343,6 +341,8 @@ class Shrinkwrap {
     this.hiddenLockfile = hiddenLockfile
     this.loadingError = null
     this.resolveOptions = resolveOptions
+    // only load npm-shrinkwrap.json in dep trees, not package-lock
+    this.shrinkwrapOnly = shrinkwrapOnly
   }
 
   // check to see if a spec is present in the yarn.lock file, and if so,
@@ -385,8 +385,6 @@ class Shrinkwrap {
   reset () {
     this.tree = null
     this.#awaitingUpdate = new Map()
-    this.packageExtensionsHash = null
-    this.npmExtensionHash = null
     const lockfileVersion = this.lockfileVersion || defaultLockfileVersion
     this.originalLockfileVersion = lockfileVersion
 
@@ -400,10 +398,14 @@ class Shrinkwrap {
 
   // files to potentially read from and write to, in order of priority
   get #filenameSet () {
+    if (this.shrinkwrapOnly) {
+      return [`${this.path}/npm-shrinkwrap.json`]
+    }
     if (this.hiddenLockfile) {
       return [`${this.path}/node_modules/.package-lock.json`]
     }
     return [
+      `${this.path}/npm-shrinkwrap.json`,
       `${this.path}/package-lock.json`,
       `${this.path}/yarn.lock`,
     ]
@@ -423,9 +425,9 @@ class Shrinkwrap {
   }
 
   get resetFiles () {
-    // slice out yarn, we only care about the package-lock when checking
+    // slice out yarn, we only care about lock or shrinkwrap when checking
     // this way, since we're not actually loading the full lock metadata
-    return Promise.all(this.#filenameSet.slice(0, 1)
+    return Promise.all(this.#filenameSet.slice(0, 2)
       .map(file => file && stat(file).then(st => st.isFile(), er => {
         /* istanbul ignore else - can't test without breaking module itself */
         if (er.code === 'ENOENT') {
@@ -452,18 +454,25 @@ class Shrinkwrap {
   }
 
   async load () {
+    // we don't need to load package-lock.json except for top of tree nodes,
+    // only npm-shrinkwrap.json.
     let data
     try {
-      const [lock, yarn] = await this.loadFiles
-      data = lock || '{}'
+      const [sw, lock, yarn] = await this.loadFiles
+      data = sw || lock || '{}'
 
+      // use shrinkwrap only for deps; otherwise, prefer package-lock
+      // and ignore npm-shrinkwrap if both are present.
+      // TODO: emit a warning here or something if both are present.
       if (this.hiddenLockfile) {
         this.filename = resolve(this.path, 'node_modules/.package-lock.json')
+      } else if (this.shrinkwrapOnly || sw) {
+        this.filename = resolve(this.path, 'npm-shrinkwrap.json')
       } else {
         this.filename = resolve(this.path, 'package-lock.json')
       }
       this.type = basename(this.filename)
-      this.loadedFromDisk = Boolean(lock)
+      this.loadedFromDisk = Boolean(sw || lock)
 
       if (yarn) {
         this.yarnLock = new YarnLock()
@@ -498,13 +507,6 @@ class Shrinkwrap {
       this.ancientLockfile = false
       data = {}
     }
-    // refuse lockfiles newer than we understand so we never drop a patched or repaired graph we cannot read
-    if (data.lockfileVersion > maxLockfileVersion) {
-      throw Object.assign(
-        new Error(`Unsupported lockfileVersion ${data.lockfileVersion}. This npm only supports up to ${maxLockfileVersion}. Please upgrade npm.`),
-        { code: 'ELOCKFILEVERSION' }
-      )
-    }
     // auto convert v1 lockfiles to v3
     // leave v2 in place unless configured
     // v3 by default
@@ -525,11 +527,6 @@ class Shrinkwrap {
 
     this.originalLockfileVersion = data.lockfileVersion
 
-    // the canonical packageExtensions hash, if the lockfile recorded one on its root entry
-    this.packageExtensionsHash = data.packages?.['']?.packageExtensionsHash || null
-    // the .npm-extension file hash, if the lockfile recorded one on its root entry
-    this.npmExtensionHash = data.packages?.['']?.npmExtensionHash || null
-
     // use default if it wasn't explicitly set, and the current file is
     // less than our default.  otherwise, keep whatever is in the file,
     // unless we had an explicit setting already.
@@ -841,6 +838,7 @@ class Shrinkwrap {
       const {
         resolved,
         integrity,
+        hasShrinkwrap,
         version,
       } = this.get(node.path)
 
@@ -867,14 +865,17 @@ class Shrinkwrap {
       if (allOk) {
         node.resolved = node.resolved || pathFixed || null
         node.integrity = node.integrity || integrity || null
+        node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false
       } else {
         // try to read off the package or node itself
         const {
           resolved,
           integrity,
+          hasShrinkwrap,
         } = Shrinkwrap.metaFromNode(node, this.path, this.resolveOptions)
         node.resolved = node.resolved || resolved || null
         node.integrity = node.integrity || integrity || null
+        node.hasShrinkwrap = node.hasShrinkwrap || hasShrinkwrap || false
       }
     }
     this.#awaitingUpdate.set(loc, node)
@@ -947,14 +948,6 @@ class Shrinkwrap {
         this.tree.target,
         this.path,
         this.resolveOptions)
-      // record the canonical packageExtensions hash on the root entry so npm ci can detect stale extension state
-      if (this.packageExtensionsHash) {
-        root.packageExtensionsHash = this.packageExtensionsHash
-      }
-      // record the .npm-extension file hash on the root entry for the same reason
-      if (this.npmExtensionHash) {
-        root.npmExtensionHash = this.npmExtensionHash
-      }
       this.data.packages = {}
       if (Object.keys(root).length) {
         this.data.packages[''] = root
@@ -1000,22 +993,6 @@ class Shrinkwrap {
     if (!this.lockfileVersion) {
       this.lockfileVersion = defaultLockfileVersion
     }
-    // patched nodes force lockfileVersion 4 so older clients abort the install
-    // the hidden lockfile is an internal cache pinned to version 3, so it never drives this upgrade
-    const hasPatched = !this.hiddenLockfile &&
-      Object.values(this.data.packages).some(p => p.patched)
-    if (hasPatched && this.lockfileVersion < patchedLockfileVersion) {
-      log.warn('shrinkwrap', `patchedDependencies requires lockfileVersion ${patchedLockfileVersion}; upgrading the lockfile from version ${this.lockfileVersion}.`)
-      this.lockfileVersion = patchedLockfileVersion
-    }
-    // packageExtensions and .npm-extension state likewise force lockfileVersion 4 so older clients abort instead of dropping the repaired graph
-    const hasExtensionState = !this.hiddenLockfile &&
-      (this.packageExtensionsHash || this.npmExtensionHash ||
-        Object.values(this.data.packages).some(p => p.packageExtensionsApplied || p.npmExtensionApplied))
-    if (hasExtensionState && this.lockfileVersion < packageExtensionsLockfileVersion) {
-      log.warn('shrinkwrap', `manifest extensions require lockfileVersion ${packageExtensionsLockfileVersion}; upgrading the lockfile from version ${this.lockfileVersion}.`)
-      this.lockfileVersion = packageExtensionsLockfileVersion
-    }
     this.data.lockfileVersion = this.lockfileVersion
 
     // hidden lockfiles don't include legacy metadata or a root entry

package/node_modules/@npmcli/arborist/package.json

@@ -1,52 +1,50 @@
 {
   "name": "@npmcli/arborist",
-  "version": "10.0.3",
+  "version": "9.9.2",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",
     "@isaacs/string-locale-compare": "^1.1.0",
-    "@npmcli/fs": "^6.0.0",
-    "@npmcli/installed-package-contents": "^5.0.0",
-    "@npmcli/map-workspaces": "^6.0.0",
-    "@npmcli/metavuln-calculator": "^10.0.0",
-    "@npmcli/name-from-folder": "^5.0.0",
-    "@npmcli/node-gyp": "^6.0.0",
-    "@npmcli/package-json": "^8.0.0",
+    "@npmcli/fs": "^5.0.0",
+    "@npmcli/installed-package-contents": "^4.0.0",
+    "@npmcli/map-workspaces": "^5.0.0",
+    "@npmcli/metavuln-calculator": "^9.0.2",
+    "@npmcli/name-from-folder": "^4.0.0",
+    "@npmcli/node-gyp": "^5.0.0",
+    "@npmcli/package-json": "^7.0.0",
     "@npmcli/query": "^5.0.0",
-    "@npmcli/redact": "^5.0.0",
-    "@npmcli/run-script": "^11.0.0",
-    "bin-links": "^7.0.0",
-    "cacache": "^21.0.1",
+    "@npmcli/redact": "^4.0.0",
+    "@npmcli/run-script": "^10.0.0",
+    "bin-links": "^6.0.0",
+    "cacache": "^20.0.1",
     "common-ancestor-path": "^2.0.0",
-    "diff": "^8.0.2",
-    "hosted-git-info": "^10.1.1",
+    "hosted-git-info": "^9.0.0",
     "json-stringify-nice": "^1.1.4",
     "lru-cache": "^11.2.1",
     "minimatch": "^10.0.3",
-    "nopt": "^10.0.1",
-    "npm-install-checks": "^9.0.0",
-    "npm-package-arg": "^14.0.0",
-    "npm-pick-manifest": "^12.0.0",
-    "npm-registry-fetch": "^20.0.1",
-    "pacote": "^22.0.0",
-    "parse-conflict-json": "^6.0.0",
-    "proc-log": "^7.0.0",
+    "nopt": "^9.0.0",
+    "npm-install-checks": "^8.0.0",
+    "npm-package-arg": "^13.0.0",
+    "npm-pick-manifest": "^11.0.1",
+    "npm-registry-fetch": "^19.0.0",
+    "pacote": "^21.0.2",
+    "parse-conflict-json": "^5.0.1",
+    "proc-log": "^6.0.0",
     "proggy": "^4.0.0",
     "promise-all-reject-late": "^1.0.0",
     "promise-call-limit": "^3.0.1",
     "semver": "^7.3.7",
-    "ssri": "^14.0.0",
+    "ssri": "^13.0.0",
     "treeverse": "^3.0.0",
-    "validate-npm-package-name": "^8.0.0",
     "walk-up-path": "^4.0.0"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^5.0.1",
     "@npmcli/mock-registry": "^1.0.0",
-    "@npmcli/template-oss": "5.1.1",
+    "@npmcli/template-oss": "4.29.0",
     "benchmark": "^2.1.4",
     "minify-registry-metadata": "^4.0.0",
-    "nock": "^14.0.0",
+    "nock": "^13.3.3",
     "tap": "^16.3.8",
     "tar-stream": "^3.0.0",
     "tcompare": "^5.0.6"
@@ -84,10 +82,6 @@
     "test-env": [
       "LC_ALL=sk"
     ],
-    "node-arg": [
-      "--require",
-      "../../scripts/disable-agent-for-tests.js"
-    ],
     "timeout": "720",
     "nyc-arg": [
       "--exclude",
@@ -95,11 +89,11 @@
     ]
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.1",
+    "version": "4.29.0",
     "content": "../../scripts/template-oss/index.js"
   }
 }

package/node_modules/@npmcli/fs/lib/move-file.js

@@ -56,19 +56,19 @@ const moveFile = async (source, destination, options = {}, root = true, symlinks
       }
       // try to determine what the actual file is so we can create the correct
       // type of symlink in windows
-      let targetType = 'file'
+      let targetStat = 'file'
       try {
-        const targetStat = await fs.stat(resolve(dirname(symSource), target))
+        targetStat = await fs.stat(resolve(dirname(symSource), target))
         if (targetStat.isDirectory()) {
-          targetType = 'junction'
+          targetStat = 'junction'
         }
       } catch {
-        // targetType remains 'file'
+        // targetStat remains 'file'
       }
       await fs.symlink(
         target,
         symDestination,
-        targetType
+        targetStat
       )
     }))
     await fs.rm(source, { recursive: true, force: true })

package/node_modules/@npmcli/fs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/fs",
-  "version": "6.0.0",
+  "version": "5.0.0",
   "description": "filesystem utilities for the npm cli",
   "main": "lib/index.js",
   "files": [
@@ -30,19 +30,19 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "devDependencies": {
-    "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.27.1",
     "tap": "^16.0.1"
   },
   "dependencies": {
     "semver": "^7.3.5"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
+    "version": "4.27.1",
     "publish": true
   },
   "tap": {

package/node_modules/@npmcli/git/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/git",
-  "version": "8.0.0",
+  "version": "7.0.2",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -31,29 +31,28 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.0",
-    "npm-package-arg": "^14.0.0",
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.24.1",
+    "npm-package-arg": "^13.0.0",
     "slash": "^3.0.0",
     "tap": "^16.0.1"
   },
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",
-    "@npmcli/promise-spawn": "^10.0.0",
-    "ini": "^7.0.0",
+    "@npmcli/promise-spawn": "^9.0.0",
+    "ini": "^6.0.0",
     "lru-cache": "^11.2.1",
-    "npm-pick-manifest": "^12.0.0",
-    "proc-log": "^7.0.0",
+    "npm-pick-manifest": "^11.0.1",
+    "proc-log": "^6.0.0",
     "semver": "^7.3.5",
-    "which": "^7.0.0"
+    "which": "^6.0.0"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
-    "publish": true,
-    "updateNpm": false
+    "version": "4.24.1",
+    "publish": true
   }
 }

package/node_modules/@npmcli/installed-package-contents/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/installed-package-contents",
-  "version": "5.0.0",
+  "version": "4.0.0",
   "description": "Get the list of files installed in a package in node_modules, including bundled dependencies",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
@@ -19,13 +19,13 @@
     "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.27.1",
     "tap": "^16.3.0"
   },
   "dependencies": {
-    "npm-bundled": "^6.0.0",
-    "npm-normalize-package-bin": "^6.0.0"
+    "npm-bundled": "^5.0.0",
+    "npm-normalize-package-bin": "^5.0.0"
   },
   "repository": {
     "type": "git",
@@ -36,11 +36,11 @@
     "lib/"
   ],
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
+    "version": "4.27.1",
     "publish": true
   },
   "tap": {

package/node_modules/@npmcli/map-workspaces/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@npmcli/map-workspaces",
-  "version": "6.0.0",
+  "version": "5.0.3",
   "main": "lib/index.js",
   "files": [
     "bin/",
     "lib/"
   ],
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "description": "Retrieves a name:pathname Map for a given workspaces config",
   "repository": {
@@ -43,19 +43,19 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/template-oss": "4.28.0",
     "tap": "^16.0.1"
   },
   "dependencies": {
-    "@npmcli/name-from-folder": "^5.0.0",
-    "@npmcli/package-json": "^8.0.0",
+    "@npmcli/name-from-folder": "^4.0.0",
+    "@npmcli/package-json": "^7.0.0",
     "glob": "^13.0.0",
     "minimatch": "^10.0.3"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
+    "version": "4.28.0",
     "publish": "true"
   }
 }

package/node_modules/@npmcli/metavuln-calculator/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/metavuln-calculator",
-  "version": "10.0.0",
+  "version": "9.0.3",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -33,24 +33,30 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.27.1",
     "require-inject": "^1.4.4",
     "tap": "^16.0.1"
   },
   "dependencies": {
-    "cacache": "^21.0.1",
-    "json-parse-even-better-errors": "^6.0.0",
-    "pacote": "^22.0.0",
-    "proc-log": "^7.0.0",
+    "cacache": "^20.0.0",
+    "json-parse-even-better-errors": "^5.0.0",
+    "pacote": "^21.0.0",
+    "proc-log": "^6.0.0",
     "semver": "^7.3.5"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
-    "publish": "true"
+    "version": "4.27.1",
+    "publish": "true",
+    "ciVersions": [
+      "16.14.0",
+      "16.x",
+      "18.0.0",
+      "18.x"
+    ]
   }
 }

package/node_modules/@npmcli/name-from-folder/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/name-from-folder",
-  "version": "5.0.0",
+  "version": "4.0.0",
   "files": [
     "bin/",
     "lib/"
@@ -14,29 +14,32 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "scripts": {
-    "test": "node --test './test/**/*.js'",
-    "snap": "node --test --test-update-snapshots './test/**/*.js'",
+    "test": "tap",
+    "snap": "tap",
     "lint": "npm run eslint",
     "postlint": "template-oss-check",
     "template-oss-apply": "template-oss-apply --force",
     "lintfix": "npm run eslint -- --fix",
     "posttest": "npm run lint",
-    "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
-    "test:node20": "node --test test",
-    "test:cover": "node --test --experimental-test-coverage --test-timeout=3000 --test-coverage-lines=100 --test-coverage-functions=100 --test-coverage-branches=100 './test/**/*.js'"
+    "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "5.0.0"
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.27.1",
+    "tap": "^16.3.2"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.0.0",
-    "publish": true,
-    "testRunner": "node:test",
-    "latestCiVersion": 24
+    "version": "4.27.1",
+    "publish": true
+  },
+  "tap": {
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   }
 }

package/node_modules/@npmcli/node-gyp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/node-gyp",
-  "version": "6.0.0",
+  "version": "5.0.0",
   "description": "Tools for dealing with node-gyp packages",
   "scripts": {
     "test": "tap",
@@ -29,16 +29,16 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "devDependencies": {
-    "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "5.0.0",
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.27.1",
     "tap": "^16.0.1"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.0.0",
+    "version": "4.27.1",
     "publish": true
   },
   "tap": {

package/node_modules/@npmcli/package-json/lib/index.js

@@ -42,7 +42,6 @@ class PackageJson {
     '_attributes',
     'bundledDependencies',
     'bundleDependencies',
-    'overrides',
     'optionalDedupe',
     'scripts',
     'funding',
@@ -56,8 +55,8 @@ class PackageJson {
     'bundledDependencies',
     'bundleDependencies',
     'bundleDependenciesDeleteFalse',
-    'overrides',
     'gypfile',
+    'serverjs',
     'scriptpath',
     'authors',
     'readme',