@yanglaofish/fishtools 0.5.2 → 0.6.0

package/node_modules/npm-packlist/lib/index.js

@@ -1,14 +1,12 @@
 'use strict'
 
 const { Walker: IgnoreWalker } = require('ignore-walk')
-const { globSync } = require('glob')
-const { readFileSync: readFile } = require('node:fs')
-const { basename, dirname, extname, join, relative, resolve, sep } = require('node:path')
+const { lstatSync: lstat, readFileSync: readFile } = require('fs')
+const { basename, dirname, extname, join, relative, resolve, sep } = require('path')
 const { log } = require('proc-log')
 
 // symbols used to represent synthetic rule sets
 const defaultRules = Symbol('npm-packlist.rules.default')
-const globalRules = Symbol('npm-packlist.rules.global')
 const strictRules = Symbol('npm-packlist.rules.strict')
 
 // There may be others, but :?|<> are handled by node-tar
@@ -85,23 +83,13 @@ class PackWalker extends IgnoreWalker {
       follow: false,
       // we path.resolve() here because ignore-walk doesn't do it and we want full paths
       path: resolve(opts?.path || tree.path).replace(/\\/g, '/'),
-      // globalRules belongs on the root walker only. Child walkers reach it through
-      // parent.filterEntry, where package.json rules can still override it; reapplying
-      // globalRules at the child level would defeat that override.
-      ignoreFiles: opts?.ignoreFiles || (opts?.parent ? [
+      ignoreFiles: opts?.ignoreFiles || [
         defaultRules,
         'package.json',
         '.npmignore',
         '.gitignore',
         strictRules,
-      ] : [
-        defaultRules,
-        globalRules,
-        'package.json',
-        '.npmignore',
-        '.gitignore',
-        strictRules,
-      ]),
+      ],
     }
 
     super(options)
@@ -109,8 +97,7 @@ class PackWalker extends IgnoreWalker {
     this.isPackage = options.isPackage
     this.seen = options.seen || new Set()
     this.tree = tree
-    this.globalIgnoreFile = options.globalIgnoreFile || null
-    this.globalIgnoreRules = options.globalIgnoreRules || null
+    this.requiredFiles = options.requiredFiles || []
 
     const additionalDefaults = []
     if (options.prefix && options.workspaces) {
@@ -137,34 +124,13 @@ class PackWalker extends IgnoreWalker {
     // go ahead and inject the default rules now
     this.injectRules(defaultRules, [...defaults, ...additionalDefaults])
 
-    // inject the global rules from the user's ignore file. positioned between
-    // defaultRules and package.json so an explicit entry in the package "files"
-    // field can still override. only the root walker carries globalRules in its
-    // ignoreFiles list; child walkers see global exclusions via parent.filterEntry,
-    // which is what lets the package.json `!/path/**` override win.
-    if (this.globalIgnoreRules === null && this.globalIgnoreFile) {
-      try {
-        this.globalIgnoreRules = readFile(this.globalIgnoreFile, { encoding: 'utf8' })
-      } catch (err) {
-        // istanbul ignore next -- only ENOENT is expected here
-        if (err.code !== 'ENOENT') {
-          throw err
-        }
-        this.globalIgnoreRules = ''
-      }
-    }
-    if (this.globalIgnoreRules) {
-      this.injectRules(globalRules, [this.globalIgnoreRules])
-      // istanbul ignore else -- globalIgnoreRules without a filename only happens when
-      // a caller pre-populates rules directly instead of going through globalIgnoreFile
-      if (this.globalIgnoreFile) {
-        log.silly('global-ignore-file', `applied rules from ${this.globalIgnoreFile}`)
-      }
-    }
-
     if (!this.isPackage) {
-      // if this instance is not a package, then place some strict default rules
-      this.injectRules(strictRules, [...strictDefaults])
+      // if this instance is not a package, then place some strict default rules, and append
+      // known required files for this directory
+      this.injectRules(strictRules, [
+        ...strictDefaults,
+        ...this.requiredFiles.map((file) => `!${file}`),
+      ])
     }
   }
 
@@ -268,6 +234,15 @@ class PackWalker extends IgnoreWalker {
     return {
       ...super.walkerOpt(entry, opts),
       ignoreFiles,
+      // we map over our own requiredFiles and pass ones that are within this entry
+      requiredFiles: this.requiredFiles
+        .map((file) => {
+          if (relative(file, entry) === '..') {
+            return relative(entry, file).replace(/\\/g, '/')
+          }
+          return false
+        })
+        .filter(Boolean),
     }
   }
 
@@ -305,7 +280,6 @@ class PackWalker extends IgnoreWalker {
       browser,
       files,
       main,
-      patchedDependencies,
     } = this.tree.package
 
     // rules in these arrays are inverted since they are patterns we want to _not_ ignore
@@ -321,62 +295,46 @@ class PackWalker extends IgnoreWalker {
       '/node_modules',
       '.npmrc',
       '/package-lock.json',
-      '/npm-shrinkwrap.json',
       '/yarn.lock',
       '/pnpm-lock.yaml',
       '/bun.lockb',
-      '/bun.lock',
-      '/.npm-extension.mjs',
-      '/.npm-extension.cjs',
     ]
 
     // if we have a files array in our package, we need to pull rules from it
     if (files) {
-      for (const entry of files) {
-        const isNegation = entry.startsWith('!')
-        // normalize: strip leading `!`s, `./`, a single leading `/`, and trailing slashes.
-        // trailing slashes confuse glob; the leading forms are equivalent to their stripped versions for glob expansion.
-        const pattern = (isNegation ? entry.replace(/^!+/, '') : entry)
-          .replace(/^\.?\//, '')
-          .replace(/\/+$/, '')
-        if (!pattern) {
-          continue
+      for (let file of files) {
+        // invert the rule because these are things we want to include
+        if (file.startsWith('./')) {
+          file = file.slice(1)
         }
-
-        // expand the entry as a glob against the package root.
-        // literal paths (e.g. `lib`, `lib/foo.js`) are valid globs and resolve to themselves;
-        // patterns (e.g. `dist-*`, `**/*.js`) resolve to all matching entries;
-        // typos and non-existent entries resolve to nothing.
-        let matches = []
-        try {
-          matches = globSync(pattern, { cwd: this.path, withFileTypes: true, dot: true })
-        } catch {
-          // unparseable globs produce no matches and drop silently.
-          // (Pre-v11 instead fell through to push the raw entry as an ignore-walk pattern rule; we deliberately don't preserve that.)
+        if (file.endsWith('/*')) {
+          file += '*'
         }
-
-        // a positive entry produces `!path` rules (un-ignore from the surrounding `*` deny-all); a negation produces `path` rules (re-ignore them).
-        // directory matches expand to also include their contents; this is documented `files[]` behavior, not a glob hack.
-        const prefix = isNegation ? '' : '!'
-        for (const match of matches) {
-          const rel = match.relativePosix()
-          // istanbul ignore next -- defensive: glob with withFileTypes returns the cwd as an entry with an empty relative path; skip it.
-          if (!rel) {
-            continue
-          }
-          if (match.isDirectory()) {
-            ignores.push(`${prefix}/${rel}`)
-            ignores.push(`${prefix}/${rel}/**`)
-            continue
-          }
-          // istanbul ignore else -- non-file-non-dir matches (sockets, fifos, broken symlinks) drop silently.
-          if (match.isFile()) {
-            ignores.push(`${prefix}/${rel}`)
+        const inverse = `!${file}`
+        try {
+          // if an entry in the files array is a specific file, then we need to include it as a
+          // strict requirement for this package. if it's a directory or a pattern, it's a default
+          // pattern instead. this is ugly, but we have to stat to find out if it's a file
+          const stat = lstat(join(this.path, file.replace(/^!+/, '')).replace(/\\/g, '/'))
+          // if we have a file and we know that, it's strictly required
+          if (stat.isFile()) {
+            strict.unshift(inverse)
+            this.requiredFiles.push(file.startsWith('/') ? file.slice(1) : file)
+          } else if (stat.isDirectory()) {
+            // otherwise, it's a default ignore, and since we got here we know it's not a pattern
+            // so we include the directory contents
+            ignores.push(inverse)
+            ignores.push(`${inverse}/**`)
           }
+          // if the thing exists, but is neither a file or a directory, we don't want it at all
+        } catch (err) {
+          // if lstat throws, then we assume we're looking at a pattern and treat it as a default
+          ignores.push(inverse)
         }
       }
 
-      // we prepend a '*' to exclude everything, followed by our inverted file rules which now mean to include those
+      // we prepend a '*' to exclude everything, followed by our inverted file rules
+      // which now mean to include those
       this.injectRules('package.json', ['*', ...ignores])
     }
 
@@ -397,32 +355,6 @@ class PackWalker extends IgnoreWalker {
       }
     }
 
-    // patch files declared in patchedDependencies are project-local fixes and must never ship.
-    // patchedDependencies is root-only state, so this applies only to the package being packed.
-    // each declared patch file is force-excluded even when it was added via "files".
-    // only the exact files are excluded, never their directory, so a shared dir keeps its other contents.
-    if (this.tree.isProjectRoot && patchedDependencies && typeof patchedDependencies === 'object') {
-      for (const patchPath of Object.values(patchedDependencies)) {
-        if (typeof patchPath !== 'string') {
-          continue
-        }
-        const rel = normalizePath(patchPath).replace(/^\.?\//, '').replace(/\/+$/, '')
-        // skip absolute paths or paths that escape the package root, which are never packed anyway
-        if (!rel || rel.startsWith('/') || rel === '..' || rel.startsWith('../') || rel.includes('/../')) {
-          continue
-        }
-        // warn when a "files" entry pulled the patch file in, either directly or via its directory
-        const parentGlob = `!/${normalizePath(dirname(rel))}/**`
-        if (files && (ignores.includes(`!/${rel}`) || ignores.includes(parentGlob))) {
-          log.warn(
-            'patched-dependencies',
-            `excluding "${rel}" from the package tarball: patch files in patchedDependencies must not be published`
-          )
-        }
-        strict.push(`/${rel}`)
-      }
-    }
-
     // and now we add all of the strict rules to our synthetic file
     this.injectRules(strictRules, strict, callback)
   }

package/node_modules/npm-packlist/package.json

@@ -1,15 +1,14 @@
 {
   "name": "npm-packlist",
-  "version": "11.3.0",
+  "version": "10.0.4",
   "description": "Get a list of the files to add from a folder into an npm package",
   "directories": {
     "test": "test"
   },
   "main": "lib/index.js",
   "dependencies": {
-    "glob": "^13.0.6",
-    "ignore-walk": "^9.0.0",
-    "proc-log": "^7.0.0"
+    "ignore-walk": "^8.0.0",
+    "proc-log": "^6.0.0"
   },
   "author": "GitHub Inc.",
   "license": "ISC",
@@ -19,8 +18,8 @@
   ],
   "devDependencies": {
     "@npmcli/arborist": "^9.0.0",
-    "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.1",
+    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/template-oss": "4.29.0",
     "mutate-fs": "^2.1.1",
     "tap": "^16.0.1"
   },
@@ -53,12 +52,11 @@
     ]
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.1",
-    "publish": true,
-    "updateNpm": false
+    "version": "4.29.0",
+    "publish": true
   }
 }

package/node_modules/npm-pick-manifest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npm-pick-manifest",
-  "version": "12.0.0",
+  "version": "11.0.3",
   "description": "Resolves a matching manifest from a package metadata document according to standard npm semver resolution rules.",
   "main": "./lib",
   "files": [
@@ -10,15 +10,13 @@
   "scripts": {
     "coverage": "tap",
     "lint": "npm run eslint",
-    "test": "node --test './test/**/*.js'",
+    "test": "tap",
     "posttest": "npm run lint",
     "postlint": "template-oss-check",
     "lintfix": "npm run eslint -- --fix",
-    "snap": "node --test --test-update-snapshots './test/**/*.js'",
+    "snap": "tap",
     "template-oss-apply": "template-oss-apply --force",
-    "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
-    "test:node20": "node --test test",
-    "test:cover": "node --test --experimental-test-coverage --test-timeout=3000 --test-coverage-lines=100 --test-coverage-functions=100 --test-coverage-branches=100 './test/**/*.js'"
+    "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
   "repository": {
     "type": "git",
@@ -32,23 +30,29 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "dependencies": {
-    "npm-install-checks": "^9.0.0",
-    "npm-normalize-package-bin": "^6.0.0",
-    "npm-package-arg": "^14.0.0",
+    "npm-install-checks": "^8.0.0",
+    "npm-normalize-package-bin": "^5.0.0",
+    "npm-package-arg": "^13.0.0",
     "semver": "^7.3.5"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "5.1.0"
+    "@npmcli/template-oss": "4.27.1",
+    "tap": "^16.0.1"
+  },
+  "tap": {
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
-    "publish": true,
-    "testRunner": "node:test",
-    "latestCiVersion": 24
+    "version": "4.27.1",
+    "publish": true
   }
 }

package/node_modules/npm-registry-fetch/lib/errors.js

@@ -38,18 +38,13 @@ class HttpErrorBase extends Error {
 class HttpErrorGeneral extends HttpErrorBase {
   constructor (method, res, body, spec) {
     super(method, res, body, spec)
-    let detail = ''
-    if (body && typeof body === 'object' && !Buffer.isBuffer(body)) {
-      const text = body.error || body.message || JSON.stringify(body)
-      if (text && text !== '{}') {
-        detail = ' - ' + text
-      }
-    }
     this.message = `${res.status} ${res.statusText} - ${
       this.method.toUpperCase()
     } ${
       this.spec || this.uri
-    }${detail}`
+    }${
+      (body && body.error) ? ' - ' + body.error : ''
+    }`
   }
 }
 

package/node_modules/npm-registry-fetch/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npm-registry-fetch",
-  "version": "20.0.1",
+  "version": "19.1.1",
   "description": "Fetch-based http client for use with npm registry APIs",
   "main": "lib",
   "files": [
@@ -31,22 +31,22 @@
   "author": "GitHub Inc.",
   "license": "ISC",
   "dependencies": {
-    "@npmcli/redact": "^5.0.0",
+    "@npmcli/redact": "^4.0.0",
     "jsonparse": "^1.3.1",
-    "make-fetch-happen": "^16.0.0",
+    "make-fetch-happen": "^15.0.0",
     "minipass": "^7.0.2",
-    "minipass-fetch": "^6.0.0",
+    "minipass-fetch": "^5.0.0",
     "minizlib": "^3.0.1",
-    "npm-package-arg": "^14.0.0",
-    "proc-log": "^7.0.0"
+    "npm-package-arg": "^13.0.0",
+    "proc-log": "^6.0.0"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.0",
-    "cacache": "^21.0.0",
+    "@npmcli/eslint-config": "^6.0.0",
+    "@npmcli/template-oss": "4.28.0",
+    "cacache": "^20.0.0",
     "nock": "^13.2.4",
     "require-inject": "^1.4.4",
-    "ssri": "^14.0.0",
+    "ssri": "^13.0.0",
     "tap": "^16.0.1"
   },
   "tap": {
@@ -58,11 +58,11 @@
     ]
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
+    "version": "4.28.0",
     "publish": "true"
   }
 }

package/node_modules/pacote/lib/dir.js

@@ -1,11 +1,8 @@
-const { resolve, join } = require('node:path')
-const { mkdtemp, writeFile, rm } = require('node:fs/promises')
-const { tmpdir } = require('node:os')
+const { resolve } = require('node:path')
 const packlist = require('npm-packlist')
 const runScript = require('@npmcli/run-script')
 const tar = require('tar')
 const { Minipass } = require('minipass')
-const PackageJson = require('@npmcli/package-json')
 const Fetcher = require('./fetcher.js')
 const FileFetcher = require('./file.js')
 const _ = require('./util/protected.js')
@@ -69,7 +66,7 @@ class DirFetcher extends Fetcher {
     stream.resolved = this.resolved
     stream.integrity = this.integrity
 
-    const { prefix, workspaces, globalIgnoreFile } = this.opts
+    const { prefix, workspaces } = this.opts
 
     // run the prepare script, get the list of files, and tar it up
     // pipe to the stream, and proxy errors the chain.
@@ -79,66 +76,14 @@ class DirFetcher extends Fetcher {
           const arb = new this.Arborist({ path: this.resolved })
           this.tree = await arb.loadActual()
         }
-        return packlist(this.tree, { path: this.resolved, prefix, workspaces, globalIgnoreFile })
-      })
-      .then(async files => {
-        const { options, cleanup } = await this.#tarOptions()
-        const source = tar.c(options, files)
-        // the strip temp file must outlive content consumption, so clean up once the stream is done
-        source.once('end', cleanup)
-        source.once('error', cleanup)
-        return source.on('error', er => stream.emit('error', er)).pipe(stream)
+        return packlist(this.tree, { path: this.resolved, prefix, workspaces })
       })
+      .then(files => tar.c(tarCreateOptions(this.package), files)
+        .on('error', er => stream.emit('error', er)).pipe(stream))
       .catch(er => stream.emit('error', er))
     return stream
   }
 
-  // Build the tar create options.
-  // When the packed package.json declares patchedDependencies, redirect it to a stripped copy so project-local patches never ship.
-  // Non-patched packs are unchanged.
-  async #tarOptions () {
-    const options = tarCreateOptions(this.package)
-
-    // read package.json from disk after prepare so the strip reflects the actually-packed manifest.
-    const pkgJson = await PackageJson.load(this.resolved)
-    if (!('patchedDependencies' in pkgJson.content)) {
-      return { options, cleanup: () => {} }
-    }
-
-    // serialize the package.json minus patchedDependencies, preserving its indent and newline.
-    // JSON.stringify ignores the indent and newline symbols @npmcli/package-json attaches to content.
-    delete pkgJson.content.patchedDependencies
-    const { content } = pkgJson
-    const indent = content[Symbol.for('indent')]
-    const newline = content[Symbol.for('newline')]
-    const stripped = `${JSON.stringify(content, null, indent)}\n`.replace(/\n/g, newline)
-
-    // write the stripped copy to a temp dir, removing it if the write itself fails.
-    const dir = await mkdtemp(join(tmpdir(), 'pacote-pack-'))
-    const strippedPath = join(dir, 'package.json')
-    try {
-      await writeFile(strippedPath, stripped)
-    } catch (er) {
-      /* istanbul ignore next - writing to a freshly created temp dir is not deterministically failable */
-      await rm(dir, { recursive: true, force: true })
-      /* istanbul ignore next */
-      throw er
-    }
-    const size = Buffer.byteLength(stripped)
-
-    // point only the top-level package.json entry at the stripped copy; every other file is untouched.
-    // onWriteEntry runs before the tar header and the file's hardlink check, so size and nlink here are honored.
-    options.onWriteEntry = (entry) => {
-      if (entry.path === 'package.json') {
-        entry.absolute = strippedPath
-        entry.stat.size = size
-        entry.stat.nlink = 1
-      }
-    }
-
-    return { options, cleanup: () => rm(dir, { recursive: true, force: true }) }
-  }
-
   manifest () {
     if (this.package) {
       return Promise.resolve(this.package)

package/node_modules/pacote/lib/fetcher.js

@@ -118,10 +118,6 @@ class FetcherBase {
       // we need the actual things, not just the lockfile
       '--no-package-lock-only',
       '--no-dry-run',
-      // override npm_config_global from the parent process: this inner
-      // `npm install` is preparing deps inside a tmp git clone, and it
-      // must reify into that clone's cwd, never the outer global prefix.
-      '--global=false',
     ]
   }
 

package/node_modules/pacote/lib/git.js

@@ -19,7 +19,7 @@ const hashre = /^[a-f0-9]{40,64}$/
 // otherwise, prefer ssh if available (more secure).
 // We have to add the git+ back because npa suppresses it.
 const repoUrl = (h, opts) =>
-  h.sshurl && !(h.https && (h.auth || h.default === 'https')) && addGitPlus(h.sshurl(opts)) ||
+  h.sshurl && !(h.https && h.auth) && addGitPlus(h.sshurl(opts)) ||
   h.https && addGitPlus(h.https(opts))
 
 // add git+ to the url, but only one time.
@@ -171,11 +171,6 @@ class GitFetcher extends Fetcher {
         return
       }
 
-      // honor ignoreScripts: spawning `npm install` here would run lifecycle scripts (install, preinstall, postinstall, prepare) from the cloned repo, defeating the caller's explicit opt-out.
-      if (this.opts.ignoreScripts) {
-        return
-      }
-
       // to avoid cases where we have an cycle of git deps that depend
       // on one another, we only ever do preparation for one instance
       // of a given git dep along the chain of installations.
@@ -259,11 +254,8 @@ class GitFetcher extends Fetcher {
           resolved: this.resolved,
           integrity: null, // it'll always be different, if we have one
         }).extract(tmp).then(() => handler(`${tmp}${this.spec.gitSubdir || ''}`), er => {
-          // fall back to clone if the tarball download fails due to an
-          // HTTP error or if the response is not a valid tarball (e.g.
-          // a hosted provider returning an HTML sign-in page with 200)
-          if ((typeof er.statusCode === 'number' && er.statusCode >= 400) ||
-              /^TAR_/.test(er.code)) {
+          // fall back to ssh download if tarball fails
+          if (er.constructor.name.match(/^Http/)) {
             return this.#clone(handler, false)
           } else {
             throw er

package/node_modules/pacote/lib/util/add-git-sha.js

@@ -3,7 +3,7 @@ const addGitSha = (spec, sha) => {
   if (spec.hosted) {
     const h = spec.hosted
     const opt = { noCommittish: true }
-    const base = h.https && (h.auth || h.default === 'https') ? h.https(opt) : h.shortcut(opt)
+    const base = h.https && h.auth ? h.https(opt) : h.shortcut(opt)
 
     return `${base}#${sha}`
   } else {

package/node_modules/pacote/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "22.0.0",
+  "version": "21.5.1",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -27,9 +27,9 @@
   },
   "devDependencies": {
     "@npmcli/arborist": "^9.0.2",
-    "@npmcli/eslint-config": "^7.0.0",
+    "@npmcli/eslint-config": "^6.0.0",
     "@npmcli/template-oss": "5.1.0",
-    "hosted-git-info": "^10.1.1",
+    "hosted-git-info": "^9.0.0",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
     "npm-registry-mock": "^1.3.2",
@@ -47,25 +47,25 @@
   ],
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",
-    "@npmcli/git": "^8.0.0",
-    "@npmcli/installed-package-contents": "^5.0.0",
-    "@npmcli/package-json": "^8.0.0",
-    "@npmcli/promise-spawn": "^10.0.0",
-    "@npmcli/run-script": "^11.0.0",
-    "cacache": "^21.0.1",
+    "@npmcli/git": "^7.0.0",
+    "@npmcli/installed-package-contents": "^4.0.0",
+    "@npmcli/package-json": "^7.0.0",
+    "@npmcli/promise-spawn": "^9.0.0",
+    "@npmcli/run-script": "^10.0.0",
+    "cacache": "^20.0.0",
     "fs-minipass": "^3.0.0",
     "minipass": "^7.0.2",
-    "npm-package-arg": "^14.0.0",
-    "npm-packlist": "^11.2.0",
-    "npm-pick-manifest": "^12.0.0",
-    "npm-registry-fetch": "^20.0.1",
-    "proc-log": "^7.0.0",
-    "sigstore": "^5.0.0",
-    "ssri": "^14.0.0",
+    "npm-package-arg": "^13.0.0",
+    "npm-packlist": "^10.0.1",
+    "npm-pick-manifest": "^11.0.1",
+    "npm-registry-fetch": "^19.0.0",
+    "proc-log": "^6.0.0",
+    "sigstore": "^4.0.0",
+    "ssri": "^13.0.0",
     "tar": "^7.4.3"
   },
   "engines": {
-    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
+    "node": "^20.17.0 || >=22.9.0"
   },
   "repository": {
     "type": "git",
@@ -75,7 +75,6 @@
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
     "version": "5.1.0",
     "windowsCI": false,
-    "publish": "true",
-    "updateNpm": false
+    "publish": "true"
   }
 }