pacote 11.1.12 → 11.2.1

package/README.md

@@ -162,6 +162,11 @@ resolved, and other properties, as they are determined.
   including information not strictly required for installation (author,
   description, etc.)  Defaults to `true` when `before` is set, since the
   version publish time is part of the extended packument metadata.
+* `packumentCache` For registry packuments only, you may provide a `Map`
+  object which will be used to cache packument requests between pacote
+  calls.  This allows you to easily avoid hitting the registry multiple
+  times (even just to validate the cache) for a given packument, since it
+  is unlikely to change in the span of a single command.
 
 ## Extracted File Modes
 

package/lib/fetcher.js

@@ -60,6 +60,7 @@ class FetcherBase {
     // clone the opts object so that others aren't upset when we mutate it
     // by adding/modifying the integrity value.
     this.opts = {...opts}
+
     this.cache = opts.cache || cacheDir()
     this.resolved = opts.resolved || null
 
@@ -75,7 +76,12 @@ class FetcherBase {
     this.type = this.constructor.name
     this.fmode = opts.fmode || 0o666
     this.dmode = opts.dmode || 0o777
-    this.umask = opts.umask || 0o022
+    // we don't need a default umask, because we don't chmod files coming
+    // out of package tarballs.  they're forced to have a mode that is
+    // valid, regardless of what's in the tarball entry, and then we let
+    // the process's umask setting do its job.  but if configured, we do
+    // respect it.
+    this.umask = opts.umask || 0
     this.log = opts.log || procLog
 
     this.preferOnline = !!opts.preferOnline
@@ -91,18 +97,11 @@ class FetcherBase {
 
     // command to run 'prepare' scripts on directories and git dirs
     // To use pacote with yarn, for example, set npmBin to 'yarn'
-    // and npmInstallCmd to ['add'], and npmCliConfig with yarn's equivalents.
+    // and npmCliConfig with yarn's equivalents.
     this.npmBin = opts.npmBin || 'npm'
 
     // command to install deps for preparing
-    this.npmInstallCmd = opts.npmInstallCmd || [
-      'install',
-      '--only=dev',
-      '--prod',
-      '--ignore-prepublish',
-      '--no-progress',
-      '--no-save',
-    ]
+    this.npmInstallCmd = opts.npmInstallCmd || [ 'install' ]
 
     // XXX fill more of this in based on what we know from this.opts
     // we explicitly DO NOT fill in --tag, though, since we are often
@@ -113,7 +112,10 @@ class FetcherBase {
       `--prefer-offline=${!!this.preferOffline}`,
       `--prefer-online=${!!this.preferOnline}`,
       `--offline=${!!this.offline}`,
-      `--before=${this.before ? this.before.toISOString() : ''}`,
+      ...(this.before ? [`--before=${this.before.toISOString()}`] : []),
+      '--no-progress',
+      '--no-save',
+      '--no-audit',
     ]
   }
 
@@ -294,7 +296,7 @@ class FetcherBase {
     return cacache.rm.content(this.cache, this.integrity, this.opts)
   }
 
-  [_chown] (path, uid, gid) {
+  async [_chown] (path, uid, gid) {
     return selfOwner && (selfOwner.gid !== gid || selfOwner.uid !== uid)
       ? chownr(path, uid, gid)
       : /* istanbul ignore next - we don't test in root-owned folders */ null
@@ -392,13 +394,15 @@ class FetcherBase {
 
     // make sure package bins are executable
     const exe = isPackageBin(this.package, path) ? 0o111 : 0
-    return ((mode | m) & ~this.umask) | exe
+    // always ensure that files are read/writable by the owner
+    return ((mode | m) & ~this.umask) | exe | 0o600
   }
 
   [_tarxOptions] ({ cwd, uid, gid }) {
     const sawIgnores = new Set()
     return {
       cwd,
+      noChmod: true,
       filter: (name, entry) => {
         if (/Link$/.test(entry.type))
           return false

package/lib/registry.js

@@ -20,6 +20,14 @@ class RegistryFetcher extends Fetcher {
   constructor (spec, opts) {
     super(spec, opts)
 
+    // you usually don't want to fetch the same packument multiple times in
+    // the span of a given script or command, no matter how many pacote calls
+    // are made, so this lets us avoid doing that.  It's only relevant for
+    // registry fetchers, because other types simulate their packument from
+    // the manifest, which they memoize on this.package, so it's very cheap
+    // already.
+    this.packumentCache = this.opts.packumentCache || null
+
     // handle case when npm-package-arg guesses wrong.
     if (this.spec.type === 'tag' &&
         this.spec.rawSpec === '' &&
@@ -64,11 +72,17 @@ class RegistryFetcher extends Fetcher {
     }
   }
 
-  packument () {
+  async packument () {
+    // note this might be either an in-flight promise for a request,
+    // or the actual packument, but we never want to make more than
+    // one request at a time for the same thing regardless.
+    if (this.packumentCache && this.packumentCache.has(this.packumentUrl))
+      return this.packumentCache.get(this.packumentUrl)
+
     // npm-registry-fetch the packument
     // set the appropriate header for corgis if fullMetadata isn't set
     // return the res.json() promise
-    return fetch(this.packumentUrl, {
+    const p = fetch(this.packumentUrl, {
       ...this.opts,
       headers: this[_headers](),
       spec: this.spec,
@@ -77,8 +91,12 @@ class RegistryFetcher extends Fetcher {
     }).then(res => res.json().then(packument => {
       packument._cached = res.headers.has('x-local-cache')
       packument._contentLength = +res.headers.get('content-length')
+      if (this.packumentCache)
+        this.packumentCache.set(this.packumentUrl, packument)
       return packument
     })).catch(er => {
+      if (this.packumentCache)
+        this.packumentCache.delete(this.packumentUrl)
       if (er.code === 'E404' && !this.fullMetadata) {
         // possible that corgis are not supported by this registry
         this.fullMetadata = true
@@ -86,6 +104,9 @@ class RegistryFetcher extends Fetcher {
       }
       throw er
     })
+    if (this.packumentCache)
+      this.packumentCache.set(this.packumentUrl, p)
+    return p
   }
 
   manifest () {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "11.1.12",
+  "version": "11.2.1",
   "description": "JavaScript package downloader",
   "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",
   "bin": {
@@ -13,7 +13,7 @@
     "snap": "tap",
     "preversion": "npm test",
     "postversion": "npm publish",
-    "postpublish": "git push origin --follow-tags"
+    "prepublishOnly": "git push origin --follow-tags"
   },
   "tap": {
     "timeout": 300,
@@ -47,14 +47,14 @@
     "minipass": "^3.1.3",
     "mkdirp": "^1.0.3",
     "npm-package-arg": "^8.0.1",
-    "npm-packlist": "^2.1.0",
+    "npm-packlist": "^2.1.4",
     "npm-pick-manifest": "^6.0.0",
     "npm-registry-fetch": "^9.0.0",
     "promise-retry": "^1.1.1",
     "read-package-json-fast": "^1.1.3",
     "rimraf": "^3.0.2",
     "ssri": "^8.0.0",
-    "tar": "^6.0.1"
+    "tar": "^6.1.0"
   },
   "engines": {
     "node": ">=10"