pacote 13.1.0 → 13.3.0

package/lib/fetcher.js

@@ -105,8 +105,15 @@ class FetcherBase {
       this[_readPackageJson] = readPackageJsonFast
     }
 
-    // config values: npmjs (default), never
-    this.replaceRegistryHost = opts.replaceRegistryHost === 'never' ? 'never' : 'npmjs'
+    // config values: npmjs (default), never, always
+    // we don't want to mutate the original value
+    if (opts.replaceRegistryHost !== 'never'
+      && opts.replaceRegistryHost !== 'always'
+    ) {
+      this.replaceRegistryHost = 'npmjs'
+    } else {
+      this.replaceRegistryHost = opts.replaceRegistryHost
+    }
 
     this.defaultTag = opts.defaultTag || 'latest'
     this.registry = removeTrailingSlashes(opts.registry || 'https://registry.npmjs.org')

package/lib/registry.js

@@ -165,6 +165,9 @@ class RegistryFetcher extends Fetcher {
         }
         if (this.integrity) {
           mani._integrity = String(this.integrity)
+          if (dist.signatures) {
+            mani._signatures = dist.signatures
+          }
         }
         this.package = rpj.normalize(mani)
         return this.package

package/lib/remote.js

@@ -5,7 +5,7 @@ const pacoteVersion = require('../package.json').version
 const fetch = require('npm-registry-fetch')
 const Minipass = require('minipass')
 // The default registry URL is a string of great magic.
-const magic = /^https?:\/\/registry\.npmjs\.org\//
+const magicHost = 'https://registry.npmjs.org'
 
 const _cacheFetches = Symbol.for('pacote.Fetcher._cacheFetches')
 const _headers = Symbol('_headers')
@@ -13,10 +13,13 @@ class RemoteFetcher extends Fetcher {
   constructor (spec, opts) {
     super(spec, opts)
     this.resolved = this.spec.fetchSpec
-    if (this.replaceRegistryHost === 'npmjs'
-      && magic.test(this.resolved)
-      && !magic.test(this.registry + '/')) {
-      this.resolved = this.resolved.replace(magic, this.registry + '/')
+    const resolvedURL = new URL(this.resolved)
+    if (
+      (this.replaceRegistryHost === 'npmjs'
+        && resolvedURL.origin === magicHost)
+      || this.replaceRegistryHost === 'always'
+    ) {
+      this.resolved = new URL(resolvedURL.pathname, this.registry).href
     }
 
     // nam is a fermented pork sausage that is good to eat

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "13.1.0",
+  "version": "13.3.0",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -26,11 +26,11 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.2.2",
+    "@npmcli/template-oss": "3.4.3",
     "hosted-git-info": "^5.0.0",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
-    "npm-registry-mock": "^1.3.1",
+    "npm-registry-mock": "^1.3.2",
     "tap": "^16.0.1"
   },
   "files": [
@@ -54,7 +54,7 @@
     "minipass": "^3.1.6",
     "mkdirp": "^1.0.4",
     "npm-package-arg": "^9.0.0",
-    "npm-packlist": "^4.0.0",
+    "npm-packlist": "^5.0.0",
     "npm-pick-manifest": "^7.0.0",
     "npm-registry-fetch": "^13.0.1",
     "proc-log": "^2.0.0",
@@ -74,7 +74,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.2.2",
+    "version": "3.4.3",
     "windowsCI": false
   }
 }