pacote 21.0.3 → 21.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +99 -141
- package/lib/fetcher.js +20 -0
- package/package.json +8 -8
package/README.md
CHANGED
|
@@ -21,24 +21,19 @@ pacote.tarball('https://server.com/package.tgz').then(data => {
|
|
|
21
21
|
})
|
|
22
22
|
```
|
|
23
23
|
|
|
24
|
-
`pacote` works with any kind of package specifier that npm can install.
|
|
25
|
-
you can pass it to the npm CLI, you can pass it to pacote.
|
|
26
|
-
exactly what the npm CLI does.)
|
|
24
|
+
`pacote` works with any kind of package specifier that npm can install.
|
|
25
|
+
If you can pass it to the npm CLI, you can pass it to pacote.
|
|
26
|
+
(In fact, that's exactly what the npm CLI does.)
|
|
27
27
|
|
|
28
28
|
Anything that you can do with one kind of package, you can do with another.
|
|
29
29
|
|
|
30
|
-
Data that isn't relevant (like a packument for a tarball) will be
|
|
31
|
-
simulated.
|
|
30
|
+
Data that isn't relevant (like a packument for a tarball) will be simulated.
|
|
32
31
|
|
|
33
|
-
`prepare` scripts will be run when generating tarballs from `git` and
|
|
34
|
-
`directory` locations, to simulate what _would_ be published to the
|
|
35
|
-
registry, so that you get a working package instead of just raw source
|
|
36
|
-
code that might need to be transpiled.
|
|
32
|
+
`prepare` scripts will be run when generating tarballs from `git` and `directory` locations, to simulate what _would_ be published to the registry, so that you get a working package instead of just raw source code that might need to be transpiled.
|
|
37
33
|
|
|
38
34
|
## CLI
|
|
39
35
|
|
|
40
|
-
This module exports a command line interface that can do most of what is
|
|
41
|
-
described below. Run `pacote -h` to learn more.
|
|
36
|
+
This module exports a command line interface that can do most of what is described below. Run `pacote -h` to learn more.
|
|
42
37
|
|
|
43
38
|
```
|
|
44
39
|
Pacote - The JavaScript Package Handler, v10.1.1
|
|
@@ -75,112 +70,96 @@ For example '--cache=/path/to/folder' will use that folder as the cache.
|
|
|
75
70
|
|
|
76
71
|
## API
|
|
77
72
|
|
|
78
|
-
The `spec` refers to any kind of package specifier that npm can install.
|
|
79
|
-
If you can pass it to the npm CLI, you can pass it to pacote. (In fact,
|
|
80
|
-
that's exactly what the npm CLI does.)
|
|
73
|
+
The `spec` refers to any kind of [package specifier](npm.im/npm-package-arg) that npm can install.
|
|
81
74
|
|
|
82
75
|
See below for valid `opts` values.
|
|
83
76
|
|
|
84
|
-
* `pacote.resolve(spec, opts)` Resolve a specifier like `foo@latest` or
|
|
85
|
-
`github:user/project` all the way to a tarball url, tarball file, or git
|
|
86
|
-
repo with commit hash.
|
|
77
|
+
* `pacote.resolve(spec, opts)` Resolve a specifier like `foo@latest` or `github:user/project` all the way to a tarball url, tarball file, or git repo with commit hash.
|
|
87
78
|
|
|
88
|
-
* `pacote.extract(spec, dest, opts)` Extract a package's tarball into a
|
|
89
|
-
|
|
90
|
-
`{from,resolved,integrity}` of the extracted package.
|
|
79
|
+
* `pacote.extract(spec, dest, opts)` Extract a package's tarball into a destination folder.
|
|
80
|
+
Returns a promise that resolves to the `{from,resolved,integrity}` of the extracted package.
|
|
91
81
|
|
|
92
|
-
* `pacote.manifest(spec, opts)` Fetch (or simulate) a package's manifest
|
|
93
|
-
|
|
94
|
-
|
|
95
|
-
resolves to the manifest object.
|
|
82
|
+
* `pacote.manifest(spec, opts)` Fetch (or simulate) a package's manifest (basically, the `package.json` file, plus a bit of metadata).
|
|
83
|
+
See below for more on manifests and packuments.
|
|
84
|
+
Returns a Promise that resolves to the manifest object.
|
|
96
85
|
|
|
97
|
-
* `pacote.packument(spec, opts)` Fetch (or simulate) a package's packument
|
|
98
|
-
|
|
99
|
-
the registry returns). See below for more on manifests and packuments.
|
|
86
|
+
* `pacote.packument(spec, opts)` Fetch (or simulate) a package's packument (basically, the top-level package document listing all the manifests that the registry returns).
|
|
87
|
+
See below for more on manifests and packuments.
|
|
100
88
|
Returns a Promise that resolves to the packument object.
|
|
101
89
|
|
|
102
90
|
* `pacote.tarball(spec, opts)` Get a package tarball data as a buffer in
|
|
103
|
-
memory.
|
|
104
|
-
`from`, `resolved`, and `integrity` fields attached.
|
|
91
|
+
memory.
|
|
92
|
+
Returns a Promise that resolves to the tarball data Buffer, with `from`, `resolved`, and `integrity` fields attached.
|
|
105
93
|
|
|
106
|
-
* `pacote.tarball.file(spec, dest, opts)` Save a package tarball data to
|
|
107
|
-
|
|
108
|
-
`{from,integrity,resolved}` of the fetched tarball.
|
|
94
|
+
* `pacote.tarball.file(spec, dest, opts)` Save a package tarball data to a file on disk.
|
|
95
|
+
Returns a Promise that resolves to `{from,integrity,resolved}` of the fetched tarball.
|
|
109
96
|
|
|
110
|
-
* `pacote.tarball.stream(spec, streamHandler, opts)` Fetch a tarball and
|
|
111
|
-
make the stream available to the `streamHandler` function.
|
|
97
|
+
* `pacote.tarball.stream(spec, streamHandler, opts)` Fetch a tarball and make the stream available to the `streamHandler` function.
|
|
112
98
|
|
|
113
|
-
This is mostly an internal function, but it is exposed because it does
|
|
114
|
-
provide some functionality that may be difficult to achieve otherwise.
|
|
99
|
+
This is mostly an internal function, but it is exposed because it does provide some functionality that may be difficult to achieve otherwise.
|
|
115
100
|
|
|
116
|
-
The `streamHandler` function MUST return a Promise that resolves when
|
|
117
|
-
the stream (and all associated work) is ended, or rejects if the stream
|
|
101
|
+
The `streamHandler` function MUST return a Promise that resolves when the stream (and all associated work) is ended, or rejects if the stream
|
|
118
102
|
has an error.
|
|
119
103
|
|
|
120
|
-
The `streamHandler` function MAY be called multiple times, as Pacote
|
|
121
|
-
retries requests in some scenarios, such as cache corruption or
|
|
122
|
-
retriable network failures.
|
|
104
|
+
The `streamHandler` function MAY be called multiple times, as Pacote retries requests in some scenarios, such as cache corruption or retriable network failures.
|
|
123
105
|
|
|
124
106
|
### Options
|
|
125
107
|
|
|
126
108
|
Options are passed to
|
|
127
|
-
[`npm-registry-fetch`](http://npm.im/npm-registry-fetch) and
|
|
128
|
-
[`cacache`](http://npm.im/cacache), so in addition to these, anything for
|
|
129
|
-
those modules can be given to pacote as well.
|
|
109
|
+
[`npm-registry-fetch`](http://npm.im/npm-registry-fetch) and [`cacache`](http://npm.im/cacache), so in addition to these, anything for those modules can be given to pacote as well.
|
|
130
110
|
|
|
131
|
-
Options object is cloned, and mutated along the way to add integrity,
|
|
132
|
-
resolved, and other properties, as they are determined.
|
|
111
|
+
Options object is cloned, and mutated along the way to add integrity, resolved, and other properties, as they are determined.
|
|
133
112
|
|
|
134
|
-
* `cache` Where to store cache entries and temp files.
|
|
135
|
-
[`cacache`](http://npm.im/cacache).
|
|
136
|
-
that npm will use by default, based on platform and environment.
|
|
113
|
+
* `cache` Where to store cache entries and temp files.
|
|
114
|
+
Passed to [`cacache`](http://npm.im/cacache).
|
|
115
|
+
Defaults to the same cache directory that npm will use by default, based on platform and environment.
|
|
137
116
|
* `where` Base folder for resolving relative `file:` dependencies.
|
|
138
|
-
* `resolved` Shortcut for looking up resolved values. Should be specified
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
tarballs with mismatched integrity values will raise an `EINTEGRITY`
|
|
142
|
-
error.
|
|
117
|
+
* `resolved` Shortcut for looking up resolved values. Should be specified if known.
|
|
118
|
+
* `integrity` Expected integrity of fetched package tarball.
|
|
119
|
+
If specified, tarballs with mismatched integrity values will raise an `EINTEGRITY` error.
|
|
143
120
|
* `umask` Permission mode mask for extracted files and directories.
|
|
144
|
-
Defaults to `0o22`.
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
* `
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
|
|
154
|
-
|
|
155
|
-
|
|
156
|
-
|
|
157
|
-
|
|
158
|
-
|
|
159
|
-
|
|
160
|
-
|
|
161
|
-
|
|
162
|
-
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
167
|
-
|
|
168
|
-
is
|
|
169
|
-
* `
|
|
170
|
-
|
|
171
|
-
|
|
172
|
-
|
|
173
|
-
* `
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
121
|
+
Defaults to `0o22`.
|
|
122
|
+
See "Extracted File Modes" below.
|
|
123
|
+
* `fmode` Minimum permission mode for extracted files.
|
|
124
|
+
Defaults to `0o666`.
|
|
125
|
+
See "Extracted File Modes" below.
|
|
126
|
+
* `dmode` Minimum permission mode for extracted directories.
|
|
127
|
+
Defaults to `0o777`.
|
|
128
|
+
See "Extracted File Modes" below.
|
|
129
|
+
* `preferOnline` Prefer to revalidate cache entries, even when it would not be strictly necessary.
|
|
130
|
+
Defaults to `false`.
|
|
131
|
+
* `before` When picking a manifest from a packument, only consider packages published before the specified date.
|
|
132
|
+
Defaults to `null`.
|
|
133
|
+
* `defaultTag` The default `dist-tag` to use when choosing a manifest from a packument.
|
|
134
|
+
Defaults to `latest`.
|
|
135
|
+
* `registry` The npm registry to use by default.
|
|
136
|
+
Defaults to `https://registry.npmjs.org/`.
|
|
137
|
+
* `fullMetadata` Fetch the full metadata from the registry for packuments, including information not strictly required for installation (author, description, etc.).
|
|
138
|
+
Defaults to `true` when `before` is set, since the version publish time is part of the extended packument metadata.
|
|
139
|
+
Otherwise defaults to `false`.
|
|
140
|
+
* `fullReadJson` Use the slower `read-package-json` package insted of `read-package-json-fast` in order to include extra fields like "readme" in the manifest.
|
|
141
|
+
Defaults to `false`.
|
|
142
|
+
* `packumentCache` For registry packuments only, you may provide a `Map` object which will be used to cache packument requests between pacote calls.
|
|
143
|
+
This allows you to easily avoid hitting the registry multiple times (even just to validate the cache) for a given packument, since it is unlikely to change in the span of a single command.
|
|
144
|
+
* `verifySignatures` A boolean that will make pacote verify the integrity signature of a manifest, if present.
|
|
145
|
+
There must be a configured `_keys` entry in the config that is scoped to the registry the manifest is being fetched from.
|
|
146
|
+
* `verifyAttestations` A boolean that will make pacote verify Sigstore attestations, if present.
|
|
147
|
+
There must be a configured `_keys` entry in the config that is scoped to the registry the manifest is being fetched from.
|
|
148
|
+
* `tufCache` Where to store metadata/target files when retrieving the package attestation key material via TUF.
|
|
149
|
+
Defaults to the same cache directory that npm will use by default, based on platform and environment.
|
|
150
|
+
* `allowGit` Whether or not to allow data to be fetched from git.
|
|
151
|
+
Possible values are `all`, `none`, or `root`.
|
|
152
|
+
Defaults to `all`.
|
|
153
|
+
`all` means git is allowed
|
|
154
|
+
`none` means git is not allowed
|
|
155
|
+
`root` means that git is only allowed if fetching from a root context.
|
|
156
|
+
Context for whether or not the package being fetched is `root` is set via the `_isRoot` option.
|
|
157
|
+
* `_isRoot` Whether or not the package being fetched is in a root context.
|
|
158
|
+
For `npm` itself this means a package that is defined in the local project or workspace package.json, or a package that is being fetched for another command like `npm view`.
|
|
179
159
|
|
|
180
160
|
### Advanced API
|
|
181
161
|
|
|
182
|
-
Each different type of fetcher is exposed for more advanced usage such as
|
|
183
|
-
using helper methods from this classes:
|
|
162
|
+
Each different type of fetcher is exposed for more advanced usage such as using helper methods from this classes:
|
|
184
163
|
|
|
185
164
|
* `DirFetcher`
|
|
186
165
|
* `FileFetcher`
|
|
@@ -196,87 +175,66 @@ Files are extracted with a mode matching the following formula:
|
|
|
196
175
|
( (tarball entry mode value) | (minimum mode option) ) ~ (umask)
|
|
197
176
|
```
|
|
198
177
|
|
|
199
|
-
This is in order to prevent unreadable files or unlistable directories from
|
|
200
|
-
cluttering a project's `node_modules` folder, even if the package tarball
|
|
201
|
-
specifies that the file should be inaccessible.
|
|
178
|
+
This is in order to prevent unreadable files or unlistable directories from cluttering a project's `node_modules` folder, even if the package tarball specifies that the file should be inaccessible.
|
|
202
179
|
|
|
203
|
-
It also prevents files from being group- or world-writable without explicit
|
|
204
|
-
opt-in by the user, because all file and directory modes are masked against
|
|
205
|
-
the `umask` value.
|
|
180
|
+
It also prevents files from being group- or world-writable without explicit opt-in by the user, because all file and directory modes are masked against the `umask` value.
|
|
206
181
|
|
|
207
|
-
So, a file which is `0o771` in the tarball, using the default `fmode` of
|
|
208
|
-
`0o666` and `umask` of `0o22`, will result in a file mode of `0o755`:
|
|
182
|
+
So, a file which is `0o771` in the tarball, using the default `fmode` of `0o666` and `umask` of `0o22`, will result in a file mode of `0o755`:
|
|
209
183
|
|
|
210
184
|
```
|
|
211
185
|
(0o771 | 0o666) => 0o777
|
|
212
186
|
(0o777 ~ 0o22) => 0o755
|
|
213
187
|
```
|
|
214
188
|
|
|
215
|
-
In almost every case, the defaults are appropriate.
|
|
216
|
-
what is in the package tarball (even if this makes an unusable system), set
|
|
217
|
-
|
|
218
|
-
should be used in most cases where file mode modifications are required,
|
|
219
|
-
and this functions more or less the same as the `umask` value in most Unix
|
|
220
|
-
systems.
|
|
189
|
+
In almost every case, the defaults are appropriate.
|
|
190
|
+
To respect exactly what is in the package tarball (even if this makes an unusable system), set both `dmode` and `fmode` options to `0`.
|
|
191
|
+
Otherwise, the `umask` config should be used in most cases where file mode modifications are required, and this functions more or less the same as the `umask` value in most Unix systems.
|
|
221
192
|
|
|
222
193
|
## Extracted File Ownership
|
|
223
194
|
|
|
224
|
-
When running as `root` on Unix systems, all extracted files and folders
|
|
225
|
-
will have their owning `uid` and `gid` values set to match the ownership
|
|
226
|
-
of the containing folder.
|
|
195
|
+
When running as `root` on Unix systems, all extracted files and folders will have their owning `uid` and `gid` values set to match the ownership of the containing folder.
|
|
227
196
|
|
|
228
|
-
This prevents `root`-owned files showing up in a project's `node_modules`
|
|
229
|
-
folder when a user runs `sudo npm install`.
|
|
197
|
+
This prevents `root`-owned files showing up in a project's `node_modules` folder when a user runs `sudo npm install`.
|
|
230
198
|
|
|
231
199
|
## Manifests
|
|
232
200
|
|
|
233
|
-
A `manifest` is similar to a `package.json` file.
|
|
234
|
-
pieces of extra metadata, and sometimes lacks metadata that is inessential
|
|
235
|
-
to package installation.
|
|
201
|
+
A `manifest` is similar to a `package.json` file.
|
|
202
|
+
However, it has a few pieces of extra metadata, and sometimes lacks metadata that is inessential to package installation.
|
|
236
203
|
|
|
237
204
|
In addition to the common `package.json` fields, manifests include:
|
|
238
205
|
|
|
239
|
-
* `manifest._resolved` The tarball url or file path where the package
|
|
240
|
-
artifact can be found.
|
|
206
|
+
* `manifest._resolved` The tarball url or file path where the package artifact can be found.
|
|
241
207
|
* `manifest._from` A normalized form of the spec passed in as an argument.
|
|
242
208
|
* `manifest._integrity` The integrity value for the package artifact.
|
|
243
209
|
* `manifest._id` The canonical spec of this package version: name@version.
|
|
244
|
-
* `manifest.dist` Registry manifests (those included in a packument) have a
|
|
245
|
-
|
|
246
|
-
|
|
247
|
-
|
|
248
|
-
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
to `manifest._integrity`.)
|
|
210
|
+
* `manifest.dist` Registry manifests (those included in a packument) have a `dist` object.
|
|
211
|
+
Only `tarball` is required, though at least one of `shasum` or `integrity` is almost always present.
|
|
212
|
+
|
|
213
|
+
* `tarball` The url to the associated package artifact.
|
|
214
|
+
(Copied by Pacote to `manifest._resolved`.)
|
|
215
|
+
* `integrity` The integrity SRI string for the artifact.
|
|
216
|
+
This may not be present for older packages on the npm registry.
|
|
217
|
+
(Copied by Pacote to `manifest._integrity`.)
|
|
253
218
|
* `shasum` Legacy integrity value. Hexadecimal-encoded sha1 hash.
|
|
254
|
-
(Converted to an SRI string and copied by Pacote to
|
|
255
|
-
`manifest._integrity` when `dist.integrity` is not present.)
|
|
219
|
+
(Converted to an SRI string and copied by Pacote to `manifest._integrity` when `dist.integrity` is not present.)
|
|
256
220
|
* `fileCount` Number of files in the tarball.
|
|
257
221
|
* `unpackedSize` Size on disk of the package when unpacked.
|
|
258
|
-
* `signatures` Signatures of the shasum.
|
|
259
|
-
|
|
260
|
-
registry`](https://registry.npmjs.org/-/npm/v1/keys)
|
|
222
|
+
* `signatures` Signatures of the shasum.
|
|
223
|
+
Includes the keyid that correlates to a [`key from the npm registry`](https://registry.npmjs.org/-/npm/v1/keys)
|
|
261
224
|
|
|
262
225
|
## Packuments
|
|
263
226
|
|
|
264
|
-
A packument is the top-level package document that lists the set of
|
|
265
|
-
manifests for available versions for a package.
|
|
227
|
+
A packument is the top-level package document that lists the set of manifests for available versions for a package.
|
|
266
228
|
|
|
267
|
-
When a packument is fetched with `accept:
|
|
268
|
-
|
|
269
|
-
minimum necessary metadata is returned. Additional metadata is returned
|
|
270
|
-
when fetched with only `accept: application/json`.
|
|
229
|
+
When a packument is fetched with `accept: application/vnd.npm.install-v1+json` in the HTTP headers, only the most minimum necessary metadata is returned.
|
|
230
|
+
Additional metadata is returned when fetched with only `accept: application/json`.
|
|
271
231
|
|
|
272
232
|
For Pacote's purposes, the following fields are relevant:
|
|
273
233
|
|
|
274
|
-
* `versions` An object where each key is a version, and each value is the
|
|
275
|
-
|
|
276
|
-
|
|
277
|
-
|
|
278
|
-
* `time` In the full packument, an object mapping version numbers to
|
|
279
|
-
publication times, for the `opts.before` functionality.
|
|
234
|
+
* `versions` An object where each key is a version, and each value is the manifest for that version.
|
|
235
|
+
* `dist-tags` An object mapping dist-tags to version numbers.
|
|
236
|
+
This is how `foo@latest` gets turned into `foo@1.2.3`.
|
|
237
|
+
* `time` In the full packument, an object mapping version numbers to publication times, for the `opts.before` functionality.
|
|
280
238
|
|
|
281
239
|
Pacote adds the following field, regardless of the accept header:
|
|
282
240
|
|
package/lib/fetcher.js
CHANGED
|
@@ -469,11 +469,31 @@ const FileFetcher = require('./file.js')
|
|
|
469
469
|
const DirFetcher = require('./dir.js')
|
|
470
470
|
const RemoteFetcher = require('./remote.js')
|
|
471
471
|
|
|
472
|
+
// possible values for allow: 'all', 'root', 'none'
|
|
473
|
+
const canUseGit = (allow = 'all', isRoot = false) => {
|
|
474
|
+
if (allow === 'all') {
|
|
475
|
+
return true
|
|
476
|
+
}
|
|
477
|
+
if (allow !== 'none' && isRoot) {
|
|
478
|
+
return true
|
|
479
|
+
}
|
|
480
|
+
return false
|
|
481
|
+
}
|
|
482
|
+
|
|
472
483
|
// Get an appropriate fetcher object from a spec and options
|
|
473
484
|
FetcherBase.get = (rawSpec, opts = {}) => {
|
|
474
485
|
const spec = npa(rawSpec, opts.where)
|
|
475
486
|
switch (spec.type) {
|
|
476
487
|
case 'git':
|
|
488
|
+
if (!canUseGit(opts.allowGit, opts._isRoot)) {
|
|
489
|
+
throw Object.assign(
|
|
490
|
+
new Error(`Fetching${opts.allowGit === 'root' ? ' non-root' : ''} packages from git has been disabled`),
|
|
491
|
+
{
|
|
492
|
+
code: 'EALLOWGIT',
|
|
493
|
+
package: spec.toString(),
|
|
494
|
+
}
|
|
495
|
+
)
|
|
496
|
+
}
|
|
477
497
|
return new GitFetcher(spec, opts)
|
|
478
498
|
|
|
479
499
|
case 'remote':
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "pacote",
|
|
3
|
-
"version": "21.0
|
|
3
|
+
"version": "21.1.0",
|
|
4
4
|
"description": "JavaScript package downloader",
|
|
5
5
|
"author": "GitHub Inc.",
|
|
6
6
|
"bin": {
|
|
@@ -27,8 +27,8 @@
|
|
|
27
27
|
},
|
|
28
28
|
"devDependencies": {
|
|
29
29
|
"@npmcli/arborist": "^9.0.2",
|
|
30
|
-
"@npmcli/eslint-config": "^
|
|
31
|
-
"@npmcli/template-oss": "4.
|
|
30
|
+
"@npmcli/eslint-config": "^6.0.0",
|
|
31
|
+
"@npmcli/template-oss": "4.28.0",
|
|
32
32
|
"hosted-git-info": "^9.0.0",
|
|
33
33
|
"mutate-fs": "^2.1.1",
|
|
34
34
|
"nock": "^13.2.4",
|
|
@@ -47,9 +47,9 @@
|
|
|
47
47
|
],
|
|
48
48
|
"dependencies": {
|
|
49
49
|
"@npmcli/git": "^7.0.0",
|
|
50
|
-
"@npmcli/installed-package-contents": "^
|
|
50
|
+
"@npmcli/installed-package-contents": "^4.0.0",
|
|
51
51
|
"@npmcli/package-json": "^7.0.0",
|
|
52
|
-
"@npmcli/promise-spawn": "^
|
|
52
|
+
"@npmcli/promise-spawn": "^9.0.0",
|
|
53
53
|
"@npmcli/run-script": "^10.0.0",
|
|
54
54
|
"cacache": "^20.0.0",
|
|
55
55
|
"fs-minipass": "^3.0.0",
|
|
@@ -58,10 +58,10 @@
|
|
|
58
58
|
"npm-packlist": "^10.0.1",
|
|
59
59
|
"npm-pick-manifest": "^11.0.1",
|
|
60
60
|
"npm-registry-fetch": "^19.0.0",
|
|
61
|
-
"proc-log": "^
|
|
61
|
+
"proc-log": "^6.0.0",
|
|
62
62
|
"promise-retry": "^2.0.1",
|
|
63
63
|
"sigstore": "^4.0.0",
|
|
64
|
-
"ssri": "^
|
|
64
|
+
"ssri": "^13.0.0",
|
|
65
65
|
"tar": "^7.4.3"
|
|
66
66
|
},
|
|
67
67
|
"engines": {
|
|
@@ -73,7 +73,7 @@
|
|
|
73
73
|
},
|
|
74
74
|
"templateOSS": {
|
|
75
75
|
"//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
|
|
76
|
-
"version": "4.
|
|
76
|
+
"version": "4.28.0",
|
|
77
77
|
"windowsCI": false,
|
|
78
78
|
"publish": "true"
|
|
79
79
|
}
|