pacote 21.5.0 → 22.0.0

package/lib/dir.js

@@ -1,8 +1,11 @@
-const { resolve } = require('node:path')
+const { resolve, join } = require('node:path')
+const { mkdtemp, writeFile, rm } = require('node:fs/promises')
+const { tmpdir } = require('node:os')
 const packlist = require('npm-packlist')
 const runScript = require('@npmcli/run-script')
 const tar = require('tar')
 const { Minipass } = require('minipass')
+const PackageJson = require('@npmcli/package-json')
 const Fetcher = require('./fetcher.js')
 const FileFetcher = require('./file.js')
 const _ = require('./util/protected.js')
@@ -66,7 +69,7 @@ class DirFetcher extends Fetcher {
     stream.resolved = this.resolved
     stream.integrity = this.integrity
 
-    const { prefix, workspaces } = this.opts
+    const { prefix, workspaces, globalIgnoreFile } = this.opts
 
     // run the prepare script, get the list of files, and tar it up
     // pipe to the stream, and proxy errors the chain.
@@ -76,14 +79,66 @@ class DirFetcher extends Fetcher {
           const arb = new this.Arborist({ path: this.resolved })
           this.tree = await arb.loadActual()
         }
-        return packlist(this.tree, { path: this.resolved, prefix, workspaces })
+        return packlist(this.tree, { path: this.resolved, prefix, workspaces, globalIgnoreFile })
+      })
+      .then(async files => {
+        const { options, cleanup } = await this.#tarOptions()
+        const source = tar.c(options, files)
+        // the strip temp file must outlive content consumption, so clean up once the stream is done
+        source.once('end', cleanup)
+        source.once('error', cleanup)
+        return source.on('error', er => stream.emit('error', er)).pipe(stream)
       })
-      .then(files => tar.c(tarCreateOptions(this.package), files)
-        .on('error', er => stream.emit('error', er)).pipe(stream))
       .catch(er => stream.emit('error', er))
     return stream
   }
 
+  // Build the tar create options.
+  // When the packed package.json declares patchedDependencies, redirect it to a stripped copy so project-local patches never ship.
+  // Non-patched packs are unchanged.
+  async #tarOptions () {
+    const options = tarCreateOptions(this.package)
+
+    // read package.json from disk after prepare so the strip reflects the actually-packed manifest.
+    const pkgJson = await PackageJson.load(this.resolved)
+    if (!('patchedDependencies' in pkgJson.content)) {
+      return { options, cleanup: () => {} }
+    }
+
+    // serialize the package.json minus patchedDependencies, preserving its indent and newline.
+    // JSON.stringify ignores the indent and newline symbols @npmcli/package-json attaches to content.
+    delete pkgJson.content.patchedDependencies
+    const { content } = pkgJson
+    const indent = content[Symbol.for('indent')]
+    const newline = content[Symbol.for('newline')]
+    const stripped = `${JSON.stringify(content, null, indent)}\n`.replace(/\n/g, newline)
+
+    // write the stripped copy to a temp dir, removing it if the write itself fails.
+    const dir = await mkdtemp(join(tmpdir(), 'pacote-pack-'))
+    const strippedPath = join(dir, 'package.json')
+    try {
+      await writeFile(strippedPath, stripped)
+    } catch (er) {
+      /* istanbul ignore next - writing to a freshly created temp dir is not deterministically failable */
+      await rm(dir, { recursive: true, force: true })
+      /* istanbul ignore next */
+      throw er
+    }
+    const size = Buffer.byteLength(stripped)
+
+    // point only the top-level package.json entry at the stripped copy; every other file is untouched.
+    // onWriteEntry runs before the tar header and the file's hardlink check, so size and nlink here are honored.
+    options.onWriteEntry = (entry) => {
+      if (entry.path === 'package.json') {
+        entry.absolute = strippedPath
+        entry.stat.size = size
+        entry.stat.nlink = 1
+      }
+    }
+
+    return { options, cleanup: () => rm(dir, { recursive: true, force: true }) }
+  }
+
   manifest () {
     if (this.package) {
       return Promise.resolve(this.package)

package/lib/fetcher.js

@@ -118,6 +118,10 @@ class FetcherBase {
       // we need the actual things, not just the lockfile
       '--no-package-lock-only',
       '--no-dry-run',
+      // override npm_config_global from the parent process: this inner
+      // `npm install` is preparing deps inside a tmp git clone, and it
+      // must reify into that clone's cwd, never the outer global prefix.
+      '--global=false',
     ]
   }
 

package/lib/git.js

@@ -19,7 +19,7 @@ const hashre = /^[a-f0-9]{40,64}$/
 // otherwise, prefer ssh if available (more secure).
 // We have to add the git+ back because npa suppresses it.
 const repoUrl = (h, opts) =>
-  h.sshurl && !(h.https && h.auth) && addGitPlus(h.sshurl(opts)) ||
+  h.sshurl && !(h.https && (h.auth || h.default === 'https')) && addGitPlus(h.sshurl(opts)) ||
   h.https && addGitPlus(h.https(opts))
 
 // add git+ to the url, but only one time.
@@ -171,6 +171,11 @@ class GitFetcher extends Fetcher {
         return
       }
 
+      // honor ignoreScripts: spawning `npm install` here would run lifecycle scripts (install, preinstall, postinstall, prepare) from the cloned repo, defeating the caller's explicit opt-out.
+      if (this.opts.ignoreScripts) {
+        return
+      }
+
       // to avoid cases where we have an cycle of git deps that depend
       // on one another, we only ever do preparation for one instance
       // of a given git dep along the chain of installations.
@@ -254,8 +259,11 @@ class GitFetcher extends Fetcher {
           resolved: this.resolved,
           integrity: null, // it'll always be different, if we have one
         }).extract(tmp).then(() => handler(`${tmp}${this.spec.gitSubdir || ''}`), er => {
-          // fall back to ssh download if tarball fails
-          if (er.constructor.name.match(/^Http/)) {
+          // fall back to clone if the tarball download fails due to an
+          // HTTP error or if the response is not a valid tarball (e.g.
+          // a hosted provider returning an HTML sign-in page with 200)
+          if ((typeof er.statusCode === 'number' && er.statusCode >= 400) ||
+              /^TAR_/.test(er.code)) {
             return this.#clone(handler, false)
           } else {
             throw er

package/lib/util/add-git-sha.js

@@ -3,12 +3,15 @@ const addGitSha = (spec, sha) => {
   if (spec.hosted) {
     const h = spec.hosted
     const opt = { noCommittish: true }
-    const base = h.https && h.auth ? h.https(opt) : h.shortcut(opt)
+    const base = h.https && (h.auth || h.default === 'https') ? h.https(opt) : h.shortcut(opt)
 
     return `${base}#${sha}`
   } else {
     // don't use new URL for this, because it doesn't handle scp urls
-    return spec.rawSpec.replace(/#.*$/, '') + `#${sha}`
+    // strip the committish with indexOf/slice to avoid a regexp redos
+    const hashIndex = spec.rawSpec.indexOf('#')
+    const base = hashIndex === -1 ? spec.rawSpec : spec.rawSpec.slice(0, hashIndex)
+    return `${base}#${sha}`
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "21.5.0",
+  "version": "22.0.0",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -27,9 +27,9 @@
   },
   "devDependencies": {
     "@npmcli/arborist": "^9.0.2",
-    "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "4.29.0",
-    "hosted-git-info": "^9.0.0",
+    "@npmcli/eslint-config": "^7.0.0",
+    "@npmcli/template-oss": "5.1.0",
+    "hosted-git-info": "^10.1.1",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
     "npm-registry-mock": "^1.3.2",
@@ -47,25 +47,25 @@
   ],
   "dependencies": {
     "@gar/promise-retry": "^1.0.0",
-    "@npmcli/git": "^7.0.0",
-    "@npmcli/installed-package-contents": "^4.0.0",
-    "@npmcli/package-json": "^7.0.0",
-    "@npmcli/promise-spawn": "^9.0.0",
-    "@npmcli/run-script": "^10.0.0",
-    "cacache": "^20.0.0",
+    "@npmcli/git": "^8.0.0",
+    "@npmcli/installed-package-contents": "^5.0.0",
+    "@npmcli/package-json": "^8.0.0",
+    "@npmcli/promise-spawn": "^10.0.0",
+    "@npmcli/run-script": "^11.0.0",
+    "cacache": "^21.0.1",
     "fs-minipass": "^3.0.0",
     "minipass": "^7.0.2",
-    "npm-package-arg": "^13.0.0",
-    "npm-packlist": "^10.0.1",
-    "npm-pick-manifest": "^11.0.1",
-    "npm-registry-fetch": "^19.0.0",
-    "proc-log": "^6.0.0",
-    "sigstore": "^4.0.0",
-    "ssri": "^13.0.0",
+    "npm-package-arg": "^14.0.0",
+    "npm-packlist": "^11.2.0",
+    "npm-pick-manifest": "^12.0.0",
+    "npm-registry-fetch": "^20.0.1",
+    "proc-log": "^7.0.0",
+    "sigstore": "^5.0.0",
+    "ssri": "^14.0.0",
     "tar": "^7.4.3"
   },
   "engines": {
-    "node": "^20.17.0 || >=22.9.0"
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
   "repository": {
     "type": "git",
@@ -73,8 +73,9 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.29.0",
+    "version": "5.1.0",
     "windowsCI": false,
-    "publish": "true"
+    "publish": "true",
+    "updateNpm": false
   }
 }