Deps updates

DEPENDENCIES.md

@@ -282,6 +282,7 @@ graph LR;
   cross-spawn-->which;
   debug-->ms;
   encoding-->iconv-lite;
+  fdir-->picomatch;
   foreground-child-->cross-spawn;
   foreground-child-->signal-exit;
   fs-minipass-->minipass;
@@ -428,16 +429,15 @@ graph LR;
   minipass-pipeline-->minipass;
   minipass-sized-->minipass;
   minizlib-->minipass;
-  minizlib-->rimraf;
   node-gyp-->env-paths;
   node-gyp-->exponential-backoff;
-  node-gyp-->glob;
   node-gyp-->graceful-fs;
   node-gyp-->make-fetch-happen;
   node-gyp-->nopt;
   node-gyp-->proc-log;
   node-gyp-->semver;
   node-gyp-->tar;
+  node-gyp-->tinyglobby;
   node-gyp-->which;
   nopt-->abbrev;
   normalize-package-data-->hosted-git-info;
@@ -677,6 +677,7 @@ graph LR;
   npmcli-smoke-tests-->npmcli-promise-spawn["@npmcli/promise-spawn"];
   npmcli-smoke-tests-->npmcli-template-oss["@npmcli/template-oss"];
   npmcli-smoke-tests-->proxy;
+  npmcli-smoke-tests-->rimraf;
   npmcli-smoke-tests-->tap;
   npmcli-smoke-tests-->which;
   pacote-->cacache;
@@ -709,7 +710,6 @@ graph LR;
   read-->mute-stream;
   read-package-json-fast-->json-parse-even-better-errors;
   read-package-json-fast-->npm-normalize-package-bin;
-  rimraf-->glob;
   shebang-command-->shebang-regex;
   sigstore-->sigstore-bundle["@sigstore/bundle"];
   sigstore-->sigstore-core["@sigstore/core"];
@@ -751,6 +751,8 @@ graph LR;
   tar-->minizlib;
   tar-->mkdirp;
   tar-->yallist;
+  tinyglobby-->fdir;
+  tinyglobby-->picomatch;
   tuf-js-->debug;
   tuf-js-->make-fetch-happen;
   tuf-js-->tufjs-models["@tufjs/models"];

node_modules/.gitignore

@@ -182,7 +182,6 @@
 !/read-package-json-fast
 !/read
 !/retry
-!/rimraf
 !/safer-buffer
 !/semver
 !/shebang-command
@@ -216,6 +215,11 @@
 !/tar/node_modules/minipass
 !/text-table
 !/tiny-relative-date
+!/tinyglobby
+!/tinyglobby/node_modules/
+/tinyglobby/node_modules/*
+!/tinyglobby/node_modules/fdir
+!/tinyglobby/node_modules/picomatch
 !/treeverse
 !/tuf-js
 !/unique-filename

node_modules/cacache/node_modules/minizlib/dist/commonjs/index.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -7,11 +40,18 @@ exports.BrotliDecompress = exports.BrotliCompress = exports.Brotli = exports.Unz
 const assert_1 = __importDefault(require("assert"));
 const buffer_1 = require("buffer");
 const minipass_1 = require("minipass");
-const zlib_1 = __importDefault(require("zlib"));
+const realZlib = __importStar(require("zlib"));
 const constants_js_1 = require("./constants.js");
 var constants_js_2 = require("./constants.js");
 Object.defineProperty(exports, "constants", { enumerable: true, get: function () { return constants_js_2.constants; } });
 const OriginalBufferConcat = buffer_1.Buffer.concat;
+const desc = Object.getOwnPropertyDescriptor(buffer_1.Buffer, 'concat');
+const noop = (args) => args;
+const passthroughBufferConcat = desc?.writable === true || desc?.set !== undefined
+    ? (makeNoOp) => {
+        buffer_1.Buffer.concat = makeNoOp ? noop : OriginalBufferConcat;
+    }
+    : (_) => { };
 const _superWrite = Symbol('_superWrite');
 class ZlibError extends Error {
     code;
@@ -69,7 +109,7 @@ class ZlibBase extends minipass_1.Minipass {
         try {
             // @types/node doesn't know that it exports the classes, but they're there
             //@ts-ignore
-            this.#handle = new zlib_1.default[mode](opts);
+            this.#handle = new realZlib[mode](opts);
         }
         catch (er) {
             // make sure that all errors get decorated properly
@@ -159,20 +199,20 @@ class ZlibBase extends minipass_1.Minipass {
         this.#handle.close = () => { };
         // It also calls `Buffer.concat()` at the end, which may be convenient
         // for some, but which we are not interested in as it slows us down.
-        buffer_1.Buffer.concat = args => args;
+        passthroughBufferConcat(true);
         let result = undefined;
         try {
             const flushFlag = typeof chunk[_flushFlag] === 'number'
                 ? chunk[_flushFlag]
                 : this.#flushFlag;
             result = this.#handle._processChunk(chunk, flushFlag);
             // if we don't throw, reset it back how it was
-            buffer_1.Buffer.concat = OriginalBufferConcat;
+            passthroughBufferConcat(false);
         }
         catch (err) {
             // or if we do, put Buffer.concat() back before we emit error
             // Error events call into user code, which may call Buffer.concat()
-            buffer_1.Buffer.concat = OriginalBufferConcat;
+            passthroughBufferConcat(false);
             this.#onError(new ZlibError(err));
         }
         finally {

node_modules/cacache/node_modules/minizlib/dist/esm/index.js

@@ -1,10 +1,17 @@
 import assert from 'assert';
 import { Buffer } from 'buffer';
 import { Minipass } from 'minipass';
-import realZlib from 'zlib';
+import * as realZlib from 'zlib';
 import { constants } from './constants.js';
 export { constants } from './constants.js';
 const OriginalBufferConcat = Buffer.concat;
+const desc = Object.getOwnPropertyDescriptor(Buffer, 'concat');
+const noop = (args) => args;
+const passthroughBufferConcat = desc?.writable === true || desc?.set !== undefined
+    ? (makeNoOp) => {
+        Buffer.concat = makeNoOp ? noop : OriginalBufferConcat;
+    }
+    : (_) => { };
 const _superWrite = Symbol('_superWrite');
 export class ZlibError extends Error {
     code;
@@ -151,20 +158,20 @@ class ZlibBase extends Minipass {
         this.#handle.close = () => { };
         // It also calls `Buffer.concat()` at the end, which may be convenient
         // for some, but which we are not interested in as it slows us down.
-        Buffer.concat = args => args;
+        passthroughBufferConcat(true);
         let result = undefined;
         try {
             const flushFlag = typeof chunk[_flushFlag] === 'number'
                 ? chunk[_flushFlag]
                 : this.#flushFlag;
             result = this.#handle._processChunk(chunk, flushFlag);
             // if we don't throw, reset it back how it was
-            Buffer.concat = OriginalBufferConcat;
+            passthroughBufferConcat(false);
         }
         catch (err) {
             // or if we do, put Buffer.concat() back before we emit error
             // Error events call into user code, which may call Buffer.concat()
-            Buffer.concat = OriginalBufferConcat;
+            passthroughBufferConcat(false);
             this.#onError(new ZlibError(err));
         }
         finally {

node_modules/cacache/node_modules/minizlib/package.json

@@ -1,11 +1,10 @@
 {
   "name": "minizlib",
-  "version": "3.0.1",
+  "version": "3.0.2",
   "description": "A small fast zlib stream built on [minipass](http://npm.im/minipass) and Node.js's zlib binding.",
   "main": "./dist/commonjs/index.js",
   "dependencies": {
-    "minipass": "^7.0.4",
-    "rimraf": "^5.0.5"
+    "minipass": "^7.1.2"
   },
   "scripts": {
     "prepare": "tshy",
@@ -34,11 +33,10 @@
   "author": "Isaac Z. Schlueter <[email protected]> (http://blog.izs.me/)",
   "license": "MIT",
   "devDependencies": {
-    "@types/node": "^20.11.29",
-    "mkdirp": "^3.0.1",
-    "tap": "^18.7.1",
-    "tshy": "^1.12.0",
-    "typedoc": "^0.25.12"
+    "@types/node": "^22.13.14",
+    "tap": "^21.1.0",
+    "tshy": "^3.0.2",
+    "typedoc": "^0.28.1"
   },
   "files": [
     "dist"
@@ -77,5 +75,6 @@
     "bracketSameLine": true,
     "arrowParens": "avoid",
     "endOfLine": "lf"
-  }
+  },
+  "module": "./dist/esm/index.js"
 }

node_modules/ci-info/index.js

@@ -36,7 +36,7 @@ exports.isCI = !!(
   env.CI !== 'false' && // Bypass all checks if CI env is explicitly set to 'false'
   (env.BUILD_ID || // Jenkins, Cloudbees
     env.BUILD_NUMBER || // Jenkins, TeamCity
-    env.CI || // Travis CI, CircleCI, Cirrus CI, Gitlab CI, Appveyor, CodeShip, dsari
+    env.CI || // Travis CI, CircleCI, Cirrus CI, Gitlab CI, Appveyor, CodeShip, dsari, Cloudflare Pages
     env.CI_APP_ID || // Appflow
     env.CI_BUILD_ID || // Appflow
     env.CI_BUILD_NUMBER || // Appflow

node_modules/ci-info/package.json

@@ -1,12 +1,13 @@
 {
   "name": "ci-info",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "Get details about the current Continuous Integration environment",
   "main": "index.js",
   "typings": "index.d.ts",
+  "type": "commonjs",
   "author": "Thomas Watson Steen <[email protected]> (https://twitter.com/wa7son)",
   "license": "MIT",
-  "repository": "https://github.com/watson/ci-info.git",
+  "repository": "github:watson/ci-info",
   "bugs": "https://github.com/watson/ci-info/issues",
   "homepage": "https://github.com/watson/ci-info",
   "contributors": [
@@ -41,7 +42,8 @@
   },
   "devDependencies": {
     "clear-module": "^4.1.2",
-    "husky": "^9.1.6",
+    "husky": "^9.1.7",
+    "publint": "^0.3.8",
     "standard": "^17.1.2",
     "tape": "^5.9.0"
   },

node_modules/ci-info/vendors.json

@@ -85,6 +85,11 @@
     "env": "CIRRUS_CI",
     "pr": "CIRRUS_PR"
   },
+  {
+    "name": "Cloudflare Pages",
+    "constant": "CLOUDFLARE_PAGES",
+    "env": "CF_PAGES"
+  },
   {
     "name": "Codefresh",
     "constant": "CODEFRESH",

node_modules/minipass-fetch/lib/index.js

@@ -318,8 +318,7 @@ const fetch = async (url, opts) => {
       if (codings === 'deflate' || codings === 'x-deflate') {
         // handle the infamous raw deflate response from old servers
         // a hack for old IIS and Apache servers
-        const raw = res.pipe(new Minipass())
-        raw.once('data', chunk => {
+        res.once('data', chunk => {
           // see http://stackoverflow.com/questions/37519828
           const decoder = (chunk[0] & 0x0F) === 0x08
             ? new zlib.Inflate()

node_modules/minipass-fetch/node_modules/minizlib/dist/commonjs/index.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -7,11 +40,18 @@ exports.BrotliDecompress = exports.BrotliCompress = exports.Brotli = exports.Unz
 const assert_1 = __importDefault(require("assert"));
 const buffer_1 = require("buffer");
 const minipass_1 = require("minipass");
-const zlib_1 = __importDefault(require("zlib"));
+const realZlib = __importStar(require("zlib"));
 const constants_js_1 = require("./constants.js");
 var constants_js_2 = require("./constants.js");
 Object.defineProperty(exports, "constants", { enumerable: true, get: function () { return constants_js_2.constants; } });
 const OriginalBufferConcat = buffer_1.Buffer.concat;
+const desc = Object.getOwnPropertyDescriptor(buffer_1.Buffer, 'concat');
+const noop = (args) => args;
+const passthroughBufferConcat = desc?.writable === true || desc?.set !== undefined
+    ? (makeNoOp) => {
+        buffer_1.Buffer.concat = makeNoOp ? noop : OriginalBufferConcat;
+    }
+    : (_) => { };
 const _superWrite = Symbol('_superWrite');
 class ZlibError extends Error {
     code;
@@ -69,7 +109,7 @@ class ZlibBase extends minipass_1.Minipass {
         try {
             // @types/node doesn't know that it exports the classes, but they're there
             //@ts-ignore
-            this.#handle = new zlib_1.default[mode](opts);
+            this.#handle = new realZlib[mode](opts);
         }
         catch (er) {
             // make sure that all errors get decorated properly
@@ -159,20 +199,20 @@ class ZlibBase extends minipass_1.Minipass {
         this.#handle.close = () => { };
         // It also calls `Buffer.concat()` at the end, which may be convenient
         // for some, but which we are not interested in as it slows us down.
-        buffer_1.Buffer.concat = args => args;
+        passthroughBufferConcat(true);
         let result = undefined;
         try {
             const flushFlag = typeof chunk[_flushFlag] === 'number'
                 ? chunk[_flushFlag]
                 : this.#flushFlag;
             result = this.#handle._processChunk(chunk, flushFlag);
             // if we don't throw, reset it back how it was
-            buffer_1.Buffer.concat = OriginalBufferConcat;
+            passthroughBufferConcat(false);
         }
         catch (err) {
             // or if we do, put Buffer.concat() back before we emit error
             // Error events call into user code, which may call Buffer.concat()
-            buffer_1.Buffer.concat = OriginalBufferConcat;
+            passthroughBufferConcat(false);
             this.#onError(new ZlibError(err));
         }
         finally {