deps: update major versions of top level and nested npm deps

- @npmcli/metavuln-calculator@3.0.0
- @npmcli/git@3.0.0
- @npmcli/config@4.0.0
- pacote@13.0.2
- npm-pick-manifest@7.0.0
- npm-package-arg@9.0.0
- proc-log@2.0.0
- npm-registry-fetch@13.0.0
- npm-profile@6.0.2

node_modules/@npmcli/config/lib/env-replace.js

@@ -1,6 +1,6 @@
 // replace any ${ENV} values with the appropriate environ.
 
-const envExpr = /(\\*)\$\{([^}]+)\}/g
+const envExpr = /(?<!\\)(\\*)\$\{([^${}]+)\}/g
 
 module.exports = (f, env) => f.replace(envExpr, (orig, esc, name) => {
   const val = env[name] !== undefined ? env[name] : `$\{${name}}`

node_modules/@npmcli/config/lib/index.js

@@ -5,6 +5,7 @@ const nopt = require('nopt')
 const mkdirp = require('mkdirp-infer-owner')
 const mapWorkspaces = require('@npmcli/map-workspaces')
 const rpj = require('read-package-json-fast')
+const log = require('proc-log')
 
 /* istanbul ignore next */
 const myUid = process.getuid && process.getuid()
@@ -88,7 +89,6 @@ class Config {
     // options just to override in tests, mostly
     env = process.env,
     argv = process.argv,
-    log = require('./proc-log.js'),
     platform = process.platform,
     execPath = process.execPath,
     cwd = process.cwd(),
@@ -114,7 +114,6 @@ class Config {
     this.defaults = defaults
 
     this.npmPath = npmPath
-    this.log = log
     this.argv = argv
     this.env = env
     this.execPath = execPath
@@ -436,7 +435,7 @@ class Config {
   }
 
   invalidHandler (k, val, type, source, where) {
-    this.log.warn(
+    log.warn(
       'invalid config',
       k + '=' + JSON.stringify(val),
       `set in ${source}`
@@ -469,7 +468,7 @@ class Config {
       : mustBe.filter(m => m !== Array)
         .map(n => typeof n === 'string' ? n : JSON.stringify(n))
         .join(', ')
-    this.log.warn('invalid config', msg, desc)
+    log.warn('invalid config', msg, desc)
   }
 
   [_loadObject] (obj, where, source, er = null) {
@@ -491,7 +490,7 @@ class Config {
     if (er) {
       conf.loadError = er
       if (er.code !== 'ENOENT') {
-        this.log.verbose('config', `error loading ${where} config`, er)
+        log.verbose('config', `error loading ${where} config`, er)
       }
     } else {
       conf.raw = obj
@@ -510,7 +509,7 @@ class Config {
     // XXX a future npm version will make this a warning.
     // An even more future npm version will make this an error.
     if (this.deprecated[key]) {
-      this.log.verbose('config', key, this.deprecated[key])
+      log.verbose('config', key, this.deprecated[key])
     }
   }
 
@@ -607,14 +606,14 @@ class Config {
               .catch(() => false)
 
             if (hasNpmrc) {
-              this.log.warn(`ignoring workspace config at ${this.localPrefix}/.npmrc`)
+              log.warn(`ignoring workspace config at ${this.localPrefix}/.npmrc`)
             }
 
             // set the workspace in the default layer, which allows it to be overridden easily
             const { data } = this.data.get('default')
             data.workspace = [this.localPrefix]
             this.localPrefix = p
-            this.log.info(`found workspace root at ${this.localPrefix}`)
+            log.info(`found workspace root at ${this.localPrefix}`)
             // we found a root, so we return now
             return
           }

node_modules/@npmcli/config/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/config",
-  "version": "3.0.0",
+  "version": "4.0.0",
   "files": [
     "bin",
     "lib"
@@ -30,22 +30,23 @@
     "coverage-map": "map.js"
   },
   "devDependencies": {
-    "@npmcli/template-oss": "^2.5.1",
-    "tap": "^15.0.4"
+    "@npmcli/template-oss": "^2.7.1",
+    "tap": "^15.1.6"
   },
   "dependencies": {
     "@npmcli/map-workspaces": "^2.0.0",
     "ini": "^2.0.0",
     "mkdirp-infer-owner": "^2.0.0",
     "nopt": "^5.0.0",
+    "proc-log": "^2.0.0",
     "read-package-json-fast": "^2.0.3",
-    "semver": "^7.3.4",
+    "semver": "^7.3.5",
     "walk-up-path": "^1.0.0"
   },
   "engines": {
     "node": "^12.13.0 || ^14.15.0 || >=16"
   },
   "templateOSS": {
-    "version": "2.6.0"
+    "version": "2.7.1"
   }
 }

node_modules/@npmcli/git/lib/clone.js

@@ -15,7 +15,7 @@ const shallowHosts = new Set([
   'gist.github.com',
   'gitlab.com',
   'bitbucket.com',
-  'bitbucket.org'
+  'bitbucket.org',
 ])
 // we have to use url.parse until we add the same shim that hosted-git-info has
 // to handle scp:// urls
@@ -113,10 +113,14 @@ const branch = (repo, revDoc, target, opts) => {
     revDoc.ref,
     repo,
     target,
-    '--recurse-submodules'
+    '--recurse-submodules',
   ]
-  if (maybeShallow(repo, opts)) { args.push('--depth=1') }
-  if (isWindows(opts)) { args.push('--config', 'core.longpaths=true') }
+  if (maybeShallow(repo, opts)) {
+    args.push('--depth=1')
+  }
+  if (isWindows(opts)) {
+    args.push('--config', 'core.longpaths=true')
+  }
   return spawn(args, opts).then(() => revDoc.sha)
 }
 
@@ -126,10 +130,14 @@ const plain = (repo, revDoc, target, opts) => {
     'clone',
     repo,
     target,
-    '--recurse-submodules'
+    '--recurse-submodules',
   ]
-  if (maybeShallow(repo, opts)) { args.push('--depth=1') }
-  if (isWindows(opts)) { args.push('--config', 'core.longpaths=true') }
+  if (maybeShallow(repo, opts)) {
+    args.push('--depth=1')
+  }
+  if (isWindows(opts)) {
+    args.push('--config', 'core.longpaths=true')
+  }
   return spawn(args, opts).then(() => revDoc.sha)
 }
 
@@ -143,7 +151,7 @@ const updateSubmodules = (target, opts) => new Promise(resolve =>
       'update',
       '-q',
       '--init',
-      '--recursive'
+      '--recursive',
     ], { ...opts, cwd: target }))
   }))
 

node_modules/@npmcli/git/lib/errors.js

@@ -32,5 +32,5 @@ class GitUnknownError extends GitError {
 module.exports = {
   GitConnectionError,
   GitPathspecError,
-  GitUnknownError
+  GitUnknownError,
 }

node_modules/@npmcli/git/lib/index.js

@@ -5,5 +5,5 @@ module.exports = {
   is: require('./is.js'),
   find: require('./find.js'),
   isClean: require('./is-clean.js'),
-  errors: require('./errors.js')
+  errors: require('./errors.js'),
 }

node_modules/@npmcli/git/lib/lines-to-revs.js

@@ -7,7 +7,7 @@ module.exports = lines => finish(lines.reduce(linesToRevsReducer, {
   versions: {},
   'dist-tags': {},
   refs: {},
-  shas: {}
+  shas: {},
 }))
 
 const finish = revs => distTags(shaList(peelTags(revs)))
@@ -52,7 +52,9 @@ const distTags = revs => {
       revs['dist-tags'].latest = v
     } else if (ver.sha === HEAD.sha) {
       revs['dist-tags'].HEAD = v
-      if (!revs.refs.latest) { revs['dist-tags'].latest = v }
+      if (!revs.refs.latest) {
+        revs['dist-tags'].latest = v
+      }
     }
   })
   return revs
@@ -79,7 +81,9 @@ const refType = ref => {
 // return the doc, or null if we should ignore it.
 const lineToRevDoc = line => {
   const split = line.trim().split(/\s+/, 2)
-  if (split.length < 2) { return null }
+  if (split.length < 2) {
+    return null
+  }
 
   const sha = split[0].trim()
   const rawRef = split[1].trim()
@@ -122,7 +126,9 @@ const lineToRevDoc = line => {
 const linesToRevsReducer = (revs, line) => {
   const doc = lineToRevDoc(line)
 
-  if (!doc) { return revs }
+  if (!doc) {
+    return revs
+  }
 
   revs.refs[doc.ref] = doc
   revs.refs[doc.rawRef] = doc

node_modules/@npmcli/git/lib/make-error.js

@@ -1,7 +1,7 @@
 const {
   GitConnectionError,
   GitPathspecError,
-  GitUnknownError
+  GitUnknownError,
 } = require('./errors.js')
 
 const connectionErrorRe = new RegExp([
@@ -12,7 +12,7 @@ const connectionErrorRe = new RegExp([
   'Failed to connect to .* Timed out',
   'Connection reset by peer',
   'SSL_ERROR_SYSCALL',
-  'The requested URL returned error: 503'
+  'The requested URL returned error: 503',
 ].join('|'))
 
 const missingPathspecRe = /pathspec .* did not match any file\(s\) known to git/

node_modules/@npmcli/git/lib/opts.js

@@ -2,11 +2,11 @@
 // This defaults to accepting new ssh host key fingerprints
 const gitEnv = {
   GIT_ASKPASS: 'echo',
-  GIT_SSH_COMMAND: 'ssh -oStrictHostKeyChecking=accept-new'
+  GIT_SSH_COMMAND: 'ssh -oStrictHostKeyChecking=accept-new',
 }
 module.exports = (opts = {}) => ({
   stdioString: true,
   ...opts,
   shell: false,
-  env: opts.env || { ...gitEnv, ...process.env }
+  env: opts.env || { ...gitEnv, ...process.env },
 })

node_modules/@npmcli/git/lib/revs.js

@@ -4,7 +4,7 @@ const LRU = require('lru-cache')
 
 const revsCache = new LRU({
   max: 100,
-  maxAge: 5 * 60 * 1000
+  ttl: 5 * 60 * 1000,
 })
 
 const linesToRevs = require('./lines-to-revs.js')

node_modules/@npmcli/git/lib/spawn.js

@@ -1,28 +1,29 @@
 const spawn = require('@npmcli/promise-spawn')
 const promiseRetry = require('promise-retry')
+const log = require('proc-log')
 const makeError = require('./make-error.js')
 const whichGit = require('./which.js')
 const makeOpts = require('./opts.js')
-const procLog = require('./proc-log.js')
 
 module.exports = (gitArgs, opts = {}) => {
   const gitPath = whichGit(opts)
 
-  if (gitPath instanceof Error) { return Promise.reject(gitPath) }
+  if (gitPath instanceof Error) {
+    return Promise.reject(gitPath)
+  }
 
   // undocumented option, mostly only here for tests
   const args = opts.allowReplace || gitArgs[0] === '--no-replace-objects'
     ? gitArgs
     : ['--no-replace-objects', ...gitArgs]
 
-  const log = opts.log || procLog
   let retry = opts.retry
   if (retry === null || retry === undefined) {
     retry = {
       retries: opts.fetchRetries || 2,
       factor: opts.fetchRetryFactor || 10,
       maxTimeout: opts.fetchRetryMaxtimeout || 60000,
-      minTimeout: opts.fetchRetryMintimeout || 1000
+      minTimeout: opts.fetchRetryMintimeout || 1000,
     }
   }
   return promiseRetry((retry, number) => {

node_modules/@npmcli/git/node_modules/lru-cache/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) 2010-2022 Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.