From 485753df44e66921dcb593e1bcbb39de79c6dc11 Mon Sep 17 00:00:00 2001 From: Gar Date: Tue, 5 Apr 2022 13:11:00 -0700 Subject: [PATCH] deps: cacache@16.0.4 --- .../node_modules/@npmcli/move-file/LICENSE.md | 22 + .../@npmcli/move-file/lib/index.js | 175 ++++++ .../@npmcli/move-file/package.json | 47 ++ .../cacache/node_modules/ssri/LICENSE.md | 16 + .../cacache/node_modules/ssri/lib/index.js | 499 ++++++++++++++++++ .../cacache/node_modules/ssri/package.json | 63 +++ node_modules/cacache/package.json | 10 +- package-lock.json | 64 ++- package.json | 2 +- 9 files changed, 883 insertions(+), 15 deletions(-) create mode 100644 node_modules/cacache/node_modules/@npmcli/move-file/LICENSE.md create mode 100644 node_modules/cacache/node_modules/@npmcli/move-file/lib/index.js create mode 100644 node_modules/cacache/node_modules/@npmcli/move-file/package.json create mode 100644 node_modules/cacache/node_modules/ssri/LICENSE.md create mode 100644 node_modules/cacache/node_modules/ssri/lib/index.js create mode 100644 node_modules/cacache/node_modules/ssri/package.json diff --git a/node_modules/cacache/node_modules/@npmcli/move-file/LICENSE.md b/node_modules/cacache/node_modules/@npmcli/move-file/LICENSE.md new file mode 100644 index 0000000000000..072bf20840acd --- /dev/null +++ b/node_modules/cacache/node_modules/@npmcli/move-file/LICENSE.md @@ -0,0 +1,22 @@ +MIT License + +Copyright (c) Sindre Sorhus (https://sindresorhus.com) +Copyright (c) npm, Inc. + +Permission is hereby granted, free of charge, to any person obtaining a +copy of this software and associated documentation files (the "Software"), +to deal in the Software without restriction, including without limitation +the rights to use, copy, modify, merge, publish, distribute, sublicense, +and/or sell copies of the Software, and to permit persons to whom the +Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in +all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING +FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER +DEALINGS IN THE SOFTWARE. diff --git a/node_modules/cacache/node_modules/@npmcli/move-file/lib/index.js b/node_modules/cacache/node_modules/@npmcli/move-file/lib/index.js new file mode 100644 index 0000000000000..ecc55f0171da5 --- /dev/null +++ b/node_modules/cacache/node_modules/@npmcli/move-file/lib/index.js @@ -0,0 +1,175 @@ +const { dirname, join, resolve, relative, isAbsolute } = require('path') +const rimraf_ = require('rimraf') +const { promisify } = require('util') +const { + access: access_, + accessSync, + copyFile: copyFile_, + copyFileSync, + readdir: readdir_, + readdirSync, + rename: rename_, + renameSync, + stat: stat_, + statSync, + lstat: lstat_, + lstatSync, + symlink: symlink_, + symlinkSync, + readlink: readlink_, + readlinkSync, +} = require('fs') + +const access = promisify(access_) +const copyFile = promisify(copyFile_) +const readdir = promisify(readdir_) +const rename = promisify(rename_) +const stat = promisify(stat_) +const lstat = promisify(lstat_) +const symlink = promisify(symlink_) +const readlink = promisify(readlink_) +const rimraf = promisify(rimraf_) +const rimrafSync = rimraf_.sync + +const mkdirp = require('mkdirp') + +const pathExists = async path => { + try { + await access(path) + return true + } catch (er) { + return er.code !== 'ENOENT' + } +} + +const pathExistsSync = path => { + try { + accessSync(path) + return true + } catch (er) { + return er.code !== 'ENOENT' + } +} + +const moveFile = async (source, destination, options = {}, root = true, symlinks = []) => { + if (!source || !destination) { + throw new TypeError('`source` and `destination` file required') + } + + options = { + overwrite: true, + ...options, + } + + if (!options.overwrite && await pathExists(destination)) { + throw new Error(`The destination file exists: ${destination}`) + } + + await mkdirp(dirname(destination)) + + try { + await rename(source, destination) + } catch (error) { + if (error.code === 'EXDEV' || error.code === 'EPERM') { + const sourceStat = await lstat(source) + if (sourceStat.isDirectory()) { + const files = await readdir(source) + await Promise.all(files.map((file) => + moveFile(join(source, file), join(destination, file), options, false, symlinks) + )) + } else if (sourceStat.isSymbolicLink()) { + symlinks.push({ source, destination }) + } else { + await copyFile(source, destination) + } + } else { + throw error + } + } + + if (root) { + await Promise.all(symlinks.map(async ({ source: symSource, destination: symDestination }) => { + let target = await readlink(symSource) + // junction symlinks in windows will be absolute paths, so we need to + // make sure they point to the symlink destination + if (isAbsolute(target)) { + target = resolve(symDestination, relative(symSource, target)) + } + // try to determine what the actual file is so we can create the correct + // type of symlink in windows + let targetStat + try { + targetStat = await stat(resolve(dirname(symSource), target)) + } catch (err) {} + await symlink( + target, + symDestination, + targetStat && targetStat.isDirectory() ? 'junction' : 'file' + ) + })) + await rimraf(source) + } +} + +const moveFileSync = (source, destination, options = {}, root = true, symlinks = []) => { + if (!source || !destination) { + throw new TypeError('`source` and `destination` file required') + } + + options = { + overwrite: true, + ...options, + } + + if (!options.overwrite && pathExistsSync(destination)) { + throw new Error(`The destination file exists: ${destination}`) + } + + mkdirp.sync(dirname(destination)) + + try { + renameSync(source, destination) + } catch (error) { + if (error.code === 'EXDEV' || error.code === 'EPERM') { + const sourceStat = lstatSync(source) + if (sourceStat.isDirectory()) { + const files = readdirSync(source) + for (const file of files) { + moveFileSync(join(source, file), join(destination, file), options, false, symlinks) + } + } else if (sourceStat.isSymbolicLink()) { + symlinks.push({ source, destination }) + } else { + copyFileSync(source, destination) + } + } else { + throw error + } + } + + if (root) { + for (const { source: symSource, destination: symDestination } of symlinks) { + let target = readlinkSync(symSource) + // junction symlinks in windows will be absolute paths, so we need to + // make sure they point to the symlink destination + if (isAbsolute(target)) { + target = resolve(symDestination, relative(symSource, target)) + } + // try to determine what the actual file is so we can create the correct + // type of symlink in windows + let targetStat + try { + targetStat = statSync(resolve(dirname(symSource), target)) + } catch (err) {} + symlinkSync( + target, + symDestination, + targetStat && targetStat.isDirectory() ? 'junction' : 'file' + ) + } + rimrafSync(source) + } +} + +module.exports = moveFile +module.exports.sync = moveFileSync diff --git a/node_modules/cacache/node_modules/@npmcli/move-file/package.json b/node_modules/cacache/node_modules/@npmcli/move-file/package.json new file mode 100644 index 0000000000000..1b1d377b0c7b2 --- /dev/null +++ b/node_modules/cacache/node_modules/@npmcli/move-file/package.json @@ -0,0 +1,47 @@ +{ + "name": "@npmcli/move-file", + "version": "2.0.0", + "files": [ + "bin/", + "lib/" + ], + "main": "lib/index.js", + "description": "move a file (fork of move-file)", + "dependencies": { + "mkdirp": "^1.0.4", + "rimraf": "^3.0.2" + }, + "devDependencies": { + "@npmcli/eslint-config": "^3.0.1", + "@npmcli/template-oss": "3.2.2", + "tap": "^16.0.1" + }, + "scripts": { + "test": "tap", + "snap": "tap", + "preversion": "npm test", + "postversion": "npm publish", + "prepublishOnly": "git push origin --follow-tags", + "lint": "eslint \"**/*.js\"", + "postlint": "template-oss-check", + "template-oss-apply": "template-oss-apply --force", + "lintfix": "npm run lint -- --fix", + "posttest": "npm run lint" + }, + "repository": { + "type": "git", + "url": "https://github.com/npm/move-file.git" + }, + "tap": { + "check-coverage": true + }, + "license": "MIT", + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + }, + "author": "GitHub Inc.", + "templateOSS": { + "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", + "version": "3.2.2" + } +} diff --git a/node_modules/cacache/node_modules/ssri/LICENSE.md b/node_modules/cacache/node_modules/ssri/LICENSE.md new file mode 100644 index 0000000000000..e335388869f50 --- /dev/null +++ b/node_modules/cacache/node_modules/ssri/LICENSE.md @@ -0,0 +1,16 @@ +ISC License + +Copyright 2021 (c) npm, Inc. + +Permission to use, copy, modify, and/or distribute this software for +any purpose with or without fee is hereby granted, provided that the +above copyright notice and this permission notice appear in all copies. + +THE SOFTWARE IS PROVIDED "AS IS" AND THE COPYRIGHT HOLDER DISCLAIMS +ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED +WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE +COPYRIGHT HOLDER BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR +CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS +OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE +OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE +USE OR PERFORMANCE OF THIS SOFTWARE. diff --git a/node_modules/cacache/node_modules/ssri/lib/index.js b/node_modules/cacache/node_modules/ssri/lib/index.js new file mode 100644 index 0000000000000..e2732fd072b12 --- /dev/null +++ b/node_modules/cacache/node_modules/ssri/lib/index.js @@ -0,0 +1,499 @@ +'use strict' + +const crypto = require('crypto') +const MiniPass = require('minipass') + +const SPEC_ALGORITHMS = ['sha256', 'sha384', 'sha512'] + +// TODO: this should really be a hardcoded list of algorithms we support, +// rather than [a-z0-9]. +const BASE64_REGEX = /^[a-z0-9+/]+(?:=?=?)$/i +const SRI_REGEX = /^([a-z0-9]+)-([^?]+)([?\S*]*)$/ +const STRICT_SRI_REGEX = /^([a-z0-9]+)-([A-Za-z0-9+/=]{44,88})(\?[\x21-\x7E]*)?$/ +const VCHAR_REGEX = /^[\x21-\x7E]+$/ + +const defaultOpts = { + algorithms: ['sha512'], + error: false, + options: [], + pickAlgorithm: getPrioritizedHash, + sep: ' ', + single: false, + strict: false, +} + +const ssriOpts = (opts = {}) => ({ ...defaultOpts, ...opts }) + +const getOptString = options => !options || !options.length + ? '' + : `?${options.join('?')}` + +const _onEnd = Symbol('_onEnd') +const _getOptions = Symbol('_getOptions') +class IntegrityStream extends MiniPass { + constructor (opts) { + super() + this.size = 0 + this.opts = opts + + // may be overridden later, but set now for class consistency + this[_getOptions]() + + // options used for calculating stream. can't be changed. + const { algorithms = defaultOpts.algorithms } = opts + this.algorithms = Array.from( + new Set(algorithms.concat(this.algorithm ? [this.algorithm] : [])) + ) + this.hashes = this.algorithms.map(crypto.createHash) + } + + [_getOptions] () { + const { + integrity, + size, + options, + } = { ...defaultOpts, ...this.opts } + + // For verification + this.sri = integrity ? parse(integrity, this.opts) : null + this.expectedSize = size + this.goodSri = this.sri ? !!Object.keys(this.sri).length : false + this.algorithm = this.goodSri ? this.sri.pickAlgorithm(this.opts) : null + this.digests = this.goodSri ? this.sri[this.algorithm] : null + this.optString = getOptString(options) + } + + emit (ev, data) { + if (ev === 'end') { + this[_onEnd]() + } + return super.emit(ev, data) + } + + write (data) { + this.size += data.length + this.hashes.forEach(h => h.update(data)) + return super.write(data) + } + + [_onEnd] () { + if (!this.goodSri) { + this[_getOptions]() + } + const newSri = parse(this.hashes.map((h, i) => { + return `${this.algorithms[i]}-${h.digest('base64')}${this.optString}` + }).join(' '), this.opts) + // Integrity verification mode + const match = this.goodSri && newSri.match(this.sri, this.opts) + if (typeof this.expectedSize === 'number' && this.size !== this.expectedSize) { + /* eslint-disable-next-line max-len */ + const err = new Error(`stream size mismatch when checking ${this.sri}.\n Wanted: ${this.expectedSize}\n Found: ${this.size}`) + err.code = 'EBADSIZE' + err.found = this.size + err.expected = this.expectedSize + err.sri = this.sri + this.emit('error', err) + } else if (this.sri && !match) { + /* eslint-disable-next-line max-len */ + const err = new Error(`${this.sri} integrity checksum failed when using ${this.algorithm}: wanted ${this.digests} but got ${newSri}. (${this.size} bytes)`) + err.code = 'EINTEGRITY' + err.found = newSri + err.expected = this.digests + err.algorithm = this.algorithm + err.sri = this.sri + this.emit('error', err) + } else { + this.emit('size', this.size) + this.emit('integrity', newSri) + match && this.emit('verified', match) + } + } +} + +class Hash { + get isHash () { + return true + } + + constructor (hash, opts) { + opts = ssriOpts(opts) + const strict = !!opts.strict + this.source = hash.trim() + + // set default values so that we make V8 happy to + // always see a familiar object template. + this.digest = '' + this.algorithm = '' + this.options = [] + + // 3.1. Integrity metadata (called "Hash" by ssri) + // https://w3c.github.io/webappsec-subresource-integrity/#integrity-metadata-description + const match = this.source.match( + strict + ? STRICT_SRI_REGEX + : SRI_REGEX + ) + if (!match) { + return + } + if (strict && !SPEC_ALGORITHMS.some(a => a === match[1])) { + return + } + this.algorithm = match[1] + this.digest = match[2] + + const rawOpts = match[3] + if (rawOpts) { + this.options = rawOpts.slice(1).split('?') + } + } + + hexDigest () { + return this.digest && Buffer.from(this.digest, 'base64').toString('hex') + } + + toJSON () { + return this.toString() + } + + toString (opts) { + opts = ssriOpts(opts) + if (opts.strict) { + // Strict mode enforces the standard as close to the foot of the + // letter as it can. + if (!( + // The spec has very restricted productions for algorithms. + // https://www.w3.org/TR/CSP2/#source-list-syntax + SPEC_ALGORITHMS.some(x => x === this.algorithm) && + // Usually, if someone insists on using a "different" base64, we + // leave it as-is, since there's multiple standards, and the + // specified is not a URL-safe variant. + // https://www.w3.org/TR/CSP2/#base64_value + this.digest.match(BASE64_REGEX) && + // Option syntax is strictly visual chars. + // https://w3c.github.io/webappsec-subresource-integrity/#grammardef-option-expression + // https://tools.ietf.org/html/rfc5234#appendix-B.1 + this.options.every(opt => opt.match(VCHAR_REGEX)) + )) { + return '' + } + } + const options = this.options && this.options.length + ? `?${this.options.join('?')}` + : '' + return `${this.algorithm}-${this.digest}${options}` + } +} + +class Integrity { + get isIntegrity () { + return true + } + + toJSON () { + return this.toString() + } + + isEmpty () { + return Object.keys(this).length === 0 + } + + toString (opts) { + opts = ssriOpts(opts) + let sep = opts.sep || ' ' + if (opts.strict) { + // Entries must be separated by whitespace, according to spec. + sep = sep.replace(/\S+/g, ' ') + } + return Object.keys(this).map(k => { + return this[k].map(hash => { + return Hash.prototype.toString.call(hash, opts) + }).filter(x => x.length).join(sep) + }).filter(x => x.length).join(sep) + } + + concat (integrity, opts) { + opts = ssriOpts(opts) + const other = typeof integrity === 'string' + ? integrity + : stringify(integrity, opts) + return parse(`${this.toString(opts)} ${other}`, opts) + } + + hexDigest () { + return parse(this, { single: true }).hexDigest() + } + + // add additional hashes to an integrity value, but prevent + // *changing* an existing integrity hash. + merge (integrity, opts) { + opts = ssriOpts(opts) + const other = parse(integrity, opts) + for (const algo in other) { + if (this[algo]) { + if (!this[algo].find(hash => + other[algo].find(otherhash => + hash.digest === otherhash.digest))) { + throw new Error('hashes do not match, cannot update integrity') + } + } else { + this[algo] = other[algo] + } + } + } + + match (integrity, opts) { + opts = ssriOpts(opts) + const other = parse(integrity, opts) + const algo = other.pickAlgorithm(opts) + return ( + this[algo] && + other[algo] && + this[algo].find(hash => + other[algo].find(otherhash => + hash.digest === otherhash.digest + ) + ) + ) || false + } + + pickAlgorithm (opts) { + opts = ssriOpts(opts) + const pickAlgorithm = opts.pickAlgorithm + const keys = Object.keys(this) + return keys.reduce((acc, algo) => { + return pickAlgorithm(acc, algo) || acc + }) + } +} + +module.exports.parse = parse +function parse (sri, opts) { + if (!sri) { + return null + } + opts = ssriOpts(opts) + if (typeof sri === 'string') { + return _parse(sri, opts) + } else if (sri.algorithm && sri.digest) { + const fullSri = new Integrity() + fullSri[sri.algorithm] = [sri] + return _parse(stringify(fullSri, opts), opts) + } else { + return _parse(stringify(sri, opts), opts) + } +} + +function _parse (integrity, opts) { + // 3.4.3. Parse metadata + // https://w3c.github.io/webappsec-subresource-integrity/#parse-metadata + if (opts.single) { + return new Hash(integrity, opts) + } + const hashes = integrity.trim().split(/\s+/).reduce((acc, string) => { + const hash = new Hash(string, opts) + if (hash.algorithm && hash.digest) { + const algo = hash.algorithm + if (!acc[algo]) { + acc[algo] = [] + } + acc[algo].push(hash) + } + return acc + }, new Integrity()) + return hashes.isEmpty() ? null : hashes +} + +module.exports.stringify = stringify +function stringify (obj, opts) { + opts = ssriOpts(opts) + if (obj.algorithm && obj.digest) { + return Hash.prototype.toString.call(obj, opts) + } else if (typeof obj === 'string') { + return stringify(parse(obj, opts), opts) + } else { + return Integrity.prototype.toString.call(obj, opts) + } +} + +module.exports.fromHex = fromHex +function fromHex (hexDigest, algorithm, opts) { + opts = ssriOpts(opts) + const optString = getOptString(opts.options) + return parse( + `${algorithm}-${ + Buffer.from(hexDigest, 'hex').toString('base64') + }${optString}`, opts + ) +} + +module.exports.fromData = fromData +function fromData (data, opts) { + opts = ssriOpts(opts) + const algorithms = opts.algorithms + const optString = getOptString(opts.options) + return algorithms.reduce((acc, algo) => { + const digest = crypto.createHash(algo).update(data).digest('base64') + const hash = new Hash( + `${algo}-${digest}${optString}`, + opts + ) + /* istanbul ignore else - it would be VERY strange if the string we + * just calculated with an algo did not have an algo or digest. + */ + if (hash.algorithm && hash.digest) { + const hashAlgo = hash.algorithm + if (!acc[hashAlgo]) { + acc[hashAlgo] = [] + } + acc[hashAlgo].push(hash) + } + return acc + }, new Integrity()) +} + +module.exports.fromStream = fromStream +function fromStream (stream, opts) { + opts = ssriOpts(opts) + const istream = integrityStream(opts) + return new Promise((resolve, reject) => { + stream.pipe(istream) + stream.on('error', reject) + istream.on('error', reject) + let sri + istream.on('integrity', s => { + sri = s + }) + istream.on('end', () => resolve(sri)) + istream.on('data', () => {}) + }) +} + +module.exports.checkData = checkData +function checkData (data, sri, opts) { + opts = ssriOpts(opts) + sri = parse(sri, opts) + if (!sri || !Object.keys(sri).length) { + if (opts.error) { + throw Object.assign( + new Error('No valid integrity hashes to check against'), { + code: 'EINTEGRITY', + } + ) + } else { + return false + } + } + const algorithm = sri.pickAlgorithm(opts) + const digest = crypto.createHash(algorithm).update(data).digest('base64') + const newSri = parse({ algorithm, digest }) + const match = newSri.match(sri, opts) + if (match || !opts.error) { + return match + } else if (typeof opts.size === 'number' && (data.length !== opts.size)) { + /* eslint-disable-next-line max-len */ + const err = new Error(`data size mismatch when checking ${sri}.\n Wanted: ${opts.size}\n Found: ${data.length}`) + err.code = 'EBADSIZE' + err.found = data.length + err.expected = opts.size + err.sri = sri + throw err + } else { + /* eslint-disable-next-line max-len */ + const err = new Error(`Integrity checksum failed when using ${algorithm}: Wanted ${sri}, but got ${newSri}. (${data.length} bytes)`) + err.code = 'EINTEGRITY' + err.found = newSri + err.expected = sri + err.algorithm = algorithm + err.sri = sri + throw err + } +} + +module.exports.checkStream = checkStream +function checkStream (stream, sri, opts) { + opts = ssriOpts(opts) + opts.integrity = sri + sri = parse(sri, opts) + if (!sri || !Object.keys(sri).length) { + return Promise.reject(Object.assign( + new Error('No valid integrity hashes to check against'), { + code: 'EINTEGRITY', + } + )) + } + const checker = integrityStream(opts) + return new Promise((resolve, reject) => { + stream.pipe(checker) + stream.on('error', reject) + checker.on('error', reject) + let verified + checker.on('verified', s => { + verified = s + }) + checker.on('end', () => resolve(verified)) + checker.on('data', () => {}) + }) +} + +module.exports.integrityStream = integrityStream +function integrityStream (opts = {}) { + return new IntegrityStream(opts) +} + +module.exports.create = createIntegrity +function createIntegrity (opts) { + opts = ssriOpts(opts) + const algorithms = opts.algorithms + const optString = getOptString(opts.options) + + const hashes = algorithms.map(crypto.createHash) + + return { + update: function (chunk, enc) { + hashes.forEach(h => h.update(chunk, enc)) + return this + }, + digest: function (enc) { + const integrity = algorithms.reduce((acc, algo) => { + const digest = hashes.shift().digest('base64') + const hash = new Hash( + `${algo}-${digest}${optString}`, + opts + ) + /* istanbul ignore else - it would be VERY strange if the hash we + * just calculated with an algo did not have an algo or digest. + */ + if (hash.algorithm && hash.digest) { + const hashAlgo = hash.algorithm + if (!acc[hashAlgo]) { + acc[hashAlgo] = [] + } + acc[hashAlgo].push(hash) + } + return acc + }, new Integrity()) + + return integrity + }, + } +} + +const NODE_HASHES = new Set(crypto.getHashes()) + +// This is a Best Effort™ at a reasonable priority for hash algos +const DEFAULT_PRIORITY = [ + 'md5', 'whirlpool', 'sha1', 'sha224', 'sha256', 'sha384', 'sha512', + // TODO - it's unclear _which_ of these Node will actually use as its name + // for the algorithm, so we guesswork it based on the OpenSSL names. + 'sha3', + 'sha3-256', 'sha3-384', 'sha3-512', + 'sha3_256', 'sha3_384', 'sha3_512', +].filter(algo => NODE_HASHES.has(algo)) + +function getPrioritizedHash (algo1, algo2) { + /* eslint-disable-next-line max-len */ + return DEFAULT_PRIORITY.indexOf(algo1.toLowerCase()) >= DEFAULT_PRIORITY.indexOf(algo2.toLowerCase()) + ? algo1 + : algo2 +} diff --git a/node_modules/cacache/node_modules/ssri/package.json b/node_modules/cacache/node_modules/ssri/package.json new file mode 100644 index 0000000000000..84448afc3cf04 --- /dev/null +++ b/node_modules/cacache/node_modules/ssri/package.json @@ -0,0 +1,63 @@ +{ + "name": "ssri", + "version": "9.0.0", + "description": "Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.", + "main": "lib/index.js", + "files": [ + "bin/", + "lib/" + ], + "scripts": { + "prerelease": "npm t", + "postrelease": "npm publish", + "prepublishOnly": "git push origin --follow-tags", + "posttest": "npm run lint", + "test": "tap", + "coverage": "tap", + "lint": "eslint \"**/*.js\"", + "postlint": "template-oss-check", + "template-oss-apply": "template-oss-apply --force", + "lintfix": "npm run lint -- --fix", + "preversion": "npm test", + "postversion": "npm publish", + "snap": "tap" + }, + "tap": { + "check-coverage": true + }, + "repository": { + "type": "git", + "url": "https://github.com/npm/ssri.git" + }, + "keywords": [ + "w3c", + "web", + "security", + "integrity", + "checksum", + "hashing", + "subresource integrity", + "sri", + "sri hash", + "sri string", + "sri generator", + "html" + ], + "author": "GitHub Inc.", + "license": "ISC", + "dependencies": { + "minipass": "^3.1.1" + }, + "devDependencies": { + "@npmcli/eslint-config": "^3.0.1", + "@npmcli/template-oss": "3.2.2", + "tap": "^16.0.1" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + }, + "templateOSS": { + "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", + "version": "3.2.2" + } +} diff --git a/node_modules/cacache/package.json b/node_modules/cacache/package.json index edae9a4f995b4..3467f8af804ed 100644 --- a/node_modules/cacache/package.json +++ b/node_modules/cacache/package.json @@ -1,6 +1,6 @@ { "name": "cacache", - "version": "16.0.3", + "version": "16.0.4", "cache-version": { "content": "2", "index": "5" @@ -50,7 +50,7 @@ "license": "ISC", "dependencies": { "@npmcli/fs": "^2.1.0", - "@npmcli/move-file": "^1.1.2", + "@npmcli/move-file": "^2.0.0", "chownr": "^2.0.0", "fs-minipass": "^2.1.0", "glob": "^7.2.0", @@ -64,13 +64,13 @@ "p-map": "^4.0.0", "promise-inflight": "^1.0.1", "rimraf": "^3.0.2", - "ssri": "^8.0.1", + "ssri": "^9.0.0", "tar": "^6.1.11", "unique-filename": "^1.1.1" }, "devDependencies": { "@npmcli/eslint-config": "^3.0.1", - "@npmcli/template-oss": "3.1.2", + "@npmcli/template-oss": "3.2.2", "benchmark": "^2.1.4", "chalk": "^4.1.2", "require-inject": "^1.4.4", @@ -87,7 +87,7 @@ "templateOSS": { "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", "windowsCI": false, - "version": "3.1.2" + "version": "3.2.2" }, "author": "GitHub Inc." } diff --git a/package-lock.json b/package-lock.json index 509e35da07db3..894cfae8eb450 100644 --- a/package-lock.json +++ b/package-lock.json @@ -99,7 +99,7 @@ "ansicolors": "~0.3.2", "ansistyles": "~0.1.3", "archy": "~1.0.0", - "cacache": "^16.0.3", + "cacache": "^16.0.4", "chalk": "^4.1.2", "chownr": "^2.0.0", "cli-columns": "^4.0.0", @@ -976,7 +976,6 @@ }, "node_modules/@npmcli/move-file": { "version": "1.1.2", - "inBundle": true, "license": "MIT", "dependencies": { "mkdirp": "^1.0.4", @@ -1579,12 +1578,13 @@ } }, "node_modules/cacache": { - "version": "16.0.3", + "version": "16.0.4", + "resolved": "https://registry.npmjs.org/cacache/-/cacache-16.0.4.tgz", + "integrity": "sha512-U0D4wF3/W8ZgK4qDA5fTtOVSr0gaDfd5aa7tUdAV0uukVWKsAIn6SzXQCoVlg7RWZiJa+bcsM3/pXLumGaL2Ug==", "inBundle": true, - "license": "ISC", "dependencies": { "@npmcli/fs": "^2.1.0", - "@npmcli/move-file": "^1.1.2", + "@npmcli/move-file": "^2.0.0", "chownr": "^2.0.0", "fs-minipass": "^2.1.0", "glob": "^7.2.0", @@ -1598,7 +1598,7 @@ "p-map": "^4.0.0", "promise-inflight": "^1.0.1", "rimraf": "^3.0.2", - "ssri": "^8.0.1", + "ssri": "^9.0.0", "tar": "^6.1.11", "unique-filename": "^1.1.1" }, @@ -1606,6 +1606,31 @@ "node": "^12.13.0 || ^14.15.0 || >=16.0.0" } }, + "node_modules/cacache/node_modules/@npmcli/move-file": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@npmcli/move-file/-/move-file-2.0.0.tgz", + "integrity": "sha512-UR6D5f4KEGWJV6BGPH3Qb2EtgH+t+1XQ1Tt85c7qicN6cezzuHPdZwwAxqZr4JLtnQu0LZsTza/5gmNmSl8XLg==", + "inBundle": true, + "dependencies": { + "mkdirp": "^1.0.4", + "rimraf": "^3.0.2" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, + "node_modules/cacache/node_modules/ssri": { + "version": "9.0.0", + "resolved": "https://registry.npmjs.org/ssri/-/ssri-9.0.0.tgz", + "integrity": "sha512-Y1Z6J8UYnexKFN1R/hxUaYoY2LVdKEzziPmVAFKiKX8fiwvCJTVzn/xYE9TEWod5OVyNfIHHuVfIEuBClL/uJQ==", + "inBundle": true, + "dependencies": { + "minipass": "^3.1.1" + }, + "engines": { + "node": "^12.13.0 || ^14.15.0 || >=16.0.0" + } + }, "node_modules/caching-transform": { "version": "4.0.0", "dev": true, @@ -10826,10 +10851,12 @@ } }, "cacache": { - "version": "16.0.3", + "version": "16.0.4", + "resolved": "https://registry.npmjs.org/cacache/-/cacache-16.0.4.tgz", + "integrity": "sha512-U0D4wF3/W8ZgK4qDA5fTtOVSr0gaDfd5aa7tUdAV0uukVWKsAIn6SzXQCoVlg7RWZiJa+bcsM3/pXLumGaL2Ug==", "requires": { "@npmcli/fs": "^2.1.0", - "@npmcli/move-file": "^1.1.2", + "@npmcli/move-file": "^2.0.0", "chownr": "^2.0.0", "fs-minipass": "^2.1.0", "glob": "^7.2.0", @@ -10843,9 +10870,28 @@ "p-map": "^4.0.0", "promise-inflight": "^1.0.1", "rimraf": "^3.0.2", - "ssri": "^8.0.1", + "ssri": "^9.0.0", "tar": "^6.1.11", "unique-filename": "^1.1.1" + }, + "dependencies": { + "@npmcli/move-file": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@npmcli/move-file/-/move-file-2.0.0.tgz", + "integrity": "sha512-UR6D5f4KEGWJV6BGPH3Qb2EtgH+t+1XQ1Tt85c7qicN6cezzuHPdZwwAxqZr4JLtnQu0LZsTza/5gmNmSl8XLg==", + "requires": { + "mkdirp": "^1.0.4", + "rimraf": "^3.0.2" + } + }, + "ssri": { + "version": "9.0.0", + "resolved": "https://registry.npmjs.org/ssri/-/ssri-9.0.0.tgz", + "integrity": "sha512-Y1Z6J8UYnexKFN1R/hxUaYoY2LVdKEzziPmVAFKiKX8fiwvCJTVzn/xYE9TEWod5OVyNfIHHuVfIEuBClL/uJQ==", + "requires": { + "minipass": "^3.1.1" + } + } } }, "caching-transform": { diff --git a/package.json b/package.json index 807df037dcc2f..bf4f4536f0007 100644 --- a/package.json +++ b/package.json @@ -66,7 +66,7 @@ "ansicolors": "~0.3.2", "ansistyles": "~0.1.3", "archy": "~1.0.0", - "cacache": "^16.0.3", + "cacache": "^16.0.4", "chalk": "^4.1.2", "chownr": "^2.0.0", "cli-columns": "^4.0.0",