From b696461eaee85255be329e39a747dc6d90a27ce6 Mon Sep 17 00:00:00 2001 From: Martin Ruiz Date: Wed, 21 Oct 2026 18:48:26 +0000 Subject: [PATCH 1/3] deps: bin-links@7.0.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 330b549f-83dd-4218-81b7-003cc008f869 --- node_modules/bin-links/lib/get-paths.js | 2 ++ node_modules/bin-links/package.json | 8 ++++---- package-lock.json | 8 ++++---- package.json | 2 +- 4 files changed, 11 insertions(+), 9 deletions(-) diff --git a/node_modules/bin-links/lib/get-paths.js b/node_modules/bin-links/lib/get-paths.js index b93e6982dce22..871a9c4a812ed 100644 --- a/node_modules/bin-links/lib/get-paths.js +++ b/node_modules/bin-links/lib/get-paths.js @@ -5,11 +5,13 @@ const binTarget = require('./bin-target.js') const manTarget = require('./man-target.js') const { resolve, basename, extname } = require('path') const isWindows = require('./is-windows.js') +const normalize = require('npm-normalize-package-bin') module.exports = ({ path, pkg, global, top }) => { if (top && !global) { return [] } + pkg = normalize({ ...pkg }) const binSet = [] const binTarg = binTarget({ path, top }) if (pkg.bin) { diff --git a/node_modules/bin-links/package.json b/node_modules/bin-links/package.json index a6d8ae822178f..a265be3dd9046 100644 --- a/node_modules/bin-links/package.json +++ b/node_modules/bin-links/package.json @@ -1,6 +1,6 @@ { "name": "bin-links", - "version": "7.0.0", + "version": "7.0.1", "description": "JavaScript package binary linker", "main": "./lib/index.js", "scripts": { @@ -31,8 +31,8 @@ "write-file-atomic": "^8.0.0" }, "devDependencies": { - "@npmcli/eslint-config": "^6.0.0", - "@npmcli/template-oss": "5.1.0", + "@npmcli/eslint-config": "^7.0.0", + "@npmcli/template-oss": "5.1.1", "require-inject": "^1.4.4", "tap": "^16.0.1" }, @@ -55,7 +55,7 @@ "templateOSS": { "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", "windowsCI": false, - "version": "5.1.0", + "version": "5.1.1", "publish": true, "updateNpm": false } diff --git a/package-lock.json b/package-lock.json index c813c9987e585..8417881ae303d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -100,7 +100,7 @@ "@sigstore/tuf": "^5.0.0", "abbrev": "^5.0.0", "archy": "~1.0.0", - "bin-links": "^7.0.0", + "bin-links": "^7.0.1", "cacache": "^21.0.1", "chalk": "^5.6.2", "ci-info": "^4.4.0", @@ -3603,9 +3603,9 @@ } }, "node_modules/bin-links": { - "version": "7.0.0", - "resolved": "https://registry.npmjs.org/bin-links/-/bin-links-7.0.0.tgz", - "integrity": "sha512-kEk4UROE3064ebMhwmW1qx5BFSBWzmqMe0UwUzn5gsbDyXHmqMUSO8MW6sieYNiRJsindpdnjg4U0D9iXUkIxQ==", + "version": "7.0.1", + "resolved": "https://registry.npmjs.org/bin-links/-/bin-links-7.0.1.tgz", + "integrity": "sha512-lgxd7FtxW02eSuafotQOGEQf1iGfDExMz2BRaL+e1tU5xTLx+vvSVA5oHIO6B1tR91LDKcWqYGsktUHdFMtHHQ==", "inBundle": true, "license": "ISC", "dependencies": { diff --git a/package.json b/package.json index 68a2c8ce7130e..44a9b4bcbc933 100644 --- a/package.json +++ b/package.json @@ -61,7 +61,7 @@ "@sigstore/tuf": "^5.0.0", "abbrev": "^5.0.0", "archy": "~1.0.0", - "bin-links": "^7.0.0", + "bin-links": "^7.0.1", "cacache": "^21.0.1", "chalk": "^5.6.2", "ci-info": "^4.4.0", From 5a89f8872ce477e595bfeae2782bc2dc1af83bcf Mon Sep 17 00:00:00 2001 From: Martin Ruiz Date: Wed, 21 Oct 2026 18:50:40 +0000 Subject: [PATCH 2/3] deps: promise-spawn@10.0.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 330b549f-83dd-4218-81b7-003cc008f869 --- node_modules/@npmcli/promise-spawn/lib/index.js | 11 +++++++++-- node_modules/@npmcli/promise-spawn/package.json | 8 ++++---- package-lock.json | 8 ++++---- package.json | 2 +- 4 files changed, 18 insertions(+), 11 deletions(-) diff --git a/node_modules/@npmcli/promise-spawn/lib/index.js b/node_modules/@npmcli/promise-spawn/lib/index.js index 1faf62c9157df..d6d2c8cd048e5 100644 --- a/node_modules/@npmcli/promise-spawn/lib/index.js +++ b/node_modules/@npmcli/promise-spawn/lib/index.js @@ -83,20 +83,27 @@ const spawnWithShell = (cmd, args, opts, extra) => { if (isCmd) { let doubleEscape = false - // find the actual command we're running + // Decode the executable token so escaped batch shims still get double escaping. let initialCmd = '' let insideQuotes = false for (let i = 0; i < cmd.length; ++i) { const char = cmd.charAt(i) + if (char === '^' && !insideQuotes && i + 1 < cmd.length) { + initialCmd += cmd.charAt(++i) + continue + } if (char === ' ' && !insideQuotes) { break } initialCmd += char - if (char === '"' || char === "'") { + if (char === '"') { insideQuotes = !insideQuotes } } + if (initialCmd.startsWith('"') && initialCmd.endsWith('"')) { + initialCmd = initialCmd.slice(1, -1) + } let pathToInitial try { diff --git a/node_modules/@npmcli/promise-spawn/package.json b/node_modules/@npmcli/promise-spawn/package.json index b227171eebd1f..ca32578867a04 100644 --- a/node_modules/@npmcli/promise-spawn/package.json +++ b/node_modules/@npmcli/promise-spawn/package.json @@ -1,6 +1,6 @@ { "name": "@npmcli/promise-spawn", - "version": "10.0.0", + "version": "10.0.1", "files": [ "bin/", "lib/" @@ -32,8 +32,8 @@ ] }, "devDependencies": { - "@npmcli/eslint-config": "^6.0.0", - "@npmcli/template-oss": "5.1.0", + "@npmcli/eslint-config": "^7.0.0", + "@npmcli/template-oss": "5.1.1", "spawk": "^1.7.1", "tap": "^16.0.1" }, @@ -42,7 +42,7 @@ }, "templateOSS": { "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", - "version": "5.1.0", + "version": "5.1.1", "publish": true }, "dependencies": { diff --git a/package-lock.json b/package-lock.json index 8417881ae303d..abc3fde6670ef 100644 --- a/package-lock.json +++ b/package-lock.json @@ -94,7 +94,7 @@ "@npmcli/map-workspaces": "^6.0.0", "@npmcli/metavuln-calculator": "^10.0.0", "@npmcli/package-json": "^8.0.0", - "@npmcli/promise-spawn": "^10.0.0", + "@npmcli/promise-spawn": "^10.0.1", "@npmcli/redact": "^5.0.0", "@npmcli/run-script": "^11.0.0", "@sigstore/tuf": "^5.0.0", @@ -1899,9 +1899,9 @@ } }, "node_modules/@npmcli/promise-spawn": { - "version": "10.0.0", - "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-10.0.0.tgz", - "integrity": "sha512-llZkSzeTsimFx64U+ThT2xQM2uEce8GIQUYvxgbB6ZFvBhV2LP9LeJJb3HT+syG0uCFLsTCHjV9SfC0WNU1vtA==", + "version": "10.0.1", + "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-10.0.1.tgz", + "integrity": "sha512-IstFcKAoEIZ7olS9iTwBsyNOZkIturafO2da9ocSP3LifRlm1+sxuo8IVM5phg5sNe0tNYLT0ZqCBRTLNzz0AA==", "inBundle": true, "license": "ISC", "dependencies": { diff --git a/package.json b/package.json index 44a9b4bcbc933..7509b94a64a7f 100644 --- a/package.json +++ b/package.json @@ -55,7 +55,7 @@ "@npmcli/map-workspaces": "^6.0.0", "@npmcli/metavuln-calculator": "^10.0.0", "@npmcli/package-json": "^8.0.0", - "@npmcli/promise-spawn": "^10.0.0", + "@npmcli/promise-spawn": "^10.0.1", "@npmcli/redact": "^5.0.0", "@npmcli/run-script": "^11.0.0", "@sigstore/tuf": "^5.0.0", From 5fe6490a9a2a21034d4f09549542ea299fe89ed2 Mon Sep 17 00:00:00 2001 From: Martin Ruiz Date: Wed, 21 Oct 2026 18:52:48 +0000 Subject: [PATCH 3/3] deps: pacote@22.0.1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 330b549f-83dd-4218-81b7-003cc008f869 --- node_modules/pacote/lib/registry.js | 73 ++++++++++++++++++++++++++++- node_modules/pacote/package.json | 8 ++-- package-lock.json | 8 ++-- package.json | 2 +- 4 files changed, 80 insertions(+), 11 deletions(-) diff --git a/node_modules/pacote/lib/registry.js b/node_modules/pacote/lib/registry.js index f50b27956dbeb..25278564da91b 100644 --- a/node_modules/pacote/lib/registry.js +++ b/node_modules/pacote/lib/registry.js @@ -113,6 +113,70 @@ class RegistryFetcher extends Fetcher { } } + // Registry signatures and attestations authenticate `name@version`, so the + // manifest must claim the requested name and be listed under its own + // version. Otherwise a registry could replay validly signed metadata from + // another package (or another version) and have it verify as this one. + #verifyManifestIdentity (packument, picked) { + const pickedId = `${picked.name}@${picked.version}` + if (picked.name !== this.spec.name) { + const message = [ + `${this.spec.name} registry manifest has mismatched package name:`, + `expected ${this.spec.name} but got ${pickedId}`, + ].join(' ') + throw Object.assign(new Error(message), { + code: 'EMANIFESTMISMATCH', + expected: this.spec.name, + found: pickedId, + }) + } + if (picked._id && picked._id !== pickedId) { + const message = [ + `${pickedId} registry manifest has mismatched id:`, + `expected ${pickedId} but got ${picked._id}`, + ].join(' ') + throw Object.assign(new Error(message), { + code: 'EMANIFESTMISMATCH', + expected: pickedId, + found: picked._id, + }) + } + + // without dist there are no signatures or attestations to authenticate + if (!picked.dist) { + return + } + + // npm-pick-manifest may return a shallow copy, so match on the dist object + const matchesPickedManifest = manifest => manifest.dist === picked.dist + const versionCollections = [ + packument.versions, + packument.stagedVersions?.versions, + packument.policyRestrictions?.versions, + ] + const matchingVersionKeys = [] + for (const manifestsByVersion of versionCollections) { + for (const versionKey in manifestsByVersion) { + if (Object.hasOwn(manifestsByVersion, versionKey) && + matchesPickedManifest(manifestsByVersion[versionKey])) { + matchingVersionKeys.push(versionKey) + } + } + } + + if (matchingVersionKeys.some(versionKey => versionKey !== picked.version)) { + const message = [ + `${pickedId} registry manifest has mismatched version:`, + `listed in the packument as ${matchingVersionKeys.join(', ')}`, + ].join(' ') + throw Object.assign(new Error(message), { + code: 'EMANIFESTMISMATCH', + expected: matchingVersionKeys, + found: pickedId, + }) + } + } + async manifest () { if (this.package) { return this.package @@ -127,11 +191,16 @@ class RegistryFetcher extends Fetcher { const packument = await this.packument() const steps = PackageJson.normalizeSteps.filter(s => s !== '_attributes') - const mani = await new PackageJson().fromContent(pickManifest(packument, this.spec.fetchSpec, { + const picked = pickManifest(packument, this.spec.fetchSpec, { ...this.opts, defaultTag: this.defaultTag, before: this.before, - })).normalize({ steps }).then(p => p.content) + }) + if (this.opts.verifySignatures || this.opts.verifyAttestations) { + this.#verifyManifestIdentity(packument, picked) + } + const mani = await new PackageJson().fromContent(picked) + .normalize({ steps }).then(p => p.content) /* XXX add ETARGET and E403 revalidation of cached packuments here */ diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json index 2e544354ef85d..44339363065b8 100644 --- a/node_modules/pacote/package.json +++ b/node_modules/pacote/package.json @@ -1,6 +1,6 @@ { "name": "pacote", - "version": "22.0.0", + "version": "22.0.1", "description": "JavaScript package downloader", "author": "GitHub Inc.", "bin": { @@ -26,9 +26,9 @@ ] }, "devDependencies": { - "@npmcli/arborist": "^9.0.2", + "@npmcli/arborist": "^10.0.1", "@npmcli/eslint-config": "^7.0.0", - "@npmcli/template-oss": "5.1.0", + "@npmcli/template-oss": "5.1.1", "hosted-git-info": "^10.1.1", "mutate-fs": "^2.1.1", "nock": "^13.2.4", @@ -73,7 +73,7 @@ }, "templateOSS": { "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", - "version": "5.1.0", + "version": "5.1.1", "windowsCI": false, "publish": "true", "updateNpm": false diff --git a/package-lock.json b/package-lock.json index abc3fde6670ef..6079f8d9e868d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -139,7 +139,7 @@ "npm-registry-fetch": "^20.0.1", "npm-user-validate": "^5.0.0", "p-map": "^7.0.4", - "pacote": "^22.0.0", + "pacote": "^22.0.1", "parse-conflict-json": "^6.0.0", "proc-log": "^7.0.0", "qrcode-terminal": "^0.12.0", @@ -9706,9 +9706,9 @@ "license": "BlueOak-1.0.0" }, "node_modules/pacote": { - "version": "22.0.0", - "resolved": "https://registry.npmjs.org/pacote/-/pacote-22.0.0.tgz", - "integrity": "sha512-++VqeOZeL03uGM2MFLk96jGCSt1owBGkyFKoPr+trwNlZhCpjN2RrvwYxt8nTbs1wNMqSFYurq0TafVWkAIHig==", + "version": "22.0.1", + "resolved": "https://registry.npmjs.org/pacote/-/pacote-22.0.1.tgz", + "integrity": "sha512-pu51B21E5u3MXD+ujjYO09ppqXmFLph1iPR17ySgKoakAj/iDApcMoQprUff8Wj96emV2tFhMRFkCvEMFnIDPQ==", "inBundle": true, "license": "ISC", "dependencies": { diff --git a/package.json b/package.json index 7509b94a64a7f..b90a1e0a30d60 100644 --- a/package.json +++ b/package.json @@ -100,7 +100,7 @@ "npm-registry-fetch": "^20.0.1", "npm-user-validate": "^5.0.0", "p-map": "^7.0.4", - "pacote": "^22.0.0", + "pacote": "^22.0.1", "parse-conflict-json": "^6.0.0", "proc-log": "^7.0.0", "qrcode-terminal": "^0.12.0",