deps: update bin-links, promise-spawn, and pacote

node_modules/@npmcli/promise-spawn/lib/index.js

@@ -83,20 +83,27 @@ const spawnWithShell = (cmd, args, opts, extra) => {
   if (isCmd) {
     let doubleEscape = false
 
-    // find the actual command we're running
+    // Decode the executable token so escaped batch shims still get double escaping.
     let initialCmd = ''
     let insideQuotes = false
     for (let i = 0; i < cmd.length; ++i) {
       const char = cmd.charAt(i)
+      if (char === '^' && !insideQuotes && i + 1 < cmd.length) {
+        initialCmd += cmd.charAt(++i)
+        continue
+      }
       if (char === ' ' && !insideQuotes) {
         break
       }
 
       initialCmd += char
-      if (char === '"' || char === "'") {
+      if (char === '"') {
         insideQuotes = !insideQuotes
       }
     }
+    if (initialCmd.startsWith('"') && initialCmd.endsWith('"')) {
+      initialCmd = initialCmd.slice(1, -1)
+    }
 
     let pathToInitial
     try {

node_modules/@npmcli/promise-spawn/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/promise-spawn",
-  "version": "10.0.0",
+  "version": "10.0.1",
   "files": [
     "bin/",
     "lib/"
@@ -32,8 +32,8 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/eslint-config": "^7.0.0",
+    "@npmcli/template-oss": "5.1.1",
     "spawk": "^1.7.1",
     "tap": "^16.0.1"
   },
@@ -42,7 +42,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
+    "version": "5.1.1",
     "publish": true
   },
   "dependencies": {

node_modules/bin-links/lib/get-paths.js

@@ -5,11 +5,13 @@ const binTarget = require('./bin-target.js')
 const manTarget = require('./man-target.js')
 const { resolve, basename, extname } = require('path')
 const isWindows = require('./is-windows.js')
+const normalize = require('npm-normalize-package-bin')
 module.exports = ({ path, pkg, global, top }) => {
   if (top && !global) {
     return []
   }
 
+  pkg = normalize({ ...pkg })
   const binSet = []
   const binTarg = binTarget({ path, top })
   if (pkg.bin) {

node_modules/bin-links/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bin-links",
-  "version": "7.0.0",
+  "version": "7.0.1",
   "description": "JavaScript package binary linker",
   "main": "./lib/index.js",
   "scripts": {
@@ -31,8 +31,8 @@
     "write-file-atomic": "^8.0.0"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/eslint-config": "^7.0.0",
+    "@npmcli/template-oss": "5.1.1",
     "require-inject": "^1.4.4",
     "tap": "^16.0.1"
   },
@@ -55,7 +55,7 @@
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
     "windowsCI": false,
-    "version": "5.1.0",
+    "version": "5.1.1",
     "publish": true,
     "updateNpm": false
   }

node_modules/pacote/lib/registry.js

@@ -113,6 +113,70 @@ class RegistryFetcher extends Fetcher {
     }
   }
 
+  // Registry signatures and attestations authenticate `name@version`, so the
+  // manifest must claim the requested name and be listed under its own
+  // version.  Otherwise a registry could replay validly signed metadata from
+  // another package (or another version) and have it verify as this one.
+  #verifyManifestIdentity (packument, picked) {
+    const pickedId = `${picked.name}@${picked.version}`
+    if (picked.name !== this.spec.name) {
+      const message = [
+        `${this.spec.name} registry manifest has mismatched package name:`,
+        `expected ${this.spec.name} but got ${pickedId}`,
+      ].join(' ')
+      throw Object.assign(new Error(message), {
+        code: 'EMANIFESTMISMATCH',
+        expected: this.spec.name,
+        found: pickedId,
+      })
+    }
+    if (picked._id && picked._id !== pickedId) {
+      const message = [
+        `${pickedId} registry manifest has mismatched id:`,
+        `expected ${pickedId} but got ${picked._id}`,
+      ].join(' ')
+      throw Object.assign(new Error(message), {
+        code: 'EMANIFESTMISMATCH',
+        expected: pickedId,
+        found: picked._id,
+      })
+    }
+
+    // without dist there are no signatures or attestations to authenticate
+    if (!picked.dist) {
+      return
+    }
+
+    // npm-pick-manifest may return a shallow copy, so match on the dist object
+    const matchesPickedManifest = manifest => manifest.dist === picked.dist
+    const versionCollections = [
+      packument.versions,
+      packument.stagedVersions?.versions,
+      packument.policyRestrictions?.versions,
+    ]
+    const matchingVersionKeys = []
+    for (const manifestsByVersion of versionCollections) {
+      for (const versionKey in manifestsByVersion) {
+        if (Object.hasOwn(manifestsByVersion, versionKey) &&
+            matchesPickedManifest(manifestsByVersion[versionKey])) {
+          matchingVersionKeys.push(versionKey)
+        }
+      }
+    }
+
+    if (matchingVersionKeys.some(versionKey => versionKey !== picked.version)) {
+      const message = [
+        `${pickedId} registry manifest has mismatched version:`,
+        `listed in the packument as ${matchingVersionKeys.join(', ')}`,
+      ].join(' ')
+      throw Object.assign(new Error(message), {
+        code: 'EMANIFESTMISMATCH',
+        expected: matchingVersionKeys,
+        found: pickedId,
+      })
+    }
+  }
+
   async manifest () {
     if (this.package) {
       return this.package
@@ -127,11 +191,16 @@ class RegistryFetcher extends Fetcher {
 
     const packument = await this.packument()
     const steps = PackageJson.normalizeSteps.filter(s => s !== '_attributes')
-    const mani = await new PackageJson().fromContent(pickManifest(packument, this.spec.fetchSpec, {
+    const picked = pickManifest(packument, this.spec.fetchSpec, {
       ...this.opts,
       defaultTag: this.defaultTag,
       before: this.before,
-    })).normalize({ steps }).then(p => p.content)
+    })
+    if (this.opts.verifySignatures || this.opts.verifyAttestations) {
+      this.#verifyManifestIdentity(packument, picked)
+    }
+    const mani = await new PackageJson().fromContent(picked)
+      .normalize({ steps }).then(p => p.content)
 
     /* XXX add ETARGET and E403 revalidation of cached packuments here */
 

node_modules/pacote/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "22.0.0",
+  "version": "22.0.1",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -26,9 +26,9 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/arborist": "^9.0.2",
+    "@npmcli/arborist": "^10.0.1",
     "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/template-oss": "5.1.1",
     "hosted-git-info": "^10.1.1",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
@@ -73,7 +73,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
+    "version": "5.1.1",
     "windowsCI": false,
     "publish": "true",
     "updateNpm": false

package-lock.json

@@ -94,13 +94,13 @@
         "@npmcli/map-workspaces": "^6.0.0",
         "@npmcli/metavuln-calculator": "^10.0.0",
         "@npmcli/package-json": "^8.0.0",
-        "@npmcli/promise-spawn": "^10.0.0",
+        "@npmcli/promise-spawn": "^10.0.1",
         "@npmcli/redact": "^5.0.0",
         "@npmcli/run-script": "^11.0.0",
         "@sigstore/tuf": "^5.0.0",
         "abbrev": "^5.0.0",
         "archy": "~1.0.0",
-        "bin-links": "^7.0.0",
+        "bin-links": "^7.0.1",
         "cacache": "^21.0.1",
         "chalk": "^5.6.2",
         "ci-info": "^4.4.0",
@@ -139,7 +139,7 @@
         "npm-registry-fetch": "^20.0.1",
         "npm-user-validate": "^5.0.0",
         "p-map": "^7.0.4",
-        "pacote": "^22.0.0",
+        "pacote": "^22.0.1",
         "parse-conflict-json": "^6.0.0",
         "proc-log": "^7.0.0",
         "qrcode-terminal": "^0.12.0",
@@ -1899,9 +1899,9 @@
       }
     },
     "node_modules/@npmcli/promise-spawn": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-10.0.0.tgz",
-      "integrity": "sha512-llZkSzeTsimFx64U+ThT2xQM2uEce8GIQUYvxgbB6ZFvBhV2LP9LeJJb3HT+syG0uCFLsTCHjV9SfC0WNU1vtA==",
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-10.0.1.tgz",
+      "integrity": "sha512-IstFcKAoEIZ7olS9iTwBsyNOZkIturafO2da9ocSP3LifRlm1+sxuo8IVM5phg5sNe0tNYLT0ZqCBRTLNzz0AA==",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
@@ -3603,9 +3603,9 @@
       }
     },
     "node_modules/bin-links": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/bin-links/-/bin-links-7.0.0.tgz",
-      "integrity": "sha512-kEk4UROE3064ebMhwmW1qx5BFSBWzmqMe0UwUzn5gsbDyXHmqMUSO8MW6sieYNiRJsindpdnjg4U0D9iXUkIxQ==",
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/bin-links/-/bin-links-7.0.1.tgz",
+      "integrity": "sha512-lgxd7FtxW02eSuafotQOGEQf1iGfDExMz2BRaL+e1tU5xTLx+vvSVA5oHIO6B1tR91LDKcWqYGsktUHdFMtHHQ==",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
@@ -9706,9 +9706,9 @@
       "license": "BlueOak-1.0.0"
     },
     "node_modules/pacote": {
-      "version": "22.0.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-22.0.0.tgz",
-      "integrity": "sha512-++VqeOZeL03uGM2MFLk96jGCSt1owBGkyFKoPr+trwNlZhCpjN2RrvwYxt8nTbs1wNMqSFYurq0TafVWkAIHig==",
+      "version": "22.0.1",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-22.0.1.tgz",
+      "integrity": "sha512-pu51B21E5u3MXD+ujjYO09ppqXmFLph1iPR17ySgKoakAj/iDApcMoQprUff8Wj96emV2tFhMRFkCvEMFnIDPQ==",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {

package.json

@@ -55,13 +55,13 @@
     "@npmcli/map-workspaces": "^6.0.0",
     "@npmcli/metavuln-calculator": "^10.0.0",
     "@npmcli/package-json": "^8.0.0",
-    "@npmcli/promise-spawn": "^10.0.0",
+    "@npmcli/promise-spawn": "^10.0.1",
     "@npmcli/redact": "^5.0.0",
     "@npmcli/run-script": "^11.0.0",
     "@sigstore/tuf": "^5.0.0",
     "abbrev": "^5.0.0",
     "archy": "~1.0.0",
-    "bin-links": "^7.0.0",
+    "bin-links": "^7.0.1",
     "cacache": "^21.0.1",
     "chalk": "^5.6.2",
     "ci-info": "^4.4.0",
@@ -100,7 +100,7 @@
     "npm-registry-fetch": "^20.0.1",
     "npm-user-validate": "^5.0.0",
     "p-map": "^7.0.4",
-    "pacote": "^22.0.0",
+    "pacote": "^22.0.1",
     "parse-conflict-json": "^6.0.0",
     "proc-log": "^7.0.0",
     "qrcode-terminal": "^0.12.0",