fix: correct bundled sigstore from dev dependency conflict

DEPENDENCIES.json

@@ -21,8 +21,8 @@
     "libnpmversion"
   ],
   [
-    "@npmcli/run-script",
     "@npmcli/map-workspaces",
+    "@npmcli/run-script",
     "libnpmaccess",
     "libnpmorg",
     "libnpmpublish",
@@ -41,43 +41,43 @@
   ],
   [
     "@npmcli/smoke-tests",
-    "npm-pick-manifest",
     "@npmcli/installed-package-contents",
+    "npm-pick-manifest",
     "cacache",
     "promzard"
   ],
   [
     "@npmcli/docs",
-    "npm-package-arg",
+    "@npmcli/fs",
+    "npm-bundled",
     "@npmcli/promise-spawn",
     "npm-install-checks",
-    "npm-bundled",
-    "@npmcli/fs",
+    "npm-package-arg",
     "npm-packlist",
-    "@npmcli/mock-globals",
     "bin-links",
     "nopt",
     "parse-conflict-json",
+    "@npmcli/mock-globals",
     "read"
   ],
   [
     "@npmcli/eslint-config",
     "@npmcli/template-oss",
     "ignore-walk",
     "semver",
+    "npm-normalize-package-bin",
+    "@npmcli/name-from-folder",
+    "which",
+    "ini",
     "hosted-git-info",
     "proc-log",
     "validate-npm-package-name",
-    "which",
-    "ini",
-    "npm-normalize-package-bin",
     "json-parse-even-better-errors",
-    "@npmcli/node-gyp",
     "ssri",
+    "@npmcli/node-gyp",
     "@npmcli/redact",
     "@npmcli/agent",
     "minipass-fetch",
-    "@npmcli/name-from-folder",
     "@npmcli/query",
     "cmd-shim",
     "read-cmd-shim",

DEPENDENCIES.md

@@ -742,9 +742,9 @@ packages higher up the chain.
  - @npmcli/arborist
  - @npmcli/metavuln-calculator
  - pacote, @npmcli/config, libnpmversion
- - @npmcli/run-script, @npmcli/map-workspaces, libnpmaccess, libnpmorg, libnpmpublish, libnpmsearch, libnpmteam, init-package-json, npm-profile
+ - @npmcli/map-workspaces, @npmcli/run-script, libnpmaccess, libnpmorg, libnpmpublish, libnpmsearch, libnpmteam, init-package-json, npm-profile
  - @npmcli/package-json, npm-registry-fetch
  - @npmcli/git, make-fetch-happen
- - @npmcli/smoke-tests, npm-pick-manifest, @npmcli/installed-package-contents, cacache, promzard
- - @npmcli/docs, npm-package-arg, @npmcli/promise-spawn, npm-install-checks, npm-bundled, @npmcli/fs, npm-packlist, @npmcli/mock-globals, bin-links, nopt, parse-conflict-json, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, hosted-git-info, proc-log, validate-npm-package-name, which, ini, npm-normalize-package-bin, json-parse-even-better-errors, @npmcli/node-gyp, ssri, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/name-from-folder, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate
+ - @npmcli/smoke-tests, @npmcli/installed-package-contents, npm-pick-manifest, cacache, promzard
+ - @npmcli/docs, @npmcli/fs, npm-bundled, @npmcli/promise-spawn, npm-install-checks, npm-package-arg, npm-packlist, bin-links, nopt, parse-conflict-json, @npmcli/mock-globals, read
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, which, ini, hosted-git-info, proc-log, validate-npm-package-name, json-parse-even-better-errors, ssri, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate

mock-registry/package.json

@@ -46,7 +46,7 @@
     ]
   },
   "devDependencies": {
-    "@npmcli/arborist": "^9.1.2",
+    "@npmcli/arborist": "^10.0.0",
     "@npmcli/eslint-config": "^5.0.1",
     "@npmcli/template-oss": "5.1.1",
     "json-stringify-safe": "^5.0.1",

node_modules/.gitignore

@@ -36,11 +36,16 @@
 !/@npmcli/run-script
 !/@sigstore/
 /@sigstore/*
+!/@sigstore/bundle
+!/@sigstore/core
 !/@sigstore/protobuf-specs
+!/@sigstore/sign
 !/@sigstore/tuf
+!/@sigstore/verify
 !/@tufjs/
 /@tufjs/*
 !/@tufjs/canonical-json
+!/@tufjs/models
 !/abbrev
 !/aproba
 !/archy
@@ -51,7 +56,6 @@
 !/bin-links/node_modules/cmd-shim
 !/bin-links/node_modules/npm-normalize-package-bin
 !/bin-links/node_modules/read-cmd-shim
-!/bin-links/node_modules/write-file-atomic
 !/binary-extensions
 !/brace-expansion
 !/cacache
@@ -84,11 +88,9 @@
 !/just-diff
 !/lru-cache
 !/make-fetch-happen
-!/make-fetch-happen/node_modules/
-/make-fetch-happen/node_modules/*
-!/make-fetch-happen/node_modules/minipass-fetch
 !/minimatch
 !/minipass-collect
+!/minipass-fetch
 !/minipass-flush
 !/minipass-pipeline
 !/minipass-pipeline/node_modules/
@@ -116,21 +118,9 @@
 !/npm-pick-manifest/node_modules/npm-normalize-package-bin
 !/npm-profile
 !/npm-registry-fetch
-!/npm-registry-fetch/node_modules/
-/npm-registry-fetch/node_modules/*
-!/npm-registry-fetch/node_modules/minipass-fetch
 !/npm-user-validate
 !/p-map
 !/pacote
-!/pacote/node_modules/
-/pacote/node_modules/*
-!/pacote/node_modules/@sigstore/
-/pacote/node_modules/@sigstore/*
-!/pacote/node_modules/@sigstore/bundle
-!/pacote/node_modules/@sigstore/core
-!/pacote/node_modules/@sigstore/sign
-!/pacote/node_modules/@sigstore/verify
-!/pacote/node_modules/sigstore
 !/parse-conflict-json
 !/path-scurry
 !/postcss-selector-parser
@@ -145,6 +135,7 @@
 !/safer-buffer
 !/semver
 !/signal-exit
+!/sigstore
 !/smart-buffer
 !/socks-proxy-agent
 !/socks-proxy-agent/node_modules/
@@ -166,16 +157,12 @@
 !/tinyglobby/node_modules/picomatch
 !/treeverse
 !/tuf-js
-!/tuf-js/node_modules/
-/tuf-js/node_modules/*
-!/tuf-js/node_modules/@tufjs/
-/tuf-js/node_modules/@tufjs/*
-!/tuf-js/node_modules/@tufjs/models
 !/undici
 !/util-deprecate
 !/validate-npm-package-name
 !/walk-up-path
 !/which
+!/write-file-atomic
 !/yallist
 # Always ignore some specific patterns within any allowed package
 .bin/

node_modules/iconv-lite/encodings/sbcs-data.js

@@ -109,6 +109,8 @@ module.exports = {
 
   hebrew: "iso88598",
   hebrew8: "iso88598",
+  iso88598i: "iso88598",
+  iso88598e: "iso88598",
 
   turkish: "iso88599",
   turkish8: "iso88599",

node_modules/iconv-lite/encodings/utf32.js

@@ -31,7 +31,9 @@ function Utf32Encoder (options, codec) {
 
 Utf32Encoder.prototype.write = function (str) {
   var src = Buffer.from(str, "ucs2")
-  var dst = Buffer.alloc(src.length * 2)
+  // src.length * 2 covers this chunk's code units (4 bytes each); the extra 4 bytes leave room for a
+  // high surrogate held over from a previous chunk, which is flushed ahead of this chunk's units.
+  var dst = Buffer.alloc(src.length * 2 + 4)
   var write32 = this.isLE ? dst.writeUInt32LE : dst.writeUInt32BE
   var offset = 0
 
@@ -113,9 +115,9 @@ Utf32Decoder.prototype.write = function (src) {
       // NOTE: codepoint is a signed int32 and can be negative.
       // NOTE: We copied this block from below to help V8 optimize it (it works with array, not buffer).
       if (isLE) {
-        codepoint = overflow[i] | (overflow[i + 1] << 8) | (overflow[i + 2] << 16) | (overflow[i + 3] << 24)
+        codepoint = overflow[0] | (overflow[1] << 8) | (overflow[2] << 16) | (overflow[3] << 24)
       } else {
-        codepoint = overflow[i + 3] | (overflow[i + 2] << 8) | (overflow[i + 1] << 16) | (overflow[i] << 24)
+        codepoint = overflow[3] | (overflow[2] << 8) | (overflow[1] << 16) | (overflow[0] << 24)
       }
       overflow.length = 0
 
@@ -169,7 +171,12 @@ function _writeCodepoint (dst, offset, codepoint, badChar) {
 };
 
 Utf32Decoder.prototype.end = function () {
+  if (this.overflow.length === 0) { return }
+
+  // A leftover, incomplete 4-byte code unit at the end of the input is ill-formed. Substitute a
+  // single U+FFFD (Unicode Standard conformance clause C10) instead of silently dropping the bytes.
   this.overflow.length = 0
+  return String.fromCharCode(this.badChar)
 }
 
 // == UTF-32 Auto codec =============================================================

node_modules/iconv-lite/package.json

@@ -1,7 +1,7 @@
 {
     "name": "iconv-lite",
     "description": "Convert character encodings in pure javascript.",
-    "version": "0.7.2",
+    "version": "0.7.3",
     "license": "MIT",
     "keywords": [
         "iconv",
@@ -46,7 +46,7 @@
         "stream": false
     },
     "devDependencies": {
-        "@arethetypeswrong/cli": "^0.17.4",
+        "@arethetypeswrong/cli": "^0.18.4",
         "@stylistic/eslint-plugin": "^5.1.0",
         "@stylistic/eslint-plugin-js": "^4.1.0",
         "@types/node": "^24.0.12",

node_modules/lru-cache/dist/commonjs/browser/index.js

@@ -412,17 +412,17 @@ class LRUCache {
         this.#setItemTTL = (index, ttl, start = this.#perf.now()) => {
             starts[index] = ttl !== 0 ? start : 0;
             ttls[index] = ttl;
-            setPurgetTimer(index, ttl);
+            setPurgeTimer(index, ttl);
         };
         this.#updateItemAge = index => {
             starts[index] = ttls[index] !== 0 ? this.#perf.now() : 0;
-            setPurgetTimer(index, ttls[index]);
+            setPurgeTimer(index, ttls[index]);
         };
         // clear out the purge timer if we're setting TTL to 0, and
         // previously had a ttl purge timer running, so it doesn't
         // fire unnecessarily. Don't need to do this if we're not doing
         // autopurge.
-        const setPurgetTimer = !this.ttlAutopurge ?
+        const setPurgeTimer = !this.ttlAutopurge ?
             () => { }
             : (index, ttl) => {
                 if (purgeTimers?.[index]) {
@@ -433,6 +433,10 @@ class LRUCache {
                     const t = setTimeout(() => {
                         if (this.#isStale(index)) {
                             this.#delete(this.#keyList[index], 'expire');
+                            purgeTimers[index] = undefined;
+                        }
+                        else {
+                            setPurgeTimer(index, getRemainingTTL(index));
                         }
                     }, ttl + 1);
                     // unref() not supported on all platforms
@@ -482,6 +486,9 @@ class LRUCache {
             if (index === undefined) {
                 return 0;
             }
+            return getRemainingTTL(index);
+        };
+        const getRemainingTTL = (index) => {
             const ttl = ttls[index];
             const start = starts[index];
             if (!ttl || !start) {
@@ -1621,7 +1628,7 @@ class LRUCache {
             const index = this.#keyMap.get(k);
             if (index !== undefined) {
                 if (this.#autopurgeTimers?.[index]) {
-                    clearTimeout(this.#autopurgeTimers?.[index]);
+                    clearTimeout(this.#autopurgeTimers[index]);
                     this.#autopurgeTimers[index] = undefined;
                 }
                 deleted = true;

node_modules/lru-cache/dist/commonjs/index.js

@@ -412,17 +412,17 @@ class LRUCache {
         this.#setItemTTL = (index, ttl, start = this.#perf.now()) => {
             starts[index] = ttl !== 0 ? start : 0;
             ttls[index] = ttl;
-            setPurgetTimer(index, ttl);
+            setPurgeTimer(index, ttl);
         };
         this.#updateItemAge = index => {
             starts[index] = ttls[index] !== 0 ? this.#perf.now() : 0;
-            setPurgetTimer(index, ttls[index]);
+            setPurgeTimer(index, ttls[index]);
         };
         // clear out the purge timer if we're setting TTL to 0, and
         // previously had a ttl purge timer running, so it doesn't
         // fire unnecessarily. Don't need to do this if we're not doing
         // autopurge.
-        const setPurgetTimer = !this.ttlAutopurge ?
+        const setPurgeTimer = !this.ttlAutopurge ?
             () => { }
             : (index, ttl) => {
                 if (purgeTimers?.[index]) {
@@ -433,6 +433,10 @@ class LRUCache {
                     const t = setTimeout(() => {
                         if (this.#isStale(index)) {
                             this.#delete(this.#keyList[index], 'expire');
+                            purgeTimers[index] = undefined;
+                        }
+                        else {
+                            setPurgeTimer(index, getRemainingTTL(index));
                         }
                     }, ttl + 1);
                     // unref() not supported on all platforms
@@ -482,6 +486,9 @@ class LRUCache {
             if (index === undefined) {
                 return 0;
             }
+            return getRemainingTTL(index);
+        };
+        const getRemainingTTL = (index) => {
             const ttl = ttls[index];
             const start = starts[index];
             if (!ttl || !start) {
@@ -1621,7 +1628,7 @@ class LRUCache {
             const index = this.#keyMap.get(k);
             if (index !== undefined) {
                 if (this.#autopurgeTimers?.[index]) {
-                    clearTimeout(this.#autopurgeTimers?.[index]);
+                    clearTimeout(this.#autopurgeTimers[index]);
                     this.#autopurgeTimers[index] = undefined;
                 }
                 deleted = true;

node_modules/lru-cache/dist/commonjs/node/index.js

@@ -412,17 +412,17 @@ class LRUCache {
         this.#setItemTTL = (index, ttl, start = this.#perf.now()) => {
             starts[index] = ttl !== 0 ? start : 0;
             ttls[index] = ttl;
-            setPurgetTimer(index, ttl);
+            setPurgeTimer(index, ttl);
         };
         this.#updateItemAge = index => {
             starts[index] = ttls[index] !== 0 ? this.#perf.now() : 0;
-            setPurgetTimer(index, ttls[index]);
+            setPurgeTimer(index, ttls[index]);
         };
         // clear out the purge timer if we're setting TTL to 0, and
         // previously had a ttl purge timer running, so it doesn't
         // fire unnecessarily. Don't need to do this if we're not doing
         // autopurge.
-        const setPurgetTimer = !this.ttlAutopurge ?
+        const setPurgeTimer = !this.ttlAutopurge ?
             () => { }
             : (index, ttl) => {
                 if (purgeTimers?.[index]) {
@@ -433,6 +433,10 @@ class LRUCache {
                     const t = setTimeout(() => {
                         if (this.#isStale(index)) {
                             this.#delete(this.#keyList[index], 'expire');
+                            purgeTimers[index] = undefined;
+                        }
+                        else {
+                            setPurgeTimer(index, getRemainingTTL(index));
                         }
                     }, ttl + 1);
                     // unref() not supported on all platforms
@@ -482,6 +486,9 @@ class LRUCache {
             if (index === undefined) {
                 return 0;
             }
+            return getRemainingTTL(index);
+        };
+        const getRemainingTTL = (index) => {
             const ttl = ttls[index];
             const start = starts[index];
             if (!ttl || !start) {
@@ -1621,7 +1628,7 @@ class LRUCache {
             const index = this.#keyMap.get(k);
             if (index !== undefined) {
                 if (this.#autopurgeTimers?.[index]) {
-                    clearTimeout(this.#autopurgeTimers?.[index]);
+                    clearTimeout(this.#autopurgeTimers[index]);
                     this.#autopurgeTimers[index] = undefined;
                 }
                 deleted = true;