From 0f96dd68acf86bee88540082b38a6330a99eb0c4 Mon Sep 17 00:00:00 2001 From: Martin Ruiz Date: Tue, 27 Oct 2026 22:11:07 +0000 Subject: [PATCH 1/3] deps: bin-links@6.0.3 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ff154955-6062-42af-92be-9bfeb1cd47f7 --- node_modules/bin-links/lib/get-paths.js | 2 ++ node_modules/bin-links/package.json | 3 ++- package-lock.json | 6 +++--- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/node_modules/bin-links/lib/get-paths.js b/node_modules/bin-links/lib/get-paths.js index b93e6982dce22..871a9c4a812ed 100644 --- a/node_modules/bin-links/lib/get-paths.js +++ b/node_modules/bin-links/lib/get-paths.js @@ -5,11 +5,13 @@ const binTarget = require('./bin-target.js') const manTarget = require('./man-target.js') const { resolve, basename, extname } = require('path') const isWindows = require('./is-windows.js') +const normalize = require('npm-normalize-package-bin') module.exports = ({ path, pkg, global, top }) => { if (top && !global) { return [] } + pkg = normalize({ ...pkg }) const binSet = [] const binTarg = binTarget({ path, top }) if (pkg.bin) { diff --git a/node_modules/bin-links/package.json b/node_modules/bin-links/package.json index 80a63323e884b..ad14153c11e29 100644 --- a/node_modules/bin-links/package.json +++ b/node_modules/bin-links/package.json @@ -1,6 +1,6 @@ { "name": "bin-links", - "version": "6.0.2", + "version": "6.0.3", "description": "JavaScript package binary linker", "main": "./lib/index.js", "scripts": { @@ -57,6 +57,7 @@ "windowsCI": false, "version": "4.30.0", "publish": true, + "backport": 6, "updateNpm": false, "latestCiVersion": 24 } diff --git a/package-lock.json b/package-lock.json index 1251a5305d7c6..451661d928505 100644 --- a/package-lock.json +++ b/package-lock.json @@ -2952,9 +2952,9 @@ } }, "node_modules/bin-links": { - "version": "6.0.2", - "resolved": "https://registry.npmjs.org/bin-links/-/bin-links-6.0.2.tgz", - "integrity": "sha512-frE1t78WOwJ45PKV2cF2tNPjTcs9L1J9s6VkrV59wanRP4GlaomuxYPVma7BwthMg8WnfSory4w5PTE6FZZ81w==", + "version": "6.0.3", + "resolved": "https://registry.npmjs.org/bin-links/-/bin-links-6.0.3.tgz", + "integrity": "sha512-Qg5FD7/YSReWJB1zaM8VIi1l4O637JKK/WPaF/JzJGy/9FcMDWtSklF0dOX5S9X2OMrPGhifIHIKuwtHG0IGFg==", "license": "ISC", "dependencies": { "cmd-shim": "^8.0.0", From 4db6d9c751794109d0c11a955a568559733a42e5 Mon Sep 17 00:00:00 2001 From: Martin Ruiz Date: Tue, 27 Oct 2026 22:11:15 +0000 Subject: [PATCH 2/3] deps: promise-spawn@9.0.2 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ff154955-6062-42af-92be-9bfeb1cd47f7 --- node_modules/@npmcli/promise-spawn/lib/index.js | 11 +++++++++-- node_modules/@npmcli/promise-spawn/package.json | 5 +++-- package-lock.json | 8 ++++---- package.json | 2 +- 4 files changed, 17 insertions(+), 9 deletions(-) diff --git a/node_modules/@npmcli/promise-spawn/lib/index.js b/node_modules/@npmcli/promise-spawn/lib/index.js index 1faf62c9157df..d6d2c8cd048e5 100644 --- a/node_modules/@npmcli/promise-spawn/lib/index.js +++ b/node_modules/@npmcli/promise-spawn/lib/index.js @@ -83,20 +83,27 @@ const spawnWithShell = (cmd, args, opts, extra) => { if (isCmd) { let doubleEscape = false - // find the actual command we're running + // Decode the executable token so escaped batch shims still get double escaping. let initialCmd = '' let insideQuotes = false for (let i = 0; i < cmd.length; ++i) { const char = cmd.charAt(i) + if (char === '^' && !insideQuotes && i + 1 < cmd.length) { + initialCmd += cmd.charAt(++i) + continue + } if (char === ' ' && !insideQuotes) { break } initialCmd += char - if (char === '"' || char === "'") { + if (char === '"') { insideQuotes = !insideQuotes } } + if (initialCmd.startsWith('"') && initialCmd.endsWith('"')) { + initialCmd = initialCmd.slice(1, -1) + } let pathToInitial try { diff --git a/node_modules/@npmcli/promise-spawn/package.json b/node_modules/@npmcli/promise-spawn/package.json index f00ee324355c8..747e7e1dcadcf 100644 --- a/node_modules/@npmcli/promise-spawn/package.json +++ b/node_modules/@npmcli/promise-spawn/package.json @@ -1,6 +1,6 @@ { "name": "@npmcli/promise-spawn", - "version": "9.0.1", + "version": "9.0.2", "files": [ "bin/", "lib/" @@ -43,7 +43,8 @@ "templateOSS": { "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", "version": "4.28.0", - "publish": true + "publish": true, + "backport": 9 }, "dependencies": { "which": "^6.0.0" diff --git a/package-lock.json b/package-lock.json index 451661d928505..b9fa0dedd0d91 100644 --- a/package-lock.json +++ b/package-lock.json @@ -90,7 +90,7 @@ "@npmcli/map-workspaces": "^5.0.3", "@npmcli/metavuln-calculator": "^9.0.3", "@npmcli/package-json": "^7.0.5", - "@npmcli/promise-spawn": "^9.0.1", + "@npmcli/promise-spawn": "^9.0.2", "@npmcli/redact": "^4.0.0", "@npmcli/run-script": "^10.0.4", "@sigstore/tuf": "^4.0.2", @@ -1866,9 +1866,9 @@ } }, "node_modules/@npmcli/promise-spawn": { - "version": "9.0.1", - "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-9.0.1.tgz", - "integrity": "sha512-OLUaoqBuyxeTqUvjA3FZFiXUfYC1alp3Sa99gW3EUDz3tZ3CbXDdcZ7qWKBzicrJleIgucoWamWH1saAmH/l2Q==", + "version": "9.0.2", + "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-9.0.2.tgz", + "integrity": "sha512-h7b1j0egrruBm/32eVA6/zMw5VJxxaB3vT+uVGGQ4SAAMrQVFHNuzL4+EAXn66j+huj0jApINc1fW3fC+kVoeA==", "inBundle": true, "license": "ISC", "dependencies": { diff --git a/package.json b/package.json index f35fa86bdfd15..942be0bcc8f53 100644 --- a/package.json +++ b/package.json @@ -58,7 +58,7 @@ "@npmcli/map-workspaces": "^5.0.3", "@npmcli/metavuln-calculator": "^9.0.3", "@npmcli/package-json": "^7.0.5", - "@npmcli/promise-spawn": "^9.0.1", + "@npmcli/promise-spawn": "^9.0.2", "@npmcli/redact": "^4.0.0", "@npmcli/run-script": "^10.0.4", "@sigstore/tuf": "^4.0.2", From 1987cdcb60b58a1e0efebad1b92162a8d9a5456e Mon Sep 17 00:00:00 2001 From: Martin Ruiz Date: Tue, 27 Oct 2026 22:11:59 +0000 Subject: [PATCH 3/3] deps: pacote@21.5.2 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: ff154955-6062-42be-9bfeb1cd47f7 --- node_modules/pacote/lib/registry.js | 73 ++++++++++++++++++++++++++++- node_modules/pacote/package.json | 5 +- package-lock.json | 8 ++-- package.json | 2 +- 4 files changed, 79 insertions(+), 9 deletions(-) diff --git a/node_modules/pacote/lib/registry.js b/node_modules/pacote/lib/registry.js index f50b27956dbeb..25278564da91b 100644 --- a/node_modules/pacote/lib/registry.js +++ b/node_modules/pacote/lib/registry.js @@ -113,6 +113,70 @@ class RegistryFetcher extends Fetcher { } } + // Registry signatures and attestations authenticate `name@version`, so the + // manifest must claim the requested name and be listed under its own + // version. Otherwise a registry could replay validly signed metadata from + // another package (or another version) and have it verify as this one. + #verifyManifestIdentity (packument, picked) { + const pickedId = `${picked.name}@${picked.version}` + if (picked.name !== this.spec.name) { + const message = [ + `${this.spec.name} registry manifest has mismatched package name:`, + `expected ${this.spec.name} but got ${pickedId}`, + ].join(' ') + throw Object.assign(new Error(message), { + code: 'EMANIFESTMISMATCH', + expected: this.spec.name, + found: pickedId, + }) + } + if (picked._id && picked._id !== pickedId) { + const message = [ + `${pickedId} registry manifest has mismatched id:`, + `expected ${pickedId} but got ${picked._id}`, + ].join(' ') + throw Object.assign(new Error(message), { + code: 'EMANIFESTMISMATCH', + expected: pickedId, + found: picked._id, + }) + } + + // without dist there are no signatures or attestations to authenticate + if (!picked.dist) { + return + } + + // npm-pick-manifest may return a shallow copy, so match on the dist object + const matchesPickedManifest = manifest => manifest.dist === picked.dist + const versionCollections = [ + packument.versions, + packument.stagedVersions?.versions, + packument.policyRestrictions?.versions, + ] + const matchingVersionKeys = [] + for (const manifestsByVersion of versionCollections) { + for (const versionKey in manifestsByVersion) { + if (Object.hasOwn(manifestsByVersion, versionKey) && + matchesPickedManifest(manifestsByVersion[versionKey])) { + matchingVersionKeys.push(versionKey) + } + } + } + + if (matchingVersionKeys.some(versionKey => versionKey !== picked.version)) { + const message = [ + `${pickedId} registry manifest has mismatched version:`, + `listed in the packument as ${matchingVersionKeys.join(', ')}`, + ].join(' ') + throw Object.assign(new Error(message), { + code: 'EMANIFESTMISMATCH', + expected: matchingVersionKeys, + found: pickedId, + }) + } + } + async manifest () { if (this.package) { return this.package @@ -127,11 +191,16 @@ class RegistryFetcher extends Fetcher { const packument = await this.packument() const steps = PackageJson.normalizeSteps.filter(s => s !== '_attributes') - const mani = await new PackageJson().fromContent(pickManifest(packument, this.spec.fetchSpec, { + const picked = pickManifest(packument, this.spec.fetchSpec, { ...this.opts, defaultTag: this.defaultTag, before: this.before, - })).normalize({ steps }).then(p => p.content) + }) + if (this.opts.verifySignatures || this.opts.verifyAttestations) { + this.#verifyManifestIdentity(packument, picked) + } + const mani = await new PackageJson().fromContent(picked) + .normalize({ steps }).then(p => p.content) /* XXX add ETARGET and E403 revalidation of cached packuments here */ diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json index ee9bea58fc082..7b90e43f095a4 100644 --- a/node_modules/pacote/package.json +++ b/node_modules/pacote/package.json @@ -1,6 +1,6 @@ { "name": "pacote", - "version": "21.5.1", + "version": "21.5.2", "description": "JavaScript package downloader", "author": "GitHub Inc.", "bin": { @@ -75,6 +75,7 @@ "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.", "version": "5.1.0", "windowsCI": false, - "publish": "true" + "publish": "true", + "backport": 21 } } diff --git a/package-lock.json b/package-lock.json index b9fa0dedd0d91..cb24c458d4761 100644 --- a/package-lock.json +++ b/package-lock.json @@ -133,7 +133,7 @@ "npm-registry-fetch": "^19.1.1", "npm-user-validate": "^4.0.0", "p-map": "^7.0.4", - "pacote": "^21.5.1", + "pacote": "^21.5.2", "parse-conflict-json": "^5.0.1", "proc-log": "^6.1.0", "qrcode-terminal": "^0.12.0", @@ -9022,9 +9022,9 @@ "license": "BlueOak-1.0.0" }, "node_modules/pacote": { - "version": "21.5.1", - "resolved": "https://registry.npmjs.org/pacote/-/pacote-21.5.1.tgz", - "integrity": "sha512-KvcJ9iy3crysCsgqc4+PknH/w6jkrp8JN36mpZBPwNaDRwTfMZD37YzRazNstiZUOhuF5pno9f78n9mEJBavwg==", + "version": "21.5.2", + "resolved": "https://registry.npmjs.org/pacote/-/pacote-21.5.2.tgz", + "integrity": "sha512-rifBXawDMv3nLvABWr1kTpSk0UjeglTT4Vt9t8nU9xSnfdZcCTy+FOjO6TgXWAS77lIfbZlRkl2eKQcdY0++jA==", "inBundle": true, "license": "ISC", "dependencies": { diff --git a/package.json b/package.json index 942be0bcc8f53..40c5ceb4d3a48 100644 --- a/package.json +++ b/package.json @@ -101,7 +101,7 @@ "npm-registry-fetch": "^19.1.1", "npm-user-validate": "^4.0.0", "p-map": "^7.0.4", - "pacote": "^21.5.1", + "pacote": "^21.5.2", "parse-conflict-json": "^5.0.1", "proc-log": "^6.1.0", "qrcode-terminal": "^0.12.0",