update

package/node_modules/libnpmversion/LICENSE

@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

package/node_modules/libnpmversion/README.md

@@ -0,0 +1,163 @@
+# libnpmversion
+
+[![npm version](https://img.shields.io/npm/v/libnpmversion.svg)](https://npm.im/libnpmversion)
+[![license](https://img.shields.io/npm/l/libnpmversion.svg)](https://npm.im/libnpmversion)
+[![CI - libnpmversion](https://github.com/npm/cli/actions/workflows/ci-libnpmversion.yml/badge.svg)](https://github.com/npm/cli/actions/workflows/ci-libnpmversion.yml)
+
+Library to do the things that 'npm version' does.
+
+## USAGE
+
+```js
+const npmVersion = require('libnpmversion')
+
+// argument can be one of:
+// - any semver version string (set to that exact version)
+// - 'major', 'minor', 'patch', 'pre{major,minor,patch}' (increment at
+//   that value)
+// - 'from-git' (set to the latest semver-lookin git tag - this skips
+//   gitTagVersion, but will still sign if asked)
+npmVersion(arg, {
+  path: '/path/to/my/pkg', // defaults to cwd
+
+  allowSameVersion: false, // allow tagging/etc to the current version
+  preid: '', // when arg=='pre', define the prerelease string, like 'beta' etc.
+  tagVersionPrefix: 'v', // tag as 'v1.2.3' when versioning to 1.2.3
+  commitHooks: true, // default true, run git commit hooks, default true
+  gitTagVersion: true, // default true, tag the version
+  signGitCommit: false, // default false, gpg sign the git commit
+  signGitTag: false, // default false, gpg sign the git tag
+  force: false, // push forward recklessly if any problems happen
+  ignoreScripts: false, // do not run pre/post/version lifecycle scripts
+  scriptShell: '/bin/bash', // shell to run lifecycle scripts in
+  message: 'v%s', // message for tag and commit, replace %s with the version
+}).then(newVersion => {
+  console.error('version updated!', newVersion)
+})
+```
+
+## Description
+
+Run this in a package directory to bump the version and write the new data
+back to `package.json`, `package-lock.json`, and, if present,
+`npm-shrinkwrap.json`.
+
+The `newversion` argument should be a valid semver string, a valid second
+argument to [semver.inc](https://github.com/npm/node-semver#functions) (one
+of `patch`, `minor`, `major`, `prepatch`, `preminor`, `premajor`,
+`prerelease`), or `from-git`. In the second case, the existing version will
+be incremented by 1 in the specified field.  `from-git` will try to read
+the latest git tag, and use that as the new npm version.
+
+If run in a git repo, it will also create a version commit and tag.  This
+behavior is controlled by `gitTagVersion` (see below), and can be
+disabled by setting `gitTagVersion: false` in the options.
+It will fail if the working directory is not clean, unless `force: true` is
+set.
+
+If supplied with a `message` string option, it will
+use it as a commit message when creating a version commit.  If the
+`message` option contains `%s` then that will be replaced with the
+resulting version number.
+
+If the `signGitTag` option is set, then the tag will be signed using
+the `-s` flag to git.  Note that you must have a default GPG key set up in
+your git config for this to work properly.
+
+If `preversion`, `version`, or `postversion` are in the `scripts` property
+of the package.json, they will be executed in the appropriate sequence.
+
+The exact order of execution is as follows:
+
+1. Check to make sure the git working directory is clean before we get
+   started.  Your scripts may add files to the commit in future steps.
+   This step is skipped if the `force` flag is set.
+2. Run the `preversion` script.  These scripts have access to the old
+   `version` in package.json.  A typical use would be running your full
+   test suite before deploying.  Any files you want added to the commit
+   should be explicitly added using `git add`.
+3. Bump `version` in `package.json` as requested (`patch`, `minor`,
+   `major`, explicit version number, etc).
+4. Run the `version` script. These scripts have access to the new `version`
+   in package.json (so they can incorporate it into file headers in
+   generated files for example).  Again, scripts should explicitly add
+   generated files to the commit using `git add`.
+5. Commit and tag.
+6. Run the `postversion` script. Use it to clean up the file system or
+   automatically push the commit and/or tag.
+
+Take the following example:
+
+```json
+{
+  "scripts": {
+    "preversion": "npm test",
+    "version": "npm run build && git add -A dist",
+    "postversion": "git push && git push --tags && rm -rf build/temp"
+  }
+}
+```
+
+This runs all your tests, and proceeds only if they pass. Then runs your
+`build` script, and adds everything in the `dist` directory to the commit.
+After the commit, it pushes the new commit and tag up to the server, and
+deletes the `build/temp` directory.
+
+## API
+
+### `npmVersion(newversion, options = {}) -> Promise<String>`
+
+Do the things.  Returns a promise that resolves to the new version if
+all is well, or rejects if any errors are encountered.
+
+### Options
+
+#### `path` String
+
+The path to the package being versionified.  Defaults to process.cwd().
+
+#### `allowSameVersion` Boolean
+
+Allow setting the version to the current version in package.json.  Default
+`false`.
+
+#### `preid` String
+When the `newversion` is pre, premajor, preminor, or prepatch, this
+defines the prerelease string, like 'beta' etc.
+
+#### `tagVersionPrefix` String
+
+The prefix to add to the raw semver string for the tag name.  Defaults to
+`'v'`.  (So, by default it tags as 'v1.2.3' when versioning to 1.2.3.)
+
+#### `commitHooks` Boolean
+
+Run git commit hooks.  Default true.
+
+#### `gitTagVersion` Boolean
+
+Tag the version, default true.
+
+#### `signGitCommit` Boolean
+
+GPG sign the git commit.  Default `false`.
+
+#### `signGitTag` Boolean
+
+GPG sign the git tag.  Default `false`.
+
+#### `force` Boolean
+
+Push forward recklessly if any problems happen.  Default `false`.
+
+#### `ignoreScripts` Boolean
+
+Do not run pre/post/version lifecycle scripts.  Default `false`.
+
+#### `scriptShell` String
+
+Path to the shell, which should execute the lifecycle scripts.  Defaults to `/bin/sh` on unix, or `cmd.exe` on windows.
+
+#### `message` String
+
+The message for the git commit and annotated git tag that are created.

package/node_modules/libnpmversion/lib/commit.js

@@ -0,0 +1,17 @@
+const git = require('@npmcli/git')
+
+module.exports = (version, opts) => {
+  const { commitHooks, allowSameVersion, signGitCommit, message } = opts
+  const args = ['commit']
+  if (commitHooks === false) {
+    args.push('-n')
+  }
+  if (allowSameVersion) {
+    args.push('--allow-empty')
+  }
+  if (signGitCommit) {
+    args.push('-S')
+  }
+  args.push('-m')
+  return git.spawn([...args, message.replace(/%s/g, version)], opts)
+}

package/node_modules/libnpmversion/lib/enforce-clean.js

@@ -0,0 +1,32 @@
+const git = require('@npmcli/git')
+const { log } = require('proc-log')
+
+// returns true if it's cool to do git stuff
+// throws if it's unclean, and not forced.
+module.exports = async opts => {
+  const { force } = opts
+  let hadError = false
+  const clean = await git.isClean(opts).catch(er => {
+    if (er.code === 'ENOGIT') {
+      log.warn(
+        'version',
+        'This is a Git checkout, but the git command was not found.',
+        'npm could not create a Git tag for this release!'
+      )
+      hadError = true
+      // how can merges be real if our git isn't real?
+      return true
+    } else {
+      throw er
+    }
+  })
+
+  if (!clean) {
+    if (!force) {
+      throw new Error('Git working directory not clean.')
+    }
+    log.warn('version', 'Git working directory not clean, proceeding forcefully.')
+  }
+
+  return !hadError
+}

package/node_modules/libnpmversion/lib/index.js

@@ -0,0 +1,38 @@
+const readJson = require('./read-json.js')
+const version = require('./version.js')
+
+module.exports = async (newversion, opts = {}) => {
+  const {
+    path = process.cwd(),
+    allowSameVersion = false,
+    tagVersionPrefix = 'v',
+    commitHooks = true,
+    gitTagVersion = true,
+    signGitCommit = false,
+    signGitTag = false,
+    force = false,
+    ignoreScripts = false,
+    scriptShell = undefined,
+    preid = null,
+    message = 'v%s',
+  } = opts
+
+  const pkg = opts.pkg || await readJson(path + '/package.json')
+
+  return version(newversion, {
+    path,
+    cwd: path,
+    allowSameVersion,
+    tagVersionPrefix,
+    commitHooks,
+    gitTagVersion,
+    signGitCommit,
+    signGitTag,
+    force,
+    ignoreScripts,
+    scriptShell,
+    preid,
+    pkg,
+    message,
+  })
+}

package/node_modules/libnpmversion/lib/read-json.js

@@ -0,0 +1,6 @@
+// can't use read-package-json-fast, because we want to ensure
+// that we make as few changes as possible, even for safety issues.
+const { readFile } = require('node:fs/promises')
+const parse = require('json-parse-even-better-errors')
+
+module.exports = async path => parse(await readFile(path))

package/node_modules/libnpmversion/lib/retrieve-tag.js

@@ -0,0 +1,13 @@
+const { spawn } = require('@npmcli/git')
+const semver = require('semver')
+
+module.exports = async opts => {
+  const tag = (await spawn(
+    ['describe', '--tags', '--abbrev=0', '--match=*.*.*'],
+    opts)).stdout.trim()
+  const ver = semver.coerce(tag, { loose: true })
+  if (ver) {
+    return ver.version
+  }
+  throw new Error(`Tag is not a valid version: ${JSON.stringify(tag)}`)
+}

package/node_modules/libnpmversion/lib/tag.js

@@ -0,0 +1,30 @@
+const git = require('@npmcli/git')
+
+module.exports = async (version, opts) => {
+  const {
+    signGitTag,
+    allowSameVersion,
+    tagVersionPrefix,
+    message,
+  } = opts
+
+  const tag = `${tagVersionPrefix}${version}`
+  const flags = ['-']
+
+  if (signGitTag) {
+    flags.push('s')
+  }
+
+  if (allowSameVersion) {
+    flags.push('f')
+  }
+
+  flags.push('m')
+
+  return git.spawn([
+    'tag',
+    flags.join(''),
+    message.replace(/%s/g, version),
+    tag,
+  ], opts)
+}

package/node_modules/libnpmversion/lib/version.js

@@ -0,0 +1,136 @@
+// called with all the options already set to their defaults
+
+const retrieveTag = require('./retrieve-tag.js')
+const semver = require('semver')
+const enforceClean = require('./enforce-clean.js')
+const writeJson = require('./write-json.js')
+const readJson = require('./read-json.js')
+const git = require('@npmcli/git')
+const commit = require('./commit.js')
+const tag = require('./tag.js')
+const { log } = require('proc-log')
+
+const runScript = require('@npmcli/run-script')
+
+module.exports = async (newversion, opts) => {
+  const {
+    path,
+    allowSameVersion,
+    gitTagVersion,
+    ignoreScripts,
+    preid,
+    pkg,
+  } = opts
+
+  const { valid, clean, inc } = semver
+  const current = pkg.version || '0.0.0'
+  const currentClean = clean(current)
+
+  let newV
+  if (valid(newversion, { loose: true })) {
+    newV = clean(newversion, { loose: true })
+  } else if (newversion === 'from-git') {
+    newV = await retrieveTag(opts)
+  } else {
+    newV = inc(currentClean, newversion, { loose: true }, preid)
+  }
+
+  if (!newV) {
+    throw Object.assign(new Error('Invalid version: ' + newversion), {
+      current,
+      requested: newversion,
+    })
+  }
+
+  if (newV === currentClean && !allowSameVersion) {
+    throw Object.assign(new Error('Version not changed'), {
+      current,
+      requested: newversion,
+      newVersion: newV,
+    })
+  }
+
+  const isGitDir = newversion === 'from-git' || await git.is(opts)
+
+  // ok!  now we know the new version, and the old version is in pkg
+
+  // - check if git dir is clean
+  // returns false if we should not keep doing git stuff
+  const doGit = gitTagVersion && isGitDir && await enforceClean(opts)
+
+  if (!ignoreScripts) {
+    await runScript({
+      ...opts,
+      pkg,
+      stdio: 'inherit',
+      event: 'preversion',
+      env: {
+        npm_old_version: current,
+        npm_new_version: newV,
+      },
+    })
+  }
+
+  // - update the files
+  pkg.version = newV
+  delete pkg._id
+  await writeJson(`${path}/package.json`, pkg)
+
+  // try to update shrinkwrap, but ok if this fails
+  const locks = [`${path}/package-lock.json`, `${path}/npm-shrinkwrap.json`]
+  const haveLocks = []
+  for (const lock of locks) {
+    try {
+      const sw = await readJson(lock)
+      sw.version = newV
+      if (sw.packages && sw.packages['']) {
+        sw.packages[''].version = newV
+      }
+      await writeJson(lock, sw)
+      haveLocks.push(lock)
+    } catch {
+      // ignore errors
+    }
+  }
+
+  if (!ignoreScripts) {
+    await runScript({
+      ...opts,
+      pkg,
+      stdio: 'inherit',
+      event: 'version',
+      env: {
+        npm_old_version: current,
+        npm_new_version: newV,
+      },
+    })
+  }
+
+  if (doGit) {
+    // - git add, git commit, git tag
+    await git.spawn(['add', `${path}/package.json`], opts)
+    // sometimes people .gitignore their lockfiles
+    for (const lock of haveLocks) {
+      await git.spawn(['add', lock], opts).catch(() => {})
+    }
+    await commit(newV, opts)
+    await tag(newV, opts)
+  } else {
+    log.verbose('version', 'Not tagging: not in a git repo or no git cmd')
+  }
+
+  if (!ignoreScripts) {
+    await runScript({
+      ...opts,
+      pkg,
+      stdio: 'inherit',
+      event: 'postversion',
+      env: {
+        npm_old_version: current,
+        npm_new_version: newV,
+      },
+    })
+  }
+
+  return newV
+}

package/node_modules/libnpmversion/lib/write-json.js

@@ -0,0 +1,15 @@
+// write the json back, preserving the line breaks and indent
+const { writeFile } = require('node:fs/promises')
+const kIndent = Symbol.for('indent')
+const kNewline = Symbol.for('newline')
+
+module.exports = async (path, pkg) => {
+  const {
+    [kIndent]: indent = 2,
+    [kNewline]: newline = '\n',
+  } = pkg
+  delete pkg._id
+  const raw = JSON.stringify(pkg, null, indent) + '\n'
+  const data = newline === '\n' ? raw : raw.split('\n').join(newline)
+  return writeFile(path, data)
+}

package/node_modules/libnpmversion/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "libnpmversion",
+  "version": "6.0.3",
+  "main": "lib/index.js",
+  "files": [
+    "bin/",
+    "lib/"
+  ],
+  "description": "library to do the things that 'npm version' does",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/npm/cli.git",
+    "directory": "workspaces/libnpmversion"
+  },
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "scripts": {
+    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
+    "test": "tap",
+    "posttest": "npm run lint",
+    "snap": "tap",
+    "postlint": "template-oss-check",
+    "lintfix": "npm run lint -- --fix",
+    "template-oss-apply": "template-oss-apply --force"
+  },
+  "tap": {
+    "coverage-map": "map.js",
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
+  },
+  "devDependencies": {
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.22.0",
+    "require-inject": "^1.4.4",
+    "tap": "^16.3.8"
+  },
+  "dependencies": {
+    "@npmcli/git": "^5.0.7",
+    "@npmcli/run-script": "^8.1.0",
+    "json-parse-even-better-errors": "^3.0.2",
+    "proc-log": "^4.2.0",
+    "semver": "^7.3.7"
+  },
+  "engines": {
+    "node": "^16.14.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.22.0",
+    "content": "../../scripts/template-oss/index.js"
+  }
+}