npm-package-arg@5.1.1

This includes the npa git-parsing patch to make it so
non-hosted SCP-style identifiers are correctly handled.

Previously, npa would mangle them (even though hosted-git-info
is doing the right thing for them).

Fixes: https://github.com/npm/npm/issues/16726

5 files changed, 44 insertions, 48 deletions

diff --git a/node_modules/npm-package-arg/CHANGELOG.md b/node_modules/npm-package-arg/CHANGELOG.md
deleted file mode 100644
index 339ef8793..000000000
--- a/node_modules/npm-package-arg/CHANGELOG.md
+++ /dev/null
@@ -1,23 +0,0 @@
-## new
-
-* New properties:
-  * `from` indicates how we parsed this specifier, values are:
-    localArgument, local, hosted, url and registry.
-
-    _localArgument_ differs from _local_ in that it means the argument
-    parsing rules were used instead of the dependency parsing rules. That is, the
-    rules for `npm install /foo` instead of those for `"dependencies":
-    {"foo": "file:/foo"}`.
-
-* Changed properties:
-  * `type` indicates what sort of specifier this is, values are: file, directory, git, remote, version, range, tag.
-
-* Local specifiers:
-  * Trailing spaces on local specifiers are no longer trimmed.
-  * The `spec` field for local specifiers is now a fully resolved path.
-  * The type is now _file_ or _directory, never _local_.
-* Git specifiers:
-  * The leading `git+` is no longer stripped. This makes the behavior match
-    `hosted-git-info`.
-* Hosted git specifiers:
-  * The `type` is now _git_. You can check if something is hosted by looking at the `hosted` property or checking to see if `from` is _hosted_.
diff --git a/node_modules/npm-package-arg/npa.js b/node_modules/npm-package-arg/npa.js
index a94c54abb..e359958a3 100644
--- a/node_modules/npm-package-arg/npa.js
+++ b/node_modules/npm-package-arg/npa.js
@@ -192,6 +192,22 @@ function unsupportedURLType (protocol, spec) {
   return err
 }
 
+function matchGitScp (spec) {
+  // git ssh specifiers are overloaded to also use scp-style git
+  // specifiers, so we have to parse those out and treat them special.
+  // They are NOT true URIs, so we can't hand them to `url.parse`.
+  //
+  // This regex looks for things that look like:
+  // git+ssh://git@my.custom.git.com:username/project.git#deadbeef
+  //
+  // ...and various combinations. The username in the beginning is *required*.
+  const matched = spec.match(/^git\+ssh:\/\/([^:]+:[^#]+(?:\.git)?)(?:#(.*))$/i)
+  return matched && !matched[1].match(/:[0-9]+\/?.*$/i) && {
+    fetchSpec: matched[1],
+    gitCommittish: matched[2]
+  }
+}
+
 function fromURL (res) {
   if (!url) url = require('url')
   const urlparse = url.parse(res.rawSpec)
@@ -203,15 +219,20 @@ function fromURL (res) {
     case 'git+https:':
     case 'git+rsync:':
     case 'git+ftp:':
-    case 'git+ssh:':
     case 'git+file:':
+    case 'git+ssh:':
       res.type = 'git'
-      setGitCommittish(res, urlparse.hash != null ? urlparse.hash.slice(1) : '')
-      urlparse.protocol = urlparse.protocol.replace(/^git[+]/, '')
-      delete urlparse.hash
-      res.fetchSpec = url.format(urlparse)
+      const match = urlparse.protocol === 'git+ssh:' && matchGitScp(res.rawSpec)
+      if (match) {
+        res.fetchSpec = match.fetchSpec
+        res.gitCommittish = match.gitCommittish
+      } else {
+        setGitCommittish(res, urlparse.hash != null ? urlparse.hash.slice(1) : '')
+        urlparse.protocol = urlparse.protocol.replace(/^git[+]/, '')
+        delete urlparse.hash
+        res.fetchSpec = url.format(urlparse)
+      }
       break
-
     case 'http:':
     case 'https:':
       res.type = 'remote'
diff --git a/node_modules/npm-package-arg/package.json b/node_modules/npm-package-arg/package.json
index d8ef6979c..b8afefc57 100644
--- a/node_modules/npm-package-arg/package.json
+++ b/node_modules/npm-package-arg/package.json
@@ -1,37 +1,37 @@
 {
-  "_from": "npm-package-arg@~5.0.1",
-  "_id": "npm-package-arg@5.0.1",
-  "_integrity": "sha1-CagW4/RaVJ492vM+m65eezEHeHI=",
+  "_from": "npm-package-arg@latest",
+  "_id": "npm-package-arg@5.1.1",
+  "_inBundle": false,
+  "_integrity": "sha512-67wPa1moaLvn9YAVLLECpGe+v3jL82pBDTE2jMxLOQHd0kWBLnmtCqbxrFagp5pVNFukqmtYRruK3wfoeVTZ2g==",
   "_location": "/npm-package-arg",
   "_phantomChildren": {},
   "_requested": {
-    "type": "range",
+    "type": "tag",
     "registry": true,
-    "raw": "npm-package-arg@~5.0.1",
+    "raw": "npm-package-arg@latest",
     "name": "npm-package-arg",
     "escapedName": "npm-package-arg",
-    "rawSpec": "~5.0.1",
+    "rawSpec": "latest",
     "saveSpec": null,
-    "fetchSpec": "~5.0.1"
+    "fetchSpec": "latest"
   },
   "_requiredBy": [
+    "#USER",
     "/",
     "/init-package-json",
     "/npm-registry-client",
     "/pacote",
     "/pacote/npm-pick-manifest"
   ],
-  "_resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-5.0.1.tgz",
-  "_shasum": "09a816e3f45a549e3ddaf33e9bae5e7b31077872",
-  "_shrinkwrap": null,
-  "_spec": "npm-package-arg@~5.0.1",
+  "_resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-5.1.1.tgz",
+  "_shasum": "a3d09053f2d8a0bfa562624507baa597737fc3bf",
+  "_spec": "npm-package-arg@latest",
   "_where": "/Users/zkat/Documents/code/npm",
   "author": {
     "name": "Isaac Z. Schlueter",
     "email": "i@izs.me",
     "url": "http://blog.izs.me/"
   },
-  "bin": null,
   "bugs": {
     "url": "https://github.com/npm/npm-package-arg/issues"
   },
@@ -58,8 +58,6 @@
   "license": "ISC",
   "main": "npa.js",
   "name": "npm-package-arg",
-  "optionalDependencies": {},
-  "peerDependencies": {},
   "repository": {
     "type": "git",
     "url": "git+https://github.com/npm/npm-package-arg.git"
@@ -67,5 +65,5 @@
   "scripts": {
     "test": "standard && tap -J --coverage test/*.js"
   },
-  "version": "5.0.1"
+  "version": "5.1.1"
 }
diff --git a/package-lock.json b/package-lock.json
index ffb510f90..b65627ad9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -609,9 +609,9 @@
       "integrity": "sha1-1K7N/VGlPjcjt7L5Oy7ijjB7wNc="
     },
     "npm-package-arg": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-5.0.1.tgz",
-      "integrity": "sha1-CagW4/RaVJ492vM+m65eezEHeHI="
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-5.1.1.tgz",
+      "integrity": "sha512-67wPa1moaLvn9YAVLLECpGe+v3jL82pBDTE2jMxLOQHd0kWBLnmtCqbxrFagp5pVNFukqmtYRruK3wfoeVTZ2g=="
     },
     "npm-registry-client": {
       "version": "8.3.0",
diff --git a/package.json b/package.json
index e3605144a..f036fe7d5 100644
--- a/package.json
+++ b/package.json
@@ -76,7 +76,7 @@
     "normalize-package-data": "~2.3.8",
     "npm-cache-filename": "~1.0.2",
     "npm-install-checks": "~3.0.0",
-    "npm-package-arg": "~5.0.1",
+    "npm-package-arg": "~5.1.1",
     "npm-registry-client": "~8.3.0",
     "npm-user-validate": "~1.0.0",
     "npmlog": "~4.1.0",