deps: pacote@12.0.2nlf/pacote-update

8 files changed, 180 insertions, 125 deletions

diff --git a/node_modules/ignore-walk/index.js b/node_modules/ignore-walk/index.js
index c01d57de2..13fc954c5 100644
--- a/node_modules/ignore-walk/index.js
+++ b/node_modules/ignore-walk/index.js
@@ -9,9 +9,11 @@ class Walker extends EE {
   constructor (opts) {
     opts = opts || {}
     super(opts)
+    // set to true if this.path is a symlink, whether follow is true or not
+    this.isSymbolicLink = opts.isSymbolicLink
     this.path = opts.path || process.cwd()
     this.basename = path.basename(this.path)
-    this.ignoreFiles = opts.ignoreFiles || [ '.ignore' ]
+    this.ignoreFiles = opts.ignoreFiles || ['.ignore']
     this.ignoreRules = {}
     this.parent = opts.parent || null
     this.includeEmpty = !!opts.includeEmpty
@@ -29,18 +31,19 @@ class Walker extends EE {
   emit (ev, data) {
     let ret = false
     if (!(this.sawError && ev === 'error')) {
-      if (ev === 'error')
+      if (ev === 'error') {
         this.sawError = true
-      else if (ev === 'done' && !this.parent) {
+      } else if (ev === 'done' && !this.parent) {
         data = Array.from(data)
           .map(e => /^@/.test(e) ? `./${e}` : e).sort(this.sort)
         this.result = data
       }
 
-      if (ev === 'error' && this.parent)
+      if (ev === 'error' && this.parent) {
         ret = this.parent.emit('error', data)
-      else
+      } else {
         ret = super.emit(ev, data)
+      }
     }
     return ret
   }
@@ -52,25 +55,27 @@ class Walker extends EE {
   }
 
   isIgnoreFile (e) {
-    return e !== "." &&
-      e !== ".." &&
-      -1 !== this.ignoreFiles.indexOf(e)
+    return e !== '.' &&
+      e !== '..' &&
+      this.ignoreFiles.indexOf(e) !== -1
   }
 
   onReaddir (entries) {
     this.entries = entries
     if (entries.length === 0) {
-      if (this.includeEmpty)
+      if (this.includeEmpty) {
         this.result.add(this.path.substr(this.root.length + 1))
+      }
       this.emit('done', this.result)
     } else {
       const hasIg = this.entries.some(e =>
         this.isIgnoreFile(e))
 
-      if (hasIg)
+      if (hasIg) {
         this.addIgnoreFiles()
-      else
+      } else {
         this.filterEntries()
+      }
     }
   }
 
@@ -80,8 +85,9 @@ class Walker extends EE {
 
     let igCount = newIg.length
     const then = _ => {
-      if (--igCount === 0)
+      if (--igCount === 0) {
         this.filterEntries()
+      }
     }
 
     newIg.forEach(e => this.addIgnoreFile(e, then))
@@ -98,7 +104,7 @@ class Walker extends EE {
       matchBase: true,
       dot: true,
       flipNegate: true,
-      nocase: true
+      nocase: true,
     }
     const rules = data.split(/\r?\n/)
       .filter(line => !/^#|^$/.test(line.trim()))
@@ -133,55 +139,71 @@ class Walker extends EE {
       this.emit('done', this.result)
     } else {
       const then = _ => {
-        if (-- entryCount === 0)
+        if (--entryCount === 0) {
           this.emit('done', this.result)
+        }
       }
       filtered.forEach(filt => {
         const entry = filt[0]
         const file = filt[1]
         const dir = filt[2]
-        this.stat(entry, file, dir, then)
+        this.stat({ entry, file, dir }, then)
       })
     }
   }
 
-  onstat (st, entry, file, dir, then) {
+  onstat ({ st, entry, file, dir, isSymbolicLink }, then) {
     const abs = this.path + '/' + entry
     if (!st.isDirectory()) {
-      if (file)
+      if (file) {
         this.result.add(abs.substr(this.root.length + 1))
+      }
       then()
     } else {
       // is a directory
-      if (dir)
-        this.walker(entry, then)
-      else
+      if (dir) {
+        this.walker(entry, { isSymbolicLink }, then)
+      } else {
         then()
+      }
     }
   }
 
-  stat (entry, file, dir, then) {
+  stat ({ entry, file, dir }, then) {
     const abs = this.path + '/' + entry
-    fs[this.follow ? 'stat' : 'lstat'](abs, (er, st) => {
-      if (er)
+    fs.lstat(abs, (er, st) => {
+      if (er) {
         this.emit('error', er)
-      else
-        this.onstat(st, entry, file, dir, then)
+      } else {
+        const isSymbolicLink = st.isSymbolicLink()
+        if (this.follow && isSymbolicLink) {
+          fs.stat(abs, (er, st) => {
+            if (er) {
+              this.emit('error', er)
+            } else {
+              this.onstat({ st, entry, file, dir, isSymbolicLink }, then)
+            }
+          })
+        } else {
+          this.onstat({ st, entry, file, dir, isSymbolicLink }, then)
+        }
+      }
     })
   }
 
-  walkerOpt (entry) {
+  walkerOpt (entry, opts) {
     return {
       path: this.path + '/' + entry,
       parent: this,
       ignoreFiles: this.ignoreFiles,
       follow: this.follow,
-      includeEmpty: this.includeEmpty
+      includeEmpty: this.includeEmpty,
+      ...opts,
     }
   }
 
-  walker (entry, then) {
-    new Walker(this.walkerOpt(entry)).on('done', then).start()
+  walker (entry, opts, then) {
+    new Walker(this.walkerOpt(entry, opts)).on('done', then).start()
   }
 
   filterEntry (entry, partial) {
@@ -191,7 +213,7 @@ class Walker extends EE {
     // entry = d
     // parent /a/b sees c/d
     if (this.parent && this.parent.filterEntry) {
-      var pt = this.basename + "/" + entry
+      var pt = this.basename + '/' + entry
       included = this.parent.filterEntry(pt, partial)
     }
 
@@ -214,8 +236,9 @@ class Walker extends EE {
                 rule.match('/' + entry, true) ||
                 rule.match(entry, true)))
 
-            if (match)
+            if (match) {
               included = rule.negate
+            }
           }
         })
       }
@@ -226,10 +249,6 @@ class Walker extends EE {
 }
 
 class WalkerSync extends Walker {
-  constructor (opt) {
-    super(opt)
-  }
-
   start () {
     this.onReaddir(fs.readdirSync(this.path))
     return this
@@ -240,28 +259,32 @@ class WalkerSync extends Walker {
     this.onReadIgnoreFile(file, fs.readFileSync(ig, 'utf8'), then)
   }
 
-  stat (entry, file, dir, then) {
+  stat ({ entry, file, dir }, then) {
     const abs = this.path + '/' + entry
-    const st = fs[this.follow ? 'statSync' : 'lstatSync'](abs)
-    this.onstat(st, entry, file, dir, then)
+    let st = fs.lstatSync(abs)
+    const isSymbolicLink = st.isSymbolicLink()
+    if (this.follow && isSymbolicLink) {
+      st = fs.statSync(abs)
+    }
+
+    // console.error('STAT SYNC', {st, entry, file, dir, isSymbolicLink, then})
+    this.onstat({ st, entry, file, dir, isSymbolicLink }, then)
   }
 
-  walker (entry, then) {
-    new WalkerSync(this.walkerOpt(entry)).start()
+  walker (entry, opts, then) {
+    new WalkerSync(this.walkerOpt(entry, opts)).start()
     then()
   }
 }
 
-const walk = (options, callback) => {
+const walk = (opts, callback) => {
   const p = new Promise((resolve, reject) => {
-    new Walker(options).on('done', resolve).on('error', reject).start()
+    new Walker(opts).on('done', resolve).on('error', reject).start()
   })
   return callback ? p.then(res => callback(null, res), callback) : p
 }
 
-const walkSync = options => {
-  return new WalkerSync(options).start().result
-}
+const walkSync = opts => new WalkerSync(opts).start().result
 
 module.exports = walk
 walk.sync = walkSync
diff --git a/node_modules/ignore-walk/package.json b/node_modules/ignore-walk/package.json
index 7d48b977e..ec6923d19 100644
--- a/node_modules/ignore-walk/package.json
+++ b/node_modules/ignore-walk/package.json
@@ -1,9 +1,10 @@
 {
   "name": "ignore-walk",
-  "version": "3.0.4",
+  "version": "4.0.1",
   "description": "Nested/recursive `.gitignore`/`.npmignore` parsing and filtering.",
   "main": "index.js",
   "devDependencies": {
+    "@npmcli/lint": "^1.0.2",
     "mkdirp": "^0.5.1",
     "mutate-fs": "^1.1.0",
     "rimraf": "^2.6.1",
@@ -11,9 +12,15 @@
   },
   "scripts": {
     "test": "tap",
+    "posttest": "npm run lint --",
+    "lint": "npm run npmclilint -- \"*.*js\" \"test/**/*.*js\"",
+    "eslint": "eslint",
+    "lintfix": "npm run lint -- --fix",
     "preversion": "npm test",
     "postversion": "npm publish",
-    "postpublish": "git push origin --all; git push origin --tags"
+    "postpublish": "git push origin --follow-tags",
+    "npmclilint": "npmcli-lint",
+    "postsnap": "npm run lintfix --"
   },
   "keywords": [
     "ignorefile",
@@ -40,5 +47,8 @@
     "before": "test/00-setup.js",
     "after": "test/zz-cleanup.js",
     "jobs": 1
+  },
+  "engines": {
+    "node": ">=10"
   }
 }
diff --git a/node_modules/npm-packlist/index.js b/node_modules/npm-packlist/index.js
index f498fa008..76018557c 100644
--- a/node_modules/npm-packlist/index.js
+++ b/node_modules/npm-packlist/index.js
@@ -97,13 +97,14 @@ const npmWalker = Class => class Walker extends Class {
     // ignore a bunch of things by default at the root level.
     // also ignore anything in the main project node_modules hierarchy,
     // except bundled dependencies
-    if (!this.parent) {
+    if (this.isProject) {
       this.bundled = opt.bundled || []
       this.bundledScopes = Array.from(new Set(
         this.bundled.filter(f => /^@/.test(f))
           .map(f => f.split('/')[0])))
       const rules = defaultRules.join('\n') + '\n'
-      this.packageJsonCache = opt.packageJsonCache || new Map()
+      this.packageJsonCache = this.parent ? this.parent.packageJsonCache
+        : (opt.packageJsonCache || new Map())
       super.onReadIgnoreFile(rootBuiltinRules, rules, _ => _)
     } else {
       this.bundled = []
@@ -112,8 +113,12 @@ const npmWalker = Class => class Walker extends Class {
     }
   }
 
+  get isProject () {
+    return !this.parent || this.parent.follow && this.isSymbolicLink
+  }
+
   onReaddir (entries) {
-    if (!this.parent) {
+    if (this.isProject) {
       entries = entries.filter(e =>
         e !== '.git' &&
         !(e === 'node_modules' && this.bundled.length === 0)
@@ -126,8 +131,9 @@ const npmWalker = Class => class Walker extends Class {
     // to be in the state the user wants to include them, and
     // a package.json somewhere else might be a template or
     // test or something else entirely.
-    if (this.parent || !entries.includes('package.json'))
+    if (!this.isProject || !entries.includes('package.json')) {
       return super.onReaddir(entries)
+    }
 
     // when the cache has been seeded with the root manifest,
     // we must respect that (it may differ from the filesystem)
@@ -137,8 +143,9 @@ const npmWalker = Class => class Walker extends Class {
       const pkg = this.packageJsonCache.get(ig)
 
       // fall back to filesystem when seeded manifest is invalid
-      if (!pkg || typeof pkg !== 'object')
+      if (!pkg || typeof pkg !== 'object') {
         return this.readPackageJson(entries)
+      }
 
       // feels wonky, but this ensures package bin is _always_
       // normalized, as well as guarding against invalid JSON
@@ -149,22 +156,26 @@ const npmWalker = Class => class Walker extends Class {
   }
 
   onReadPackageJson (entries, er, pkg) {
-    if (er)
+    if (er) {
       this.emit('error', er)
-    else
+    } else {
       this.getPackageFiles(entries, pkg)
+    }
   }
 
   mustHaveFilesFromPackage (pkg) {
     const files = []
-    if (pkg.browser)
+    if (pkg.browser) {
       files.push('/' + pkg.browser)
-    if (pkg.main)
+    }
+    if (pkg.main) {
       files.push('/' + pkg.main)
+    }
     if (pkg.bin) {
       // always an object because normalized already
-      for (const key in pkg.bin)
+      for (const key in pkg.bin) {
         files.push('/' + pkg.bin[key])
+      }
     }
     files.push(
       '/package.json',
@@ -194,8 +205,9 @@ const npmWalker = Class => class Walker extends Class {
     this.packageJsonCache.set(ig, pkg)
 
     // no files list, just return the normal readdir() result
-    if (!Array.isArray(pkg.files))
+    if (!Array.isArray(pkg.files)) {
       return super.onReaddir(entries)
+    }
 
     pkg.files.push(...this.mustHaveFilesFromPackage(pkg))
 
@@ -204,13 +216,15 @@ const npmWalker = Class => class Walker extends Class {
     // the files list as the effective readdir result, that means it
     // looks like we don't have a node_modules folder at all unless we
     // include it here.
-    if ((pkg.bundleDependencies || pkg.bundledDependencies) && entries.includes('node_modules'))
+    if ((pkg.bundleDependencies || pkg.bundledDependencies) && entries.includes('node_modules')) {
       pkg.files.push('node_modules')
+    }
 
     const patterns = Array.from(new Set(pkg.files)).reduce((set, pattern) => {
       const excl = pattern.match(/^!+/)
-      if (excl)
+      if (excl) {
         pattern = pattern.substr(excl[0].length)
+      }
       // strip off any / from the start of the pattern.  /foo => foo
       pattern = pattern.replace(/^\/+/, '')
       // an odd number of ! means a negated pattern.  !!foo ==> foo
@@ -224,12 +238,14 @@ const npmWalker = Class => class Walker extends Class {
     const negates = new Set()
     const results = []
     const then = (pattern, negate, er, fileList, i) => {
-      if (er)
+      if (er) {
         return this.emit('error', er)
+      }
 
       results[i] = { negate, fileList }
-      if (--n === 0)
+      if (--n === 0) {
         processResults(results)
+      }
     }
     const processResults = results => {
       for (const {negate, fileList} of results) {
@@ -268,15 +284,15 @@ const npmWalker = Class => class Walker extends Class {
     // get the partial path from the root of the walk
     const p = this.path.substr(this.root.length + 1)
     const pkgre = /^node_modules\/(@[^/]+\/?[^/]+|[^/]+)(\/.*)?$/
-    const isRoot = !this.parent
-    const pkg = isRoot && pkgre.test(entry) ?
+    const { isProject } = this
+    const pkg = isProject && pkgre.test(entry) ?
       entry.replace(pkgre, '$1') : null
-    const rootNM = isRoot && entry === 'node_modules'
-    const rootPJ = isRoot && entry === 'package.json'
+    const rootNM = isProject && entry === 'node_modules'
+    const rootPJ = isProject && entry === 'package.json'
 
     return (
       // if we're in a bundled package, check with the parent.
-      /^node_modules($|\/)/i.test(p) ? this.parent.filterEntry(
+      /^node_modules($|\/)/i.test(p) && !this.isProject ? this.parent.filterEntry(
         this.basename + '/' + entry, partial)
 
       // if package is bundled, all files included
@@ -298,11 +314,11 @@ const npmWalker = Class => class Walker extends Class {
       : packageMustHavesRE.test(entry) ? true
 
       // npm-shrinkwrap and package.json always included in the root pkg
-      : isRoot && (entry === 'npm-shrinkwrap.json' || entry === 'package.json')
+      : isProject && (entry === 'npm-shrinkwrap.json' || entry === 'package.json')
         ? true
 
       // package-lock never included
-        : isRoot && entry === 'package-lock.json' ? false
+        : isProject && entry === 'package-lock.json' ? false
 
         // otherwise, follow ignore-walk's logic
         : super.filterEntry(entry, partial)
@@ -310,20 +326,22 @@ const npmWalker = Class => class Walker extends Class {
   }
 
   filterEntries () {
-    if (this.ignoreRules['.npmignore'])
+    if (this.ignoreRules['.npmignore']) {
       this.ignoreRules['.gitignore'] = null
+    }
     this.filterEntries = super.filterEntries
     super.filterEntries()
   }
 
   addIgnoreFile (file, then) {
     const ig = path.resolve(this.path, file)
-    if (file === 'package.json' && this.parent)
+    if (file === 'package.json' && !this.isProject) {
       then()
-    else if (this.packageJsonCache.has(ig))
+    } else if (this.packageJsonCache.has(ig)) {
       this.onPackageJson(ig, this.packageJsonCache.get(ig), then)
-    else
+    } else {
       super.addIgnoreFile(file, then)
+    }
   }
 
   onPackageJson (ig, pkg, then) {
@@ -347,19 +365,22 @@ const npmWalker = Class => class Walker extends Class {
   // override parent stat function to completely skip any filenames
   // that will break windows entirely.
   // XXX(isaacs) Next major version should make this an error instead.
-  stat (entry, file, dir, then) {
-    if (nameIsBadForWindows(entry))
+  stat ({ entry, file, dir }, then) {
+    if (nameIsBadForWindows(entry)) {
       then()
-    else
-      super.stat(entry, file, dir, then)
+    } else {
+      super.stat({ entry, file, dir }, then)
+    }
   }
 
-  // override parent onstat function to nix all symlinks
-  onstat (st, entry, file, dir, then) {
-    if (st.isSymbolicLink())
+  // override parent onstat function to nix all symlinks, other than
+  // those coming out of the followed bundled symlink deps
+  onstat ({ st, entry, file, dir, isSymbolicLink }, then) {
+    if (st.isSymbolicLink()) {
       then()
-    else
-      super.onstat(st, entry, file, dir, then)
+    } else {
+      super.onstat({ st, entry, file, dir, isSymbolicLink }, then)
+    }
   }
 
   onReadIgnoreFile (file, data, then) {
@@ -371,8 +392,9 @@ const npmWalker = Class => class Walker extends Class {
         // ignore package.json files that are not json
         then()
       }
-    } else
+    } else {
       super.onReadIgnoreFile(file, data, then)
+    }
   }
 
   sort (a, b) {
@@ -390,8 +412,8 @@ class Walker extends npmWalker(IgnoreWalker) {
       this.onReadPackageJson(entries, er, pkg))
   }
 
-  walker (entry, then) {
-    new Walker(this.walkerOpt(entry)).on('done', then).start()
+  walker (entry, opt, then) {
+    new Walker(this.walkerOpt(entry, opt)).on('done', then).start()
   }
 }
 
@@ -409,8 +431,8 @@ class WalkerSync extends npmWalker(IgnoreWalkerSync) {
     }
   }
 
-  walker (entry, then) {
-    new WalkerSync(this.walkerOpt(entry)).start()
+  walker (entry, opt, then) {
+    new WalkerSync(this.walkerOpt(entry, opt)).start()
     then()
   }
 }
diff --git a/node_modules/npm-packlist/package.json b/node_modules/npm-packlist/package.json
index 49fa94754..2fe493a20 100644
--- a/node_modules/npm-packlist/package.json
+++ b/node_modules/npm-packlist/package.json
@@ -1,6 +1,6 @@
 {
   "name": "npm-packlist",
-  "version": "2.2.2",
+  "version": "3.0.0",
   "description": "Get a list of the files to add from a folder into an npm package",
   "directories": {
     "test": "test"
@@ -8,7 +8,7 @@
   "main": "index.js",
   "dependencies": {
     "glob": "^7.1.6",
-    "ignore-walk": "^3.0.3",
+    "ignore-walk": "^4.0.1",
     "npm-bundled": "^1.1.1",
     "npm-normalize-package-bin": "^1.0.1"
   },
@@ -19,25 +19,22 @@
     "index.js"
   ],
   "devDependencies": {
-    "eslint": "^7.25.0",
-    "eslint-plugin-import": "^2.22.1",
-    "eslint-plugin-node": "^11.1.0",
-    "eslint-plugin-promise": "^5.1.0",
-    "eslint-plugin-standard": "^5.0.0",
+    "@npmcli/lint": "^1.0.2",
     "mutate-fs": "^2.1.1",
     "tap": "^15.0.6"
   },
   "scripts": {
     "test": "tap",
-    "posttest": "npm run lint",
+    "posttest": "npm run lint --",
     "snap": "tap",
-    "postsnap": "npm run lintfix",
+    "postsnap": "npm run lintfix --",
     "preversion": "npm test",
     "postversion": "npm publish",
     "prepublishOnly": "git push origin --follow-tags",
     "eslint": "eslint",
-    "lint": "npm run eslint -- index.js bin/index.js \"test/**/*.js\"",
-    "lintfix": "npm run lint -- --fix"
+    "lint": "npm run npmclilint -- \"*.*js\" \"test/**/*.*js\"",
+    "lintfix": "npm run lint -- --fix",
+    "npmclilint": "npmcli-lint"
   },
   "repository": {
     "type": "git",
diff --git a/node_modules/pacote/lib/git.js b/node_modules/pacote/lib/git.js
index 18f42547b..ab87d494c 100644
--- a/node_modules/pacote/lib/git.js
+++ b/node_modules/pacote/lib/git.js
@@ -50,7 +50,7 @@ class GitFetcher extends Fetcher {
       // use hosted.tarball() when we shell to RemoteFetcher later
       this.resolved = this.spec.hosted
         ? repoUrl(this.spec.hosted, { noCommittish: false })
-        : this.spec.fetchSpec + '#' + this.spec.gitCommittish
+        : this.spec.rawSpec
     } else
       this.resolvedSha = ''
   }
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
index 17933ad12..d0fe0a065 100644
--- a/node_modules/pacote/package.json
+++ b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "12.0.0",
+  "version": "12.0.2",
   "description": "JavaScript package downloader",
   "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",
   "bin": {
@@ -44,7 +44,7 @@
     "minipass": "^3.1.3",
     "mkdirp": "^1.0.3",
     "npm-package-arg": "^8.0.1",
-    "npm-packlist": "^2.1.4",
+    "npm-packlist": "^3.0.0",
     "npm-pick-manifest": "^6.0.0",
     "npm-registry-fetch": "^11.0.0",
     "promise-retry": "^2.0.1",
diff --git a/package-lock.json b/package-lock.json
index e38d5e220..6948f5cee 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -138,7 +138,7 @@
         "npm-user-validate": "^1.0.1",
         "npmlog": "^5.0.1",
         "opener": "^1.5.2",
-        "pacote": "^12.0.0",
+        "pacote": "^12.0.2",
         "parse-conflict-json": "^1.1.1",
         "qrcode-terminal": "^0.12.0",
         "read": "~1.0.7",
@@ -3860,12 +3860,15 @@
       }
     },
     "node_modules/ignore-walk": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-3.0.4.tgz",
-      "integrity": "sha512-PY6Ii8o1jMRA1z4F2hRkH/xN59ox43DavKvD3oDpfurRlOJyAHpifIwpbdv1n4jt4ov0jSpw3kQ4GhJnpBL6WQ==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-4.0.1.tgz",
+      "integrity": "sha512-rzDQLaW4jQbh2YrOFlJdCtX8qgJTehFRYiUB2r1osqTeDzV/3+Jh8fz1oAPzUThf3iku8Ds4IDqawI5d8mUiQw==",
       "inBundle": true,
       "dependencies": {
         "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=10"
       }
     },
     "node_modules/import-fresh": {
@@ -5606,13 +5609,13 @@
       }
     },
     "node_modules/npm-packlist": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-2.2.2.tgz",
-      "integrity": "sha512-Jt01acDvJRhJGthnUJVF/w6gumWOZxO7IkpY/lsX9//zqQgnF7OJaxgQXcerd4uQOLu7W5bkb4mChL9mdfm+Zg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-3.0.0.tgz",
+      "integrity": "sha512-L/cbzmutAwII5glUcf2DBRNY/d0TFd4e/FnaZigJV6JD85RHZXJFGwCndjMWiiViiWSsWt3tiOLpI3ByTnIdFQ==",
       "inBundle": true,
       "dependencies": {
         "glob": "^7.1.6",
-        "ignore-walk": "^3.0.3",
+        "ignore-walk": "^4.0.1",
         "npm-bundled": "^1.1.1",
         "npm-normalize-package-bin": "^1.0.1"
       },
@@ -6053,9 +6056,9 @@
       }
     },
     "node_modules/pacote": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-12.0.0.tgz",
-      "integrity": "sha512-5DnYqZU0w7GIskuc5yXii1kKpQS2fsaxCaI0FXRsMULXB06lXnZpRdV7JC1TTcQN5uy62h4VWS4WMPYGWu3MYg==",
+      "version": "12.0.2",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-12.0.2.tgz",
+      "integrity": "sha512-Ar3mhjcxhMzk+OVZ8pbnXdb0l8+pimvlsqBGRNkble2NVgyqOGE3yrCGi/lAYq7E7NRDMz89R1Wx5HIMCGgeYg==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/git": "^2.1.0",
@@ -6069,7 +6072,7 @@
         "minipass": "^3.1.3",
         "mkdirp": "^1.0.3",
         "npm-package-arg": "^8.0.1",
-        "npm-packlist": "^2.1.4",
+        "npm-packlist": "^3.0.0",
         "npm-pick-manifest": "^6.0.0",
         "npm-registry-fetch": "^11.0.0",
         "promise-retry": "^2.0.1",
@@ -13428,9 +13431,9 @@
       "dev": true
     },
     "ignore-walk": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-3.0.4.tgz",
-      "integrity": "sha512-PY6Ii8o1jMRA1z4F2hRkH/xN59ox43DavKvD3oDpfurRlOJyAHpifIwpbdv1n4jt4ov0jSpw3kQ4GhJnpBL6WQ==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-4.0.1.tgz",
+      "integrity": "sha512-rzDQLaW4jQbh2YrOFlJdCtX8qgJTehFRYiUB2r1osqTeDzV/3+Jh8fz1oAPzUThf3iku8Ds4IDqawI5d8mUiQw==",
       "requires": {
         "minimatch": "^3.0.4"
       }
@@ -14728,12 +14731,12 @@
       }
     },
     "npm-packlist": {
-      "version": "2.2.2",
-      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-2.2.2.tgz",
-      "integrity": "sha512-Jt01acDvJRhJGthnUJVF/w6gumWOZxO7IkpY/lsX9//zqQgnF7OJaxgQXcerd4uQOLu7W5bkb4mChL9mdfm+Zg==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-3.0.0.tgz",
+      "integrity": "sha512-L/cbzmutAwII5glUcf2DBRNY/d0TFd4e/FnaZigJV6JD85RHZXJFGwCndjMWiiViiWSsWt3tiOLpI3ByTnIdFQ==",
       "requires": {
         "glob": "^7.1.6",
-        "ignore-walk": "^3.0.3",
+        "ignore-walk": "^4.0.1",
         "npm-bundled": "^1.1.1",
         "npm-normalize-package-bin": "^1.0.1"
       }
@@ -15059,9 +15062,9 @@
       }
     },
     "pacote": {
-      "version": "12.0.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-12.0.0.tgz",
-      "integrity": "sha512-5DnYqZU0w7GIskuc5yXii1kKpQS2fsaxCaI0FXRsMULXB06lXnZpRdV7JC1TTcQN5uy62h4VWS4WMPYGWu3MYg==",
+      "version": "12.0.2",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-12.0.2.tgz",
+      "integrity": "sha512-Ar3mhjcxhMzk+OVZ8pbnXdb0l8+pimvlsqBGRNkble2NVgyqOGE3yrCGi/lAYq7E7NRDMz89R1Wx5HIMCGgeYg==",
       "requires": {
         "@npmcli/git": "^2.1.0",
         "@npmcli/installed-package-contents": "^1.0.6",
@@ -15074,7 +15077,7 @@
         "minipass": "^3.1.3",
         "mkdirp": "^1.0.3",
         "npm-package-arg": "^8.0.1",
-        "npm-packlist": "^2.1.4",
+        "npm-packlist": "^3.0.0",
         "npm-pick-manifest": "^6.0.0",
         "npm-registry-fetch": "^11.0.0",
         "promise-retry": "^2.0.1",
diff --git a/package.json b/package.json
index bfde6737d..2c6471690 100644
--- a/package.json
+++ b/package.json
@@ -107,7 +107,7 @@
     "npm-user-validate": "^1.0.1",
     "npmlog": "^5.0.1",
     "opener": "^1.5.2",
-    "pacote": "^12.0.0",
+    "pacote": "^12.0.2",
     "parse-conflict-json": "^1.1.1",
     "qrcode-terminal": "^0.12.0",
     "read": "~1.0.7",