deps: npm-package-arg@10.0.0, pacote@15.0.2

33 files changed, 101 insertions, 2477 deletions

diff --git a/node_modules/.gitignore b/node_modules/.gitignore
index 1b56990e5..fc263d901 100644
--- a/node_modules/.gitignore
+++ b/node_modules/.gitignore
@@ -117,9 +117,6 @@
 !/inherits
 !/ini
 !/init-package-json
-!/init-package-json/node_modules/
-/init-package-json/node_modules/*
-!/init-package-json/node_modules/npm-package-arg
 !/ip-regex
 !/ip
 !/is-cidr
@@ -191,22 +188,13 @@
 !/npm-install-checks
 !/npm-normalize-package-bin
 !/npm-package-arg
-!/npm-package-arg/node_modules/
-/npm-package-arg/node_modules/*
-!/npm-package-arg/node_modules/hosted-git-info
-!/npm-package-arg/node_modules/proc-log
-!/npm-package-arg/node_modules/validate-npm-package-name
 !/npm-packlist
 !/npm-pick-manifest
-!/npm-pick-manifest/node_modules/
-/npm-pick-manifest/node_modules/*
-!/npm-pick-manifest/node_modules/npm-package-arg
 !/npm-profile
 !/npm-registry-fetch
 !/npm-registry-fetch/node_modules/
 /npm-registry-fetch/node_modules/*
 !/npm-registry-fetch/node_modules/minipass-fetch
-!/npm-registry-fetch/node_modules/npm-package-arg
 !/npm-user-validate
 !/npmlog
 !/once
diff --git a/node_modules/init-package-json/node_modules/npm-package-arg/LICENSE b/node_modules/init-package-json/node_modules/npm-package-arg/LICENSE
deleted file mode 100644
index 19cec97b1..000000000
--- a/node_modules/init-package-json/node_modules/npm-package-arg/LICENSE
+++ /dev/null
@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) npm, Inc.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/init-package-json/node_modules/npm-package-arg/lib/npa.js b/node_modules/init-package-json/node_modules/npm-package-arg/lib/npa.js
deleted file mode 100644
index 10af67be5..000000000
--- a/node_modules/init-package-json/node_modules/npm-package-arg/lib/npa.js
+++ /dev/null
@@ -1,405 +0,0 @@
-'use strict'
-module.exports = npa
-module.exports.resolve = resolve
-module.exports.Result = Result
-
-const url = require('url')
-const HostedGit = require('hosted-git-info')
-const semver = require('semver')
-const path = global.FAKE_WINDOWS ? require('path').win32 : require('path')
-const validatePackageName = require('validate-npm-package-name')
-const { homedir } = require('os')
-const log = require('proc-log')
-
-const isWindows = process.platform === 'win32' || global.FAKE_WINDOWS
-const hasSlashes = isWindows ? /\\|[/]/ : /[/]/
-const isURL = /^(?:git[+])?[a-z]+:/i
-const isGit = /^[^@]+@[^:.]+\.[^:]+:.+$/i
-const isFilename = /[.](?:tgz|tar.gz|tar)$/i
-
-function npa (arg, where) {
-  let name
-  let spec
-  if (typeof arg === 'object') {
-    if (arg instanceof Result && (!where || where === arg.where)) {
-      return arg
-    } else if (arg.name && arg.rawSpec) {
-      return npa.resolve(arg.name, arg.rawSpec, where || arg.where)
-    } else {
-      return npa(arg.raw, where || arg.where)
-    }
-  }
-  const nameEndsAt = arg[0] === '@' ? arg.slice(1).indexOf('@') + 1 : arg.indexOf('@')
-  const namePart = nameEndsAt > 0 ? arg.slice(0, nameEndsAt) : arg
-  if (isURL.test(arg)) {
-    spec = arg
-  } else if (isGit.test(arg)) {
-    spec = `git+ssh://${arg}`
-  } else if (namePart[0] !== '@' && (hasSlashes.test(namePart) || isFilename.test(namePart))) {
-    spec = arg
-  } else if (nameEndsAt > 0) {
-    name = namePart
-    spec = arg.slice(nameEndsAt + 1) || '*'
-  } else {
-    const valid = validatePackageName(arg)
-    if (valid.validForOldPackages) {
-      name = arg
-      spec = '*'
-    } else {
-      spec = arg
-    }
-  }
-  return resolve(name, spec, where, arg)
-}
-
-const isFilespec = isWindows ? /^(?:[.]|~[/]|[/\\]|[a-zA-Z]:)/ : /^(?:[.]|~[/]|[/]|[a-zA-Z]:)/
-
-function resolve (name, spec, where, arg) {
-  const res = new Result({
-    raw: arg,
-    name: name,
-    rawSpec: spec,
-    fromArgument: arg != null,
-  })
-
-  if (name) {
-    res.setName(name)
-  }
-
-  if (spec && (isFilespec.test(spec) || /^file:/i.test(spec))) {
-    return fromFile(res, where)
-  } else if (spec && /^npm:/i.test(spec)) {
-    return fromAlias(res, where)
-  }
-
-  const hosted = HostedGit.fromUrl(spec, {
-    noGitPlus: true,
-    noCommittish: true,
-  })
-  if (hosted) {
-    return fromHostedGit(res, hosted)
-  } else if (spec && isURL.test(spec)) {
-    return fromURL(res)
-  } else if (spec && (hasSlashes.test(spec) || isFilename.test(spec))) {
-    return fromFile(res, where)
-  } else {
-    return fromRegistry(res)
-  }
-}
-
-function invalidPackageName (name, valid, raw) {
-  // eslint-disable-next-line max-len
-  const err = new Error(`Invalid package name "${name}" of package "${raw}": ${valid.errors.join('; ')}.`)
-  err.code = 'EINVALIDPACKAGENAME'
-  return err
-}
-
-function invalidTagName (name, raw) {
-  // eslint-disable-next-line max-len
-  const err = new Error(`Invalid tag name "${name}" of package "${raw}": Tags may not have any characters that encodeURIComponent encodes.`)
-  err.code = 'EINVALIDTAGNAME'
-  return err
-}
-
-function Result (opts) {
-  this.type = opts.type
-  this.registry = opts.registry
-  this.where = opts.where
-  if (opts.raw == null) {
-    this.raw = opts.name ? opts.name + '@' + opts.rawSpec : opts.rawSpec
-  } else {
-    this.raw = opts.raw
-  }
-
-  this.name = undefined
-  this.escapedName = undefined
-  this.scope = undefined
-  this.rawSpec = opts.rawSpec || ''
-  this.saveSpec = opts.saveSpec
-  this.fetchSpec = opts.fetchSpec
-  if (opts.name) {
-    this.setName(opts.name)
-  }
-  this.gitRange = opts.gitRange
-  this.gitCommittish = opts.gitCommittish
-  this.gitSubdir = opts.gitSubdir
-  this.hosted = opts.hosted
-}
-
-Result.prototype.setName = function (name) {
-  const valid = validatePackageName(name)
-  if (!valid.validForOldPackages) {
-    throw invalidPackageName(name, valid, this.raw)
-  }
-
-  this.name = name
-  this.scope = name[0] === '@' ? name.slice(0, name.indexOf('/')) : undefined
-  // scoped packages in couch must have slash url-encoded, e.g. @foo%2Fbar
-  this.escapedName = name.replace('/', '%2f')
-  return this
-}
-
-Result.prototype.toString = function () {
-  const full = []
-  if (this.name != null && this.name !== '') {
-    full.push(this.name)
-  }
-  const spec = this.saveSpec || this.fetchSpec || this.rawSpec
-  if (spec != null && spec !== '') {
-    full.push(spec)
-  }
-  return full.length ? full.join('@') : this.raw
-}
-
-Result.prototype.toJSON = function () {
-  const result = Object.assign({}, this)
-  delete result.hosted
-  return result
-}
-
-function setGitCommittish (res, committish) {
-  if (!committish) {
-    res.gitCommittish = null
-    return res
-  }
-
-  // for each :: separated item:
-  for (const part of committish.split('::')) {
-    // if the item has no : the n it is a commit-ish
-    if (!part.includes(':')) {
-      if (res.gitRange) {
-        throw new Error('cannot override existing semver range with a committish')
-      }
-      if (res.gitCommittish) {
-        throw new Error('cannot override existing committish with a second committish')
-      }
-      res.gitCommittish = part
-      continue
-    }
-    // split on name:value
-    const [name, value] = part.split(':')
-    // if name is semver do semver lookup of ref or tag
-    if (name === 'semver') {
-      if (res.gitCommittish) {
-        throw new Error('cannot override existing committish with a semver range')
-      }
-      if (res.gitRange) {
-        throw new Error('cannot override existing semver range with a second semver range')
-      }
-      res.gitRange = decodeURIComponent(value)
-      continue
-    }
-    if (name === 'path') {
-      if (res.gitSubdir) {
-        throw new Error('cannot override existing path with a second path')
-      }
-      res.gitSubdir = `/${value}`
-      continue
-    }
-    log.warn('npm-package-arg', `ignoring unknown key "${name}"`)
-  }
-
-  return res
-}
-
-function fromFile (res, where) {
-  if (!where) {
-    where = process.cwd()
-  }
-  res.type = isFilename.test(res.rawSpec) ? 'file' : 'directory'
-  res.where = where
-
-  // always put the '/' on where when resolving urls, or else
-  // file:foo from /path/to/bar goes to /path/to/foo, when we want
-  // it to be /path/to/bar/foo
-
-  let specUrl
-  let resolvedUrl
-  const prefix = (!/^file:/.test(res.rawSpec) ? 'file:' : '')
-  const rawWithPrefix = prefix + res.rawSpec
-  let rawNoPrefix = rawWithPrefix.replace(/^file:/, '')
-  try {
-    resolvedUrl = new url.URL(rawWithPrefix, `file://${path.resolve(where)}/`)
-    specUrl = new url.URL(rawWithPrefix)
-  } catch (originalError) {
-    const er = new Error('Invalid file: URL, must comply with RFC 8909')
-    throw Object.assign(er, {
-      raw: res.rawSpec,
-      spec: res,
-      where,
-      originalError,
-    })
-  }
-
-  // environment switch for testing
-  if (process.env.NPM_PACKAGE_ARG_8909_STRICT !== '1') {
-    // XXX backwards compatibility lack of compliance with 8909
-    // Remove when we want a breaking change to come into RFC compliance.
-    if (resolvedUrl.host && resolvedUrl.host !== 'localhost') {
-      const rawSpec = res.rawSpec.replace(/^file:\/\//, 'file:///')
-      resolvedUrl = new url.URL(rawSpec, `file://${path.resolve(where)}/`)
-      specUrl = new url.URL(rawSpec)
-      rawNoPrefix = rawSpec.replace(/^file:/, '')
-    }
-    // turn file:/../foo into file:../foo
-    // for 1, 2 or 3 leading slashes since we attempted
-    // in the previous step to make it a file protocol url with a leading slash
-    if (/^\/{1,3}\.\.?(\/|$)/.test(rawNoPrefix)) {
-      const rawSpec = res.rawSpec.replace(/^file:\/{1,3}/, 'file:')
-      resolvedUrl = new url.URL(rawSpec, `file://${path.resolve(where)}/`)
-      specUrl = new url.URL(rawSpec)
-      rawNoPrefix = rawSpec.replace(/^file:/, '')
-    }
-    // XXX end 8909 violation backwards compatibility section
-  }
-
-  // file:foo - relative url to ./foo
-  // file:/foo - absolute path /foo
-  // file:///foo - absolute path to /foo, no authority host
-  // file://localhost/foo - absolute path to /foo, on localhost
-  // file://foo - absolute path to / on foo host (error!)
-  if (resolvedUrl.host && resolvedUrl.host !== 'localhost') {
-    const msg = `Invalid file: URL, must be absolute if // present`
-    throw Object.assign(new Error(msg), {
-      raw: res.rawSpec,
-      parsed: resolvedUrl,
-    })
-  }
-
-  // turn /C:/blah into just C:/blah on windows
-  let specPath = decodeURIComponent(specUrl.pathname)
-  let resolvedPath = decodeURIComponent(resolvedUrl.pathname)
-  if (isWindows) {
-    specPath = specPath.replace(/^\/+([a-z]:\/)/i, '$1')
-    resolvedPath = resolvedPath.replace(/^\/+([a-z]:\/)/i, '$1')
-  }
-
-  // replace ~ with homedir, but keep the ~ in the saveSpec
-  // otherwise, make it relative to where param
-  if (/^\/~(\/|$)/.test(specPath)) {
-    res.saveSpec = `file:${specPath.substr(1)}`
-    resolvedPath = path.resolve(homedir(), specPath.substr(3))
-  } else if (!path.isAbsolute(rawNoPrefix)) {
-    res.saveSpec = `file:${path.relative(where, resolvedPath)}`
-  } else {
-    res.saveSpec = `file:${path.resolve(resolvedPath)}`
-  }
-
-  res.fetchSpec = path.resolve(where, resolvedPath)
-  return res
-}
-
-function fromHostedGit (res, hosted) {
-  res.type = 'git'
-  res.hosted = hosted
-  res.saveSpec = hosted.toString({ noGitPlus: false, noCommittish: false })
-  res.fetchSpec = hosted.getDefaultRepresentation() === 'shortcut' ? null : hosted.toString()
-  return setGitCommittish(res, hosted.committish)
-}
-
-function unsupportedURLType (protocol, spec) {
-  const err = new Error(`Unsupported URL Type "${protocol}": ${spec}`)
-  err.code = 'EUNSUPPORTEDPROTOCOL'
-  return err
-}
-
-function matchGitScp (spec) {
-  // git ssh specifiers are overloaded to also use scp-style git
-  // specifiers, so we have to parse those out and treat them special.
-  // They are NOT true URIs, so we can't hand them to `url.parse`.
-  //
-  // This regex looks for things that look like:
-  // git+ssh://git@my.custom.git.com:username/project.git#deadbeef
-  //
-  // ...and various combinations. The username in the beginning is *required*.
-  const matched = spec.match(/^git\+ssh:\/\/([^:#]+:[^#]+(?:\.git)?)(?:#(.*))?$/i)
-  return matched && !matched[1].match(/:[0-9]+\/?.*$/i) && {
-    fetchSpec: matched[1],
-    gitCommittish: matched[2] == null ? null : matched[2],
-  }
-}
-
-function fromURL (res) {
-  // eslint-disable-next-line node/no-deprecated-api
-  const urlparse = url.parse(res.rawSpec)
-  res.saveSpec = res.rawSpec
-  // check the protocol, and then see if it's git or not
-  switch (urlparse.protocol) {
-    case 'git:':
-    case 'git+http:':
-    case 'git+https:':
-    case 'git+rsync:':
-    case 'git+ftp:':
-    case 'git+file:':
-    case 'git+ssh:': {
-      res.type = 'git'
-      const match = urlparse.protocol === 'git+ssh:' ? matchGitScp(res.rawSpec)
-        : null
-      if (match) {
-        setGitCommittish(res, match.gitCommittish)
-        res.fetchSpec = match.fetchSpec
-      } else {
-        setGitCommittish(res, urlparse.hash != null ? urlparse.hash.slice(1) : '')
-        urlparse.protocol = urlparse.protocol.replace(/^git[+]/, '')
-        if (urlparse.protocol === 'file:' && /^git\+file:\/\/[a-z]:/i.test(res.rawSpec)) {
-          // keep the drive letter : on windows file paths
-          urlparse.host += ':'
-          urlparse.hostname += ':'
-        }
-        delete urlparse.hash
-        res.fetchSpec = url.format(urlparse)
-      }
-      break
-    }
-    case 'http:':
-    case 'https:':
-      res.type = 'remote'
-      res.fetchSpec = res.saveSpec
-      break
-
-    default:
-      throw unsupportedURLType(urlparse.protocol, res.rawSpec)
-  }
-
-  return res
-}
-
-function fromAlias (res, where) {
-  const subSpec = npa(res.rawSpec.substr(4), where)
-  if (subSpec.type === 'alias') {
-    throw new Error('nested aliases not supported')
-  }
-
-  if (!subSpec.registry) {
-    throw new Error('aliases only work for registry deps')
-  }
-
-  res.subSpec = subSpec
-  res.registry = true
-  res.type = 'alias'
-  res.saveSpec = null
-  res.fetchSpec = null
-  return res
-}
-
-function fromRegistry (res) {
-  res.registry = true
-  const spec = res.rawSpec.trim()
-  // no save spec for registry components as we save based on the fetched
-  // version, not on the argument so this can't compute that.
-  res.saveSpec = null
-  res.fetchSpec = spec
-  const version = semver.valid(spec, true)
-  const range = semver.validRange(spec, true)
-  if (version) {
-    res.type = 'version'
-  } else if (range) {
-    res.type = 'range'
-  } else {
-    if (encodeURIComponent(spec) !== spec) {
-      throw invalidTagName(spec, res.raw)
-    }
-    res.type = 'tag'
-  }
-  return res
-}
diff --git a/node_modules/init-package-json/node_modules/npm-package-arg/package.json b/node_modules/init-package-json/node_modules/npm-package-arg/package.json
deleted file mode 100644
index 9ade534a2..000000000
--- a/node_modules/init-package-json/node_modules/npm-package-arg/package.json
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  "name": "npm-package-arg",
-  "version": "10.0.0",
-  "description": "Parse the things that can be arguments to `npm install`",
-  "main": "./lib/npa.js",
-  "directories": {
-    "test": "test"
-  },
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "dependencies": {
-    "hosted-git-info": "^6.0.0",
-    "proc-log": "^3.0.0",
-    "semver": "^7.3.5",
-    "validate-npm-package-name": "^5.0.0"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.6.1",
-    "tap": "^16.0.1"
-  },
-  "scripts": {
-    "test": "tap",
-    "snap": "tap",
-    "npmclilint": "npmcli-lint",
-    "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
-    "posttest": "npm run lint",
-    "postsnap": "npm run lintfix --",
-    "postlint": "template-oss-check",
-    "template-oss-apply": "template-oss-apply --force"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/npm-package-arg.git"
-  },
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "bugs": {
-    "url": "https://github.com/npm/npm-package-arg/issues"
-  },
-  "homepage": "https://github.com/npm/npm-package-arg",
-  "engines": {
-    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-  },
-  "tap": {
-    "branches": 97,
-    "nyc-arg": [
-      "--exclude",
-      "tap-snapshots/**"
-    ]
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.6.1"
-  }
-}
diff --git a/node_modules/npm-package-arg/lib/npa.js b/node_modules/npm-package-arg/lib/npa.js
index cd1932b0b..10af67be5 100644
--- a/node_modules/npm-package-arg/lib/npa.js
+++ b/node_modules/npm-package-arg/lib/npa.js
@@ -39,11 +39,12 @@ function npa (arg, where) {
     spec = arg
   } else if (nameEndsAt > 0) {
     name = namePart
-    spec = arg.slice(nameEndsAt + 1)
+    spec = arg.slice(nameEndsAt + 1) || '*'
   } else {
     const valid = validatePackageName(arg)
     if (valid.validForOldPackages) {
       name = arg
+      spec = '*'
     } else {
       spec = arg
     }
@@ -113,7 +114,7 @@ function Result (opts) {
   this.name = undefined
   this.escapedName = undefined
   this.scope = undefined
-  this.rawSpec = opts.rawSpec == null ? '' : opts.rawSpec
+  this.rawSpec = opts.rawSpec || ''
   this.saveSpec = opts.saveSpec
   this.fetchSpec = opts.fetchSpec
   if (opts.name) {
@@ -383,7 +384,7 @@ function fromAlias (res, where) {
 
 function fromRegistry (res) {
   res.registry = true
-  const spec = res.rawSpec === '' ? 'latest' : res.rawSpec.trim()
+  const spec = res.rawSpec.trim()
   // no save spec for registry components as we save based on the fetched
   // version, not on the argument so this can't compute that.
   res.saveSpec = null
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/LICENSE b/node_modules/npm-package-arg/node_modules/hosted-git-info/LICENSE
deleted file mode 100644
index 45055763d..000000000
--- a/node_modules/npm-package-arg/node_modules/hosted-git-info/LICENSE
+++ /dev/null
@@ -1,13 +0,0 @@
-Copyright (c) 2015, Rebecca Turner
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
-FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host-info.js b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host-info.js
deleted file mode 100644
index cdc1e4601..000000000
--- a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host-info.js
+++ /dev/null
@@ -1,192 +0,0 @@
-/* eslint-disable max-len */
-'use strict'
-const maybeJoin = (...args) => args.every(arg => arg) ? args.join('') : ''
-const maybeEncode = (arg) => arg ? encodeURIComponent(arg) : ''
-
-const defaults = {
-  sshtemplate: ({ domain, user, project, committish }) => `git@${domain}:${user}/${project}.git${maybeJoin('#', committish)}`,
-  sshurltemplate: ({ domain, user, project, committish }) => `git+ssh://git@${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  edittemplate: ({ domain, user, project, committish, editpath, path }) => `https://${domain}/${user}/${project}${maybeJoin('/', editpath, '/', maybeEncode(committish || 'master'), '/', path)}`,
-  browsetemplate: ({ domain, user, project, committish, treepath }) => `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish))}`,
-  browsefiletemplate: ({ domain, user, project, committish, treepath, path, fragment, hashformat }) => `https://${domain}/${user}/${project}/${treepath}/${maybeEncode(committish || 'master')}/${path}${maybeJoin('#', hashformat(fragment || ''))}`,
-  docstemplate: ({ domain, user, project, treepath, committish }) => `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish))}#readme`,
-  httpstemplate: ({ auth, domain, user, project, committish }) => `git+https://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  filetemplate: ({ domain, user, project, committish, path }) => `https://${domain}/${user}/${project}/raw/${maybeEncode(committish) || 'master'}/${path}`,
-  shortcuttemplate: ({ type, user, project, committish }) => `${type}:${user}/${project}${maybeJoin('#', committish)}`,
-  pathtemplate: ({ user, project, committish }) => `${user}/${project}${maybeJoin('#', committish)}`,
-  bugstemplate: ({ domain, user, project }) => `https://${domain}/${user}/${project}/issues`,
-  hashformat: formatHashFragment,
-}
-
-const gitHosts = {}
-gitHosts.github = Object.assign({}, defaults, {
-  // First two are insecure and generally shouldn't be used any more, but
-  // they are still supported.
-  protocols: ['git:', 'http:', 'git+ssh:', 'git+https:', 'ssh:', 'https:'],
-  domain: 'github.com',
-  treepath: 'tree',
-  editpath: 'edit',
-  filetemplate: ({ auth, user, project, committish, path }) => `https://${maybeJoin(auth, '@')}raw.githubusercontent.com/${user}/${project}/${maybeEncode(committish) || 'master'}/${path}`,
-  gittemplate: ({ auth, domain, user, project, committish }) => `git://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  tarballtemplate: ({ domain, user, project, committish }) => `https://codeload.${domain}/${user}/${project}/tar.gz/${maybeEncode(committish) || 'master'}`,
-  extract: (url) => {
-    let [, user, project, type, committish] = url.pathname.split('/', 5)
-    if (type && type !== 'tree') {
-      return
-    }
-
-    if (!type) {
-      committish = url.hash.slice(1)
-    }
-
-    if (project && project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    if (!user || !project) {
-      return
-    }
-
-    return { user, project, committish }
-  },
-})
-
-gitHosts.bitbucket = Object.assign({}, defaults, {
-  protocols: ['git+ssh:', 'git+https:', 'ssh:', 'https:'],
-  domain: 'bitbucket.org',
-  treepath: 'src',
-  editpath: '?mode=edit',
-  edittemplate: ({ domain, user, project, committish, treepath, path, editpath }) => `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish || 'master'), '/', path, editpath)}`,
-  tarballtemplate: ({ domain, user, project, committish }) => `https://${domain}/${user}/${project}/get/${maybeEncode(committish) || 'master'}.tar.gz`,
-  extract: (url) => {
-    let [, user, project, aux] = url.pathname.split('/', 4)
-    if (['get'].includes(aux)) {
-      return
-    }
-
-    if (project && project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    if (!user || !project) {
-      return
-    }
-
-    return { user, project, committish: url.hash.slice(1) }
-  },
-})
-
-gitHosts.gitlab = Object.assign({}, defaults, {
-  protocols: ['git+ssh:', 'git+https:', 'ssh:', 'https:'],
-  domain: 'gitlab.com',
-  treepath: 'tree',
-  editpath: '-/edit',
-  httpstemplate: ({ auth, domain, user, project, committish }) => `git+https://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  tarballtemplate: ({ domain, user, project, committish }) => `https://${domain}/${user}/${project}/repository/archive.tar.gz?ref=${maybeEncode(committish) || 'master'}`,
-  extract: (url) => {
-    const path = url.pathname.slice(1)
-    if (path.includes('/-/') || path.includes('/archive.tar.gz')) {
-      return
-    }
-
-    const segments = path.split('/')
-    let project = segments.pop()
-    if (project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    const user = segments.join('/')
-    if (!user || !project) {
-      return
-    }
-
-    return { user, project, committish: url.hash.slice(1) }
-  },
-})
-
-gitHosts.gist = Object.assign({}, defaults, {
-  protocols: ['git:', 'git+ssh:', 'git+https:', 'ssh:', 'https:'],
-  domain: 'gist.github.com',
-  editpath: 'edit',
-  sshtemplate: ({ domain, project, committish }) => `git@${domain}:${project}.git${maybeJoin('#', committish)}`,
-  sshurltemplate: ({ domain, project, committish }) => `git+ssh://git@${domain}/${project}.git${maybeJoin('#', committish)}`,
-  edittemplate: ({ domain, user, project, committish, editpath }) => `https://${domain}/${user}/${project}${maybeJoin('/', maybeEncode(committish))}/${editpath}`,
-  browsetemplate: ({ domain, project, committish }) => `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}`,
-  browsefiletemplate: ({ domain, project, committish, path, hashformat }) => `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}${maybeJoin('#', hashformat(path))}`,
-  docstemplate: ({ domain, project, committish }) => `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}`,
-  httpstemplate: ({ domain, project, committish }) => `git+https://${domain}/${project}.git${maybeJoin('#', committish)}`,
-  filetemplate: ({ user, project, committish, path }) => `https://gist.githubusercontent.com/${user}/${project}/raw${maybeJoin('/', maybeEncode(committish))}/${path}`,
-  shortcuttemplate: ({ type, project, committish }) => `${type}:${project}${maybeJoin('#', committish)}`,
-  pathtemplate: ({ project, committish }) => `${project}${maybeJoin('#', committish)}`,
-  bugstemplate: ({ domain, project }) => `https://${domain}/${project}`,
-  gittemplate: ({ domain, project, committish }) => `git://${domain}/${project}.git${maybeJoin('#', committish)}`,
-  tarballtemplate: ({ project, committish }) => `https://codeload.github.com/gist/${project}/tar.gz/${maybeEncode(committish) || 'master'}`,
-  extract: (url) => {
-    let [, user, project, aux] = url.pathname.split('/', 4)
-    if (aux === 'raw') {
-      return
-    }
-
-    if (!project) {
-      if (!user) {
-        return
-      }
-
-      project = user
-      user = null
-    }
-
-    if (project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    return { user, project, committish: url.hash.slice(1) }
-  },
-  hashformat: function (fragment) {
-    return fragment && 'file-' + formatHashFragment(fragment)
-  },
-})
-
-gitHosts.sourcehut = Object.assign({}, defaults, {
-  protocols: ['git+ssh:', 'https:'],
-  domain: 'git.sr.ht',
-  treepath: 'tree',
-  browsefiletemplate: ({ domain, user, project, committish, treepath, path, fragment, hashformat }) => `https://${domain}/${user}/${project}/${treepath}/${maybeEncode(committish || 'main')}/${path}${maybeJoin('#', hashformat(fragment || ''))}`,
-  filetemplate: ({ domain, user, project, committish, path }) => `https://${domain}/${user}/${project}/blob/${maybeEncode(committish) || 'main'}/${path}`,
-  httpstemplate: ({ domain, user, project, committish }) => `https://${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  tarballtemplate: ({ domain, user, project, committish }) => `https://${domain}/${user}/${project}/archive/${maybeEncode(committish) || 'main'}.tar.gz`,
-  bugstemplate: ({ domain, user, project }) => `https://todo.sr.ht/${user}/${project}`,
-  docstemplate: ({ domain, user, project, treepath, committish }) => `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish))}#readme`,
-  extract: (url) => {
-    let [, user, project, aux] = url.pathname.split('/', 4)
-
-    // tarball url
-    if (['archive'].includes(aux)) {
-      return
-    }
-
-    if (project && project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    if (!user || !project) {
-      return
-    }
-
-    return { user, project, committish: url.hash.slice(1) }
-  },
-})
-
-const names = Object.keys(gitHosts)
-gitHosts.byShortcut = {}
-gitHosts.byDomain = {}
-for (const name of names) {
-  gitHosts.byShortcut[`${name}:`] = name
-  gitHosts.byDomain[gitHosts[name].domain] = name
-}
-
-function formatHashFragment (fragment) {
-  return fragment.toLowerCase().replace(/^\W+|\/|\W+$/g, '').replace(/\W+/g, '-')
-}
-
-module.exports = gitHosts
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host.js b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host.js
deleted file mode 100644
index bb65d4d99..000000000
--- a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host.js
+++ /dev/null
@@ -1,114 +0,0 @@
-'use strict'
-const gitHosts = require('./git-host-info.js')
-
-class GitHost {
-  constructor (type, user, auth, project, committish, defaultRepresentation, opts = {}) {
-    Object.assign(this, gitHosts[type])
-    this.type = type
-    this.user = user
-    this.auth = auth
-    this.project = project
-    this.committish = committish
-    this.default = defaultRepresentation
-    this.opts = opts
-  }
-
-  hash () {
-    return this.committish ? `#${this.committish}` : ''
-  }
-
-  ssh (opts) {
-    return this._fill(this.sshtemplate, opts)
-  }
-
-  _fill (template, opts) {
-    if (typeof template === 'function') {
-      const options = { ...this, ...this.opts, ...opts }
-
-      // the path should always be set so we don't end up with 'undefined' in urls
-      if (!options.path) {
-        options.path = ''
-      }
-
-      // template functions will insert the leading slash themselves
-      if (options.path.startsWith('/')) {
-        options.path = options.path.slice(1)
-      }
-
-      if (options.noCommittish) {
-        options.committish = null
-      }
-
-      const result = template(options)
-      return options.noGitPlus && result.startsWith('git+') ? result.slice(4) : result
-    }
-
-    return null
-  }
-
-  sshurl (opts) {
-    return this._fill(this.sshurltemplate, opts)
-  }
-
-  browse (path, fragment, opts) {
-    // not a string, treat path as opts
-    if (typeof path !== 'string') {
-      return this._fill(this.browsetemplate, path)
-    }
-
-    if (typeof fragment !== 'string') {
-      opts = fragment
-      fragment = null
-    }
-    return this._fill(this.browsefiletemplate, { ...opts, fragment, path })
-  }
-
-  docs (opts) {
-    return this._fill(this.docstemplate, opts)
-  }
-
-  bugs (opts) {
-    return this._fill(this.bugstemplate, opts)
-  }
-
-  https (opts) {
-    return this._fill(this.httpstemplate, opts)
-  }
-
-  git (opts) {
-    return this._fill(this.gittemplate, opts)
-  }
-
-  shortcut (opts) {
-    return this._fill(this.shortcuttemplate, opts)
-  }
-
-  path (opts) {
-    return this._fill(this.pathtemplate, opts)
-  }
-
-  tarball (opts) {
-    return this._fill(this.tarballtemplate, { ...opts, noCommittish: false })
-  }
-
-  file (path, opts) {
-    return this._fill(this.filetemplate, { ...opts, path })
-  }
-
-  edit (path, opts) {
-    return this._fill(this.edittemplate, { ...opts, path })
-  }
-
-  getDefaultRepresentation () {
-    return this.default
-  }
-
-  toString (opts) {
-    if (this.default && typeof this[this.default] === 'function') {
-      return this[this.default](opts)
-    }
-
-    return this.sshurl(opts)
-  }
-}
-module.exports = GitHost
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/index.js b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/index.js
deleted file mode 100644
index d5d63c668..000000000
--- a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/index.js
+++ /dev/null
@@ -1,248 +0,0 @@
-'use strict'
-const url = require('url')
-const gitHosts = require('./git-host-info.js')
-const GitHost = module.exports = require('./git-host.js')
-const LRU = require('lru-cache')
-const cache = new LRU({ max: 1000 })
-
-const protocolToRepresentationMap = {
-  'git+ssh:': 'sshurl',
-  'git+https:': 'https',
-  'ssh:': 'sshurl',
-  'git:': 'git',
-}
-
-function protocolToRepresentation (protocol) {
-  return protocolToRepresentationMap[protocol] || protocol.slice(0, -1)
-}
-
-const authProtocols = {
-  'git:': true,
-  'https:': true,
-  'git+https:': true,
-  'http:': true,
-  'git+http:': true,
-}
-
-const knownProtocols = Object.keys(gitHosts.byShortcut)
-  .concat(['http:', 'https:', 'git:', 'git+ssh:', 'git+https:', 'ssh:'])
-
-module.exports.fromUrl = function (giturl, opts) {
-  if (typeof giturl !== 'string') {
-    return
-  }
-
-  const key = giturl + JSON.stringify(opts || {})
-
-  if (!cache.has(key)) {
-    cache.set(key, fromUrl(giturl, opts))
-  }
-
-  return cache.get(key)
-}
-
-function fromUrl (giturl, opts) {
-  if (!giturl) {
-    return
-  }
-
-  const correctedUrl = isGitHubShorthand(giturl) ? 'github:' + giturl : correctProtocol(giturl)
-  const parsed = parseGitUrl(correctedUrl)
-  if (!parsed) {
-    return parsed
-  }
-
-  const gitHostShortcut = gitHosts.byShortcut[parsed.protocol]
-  const gitHostDomain =
-    gitHosts.byDomain[parsed.hostname.startsWith('www.') ?
-      parsed.hostname.slice(4) :
-      parsed.hostname]
-  const gitHostName = gitHostShortcut || gitHostDomain
-  if (!gitHostName) {
-    return
-  }
-
-  const gitHostInfo = gitHosts[gitHostShortcut || gitHostDomain]
-  let auth = null
-  if (authProtocols[parsed.protocol] && (parsed.username || parsed.password)) {
-    auth = `${parsed.username}${parsed.password ? ':' + parsed.password : ''}`
-  }
-
-  let committish = null
-  let user = null
-  let project = null
-  let defaultRepresentation = null
-
-  try {
-    if (gitHostShortcut) {
-      let pathname = parsed.pathname.startsWith('/') ? parsed.pathname.slice(1) : parsed.pathname
-      const firstAt = pathname.indexOf('@')
-      // we ignore auth for shortcuts, so just trim it out
-      if (firstAt > -1) {
-        pathname = pathname.slice(firstAt + 1)
-      }
-
-      const lastSlash = pathname.lastIndexOf('/')
-      if (lastSlash > -1) {
-        user = decodeURIComponent(pathname.slice(0, lastSlash))
-        // we want nulls only, never empty strings
-        if (!user) {
-          user = null
-        }
-        project = decodeURIComponent(pathname.slice(lastSlash + 1))
-      } else {
-        project = decodeURIComponent(pathname)
-      }
-
-      if (project.endsWith('.git')) {
-        project = project.slice(0, -4)
-      }
-
-      if (parsed.hash) {
-        committish = decodeURIComponent(parsed.hash.slice(1))
-      }
-
-      defaultRepresentation = 'shortcut'
-    } else {
-      if (!gitHostInfo.protocols.includes(parsed.protocol)) {
-        return
-      }
-
-      const segments = gitHostInfo.extract(parsed)
-      if (!segments) {
-        return
-      }
-
-      user = segments.user && decodeURIComponent(segments.user)
-      project = decodeURIComponent(segments.project)
-      committish = decodeURIComponent(segments.committish)
-      defaultRepresentation = protocolToRepresentation(parsed.protocol)
-    }
-  } catch (err) {
-    /* istanbul ignore else */
-    if (err instanceof URIError) {
-      return
-    } else {
-      throw err
-    }
-  }
-
-  return new GitHost(gitHostName, user, auth, project, committish, defaultRepresentation, opts)
-}
-
-// accepts input like git:github.com:user/repo and inserts the // after the first :
-const correctProtocol = (arg) => {
-  const firstColon = arg.indexOf(':')
-  const proto = arg.slice(0, firstColon + 1)
-  if (knownProtocols.includes(proto)) {
-    return arg
-  }
-
-  const firstAt = arg.indexOf('@')
-  if (firstAt > -1) {
-    if (firstAt > firstColon) {
-      return `git+ssh://${arg}`
-    } else {
-      return arg
-    }
-  }
-
-  const doubleSlash = arg.indexOf('//')
-  if (doubleSlash === firstColon + 1) {
-    return arg
-  }
-
-  return arg.slice(0, firstColon + 1) + '//' + arg.slice(firstColon + 1)
-}
-
-// look for github shorthand inputs, such as npm/cli
-const isGitHubShorthand = (arg) => {
-  // it cannot contain whitespace before the first #
-  // it cannot start with a / because that's probably an absolute file path
-  // but it must include a slash since repos are username/repository
-  // it cannot start with a . because that's probably a relative file path
-  // it cannot start with an @ because that's a scoped package if it passes the other tests
-  // it cannot contain a : before a # because that tells us that there's a protocol
-  // a second / may not exist before a #
-  const firstHash = arg.indexOf('#')
-  const firstSlash = arg.indexOf('/')
-  const secondSlash = arg.indexOf('/', firstSlash + 1)
-  const firstColon = arg.indexOf(':')
-  const firstSpace = /\s/.exec(arg)
-  const firstAt = arg.indexOf('@')
-
-  const spaceOnlyAfterHash = !firstSpace || (firstHash > -1 && firstSpace.index > firstHash)
-  const atOnlyAfterHash = firstAt === -1 || (firstHash > -1 && firstAt > firstHash)
-  const colonOnlyAfterHash = firstColon === -1 || (firstHash > -1 && firstColon > firstHash)
-  const secondSlashOnlyAfterHash = secondSlash === -1 || (firstHash > -1 && secondSlash > firstHash)
-  const hasSlash = firstSlash > 0
-  // if a # is found, what we really want to know is that the character
-  // immediately before # is not a /
-  const doesNotEndWithSlash = firstHash > -1 ? arg[firstHash - 1] !== '/' : !arg.endsWith('/')
-  const doesNotStartWithDot = !arg.startsWith('.')
-
-  return spaceOnlyAfterHash && hasSlash && doesNotEndWithSlash &&
-    doesNotStartWithDot && atOnlyAfterHash && colonOnlyAfterHash &&
-    secondSlashOnlyAfterHash
-}
-
-// attempt to correct an scp style url so that it will parse with `new URL()`
-const correctUrl = (giturl) => {
-  const firstAt = giturl.indexOf('@')
-  const lastHash = giturl.lastIndexOf('#')
-  let firstColon = giturl.indexOf(':')
-  let lastColon = giturl.lastIndexOf(':', lastHash > -1 ? lastHash : Infinity)
-
-  let corrected
-  if (lastColon > firstAt) {
-    // the last : comes after the first @ (or there is no @)
-    // like it would in:
-    // proto://hostname.com:user/repo
-    // username@hostname.com:user/repo
-    // :password@hostname.com:user/repo
-    // username:password@hostname.com:user/repo
-    // proto://username@hostname.com:user/repo
-    // proto://:password@hostname.com:user/repo
-    // proto://username:password@hostname.com:user/repo
-    // then we replace the last : with a / to create a valid path
-    corrected = giturl.slice(0, lastColon) + '/' + giturl.slice(lastColon + 1)
-    // // and we find our new : positions
-    firstColon = corrected.indexOf(':')
-    lastColon = corrected.lastIndexOf(':')
-  }
-
-  if (firstColon === -1 && giturl.indexOf('//') === -1) {
-    // we have no : at all
-    // as it would be in:
-    // username@hostname.com/user/repo
-    // then we prepend a protocol
-    corrected = `git+ssh://${corrected}`
-  }
-
-  return corrected
-}
-
-// try to parse the url as its given to us, if that throws
-// then we try to clean the url and parse that result instead
-// THIS FUNCTION SHOULD NEVER THROW
-const parseGitUrl = (giturl) => {
-  let result
-  try {
-    result = new url.URL(giturl)
-  } catch {
-    // this fn should never throw
-  }
-
-  if (result) {
-    return result
-  }
-
-  const correctedUrl = correctUrl(giturl)
-  try {
-    result = new url.URL(correctedUrl)
-  } catch {
-    // this fn should never throw
-  }
-
-  return result
-}
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/package.json b/node_modules/npm-package-arg/node_modules/hosted-git-info/package.json
deleted file mode 100644
index 07a5587ca..000000000
--- a/node_modules/npm-package-arg/node_modules/hosted-git-info/package.json
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  "name": "hosted-git-info",
-  "version": "5.1.0",
-  "description": "Provides metadata and conversions from repository urls for GitHub, Bitbucket and GitLab",
-  "main": "./lib/index.js",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/hosted-git-info.git"
-  },
-  "keywords": [
-    "git",
-    "github",
-    "bitbucket",
-    "gitlab"
-  ],
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "bugs": {
-    "url": "https://github.com/npm/hosted-git-info/issues"
-  },
-  "homepage": "https://github.com/npm/hosted-git-info",
-  "scripts": {
-    "posttest": "npm run lint",
-    "postversion": "npm publish",
-    "prepublishOnly": "git push origin --follow-tags",
-    "preversion": "npm test",
-    "snap": "tap",
-    "test": "tap",
-    "test:coverage": "tap --coverage-report=html",
-    "lint": "eslint \"**/*.js\"",
-    "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
-    "template-oss-apply": "template-oss-apply --force"
-  },
-  "dependencies": {
-    "lru-cache": "^7.5.1"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.5.0",
-    "tap": "^16.0.1"
-  },
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "engines": {
-    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-  },
-  "tap": {
-    "color": 1,
-    "coverage": true
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.5.0"
-  }
-}
diff --git a/node_modules/npm-package-arg/node_modules/proc-log/LICENSE b/node_modules/npm-package-arg/node_modules/proc-log/LICENSE
deleted file mode 100644
index 838377972..000000000
--- a/node_modules/npm-package-arg/node_modules/proc-log/LICENSE
+++ /dev/null
@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) GitHub, Inc.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/npm-package-arg/node_modules/proc-log/lib/index.js b/node_modules/npm-package-arg/node_modules/proc-log/lib/index.js
deleted file mode 100644
index 7c5dfad3b..000000000
--- a/node_modules/npm-package-arg/node_modules/proc-log/lib/index.js
+++ /dev/null
@@ -1,23 +0,0 @@
-// emits 'log' events on the process
-const LEVELS = [
-  'notice',
-  'error',
-  'warn',
-  'info',
-  'verbose',
-  'http',
-  'silly',
-  'pause',
-  'resume',
-]
-
-const log = level => (...args) => process.emit('log', level, ...args)
-
-const logger = {}
-for (const level of LEVELS) {
-  logger[level] = log(level)
-}
-
-logger.LEVELS = LEVELS
-
-module.exports = logger
diff --git a/node_modules/npm-package-arg/node_modules/proc-log/package.json b/node_modules/npm-package-arg/node_modules/proc-log/package.json
deleted file mode 100644
index ca2f1c771..000000000
--- a/node_modules/npm-package-arg/node_modules/proc-log/package.json
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  "name": "proc-log",
-  "version": "2.0.1",
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "main": "lib/index.js",
-  "description": "just emit 'log' events on the process object",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/proc-log.git"
-  },
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "scripts": {
-    "test": "tap",
-    "snap": "tap",
-    "posttest": "npm run lint",
-    "postsnap": "eslint index.js test/*.js --fix",
-    "preversion": "npm test",
-    "postversion": "npm publish",
-    "prepublishOnly": "git push origin --follow-tags",
-    "lint": "eslint \"**/*.js\"",
-    "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
-    "template-oss-apply": "template-oss-apply --force"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.2.0",
-    "tap": "^16.0.1"
-  },
-  "engines": {
-    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.2.0"
-  }
-}
diff --git a/node_modules/npm-package-arg/node_modules/validate-npm-package-name/LICENSE b/node_modules/npm-package-arg/node_modules/validate-npm-package-name/LICENSE
deleted file mode 100644
index fdcd63b30..000000000
--- a/node_modules/npm-package-arg/node_modules/validate-npm-package-name/LICENSE
+++ /dev/null
@@ -1,6 +0,0 @@
-Copyright (c) 2015, npm, Inc
-
-
-Permission to use, copy, modify, and/or distribute this software for any purpose with or without fee is hereby granted, provided that the above copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/npm-package-arg/node_modules/validate-npm-package-name/lib/index.js b/node_modules/npm-package-arg/node_modules/validate-npm-package-name/lib/index.js
deleted file mode 100644
index e7e612bfb..000000000
--- a/node_modules/npm-package-arg/node_modules/validate-npm-package-name/lib/index.js
+++ /dev/null
@@ -1,107 +0,0 @@
-'use strict'
-
-var scopedPackagePattern = new RegExp('^(?:@([^/]+?)[/])?([^/]+?)$')
-var builtins = require('builtins')
-var blacklist = [
-  'node_modules',
-  'favicon.ico',
-]
-
-function validate (name) {
-  var warnings = []
-  var errors = []
-
-  if (name === null) {
-    errors.push('name cannot be null')
-    return done(warnings, errors)
-  }
-
-  if (name === undefined) {
-    errors.push('name cannot be undefined')
-    return done(warnings, errors)
-  }
-
-  if (typeof name !== 'string') {
-    errors.push('name must be a string')
-    return done(warnings, errors)
-  }
-
-  if (!name.length) {
-    errors.push('name length must be greater than zero')
-  }
-
-  if (name.match(/^\./)) {
-    errors.push('name cannot start with a period')
-  }
-
-  if (name.match(/^_/)) {
-    errors.push('name cannot start with an underscore')
-  }
-
-  if (name.trim() !== name) {
-    errors.push('name cannot contain leading or trailing spaces')
-  }
-
-  // No funny business
-  blacklist.forEach(function (blacklistedName) {
-    if (name.toLowerCase() === blacklistedName) {
-      errors.push(blacklistedName + ' is a blacklisted name')
-    }
-  })
-
-  // Generate warnings for stuff that used to be allowed
-
-  // core module names like http, events, util, etc
-  builtins({ version: '*' }).forEach(function (builtin) {
-    if (name.toLowerCase() === builtin) {
-      warnings.push(builtin + ' is a core module name')
-    }
-  })
-
-  if (name.length > 214) {
-    warnings.push('name can no longer contain more than 214 characters')
-  }
-
-  // mIxeD CaSe nAMEs
-  if (name.toLowerCase() !== name) {
-    warnings.push('name can no longer contain capital letters')
-  }
-
-  if (/[~'!()*]/.test(name.split('/').slice(-1)[0])) {
-    warnings.push('name can no longer contain special characters ("~\'!()*")')
-  }
-
-  if (encodeURIComponent(name) !== name) {
-    // Maybe it's a scoped package name, like @user/package
-    var nameMatch = name.match(scopedPackagePattern)
-    if (nameMatch) {
-      var user = nameMatch[1]
-      var pkg = nameMatch[2]
-      if (encodeURIComponent(user) === user && encodeURIComponent(pkg) === pkg) {
-        return done(warnings, errors)
-      }
-    }
-
-    errors.push('name can only contain URL-friendly characters')
-  }
-
-  return done(warnings, errors)
-}
-
-var done = function (warnings, errors) {
-  var result = {
-    validForNewPackages: errors.length === 0 && warnings.length === 0,
-    validForOldPackages: errors.length === 0,
-    warnings: warnings,
-    errors: errors,
-  }
-  if (!result.warnings.length) {
-    delete result.warnings
-  }
-  if (!result.errors.length) {
-    delete result.errors
-  }
-  return result
-}
-
-module.exports = validate
diff --git a/node_modules/npm-package-arg/node_modules/validate-npm-package-name/package.json b/node_modules/npm-package-arg/node_modules/validate-npm-package-name/package.json
deleted file mode 100644
index fa9a6920d..000000000
--- a/node_modules/npm-package-arg/node_modules/validate-npm-package-name/package.json
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  "name": "validate-npm-package-name",
-  "version": "4.0.0",
-  "description": "Give me a string and I'll tell you if it's a valid npm package name",
-  "main": "lib/",
-  "directories": {
-    "test": "test"
-  },
-  "dependencies": {
-    "builtins": "^5.0.0"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.2.1",
-    "tap": "^16.0.1"
-  },
-  "scripts": {
-    "cov:test": "TAP_FLAGS='--cov' npm run test:code",
-    "test:code": "tap ${TAP_FLAGS:-'--'} test/*.js",
-    "test:style": "standard",
-    "test": "tap",
-    "lint": "eslint \"**/*.js\"",
-    "postlint": "template-oss-check",
-    "template-oss-apply": "template-oss-apply --force",
-    "lintfix": "npm run lint -- --fix",
-    "preversion": "npm test",
-    "postversion": "npm publish",
-    "prepublishOnly": "git push origin --follow-tags",
-    "snap": "tap",
-    "posttest": "npm run lint"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/validate-npm-package-name.git"
-  },
-  "keywords": [
-    "npm",
-    "package",
-    "names",
-    "validation"
-  ],
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "bugs": {
-    "url": "https://github.com/npm/validate-npm-package-name/issues"
-  },
-  "homepage": "https://github.com/npm/validate-npm-package-name",
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "engines": {
-    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.2.1"
-  },
-  "tap": {
-    "statements": 88,
-    "branches": 92,
-    "lines": 88
-  }
-}
diff --git a/node_modules/npm-package-arg/package.json b/node_modules/npm-package-arg/package.json
index eddc6bbbb..9ade534a2 100644
--- a/node_modules/npm-package-arg/package.json
+++ b/node_modules/npm-package-arg/package.json
@@ -1,6 +1,6 @@
 {
   "name": "npm-package-arg",
-  "version": "9.1.2",
+  "version": "10.0.0",
   "description": "Parse the things that can be arguments to `npm install`",
   "main": "./lib/npa.js",
   "directories": {
@@ -11,14 +11,14 @@
     "lib/"
   ],
   "dependencies": {
-    "hosted-git-info": "^5.0.0",
-    "proc-log": "^2.0.1",
+    "hosted-git-info": "^6.0.0",
+    "proc-log": "^3.0.0",
     "semver": "^7.3.5",
-    "validate-npm-package-name": "^4.0.0"
+    "validate-npm-package-name": "^5.0.0"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "4.3.2",
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.6.1",
     "tap": "^16.0.1"
   },
   "scripts": {
@@ -43,7 +43,7 @@
   },
   "homepage": "https://github.com/npm/npm-package-arg",
   "engines": {
-    "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
   },
   "tap": {
     "branches": 97,
@@ -54,17 +54,6 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.3.2",
-    "releaseBranches": [
-      "v9"
-    ],
-    "ciVersions": [
-      "12.13.0",
-      "12.x",
-      "14.15.0",
-      "14.x",
-      "16.0.0",
-      "16.x"
-    ]
+    "version": "4.6.1"
   }
 }
diff --git a/node_modules/npm-pick-manifest/node_modules/npm-package-arg/LICENSE b/node_modules/npm-pick-manifest/node_modules/npm-package-arg/LICENSE
deleted file mode 100644
index 19cec97b1..000000000
--- a/node_modules/npm-pick-manifest/node_modules/npm-package-arg/LICENSE
+++ /dev/null
@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) npm, Inc.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/npm-pick-manifest/node_modules/npm-package-arg/lib/npa.js b/node_modules/npm-pick-manifest/node_modules/npm-package-arg/lib/npa.js
deleted file mode 100644
index 10af67be5..000000000
--- a/node_modules/npm-pick-manifest/node_modules/npm-package-arg/lib/npa.js
+++ /dev/null
@@ -1,405 +0,0 @@
-'use strict'
-module.exports = npa
-module.exports.resolve = resolve
-module.exports.Result = Result
-
-const url = require('url')
-const HostedGit = require('hosted-git-info')
-const semver = require('semver')
-const path = global.FAKE_WINDOWS ? require('path').win32 : require('path')
-const validatePackageName = require('validate-npm-package-name')
-const { homedir } = require('os')
-const log = require('proc-log')
-
-const isWindows = process.platform === 'win32' || global.FAKE_WINDOWS
-const hasSlashes = isWindows ? /\\|[/]/ : /[/]/
-const isURL = /^(?:git[+])?[a-z]+:/i
-const isGit = /^[^@]+@[^:.]+\.[^:]+:.+$/i
-const isFilename = /[.](?:tgz|tar.gz|tar)$/i
-
-function npa (arg, where) {
-  let name
-  let spec
-  if (typeof arg === 'object') {
-    if (arg instanceof Result && (!where || where === arg.where)) {
-      return arg
-    } else if (arg.name && arg.rawSpec) {
-      return npa.resolve(arg.name, arg.rawSpec, where || arg.where)
-    } else {
-      return npa(arg.raw, where || arg.where)
-    }
-  }
-  const nameEndsAt = arg[0] === '@' ? arg.slice(1).indexOf('@') + 1 : arg.indexOf('@')
-  const namePart = nameEndsAt > 0 ? arg.slice(0, nameEndsAt) : arg
-  if (isURL.test(arg)) {
-    spec = arg
-  } else if (isGit.test(arg)) {
-    spec = `git+ssh://${arg}`
-  } else if (namePart[0] !== '@' && (hasSlashes.test(namePart) || isFilename.test(namePart))) {
-    spec = arg
-  } else if (nameEndsAt > 0) {
-    name = namePart
-    spec = arg.slice(nameEndsAt + 1) || '*'
-  } else {
-    const valid = validatePackageName(arg)
-    if (valid.validForOldPackages) {
-      name = arg
-      spec = '*'
-    } else {
-      spec = arg
-    }
-  }
-  return resolve(name, spec, where, arg)
-}
-
-const isFilespec = isWindows ? /^(?:[.]|~[/]|[/\\]|[a-zA-Z]:)/ : /^(?:[.]|~[/]|[/]|[a-zA-Z]:)/
-
-function resolve (name, spec, where, arg) {
-  const res = new Result({
-    raw: arg,
-    name: name,
-    rawSpec: spec,
-    fromArgument: arg != null,
-  })
-
-  if (name) {
-    res.setName(name)
-  }
-
-  if (spec && (isFilespec.test(spec) || /^file:/i.test(spec))) {
-    return fromFile(res, where)
-  } else if (spec && /^npm:/i.test(spec)) {
-    return fromAlias(res, where)
-  }
-
-  const hosted = HostedGit.fromUrl(spec, {
-    noGitPlus: true,
-    noCommittish: true,
-  })
-  if (hosted) {
-    return fromHostedGit(res, hosted)
-  } else if (spec && isURL.test(spec)) {
-    return fromURL(res)
-  } else if (spec && (hasSlashes.test(spec) || isFilename.test(spec))) {
-    return fromFile(res, where)
-  } else {
-    return fromRegistry(res)
-  }
-}
-
-function invalidPackageName (name, valid, raw) {
-  // eslint-disable-next-line max-len
-  const err = new Error(`Invalid package name "${name}" of package "${raw}": ${valid.errors.join('; ')}.`)
-  err.code = 'EINVALIDPACKAGENAME'
-  return err
-}
-
-function invalidTagName (name, raw) {
-  // eslint-disable-next-line max-len
-  const err = new Error(`Invalid tag name "${name}" of package "${raw}": Tags may not have any characters that encodeURIComponent encodes.`)
-  err.code = 'EINVALIDTAGNAME'
-  return err
-}
-
-function Result (opts) {
-  this.type = opts.type
-  this.registry = opts.registry
-  this.where = opts.where
-  if (opts.raw == null) {
-    this.raw = opts.name ? opts.name + '@' + opts.rawSpec : opts.rawSpec
-  } else {
-    this.raw = opts.raw
-  }
-
-  this.name = undefined
-  this.escapedName = undefined
-  this.scope = undefined
-  this.rawSpec = opts.rawSpec || ''
-  this.saveSpec = opts.saveSpec
-  this.fetchSpec = opts.fetchSpec
-  if (opts.name) {
-    this.setName(opts.name)
-  }
-  this.gitRange = opts.gitRange
-  this.gitCommittish = opts.gitCommittish
-  this.gitSubdir = opts.gitSubdir
-  this.hosted = opts.hosted
-}
-
-Result.prototype.setName = function (name) {
-  const valid = validatePackageName(name)
-  if (!valid.validForOldPackages) {
-    throw invalidPackageName(name, valid, this.raw)
-  }
-
-  this.name = name
-  this.scope = name[0] === '@' ? name.slice(0, name.indexOf('/')) : undefined
-  // scoped packages in couch must have slash url-encoded, e.g. @foo%2Fbar
-  this.escapedName = name.replace('/', '%2f')
-  return this
-}
-
-Result.prototype.toString = function () {
-  const full = []
-  if (this.name != null && this.name !== '') {
-    full.push(this.name)
-  }
-  const spec = this.saveSpec || this.fetchSpec || this.rawSpec
-  if (spec != null && spec !== '') {
-    full.push(spec)
-  }
-  return full.length ? full.join('@') : this.raw
-}
-
-Result.prototype.toJSON = function () {
-  const result = Object.assign({}, this)
-  delete result.hosted
-  return result
-}
-
-function setGitCommittish (res, committish) {
-  if (!committish) {
-    res.gitCommittish = null
-    return res
-  }
-
-  // for each :: separated item:
-  for (const part of committish.split('::')) {
-    // if the item has no : the n it is a commit-ish
-    if (!part.includes(':')) {
-      if (res.gitRange) {
-        throw new Error('cannot override existing semver range with a committish')
-      }
-      if (res.gitCommittish) {
-        throw new Error('cannot override existing committish with a second committish')
-      }
-      res.gitCommittish = part
-      continue
-    }
-    // split on name:value
-    const [name, value] = part.split(':')
-    // if name is semver do semver lookup of ref or tag
-    if (name === 'semver') {
-      if (res.gitCommittish) {
-        throw new Error('cannot override existing committish with a semver range')
-      }
-      if (res.gitRange) {
-        throw new Error('cannot override existing semver range with a second semver range')
-      }
-      res.gitRange = decodeURIComponent(value)
-      continue
-    }
-    if (name === 'path') {
-      if (res.gitSubdir) {
-        throw new Error('cannot override existing path with a second path')
-      }
-      res.gitSubdir = `/${value}`
-      continue
-    }
-    log.warn('npm-package-arg', `ignoring unknown key "${name}"`)
-  }
-
-  return res
-}
-
-function fromFile (res, where) {
-  if (!where) {
-    where = process.cwd()
-  }
-  res.type = isFilename.test(res.rawSpec) ? 'file' : 'directory'
-  res.where = where
-
-  // always put the '/' on where when resolving urls, or else
-  // file:foo from /path/to/bar goes to /path/to/foo, when we want
-  // it to be /path/to/bar/foo
-
-  let specUrl
-  let resolvedUrl
-  const prefix = (!/^file:/.test(res.rawSpec) ? 'file:' : '')
-  const rawWithPrefix = prefix + res.rawSpec
-  let rawNoPrefix = rawWithPrefix.replace(/^file:/, '')
-  try {
-    resolvedUrl = new url.URL(rawWithPrefix, `file://${path.resolve(where)}/`)
-    specUrl = new url.URL(rawWithPrefix)
-  } catch (originalError) {
-    const er = new Error('Invalid file: URL, must comply with RFC 8909')
-    throw Object.assign(er, {
-      raw: res.rawSpec,
-      spec: res,
-      where,
-      originalError,
-    })
-  }
-
-  // environment switch for testing
-  if (process.env.NPM_PACKAGE_ARG_8909_STRICT !== '1') {
-    // XXX backwards compatibility lack of compliance with 8909
-    // Remove when we want a breaking change to come into RFC compliance.
-    if (resolvedUrl.host && resolvedUrl.host !== 'localhost') {
-      const rawSpec = res.rawSpec.replace(/^file:\/\//, 'file:///')
-      resolvedUrl = new url.URL(rawSpec, `file://${path.resolve(where)}/`)
-      specUrl = new url.URL(rawSpec)
-      rawNoPrefix = rawSpec.replace(/^file:/, '')
-    }
-    // turn file:/../foo into file:../foo
-    // for 1, 2 or 3 leading slashes since we attempted
-    // in the previous step to make it a file protocol url with a leading slash
-    if (/^\/{1,3}\.\.?(\/|$)/.test(rawNoPrefix)) {
-      const rawSpec = res.rawSpec.replace(/^file:\/{1,3}/, 'file:')
-      resolvedUrl = new url.URL(rawSpec, `file://${path.resolve(where)}/`)
-      specUrl = new url.URL(rawSpec)
-      rawNoPrefix = rawSpec.replace(/^file:/, '')
-    }
-    // XXX end 8909 violation backwards compatibility section
-  }
-
-  // file:foo - relative url to ./foo
-  // file:/foo - absolute path /foo
-  // file:///foo - absolute path to /foo, no authority host
-  // file://localhost/foo - absolute path to /foo, on localhost
-  // file://foo - absolute path to / on foo host (error!)
-  if (resolvedUrl.host && resolvedUrl.host !== 'localhost') {
-    const msg = `Invalid file: URL, must be absolute if // present`
-    throw Object.assign(new Error(msg), {
-      raw: res.rawSpec,
-      parsed: resolvedUrl,
-    })
-  }
-
-  // turn /C:/blah into just C:/blah on windows
-  let specPath = decodeURIComponent(specUrl.pathname)
-  let resolvedPath = decodeURIComponent(resolvedUrl.pathname)
-  if (isWindows) {
-    specPath = specPath.replace(/^\/+([a-z]:\/)/i, '$1')
-    resolvedPath = resolvedPath.replace(/^\/+([a-z]:\/)/i, '$1')
-  }
-
-  // replace ~ with homedir, but keep the ~ in the saveSpec
-  // otherwise, make it relative to where param
-  if (/^\/~(\/|$)/.test(specPath)) {
-    res.saveSpec = `file:${specPath.substr(1)}`
-    resolvedPath = path.resolve(homedir(), specPath.substr(3))
-  } else if (!path.isAbsolute(rawNoPrefix)) {
-    res.saveSpec = `file:${path.relative(where, resolvedPath)}`
-  } else {
-    res.saveSpec = `file:${path.resolve(resolvedPath)}`
-  }
-
-  res.fetchSpec = path.resolve(where, resolvedPath)
-  return res
-}
-
-function fromHostedGit (res, hosted) {
-  res.type = 'git'
-  res.hosted = hosted
-  res.saveSpec = hosted.toString({ noGitPlus: false, noCommittish: false })
-  res.fetchSpec = hosted.getDefaultRepresentation() === 'shortcut' ? null : hosted.toString()
-  return setGitCommittish(res, hosted.committish)
-}
-
-function unsupportedURLType (protocol, spec) {
-  const err = new Error(`Unsupported URL Type "${protocol}": ${spec}`)
-  err.code = 'EUNSUPPORTEDPROTOCOL'
-  return err
-}
-
-function matchGitScp (spec) {
-  // git ssh specifiers are overloaded to also use scp-style git
-  // specifiers, so we have to parse those out and treat them special.
-  // They are NOT true URIs, so we can't hand them to `url.parse`.
-  //
-  // This regex looks for things that look like:
-  // git+ssh://git@my.custom.git.com:username/project.git#deadbeef
-  //
-  // ...and various combinations. The username in the beginning is *required*.
-  const matched = spec.match(/^git\+ssh:\/\/([^:#]+:[^#]+(?:\.git)?)(?:#(.*))?$/i)
-  return matched && !matched[1].match(/:[0-9]+\/?.*$/i) && {
-    fetchSpec: matched[1],
-    gitCommittish: matched[2] == null ? null : matched[2],
-  }
-}
-
-function fromURL (res) {
-  // eslint-disable-next-line node/no-deprecated-api
-  const urlparse = url.parse(res.rawSpec)
-  res.saveSpec = res.rawSpec
-  // check the protocol, and then see if it's git or not
-  switch (urlparse.protocol) {
-    case 'git:':
-    case 'git+http:':
-    case 'git+https:':
-    case 'git+rsync:':
-    case 'git+ftp:':
-    case 'git+file:':
-    case 'git+ssh:': {
-      res.type = 'git'
-      const match = urlparse.protocol === 'git+ssh:' ? matchGitScp(res.rawSpec)
-        : null
-      if (match) {
-        setGitCommittish(res, match.gitCommittish)
-        res.fetchSpec = match.fetchSpec
-      } else {
-        setGitCommittish(res, urlparse.hash != null ? urlparse.hash.slice(1) : '')
-        urlparse.protocol = urlparse.protocol.replace(/^git[+]/, '')
-        if (urlparse.protocol === 'file:' && /^git\+file:\/\/[a-z]:/i.test(res.rawSpec)) {
-          // keep the drive letter : on windows file paths
-          urlparse.host += ':'
-          urlparse.hostname += ':'
-        }
-        delete urlparse.hash
-        res.fetchSpec = url.format(urlparse)
-      }
-      break
-    }
-    case 'http:':
-    case 'https:':
-      res.type = 'remote'
-      res.fetchSpec = res.saveSpec
-      break
-
-    default:
-      throw unsupportedURLType(urlparse.protocol, res.rawSpec)
-  }
-
-  return res
-}
-
-function fromAlias (res, where) {
-  const subSpec = npa(res.rawSpec.substr(4), where)
-  if (subSpec.type === 'alias') {
-    throw new Error('nested aliases not supported')
-  }
-
-  if (!subSpec.registry) {
-    throw new Error('aliases only work for registry deps')
-  }
-
-  res.subSpec = subSpec
-  res.registry = true
-  res.type = 'alias'
-  res.saveSpec = null
-  res.fetchSpec = null
-  return res
-}
-
-function fromRegistry (res) {
-  res.registry = true
-  const spec = res.rawSpec.trim()
-  // no save spec for registry components as we save based on the fetched
-  // version, not on the argument so this can't compute that.
-  res.saveSpec = null
-  res.fetchSpec = spec
-  const version = semver.valid(spec, true)
-  const range = semver.validRange(spec, true)
-  if (version) {
-    res.type = 'version'
-  } else if (range) {
-    res.type = 'range'
-  } else {
-    if (encodeURIComponent(spec) !== spec) {
-      throw invalidTagName(spec, res.raw)
-    }
-    res.type = 'tag'
-  }
-  return res
-}
diff --git a/node_modules/npm-pick-manifest/node_modules/npm-package-arg/package.json b/node_modules/npm-pick-manifest/node_modules/npm-package-arg/package.json
deleted file mode 100644
index 9ade534a2..000000000
--- a/node_modules/npm-pick-manifest/node_modules/npm-package-arg/package.json
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  "name": "npm-package-arg",
-  "version": "10.0.0",
-  "description": "Parse the things that can be arguments to `npm install`",
-  "main": "./lib/npa.js",
-  "directories": {
-    "test": "test"
-  },
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "dependencies": {
-    "hosted-git-info": "^6.0.0",
-    "proc-log": "^3.0.0",
-    "semver": "^7.3.5",
-    "validate-npm-package-name": "^5.0.0"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.6.1",
-    "tap": "^16.0.1"
-  },
-  "scripts": {
-    "test": "tap",
-    "snap": "tap",
-    "npmclilint": "npmcli-lint",
-    "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
-    "posttest": "npm run lint",
-    "postsnap": "npm run lintfix --",
-    "postlint": "template-oss-check",
-    "template-oss-apply": "template-oss-apply --force"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/npm-package-arg.git"
-  },
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "bugs": {
-    "url": "https://github.com/npm/npm-package-arg/issues"
-  },
-  "homepage": "https://github.com/npm/npm-package-arg",
-  "engines": {
-    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-  },
-  "tap": {
-    "branches": 97,
-    "nyc-arg": [
-      "--exclude",
-      "tap-snapshots/**"
-    ]
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.6.1"
-  }
-}
diff --git a/node_modules/npm-registry-fetch/node_modules/npm-package-arg/LICENSE b/node_modules/npm-registry-fetch/node_modules/npm-package-arg/LICENSE
deleted file mode 100644
index 19cec97b1..000000000
--- a/node_modules/npm-registry-fetch/node_modules/npm-package-arg/LICENSE
+++ /dev/null
@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) npm, Inc.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/npm-registry-fetch/node_modules/npm-package-arg/lib/npa.js b/node_modules/npm-registry-fetch/node_modules/npm-package-arg/lib/npa.js
deleted file mode 100644
index 10af67be5..000000000
--- a/node_modules/npm-registry-fetch/node_modules/npm-package-arg/lib/npa.js
+++ /dev/null
@@ -1,405 +0,0 @@
-'use strict'
-module.exports = npa
-module.exports.resolve = resolve
-module.exports.Result = Result
-
-const url = require('url')
-const HostedGit = require('hosted-git-info')
-const semver = require('semver')
-const path = global.FAKE_WINDOWS ? require('path').win32 : require('path')
-const validatePackageName = require('validate-npm-package-name')
-const { homedir } = require('os')
-const log = require('proc-log')
-
-const isWindows = process.platform === 'win32' || global.FAKE_WINDOWS
-const hasSlashes = isWindows ? /\\|[/]/ : /[/]/
-const isURL = /^(?:git[+])?[a-z]+:/i
-const isGit = /^[^@]+@[^:.]+\.[^:]+:.+$/i
-const isFilename = /[.](?:tgz|tar.gz|tar)$/i
-
-function npa (arg, where) {
-  let name
-  let spec
-  if (typeof arg === 'object') {
-    if (arg instanceof Result && (!where || where === arg.where)) {
-      return arg
-    } else if (arg.name && arg.rawSpec) {
-      return npa.resolve(arg.name, arg.rawSpec, where || arg.where)
-    } else {
-      return npa(arg.raw, where || arg.where)
-    }
-  }
-  const nameEndsAt = arg[0] === '@' ? arg.slice(1).indexOf('@') + 1 : arg.indexOf('@')
-  const namePart = nameEndsAt > 0 ? arg.slice(0, nameEndsAt) : arg
-  if (isURL.test(arg)) {
-    spec = arg
-  } else if (isGit.test(arg)) {
-    spec = `git+ssh://${arg}`
-  } else if (namePart[0] !== '@' && (hasSlashes.test(namePart) || isFilename.test(namePart))) {
-    spec = arg
-  } else if (nameEndsAt > 0) {
-    name = namePart
-    spec = arg.slice(nameEndsAt + 1) || '*'
-  } else {
-    const valid = validatePackageName(arg)
-    if (valid.validForOldPackages) {
-      name = arg
-      spec = '*'
-    } else {
-      spec = arg
-    }
-  }
-  return resolve(name, spec, where, arg)
-}
-
-const isFilespec = isWindows ? /^(?:[.]|~[/]|[/\\]|[a-zA-Z]:)/ : /^(?:[.]|~[/]|[/]|[a-zA-Z]:)/
-
-function resolve (name, spec, where, arg) {
-  const res = new Result({
-    raw: arg,
-    name: name,
-    rawSpec: spec,
-    fromArgument: arg != null,
-  })
-
-  if (name) {
-    res.setName(name)
-  }
-
-  if (spec && (isFilespec.test(spec) || /^file:/i.test(spec))) {
-    return fromFile(res, where)
-  } else if (spec && /^npm:/i.test(spec)) {
-    return fromAlias(res, where)
-  }
-
-  const hosted = HostedGit.fromUrl(spec, {
-    noGitPlus: true,
-    noCommittish: true,
-  })
-  if (hosted) {
-    return fromHostedGit(res, hosted)
-  } else if (spec && isURL.test(spec)) {
-    return fromURL(res)
-  } else if (spec && (hasSlashes.test(spec) || isFilename.test(spec))) {
-    return fromFile(res, where)
-  } else {
-    return fromRegistry(res)
-  }
-}
-
-function invalidPackageName (name, valid, raw) {
-  // eslint-disable-next-line max-len
-  const err = new Error(`Invalid package name "${name}" of package "${raw}": ${valid.errors.join('; ')}.`)
-  err.code = 'EINVALIDPACKAGENAME'
-  return err
-}
-
-function invalidTagName (name, raw) {
-  // eslint-disable-next-line max-len
-  const err = new Error(`Invalid tag name "${name}" of package "${raw}": Tags may not have any characters that encodeURIComponent encodes.`)
-  err.code = 'EINVALIDTAGNAME'
-  return err
-}
-
-function Result (opts) {
-  this.type = opts.type
-  this.registry = opts.registry
-  this.where = opts.where
-  if (opts.raw == null) {
-    this.raw = opts.name ? opts.name + '@' + opts.rawSpec : opts.rawSpec
-  } else {
-    this.raw = opts.raw
-  }
-
-  this.name = undefined
-  this.escapedName = undefined
-  this.scope = undefined
-  this.rawSpec = opts.rawSpec || ''
-  this.saveSpec = opts.saveSpec
-  this.fetchSpec = opts.fetchSpec
-  if (opts.name) {
-    this.setName(opts.name)
-  }
-  this.gitRange = opts.gitRange
-  this.gitCommittish = opts.gitCommittish
-  this.gitSubdir = opts.gitSubdir
-  this.hosted = opts.hosted
-}
-
-Result.prototype.setName = function (name) {
-  const valid = validatePackageName(name)
-  if (!valid.validForOldPackages) {
-    throw invalidPackageName(name, valid, this.raw)
-  }
-
-  this.name = name
-  this.scope = name[0] === '@' ? name.slice(0, name.indexOf('/')) : undefined
-  // scoped packages in couch must have slash url-encoded, e.g. @foo%2Fbar
-  this.escapedName = name.replace('/', '%2f')
-  return this
-}
-
-Result.prototype.toString = function () {
-  const full = []
-  if (this.name != null && this.name !== '') {
-    full.push(this.name)
-  }
-  const spec = this.saveSpec || this.fetchSpec || this.rawSpec
-  if (spec != null && spec !== '') {
-    full.push(spec)
-  }
-  return full.length ? full.join('@') : this.raw
-}
-
-Result.prototype.toJSON = function () {
-  const result = Object.assign({}, this)
-  delete result.hosted
-  return result
-}
-
-function setGitCommittish (res, committish) {
-  if (!committish) {
-    res.gitCommittish = null
-    return res
-  }
-
-  // for each :: separated item:
-  for (const part of committish.split('::')) {
-    // if the item has no : the n it is a commit-ish
-    if (!part.includes(':')) {
-      if (res.gitRange) {
-        throw new Error('cannot override existing semver range with a committish')
-      }
-      if (res.gitCommittish) {
-        throw new Error('cannot override existing committish with a second committish')
-      }
-      res.gitCommittish = part
-      continue
-    }
-    // split on name:value
-    const [name, value] = part.split(':')
-    // if name is semver do semver lookup of ref or tag
-    if (name === 'semver') {
-      if (res.gitCommittish) {
-        throw new Error('cannot override existing committish with a semver range')
-      }
-      if (res.gitRange) {
-        throw new Error('cannot override existing semver range with a second semver range')
-      }
-      res.gitRange = decodeURIComponent(value)
-      continue
-    }
-    if (name === 'path') {
-      if (res.gitSubdir) {
-        throw new Error('cannot override existing path with a second path')
-      }
-      res.gitSubdir = `/${value}`
-      continue
-    }
-    log.warn('npm-package-arg', `ignoring unknown key "${name}"`)
-  }
-
-  return res
-}
-
-function fromFile (res, where) {
-  if (!where) {
-    where = process.cwd()
-  }
-  res.type = isFilename.test(res.rawSpec) ? 'file' : 'directory'
-  res.where = where
-
-  // always put the '/' on where when resolving urls, or else
-  // file:foo from /path/to/bar goes to /path/to/foo, when we want
-  // it to be /path/to/bar/foo
-
-  let specUrl
-  let resolvedUrl
-  const prefix = (!/^file:/.test(res.rawSpec) ? 'file:' : '')
-  const rawWithPrefix = prefix + res.rawSpec
-  let rawNoPrefix = rawWithPrefix.replace(/^file:/, '')
-  try {
-    resolvedUrl = new url.URL(rawWithPrefix, `file://${path.resolve(where)}/`)
-    specUrl = new url.URL(rawWithPrefix)
-  } catch (originalError) {
-    const er = new Error('Invalid file: URL, must comply with RFC 8909')
-    throw Object.assign(er, {
-      raw: res.rawSpec,
-      spec: res,
-      where,
-      originalError,
-    })
-  }
-
-  // environment switch for testing
-  if (process.env.NPM_PACKAGE_ARG_8909_STRICT !== '1') {
-    // XXX backwards compatibility lack of compliance with 8909
-    // Remove when we want a breaking change to come into RFC compliance.
-    if (resolvedUrl.host && resolvedUrl.host !== 'localhost') {
-      const rawSpec = res.rawSpec.replace(/^file:\/\//, 'file:///')
-      resolvedUrl = new url.URL(rawSpec, `file://${path.resolve(where)}/`)
-      specUrl = new url.URL(rawSpec)
-      rawNoPrefix = rawSpec.replace(/^file:/, '')
-    }
-    // turn file:/../foo into file:../foo
-    // for 1, 2 or 3 leading slashes since we attempted
-    // in the previous step to make it a file protocol url with a leading slash
-    if (/^\/{1,3}\.\.?(\/|$)/.test(rawNoPrefix)) {
-      const rawSpec = res.rawSpec.replace(/^file:\/{1,3}/, 'file:')
-      resolvedUrl = new url.URL(rawSpec, `file://${path.resolve(where)}/`)
-      specUrl = new url.URL(rawSpec)
-      rawNoPrefix = rawSpec.replace(/^file:/, '')
-    }
-    // XXX end 8909 violation backwards compatibility section
-  }
-
-  // file:foo - relative url to ./foo
-  // file:/foo - absolute path /foo
-  // file:///foo - absolute path to /foo, no authority host
-  // file://localhost/foo - absolute path to /foo, on localhost
-  // file://foo - absolute path to / on foo host (error!)
-  if (resolvedUrl.host && resolvedUrl.host !== 'localhost') {
-    const msg = `Invalid file: URL, must be absolute if // present`
-    throw Object.assign(new Error(msg), {
-      raw: res.rawSpec,
-      parsed: resolvedUrl,
-    })
-  }
-
-  // turn /C:/blah into just C:/blah on windows
-  let specPath = decodeURIComponent(specUrl.pathname)
-  let resolvedPath = decodeURIComponent(resolvedUrl.pathname)
-  if (isWindows) {
-    specPath = specPath.replace(/^\/+([a-z]:\/)/i, '$1')
-    resolvedPath = resolvedPath.replace(/^\/+([a-z]:\/)/i, '$1')
-  }
-
-  // replace ~ with homedir, but keep the ~ in the saveSpec
-  // otherwise, make it relative to where param
-  if (/^\/~(\/|$)/.test(specPath)) {
-    res.saveSpec = `file:${specPath.substr(1)}`
-    resolvedPath = path.resolve(homedir(), specPath.substr(3))
-  } else if (!path.isAbsolute(rawNoPrefix)) {
-    res.saveSpec = `file:${path.relative(where, resolvedPath)}`
-  } else {
-    res.saveSpec = `file:${path.resolve(resolvedPath)}`
-  }
-
-  res.fetchSpec = path.resolve(where, resolvedPath)
-  return res
-}
-
-function fromHostedGit (res, hosted) {
-  res.type = 'git'
-  res.hosted = hosted
-  res.saveSpec = hosted.toString({ noGitPlus: false, noCommittish: false })
-  res.fetchSpec = hosted.getDefaultRepresentation() === 'shortcut' ? null : hosted.toString()
-  return setGitCommittish(res, hosted.committish)
-}
-
-function unsupportedURLType (protocol, spec) {
-  const err = new Error(`Unsupported URL Type "${protocol}": ${spec}`)
-  err.code = 'EUNSUPPORTEDPROTOCOL'
-  return err
-}
-
-function matchGitScp (spec) {
-  // git ssh specifiers are overloaded to also use scp-style git
-  // specifiers, so we have to parse those out and treat them special.
-  // They are NOT true URIs, so we can't hand them to `url.parse`.
-  //
-  // This regex looks for things that look like:
-  // git+ssh://git@my.custom.git.com:username/project.git#deadbeef
-  //
-  // ...and various combinations. The username in the beginning is *required*.
-  const matched = spec.match(/^git\+ssh:\/\/([^:#]+:[^#]+(?:\.git)?)(?:#(.*))?$/i)
-  return matched && !matched[1].match(/:[0-9]+\/?.*$/i) && {
-    fetchSpec: matched[1],
-    gitCommittish: matched[2] == null ? null : matched[2],
-  }
-}
-
-function fromURL (res) {
-  // eslint-disable-next-line node/no-deprecated-api
-  const urlparse = url.parse(res.rawSpec)
-  res.saveSpec = res.rawSpec
-  // check the protocol, and then see if it's git or not
-  switch (urlparse.protocol) {
-    case 'git:':
-    case 'git+http:':
-    case 'git+https:':
-    case 'git+rsync:':
-    case 'git+ftp:':
-    case 'git+file:':
-    case 'git+ssh:': {
-      res.type = 'git'
-      const match = urlparse.protocol === 'git+ssh:' ? matchGitScp(res.rawSpec)
-        : null
-      if (match) {
-        setGitCommittish(res, match.gitCommittish)
-        res.fetchSpec = match.fetchSpec
-      } else {
-        setGitCommittish(res, urlparse.hash != null ? urlparse.hash.slice(1) : '')
-        urlparse.protocol = urlparse.protocol.replace(/^git[+]/, '')
-        if (urlparse.protocol === 'file:' && /^git\+file:\/\/[a-z]:/i.test(res.rawSpec)) {
-          // keep the drive letter : on windows file paths
-          urlparse.host += ':'
-          urlparse.hostname += ':'
-        }
-        delete urlparse.hash
-        res.fetchSpec = url.format(urlparse)
-      }
-      break
-    }
-    case 'http:':
-    case 'https:':
-      res.type = 'remote'
-      res.fetchSpec = res.saveSpec
-      break
-
-    default:
-      throw unsupportedURLType(urlparse.protocol, res.rawSpec)
-  }
-
-  return res
-}
-
-function fromAlias (res, where) {
-  const subSpec = npa(res.rawSpec.substr(4), where)
-  if (subSpec.type === 'alias') {
-    throw new Error('nested aliases not supported')
-  }
-
-  if (!subSpec.registry) {
-    throw new Error('aliases only work for registry deps')
-  }
-
-  res.subSpec = subSpec
-  res.registry = true
-  res.type = 'alias'
-  res.saveSpec = null
-  res.fetchSpec = null
-  return res
-}
-
-function fromRegistry (res) {
-  res.registry = true
-  const spec = res.rawSpec.trim()
-  // no save spec for registry components as we save based on the fetched
-  // version, not on the argument so this can't compute that.
-  res.saveSpec = null
-  res.fetchSpec = spec
-  const version = semver.valid(spec, true)
-  const range = semver.validRange(spec, true)
-  if (version) {
-    res.type = 'version'
-  } else if (range) {
-    res.type = 'range'
-  } else {
-    if (encodeURIComponent(spec) !== spec) {
-      throw invalidTagName(spec, res.raw)
-    }
-    res.type = 'tag'
-  }
-  return res
-}
diff --git a/node_modules/npm-registry-fetch/node_modules/npm-package-arg/package.json b/node_modules/npm-registry-fetch/node_modules/npm-package-arg/package.json
deleted file mode 100644
index 9ade534a2..000000000
--- a/node_modules/npm-registry-fetch/node_modules/npm-package-arg/package.json
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  "name": "npm-package-arg",
-  "version": "10.0.0",
-  "description": "Parse the things that can be arguments to `npm install`",
-  "main": "./lib/npa.js",
-  "directories": {
-    "test": "test"
-  },
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "dependencies": {
-    "hosted-git-info": "^6.0.0",
-    "proc-log": "^3.0.0",
-    "semver": "^7.3.5",
-    "validate-npm-package-name": "^5.0.0"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.6.1",
-    "tap": "^16.0.1"
-  },
-  "scripts": {
-    "test": "tap",
-    "snap": "tap",
-    "npmclilint": "npmcli-lint",
-    "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
-    "posttest": "npm run lint",
-    "postsnap": "npm run lintfix --",
-    "postlint": "template-oss-check",
-    "template-oss-apply": "template-oss-apply --force"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/npm-package-arg.git"
-  },
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "bugs": {
-    "url": "https://github.com/npm/npm-package-arg/issues"
-  },
-  "homepage": "https://github.com/npm/npm-package-arg",
-  "engines": {
-    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-  },
-  "tap": {
-    "branches": 97,
-    "nyc-arg": [
-      "--exclude",
-      "tap-snapshots/**"
-    ]
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.6.1"
-  }
-}
diff --git a/node_modules/pacote/lib/registry.js b/node_modules/pacote/lib/registry.js
index eeb22e93c..c4c9df8e4 100644
--- a/node_modules/pacote/lib/registry.js
+++ b/node_modules/pacote/lib/registry.js
@@ -3,7 +3,6 @@ const RemoteFetcher = require('./remote.js')
 const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
 const pacoteVersion = require('../package.json').version
 const removeTrailingSlashes = require('./util/trailing-slashes.js')
-const npa = require('npm-package-arg')
 const rpj = require('read-package-json-fast')
 const pickManifest = require('npm-pick-manifest')
 const ssri = require('ssri')
@@ -28,12 +27,6 @@ class RegistryFetcher extends Fetcher {
     // already.
     this.packumentCache = this.opts.packumentCache || null
 
-    // handle case when npm-package-arg guesses wrong.
-    if (this.spec.type === 'tag' &&
-        this.spec.rawSpec === '' &&
-        this.defaultTag !== 'latest') {
-      this.spec = npa(`${this.spec.name}@${this.defaultTag}`)
-    }
     this.registry = fetch.pickRegistry(spec, opts)
     this.packumentUrl = removeTrailingSlashes(this.registry) + '/' +
       this.spec.escapedName
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
index 53e488878..07adc61dc 100644
--- a/node_modules/pacote/package.json
+++ b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "15.0.1",
+  "version": "15.0.2",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -26,9 +26,9 @@
   },
   "devDependencies": {
     "@npmcli/arborist": "^6.0.0 || ^6.0.0-pre.0",
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.6.0",
-    "hosted-git-info": "^5.0.0",
+    "@npmcli/eslint-config": "^3.1.0",
+    "@npmcli/template-oss": "4.6.2",
+    "hosted-git-info": "^6.0.0",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
     "npm-registry-mock": "^1.3.2",
@@ -51,7 +51,7 @@
     "cacache": "^17.0.0",
     "fs-minipass": "^2.1.0",
     "minipass": "^3.1.6",
-    "npm-package-arg": "^9.0.0",
+    "npm-package-arg": "^10.0.0",
     "npm-packlist": "^7.0.0",
     "npm-pick-manifest": "^8.0.0",
     "npm-registry-fetch": "^14.0.0",
@@ -71,7 +71,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.6.0",
+    "version": "4.6.2",
     "windowsCI": false
   }
 }
diff --git a/package-lock.json b/package-lock.json
index 6bfbc6c93..7cd85505f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -130,7 +130,7 @@
         "nopt": "^6.0.0",
         "npm-audit-report": "^4.0.0",
         "npm-install-checks": "^6.0.0",
-        "npm-package-arg": "^9.1.2",
+        "npm-package-arg": "^10.0.0",
         "npm-pick-manifest": "^8.0.1",
         "npm-profile": "^7.0.1",
         "npm-registry-fetch": "^14.0.2",
@@ -138,7 +138,7 @@
         "npmlog": "^7.0.0",
         "opener": "^1.5.2",
         "p-map": "^4.0.0",
-        "pacote": "^15.0.1",
+        "pacote": "^15.0.2",
         "parse-conflict-json": "^3.0.0",
         "proc-log": "^3.0.0",
         "qrcode-terminal": "^0.12.0",
@@ -2404,6 +2404,54 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
+    "node_modules/@npmcli/template-oss/node_modules/npm-package-arg": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-9.1.2.tgz",
+      "integrity": "sha512-pzd9rLEx4TfNJkovvlBSLGhq31gGu2QDexFPWT19yCDh0JgnRhlBLNo5759N0AJmBk+kQ9Y/hXoLnlgFD+ukmg==",
+      "dev": true,
+      "dependencies": {
+        "hosted-git-info": "^5.0.0",
+        "proc-log": "^2.0.1",
+        "semver": "^7.3.5",
+        "validate-npm-package-name": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@npmcli/template-oss/node_modules/npm-package-arg/node_modules/hosted-git-info": {
+      "version": "5.1.0",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-5.1.0.tgz",
+      "integrity": "sha512-Ek+QmMEqZF8XrbFdwoDjSbm7rT23pCgEMOJmz6GPk/s4yH//RQfNPArhIxbguNxROq/+5lNBwCDHMhA903Kx1Q==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^7.5.1"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@npmcli/template-oss/node_modules/npm-package-arg/node_modules/proc-log": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-2.0.1.tgz",
+      "integrity": "sha512-Kcmo2FhfDTXdcbfDH76N7uBYHINxc/8GW7UAVuVP9I+Va3uHSerrnKV6dLooga/gh7GlgzuCCr/eoldnL1muGw==",
+      "dev": true,
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@npmcli/template-oss/node_modules/validate-npm-package-name": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-4.0.0.tgz",
+      "integrity": "sha512-mzR0L8ZDktZjpX4OB46KT+56MAhl4EIazWP/+G/HPGuvfdaqg4YsCdtOm6U9+LOFyYDoh4dpnpxZRB9MQQns5Q==",
+      "dev": true,
+      "dependencies": {
+        "builtins": "^5.0.0"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+      }
+    },
     "node_modules/@octokit/auth-token": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-3.0.1.tgz",
@@ -6255,21 +6303,6 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
-    "node_modules/init-package-json/node_modules/npm-package-arg": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-10.0.0.tgz",
-      "integrity": "sha512-7dkh8mRp7s0KwVHKIVJnFCJQ2B34gOGnzgBjDGyprycmARq/82SX/lhilQ95ZuacP/G/1gsS345iAkKmxWBQ2Q==",
-      "inBundle": true,
-      "dependencies": {
-        "hosted-git-info": "^6.0.0",
-        "proc-log": "^3.0.0",
-        "semver": "^7.3.5",
-        "validate-npm-package-name": "^5.0.0"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
-    },
     "node_modules/inline-style-parser": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/inline-style-parser/-/inline-style-parser-0.1.1.tgz",
@@ -8331,50 +8364,18 @@
       }
     },
     "node_modules/npm-package-arg": {
-      "version": "9.1.2",
+      "version": "10.0.0",
+      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-10.0.0.tgz",
+      "integrity": "sha512-7dkh8mRp7s0KwVHKIVJnFCJQ2B34gOGnzgBjDGyprycmARq/82SX/lhilQ95ZuacP/G/1gsS345iAkKmxWBQ2Q==",
       "inBundle": true,
-      "license": "ISC",
       "dependencies": {
-        "hosted-git-info": "^5.0.0",
-        "proc-log": "^2.0.1",
+        "hosted-git-info": "^6.0.0",
+        "proc-log": "^3.0.0",
         "semver": "^7.3.5",
-        "validate-npm-package-name": "^4.0.0"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
-    },
-    "node_modules/npm-package-arg/node_modules/hosted-git-info": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-5.1.0.tgz",
-      "integrity": "sha512-Ek+QmMEqZF8XrbFdwoDjSbm7rT23pCgEMOJmz6GPk/s4yH//RQfNPArhIxbguNxROq/+5lNBwCDHMhA903Kx1Q==",
-      "inBundle": true,
-      "dependencies": {
-        "lru-cache": "^7.5.1"
-      },
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
-    },
-    "node_modules/npm-package-arg/node_modules/proc-log": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-2.0.1.tgz",
-      "integrity": "sha512-Kcmo2FhfDTXdcbfDH76N7uBYHINxc/8GW7UAVuVP9I+Va3uHSerrnKV6dLooga/gh7GlgzuCCr/eoldnL1muGw==",
-      "inBundle": true,
-      "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
-      }
-    },
-    "node_modules/npm-package-arg/node_modules/validate-npm-package-name": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-4.0.0.tgz",
-      "integrity": "sha512-mzR0L8ZDktZjpX4OB46KT+56MAhl4EIazWP/+G/HPGuvfdaqg4YsCdtOm6U9+LOFyYDoh4dpnpxZRB9MQQns5Q==",
-      "inBundle": true,
-      "dependencies": {
-        "builtins": "^5.0.0"
+        "validate-npm-package-name": "^5.0.0"
       },
       "engines": {
-        "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
+        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
     "node_modules/npm-packlist": {
@@ -8404,21 +8405,6 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
-    "node_modules/npm-pick-manifest/node_modules/npm-package-arg": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-10.0.0.tgz",
-      "integrity": "sha512-7dkh8mRp7s0KwVHKIVJnFCJQ2B34gOGnzgBjDGyprycmARq/82SX/lhilQ95ZuacP/G/1gsS345iAkKmxWBQ2Q==",
-      "inBundle": true,
-      "dependencies": {
-        "hosted-git-info": "^6.0.0",
-        "proc-log": "^3.0.0",
-        "semver": "^7.3.5",
-        "validate-npm-package-name": "^5.0.0"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
-    },
     "node_modules/npm-profile": {
       "version": "7.0.1",
       "resolved": "https://registry.npmjs.org/npm-profile/-/npm-profile-7.0.1.tgz",
@@ -8467,21 +8453,6 @@
         "encoding": "^0.1.13"
       }
     },
-    "node_modules/npm-registry-fetch/node_modules/npm-package-arg": {
-      "version": "10.0.0",
-      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-10.0.0.tgz",
-      "integrity": "sha512-7dkh8mRp7s0KwVHKIVJnFCJQ2B34gOGnzgBjDGyprycmARq/82SX/lhilQ95ZuacP/G/1gsS345iAkKmxWBQ2Q==",
-      "inBundle": true,
-      "dependencies": {
-        "hosted-git-info": "^6.0.0",
-        "proc-log": "^3.0.0",
-        "semver": "^7.3.5",
-        "validate-npm-package-name": "^5.0.0"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
-    },
     "node_modules/npm-run-path": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
@@ -9011,9 +8982,9 @@
       }
     },
     "node_modules/pacote": {
-      "version": "15.0.1",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-15.0.1.tgz",
-      "integrity": "sha512-91Po/ZZE5fIEkbesHwsZPNae7SczIN8pSD2od96NMCfA2gGzdeEVY4CAFfXZKi+lfSEOlFIsKadRrYPj7nR/PA==",
+      "version": "15.0.2",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-15.0.2.tgz",
+      "integrity": "sha512-Gj4w436jiM9/0574JGI8nxpsuXssp5OhyBhnWijvzUVJdU5GvNvnYUgd5WA6mr6ImOQ7JqWqdA44ixBqqMfyZQ==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/git": "^4.0.0",
@@ -9023,7 +8994,7 @@
         "cacache": "^17.0.0",
         "fs-minipass": "^2.1.0",
         "minipass": "^3.1.6",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^10.0.0",
         "npm-packlist": "^7.0.0",
         "npm-pick-manifest": "^8.0.0",
         "npm-registry-fetch": "^14.0.0",
@@ -14149,11 +14120,11 @@
         "minimatch": "^5.1.0",
         "nopt": "^6.0.0",
         "npm-install-checks": "^6.0.0",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^10.0.0",
         "npm-pick-manifest": "^8.0.1",
         "npm-registry-fetch": "^14.0.2",
         "npmlog": "^7.0.0",
-        "pacote": "^15.0.1",
+        "pacote": "^15.0.2",
         "parse-conflict-json": "^3.0.0",
         "proc-log": "^3.0.0",
         "promise-all-reject-late": "^1.0.0",
@@ -14186,7 +14157,7 @@
       "version": "7.0.0-pre.1",
       "license": "ISC",
       "dependencies": {
-        "npm-package-arg": "^9.0.1",
+        "npm-package-arg": "^10.0.0",
         "npm-registry-fetch": "^14.0.2"
       },
       "devDependencies": {
@@ -14209,8 +14180,8 @@
         "binary-extensions": "^2.2.0",
         "diff": "^5.1.0",
         "minimatch": "^5.0.1",
-        "npm-package-arg": "^9.0.1",
-        "pacote": "^15.0.1",
+        "npm-package-arg": "^10.0.0",
+        "pacote": "^15.0.2",
         "tar": "^6.1.0"
       },
       "devDependencies": {
@@ -14230,9 +14201,9 @@
         "@npmcli/ci-detect": "^3.0.0",
         "@npmcli/run-script": "^5.0.0",
         "chalk": "^4.1.0",
-        "npm-package-arg": "^9.0.1",
+        "npm-package-arg": "^10.0.0",
         "npmlog": "^7.0.0",
-        "pacote": "^15.0.1",
+        "pacote": "^15.0.2",
         "proc-log": "^3.0.0",
         "read": "^1.0.7",
         "read-package-json-fast": "^3.0.1",
@@ -14307,8 +14278,8 @@
       "dependencies": {
         "@npmcli/arborist": "^6.0.0-pre.4",
         "@npmcli/run-script": "^5.0.0",
-        "npm-package-arg": "^9.0.1",
-        "pacote": "^15.0.1"
+        "npm-package-arg": "^10.0.0",
+        "pacote": "^15.0.2"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^4.0.0",
@@ -14326,7 +14297,7 @@
       "license": "ISC",
       "dependencies": {
         "normalize-package-data": "^5.0.0",
-        "npm-package-arg": "^9.0.1",
+        "npm-package-arg": "^10.0.0",
         "npm-registry-fetch": "^14.0.2",
         "semver": "^7.3.7",
         "ssri": "^10.0.0"
diff --git a/package.json b/package.json
index ae877de76..0fb41c1e7 100644
--- a/package.json
+++ b/package.json
@@ -99,7 +99,7 @@
     "nopt": "^6.0.0",
     "npm-audit-report": "^4.0.0",
     "npm-install-checks": "^6.0.0",
-    "npm-package-arg": "^9.1.2",
+    "npm-package-arg": "^10.0.0",
     "npm-pick-manifest": "^8.0.1",
     "npm-profile": "^7.0.1",
     "npm-registry-fetch": "^14.0.2",
@@ -107,7 +107,7 @@
     "npmlog": "^7.0.0",
     "opener": "^1.5.2",
     "p-map": "^4.0.0",
-    "pacote": "^15.0.1",
+    "pacote": "^15.0.2",
     "parse-conflict-json": "^3.0.0",
     "proc-log": "^3.0.0",
     "qrcode-terminal": "^0.12.0",
diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index f8bd08ea5..381f57fb1 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -21,11 +21,11 @@
     "minimatch": "^5.1.0",
     "nopt": "^6.0.0",
     "npm-install-checks": "^6.0.0",
-    "npm-package-arg": "^9.0.0",
+    "npm-package-arg": "^10.0.0",
     "npm-pick-manifest": "^8.0.1",
     "npm-registry-fetch": "^14.0.2",
     "npmlog": "^7.0.0",
-    "pacote": "^15.0.1",
+    "pacote": "^15.0.2",
     "parse-conflict-json": "^3.0.0",
     "proc-log": "^3.0.0",
     "promise-all-reject-late": "^1.0.0",
diff --git a/workspaces/libnpmaccess/package.json b/workspaces/libnpmaccess/package.json
index 11d3ed991..adf361b95 100644
--- a/workspaces/libnpmaccess/package.json
+++ b/workspaces/libnpmaccess/package.json
@@ -28,7 +28,7 @@
   "bugs": "https://github.com/npm/libnpmaccess/issues",
   "homepage": "https://npmjs.com/package/libnpmaccess",
   "dependencies": {
-    "npm-package-arg": "^9.0.1",
+    "npm-package-arg": "^10.0.0",
     "npm-registry-fetch": "^14.0.2"
   },
   "engines": {
diff --git a/workspaces/libnpmdiff/package.json b/workspaces/libnpmdiff/package.json
index c752e5d92..c9c478502 100644
--- a/workspaces/libnpmdiff/package.json
+++ b/workspaces/libnpmdiff/package.json
@@ -53,8 +53,8 @@
     "binary-extensions": "^2.2.0",
     "diff": "^5.1.0",
     "minimatch": "^5.0.1",
-    "npm-package-arg": "^9.0.1",
-    "pacote": "^15.0.1",
+    "npm-package-arg": "^10.0.0",
+    "pacote": "^15.0.2",
     "tar": "^6.1.0"
   },
   "templateOSS": {
diff --git a/workspaces/libnpmexec/package.json b/workspaces/libnpmexec/package.json
index bdae1875f..8845f7a68 100644
--- a/workspaces/libnpmexec/package.json
+++ b/workspaces/libnpmexec/package.json
@@ -62,9 +62,9 @@
     "@npmcli/ci-detect": "^3.0.0",
     "@npmcli/run-script": "^5.0.0",
     "chalk": "^4.1.0",
-    "npm-package-arg": "^9.0.1",
+    "npm-package-arg": "^10.0.0",
     "npmlog": "^7.0.0",
-    "pacote": "^15.0.1",
+    "pacote": "^15.0.2",
     "proc-log": "^3.0.0",
     "read": "^1.0.7",
     "read-package-json-fast": "^3.0.1",
diff --git a/workspaces/libnpmpack/package.json b/workspaces/libnpmpack/package.json
index c4c0fe9e9..8cb8861dc 100644
--- a/workspaces/libnpmpack/package.json
+++ b/workspaces/libnpmpack/package.json
@@ -38,8 +38,8 @@
   "dependencies": {
     "@npmcli/arborist": "^6.0.0-pre.4",
     "@npmcli/run-script": "^5.0.0",
-    "npm-package-arg": "^9.0.1",
-    "pacote": "^15.0.1"
+    "npm-package-arg": "^10.0.0",
+    "pacote": "^15.0.2"
   },
   "engines": {
     "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
diff --git a/workspaces/libnpmpublish/package.json b/workspaces/libnpmpublish/package.json
index 5dd4d2537..534d45bb1 100644
--- a/workspaces/libnpmpublish/package.json
+++ b/workspaces/libnpmpublish/package.json
@@ -40,7 +40,7 @@
   "homepage": "https://npmjs.com/package/libnpmpublish",
   "dependencies": {
     "normalize-package-data": "^5.0.0",
-    "npm-package-arg": "^9.0.1",
+    "npm-package-arg": "^10.0.0",
     "npm-registry-fetch": "^14.0.2",
     "semver": "^7.3.7",
     "ssri": "^10.0.0"