update dependencies, refactor config loading to async

This removes a lot of very outdated dependencies, updates many to
their modern (usually promisified) versions, and updates (or removes)
code to account for the change.

Several dependencies have been completely removed, and others a bit
shuffled around, so that the node_modules folder can be bundled somewhat
more optimally than it would have otherwise.

3 files changed, 55 insertions, 10 deletions

diff --git a/node_modules/hosted-git-info/CHANGELOG.md b/node_modules/hosted-git-info/CHANGELOG.md
index 9bc6cae2e..afdd90e13 100644
--- a/node_modules/hosted-git-info/CHANGELOG.md
+++ b/node_modules/hosted-git-info/CHANGELOG.md
@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="3.0.5"></a>
+## [3.0.5](https://github.com/npm/hosted-git-info/compare/v3.0.4...v3.0.5) (2020-07-11)
+
+
+
+<a name="3.0.4"></a>
+## [3.0.4](https://github.com/npm/hosted-git-info/compare/v3.0.3...v3.0.4) (2020-02-26)
+
+
+### Bug Fixes
+
+* Do not pass scp-style URLs to the WhatWG url.URL ([0835306](https://github.com/npm/hosted-git-info/commit/0835306)), closes [#60](https://github.com/npm/hosted-git-info/issues/60) [#63](https://github.com/npm/hosted-git-info/issues/63)
+
+
+
+<a name="3.0.3"></a>
+## [3.0.3](https://github.com/npm/hosted-git-info/compare/v3.0.2...v3.0.3) (2020-02-25)
+
+
+
 <a name="3.0.2"></a>
 ## [3.0.2](https://github.com/npm/hosted-git-info/compare/v3.0.1...v3.0.2) (2019-10-08)
 
diff --git a/node_modules/hosted-git-info/index.js b/node_modules/hosted-git-info/index.js
index 2ccb1d69c..0b08be155 100644
--- a/node_modules/hosted-git-info/index.js
+++ b/node_modules/hosted-git-info/index.js
@@ -47,7 +47,7 @@ function fromUrl (giturl, opts) {
       var gitHostInfo = gitHosts[gitHostName]
       var auth = null
       if (parsed.auth && authProtocols[parsed.protocol]) {
-        auth = decodeURIComponent(parsed.auth)
+        auth = parsed.auth
       }
       var committish = parsed.hash ? decodeURIComponent(parsed.hash.substr(1)) : null
       var user = null
@@ -106,7 +106,28 @@ function fixupUnqualifiedGist (giturl) {
 
 function parseGitUrl (giturl) {
   var matched = giturl.match(/^([^@]+)@([^:/]+):[/]?((?:[^/]+[/])?[^/]+?)(?:[.]git)?(#.*)?$/)
-  if (!matched) return url.parse(giturl)
+  if (!matched) {
+    var legacy = url.parse(giturl)
+    if (legacy.auth) {
+      // git urls can be in the form of scp-style/ssh-connect strings, like
+      // git+ssh://user@host.com:some/path, which the legacy url parser
+      // supports, but WhatWG url.URL class does not.  However, the legacy
+      // parser de-urlencodes the username and password, so something like
+      // https://user%3An%40me:p%40ss%3Aword@x.com/ becomes
+      // https://user:n@me:p@ss:word@x.com/ which is all kinds of wrong.
+      // Pull off just the auth and host, so we dont' get the confusing
+      // scp-style URL, then pass that to the WhatWG parser to get the
+      // auth properly escaped.
+      const authmatch = giturl.match(/[^@]+@[^:/]+/)
+      /* istanbul ignore else - this should be impossible */
+      if (authmatch) {
+        var whatwg = new url.URL(authmatch[0])
+        legacy.auth = whatwg.username || ''
+        if (whatwg.password) legacy.auth += ':' + whatwg.password
+      }
+    }
+    return legacy
+  }
   return {
     protocol: 'git+ssh:',
     slashes: true,
diff --git a/node_modules/hosted-git-info/package.json b/node_modules/hosted-git-info/package.json
index e78e48850..867f1de4c 100644
--- a/node_modules/hosted-git-info/package.json
+++ b/node_modules/hosted-git-info/package.json
@@ -1,8 +1,8 @@
 {
   "_from": "hosted-git-info@latest",
-  "_id": "hosted-git-info@3.0.2",
+  "_id": "hosted-git-info@3.0.5",
   "_inBundle": false,
-  "_integrity": "sha512-ezZMWtHXm7Eb7Rq4Mwnx2vs79WUx2QmRg3+ZqeGroKzfDO+EprOcgRPYghsOP9JuYBfK18VojmRTGCg8Ma+ktw==",
+  "_integrity": "sha512-i4dpK6xj9BIpVOTboXIlKG9+8HMKggcrMX7WA24xZtKwX0TPelq/rbaS5rCKeNX8sJXZJGdSxpnEGtta+wismQ==",
   "_location": "/hosted-git-info",
   "_phantomChildren": {},
   "_requested": {
@@ -17,10 +17,11 @@
   },
   "_requiredBy": [
     "#USER",
-    "/"
+    "/",
+    "/npm-package-arg"
   ],
-  "_resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-3.0.2.tgz",
-  "_shasum": "8b7e3bd114b59b51786f8bade0f39ddc80275a97",
+  "_resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-3.0.5.tgz",
+  "_shasum": "bea87905ef7317442e8df3087faa3c842397df03",
   "_spec": "hosted-git-info@latest",
   "_where": "/Users/isaacs/dev/npm/cli",
   "author": {
@@ -33,7 +34,7 @@
   },
   "bundleDependencies": false,
   "dependencies": {
-    "lru-cache": "^5.1.1"
+    "lru-cache": "^6.0.0"
   },
   "deprecated": false,
   "description": "Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab",
@@ -42,6 +43,9 @@
     "standard-version": "^4.4.0",
     "tap": "^12.7.0"
   },
+  "engines": {
+    "node": ">=10"
+  },
   "files": [
     "index.js",
     "git-host.js",
@@ -63,11 +67,11 @@
   },
   "scripts": {
     "postrelease": "npm publish && git push --follow-tags",
+    "posttest": "standard",
     "prerelease": "npm t",
-    "pretest": "standard",
     "release": "standard-version -s",
     "test": "tap -J --100 --no-esm test/*.js",
     "test:coverage": "tap --coverage-report=html -J --100 --no-esm test/*.js"
   },
-  "version": "3.0.2"
+  "version": "3.0.5"
 }