dedupe npm-pick-manifest up to 6.1.0

4 files changed, 116 insertions, 20 deletions

diff --git a/node_modules/npm-pick-manifest/CHANGELOG.md b/node_modules/npm-pick-manifest/CHANGELOG.md
index 93a44f822..a4ee13e92 100644
--- a/node_modules/npm-pick-manifest/CHANGELOG.md
+++ b/node_modules/npm-pick-manifest/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+## [6.1.0](https://github.com/npm/npm-pick-manifest/compare/v6.0.0...v6.1.0) (2020-04-07)
+
+
+### Features
+
+* add 'avoid' semver range option ([c64973d](https://github.com/npm/npm-pick-manifest/commit/c64973d63ddf6797edf41c20df641f816d30ff03))
+* add avoidStrict option to strictly avoid ([c268796](https://github.com/npm/npm-pick-manifest/commit/c2687967b6294f5ce01aa6b59071e79272dc57de)), closes [#30](https://github.com/npm/npm-pick-manifest/issues/30)
+
 ## [6.0.0](https://github.com/npm/npm-pick-manifest/compare/v5.0.0...v6.0.0) (2020-02-18)
 
 
diff --git a/node_modules/npm-pick-manifest/README.md b/node_modules/npm-pick-manifest/README.md
index fd177757a..26ee43e05 100644
--- a/node_modules/npm-pick-manifest/README.md
+++ b/node_modules/npm-pick-manifest/README.md
@@ -90,6 +90,30 @@ All options are optional.
 * `npmVersion` - String, default `null`.  The npm version to use when
   checking manifest for `engines` requirement satisfaction.  (If `null`,
   then this particular check is skipped.)
+* `avoid` - String, default `null`.  A SemVer range of
+  versions that should be avoided.  An avoided version MAY be selected if
+  there is no other option, so when using this for version selection ensure
+  that you check the result against the range to see if there was no
+  alternative available.
+* `avoidStrict` Boolean, default `false`.  If set to true, then
+  `pickManifest` will never return a version in the `avoid` range.  If the
+  only available version in the `wanted` range is a version that should be
+  avoided, then it will return a version _outside_ the `wanted` range,
+  preferring to do so without making a SemVer-major jump, if possible.  If
+  there are no versions outside the `avoid` range, then throw an
+  `ETARGET` error.  It does this by calling pickManifest first with the
+  `wanted` range, then with a `^` affixed to the version returned by the
+  `wanted` range, and then with a `*` version range, and throwing if
+  nothing could be found to satisfy the avoidance request.
+
+Return value is the manifest as it exists in the packument, possibly
+decorated with the following boolean flags:
+
+* `_shouldAvoid` The version is in the `avoid` range.  Watch out!
+* `_outsideDependencyRange` The version is outside the `wanted` range,
+  because `avoidStrict: true` was set.
+* `_isSemVerMajor` The `_outsideDependencyRange` result is a SemVer-major
+  step up from the version returned by the `wanted` range.
 
 ### Algorithm
 
@@ -114,17 +138,19 @@ All options are optional.
    `before` setting, then select that manifest.
 6. If nothing is yet selected, sort by the following heuristics in order,
    and select the top item:
-    1. Prioritize versions that are not in `policyRestrictions` over those
+    1. Prioritize versions that are not in the `avoid` range over those
        that are.
-    2. Prioritize published versions over staged versions.
-    3. Prioritize versions that are not deprecated, and which have a
+    2. Prioritize versions that are not in `policyRestrictions` over those
+       that are.
+    3. Prioritize published versions over staged versions.
+    4. Prioritize versions that are not deprecated, and which have a
        satisfied engines requirement, over those that are either deprecated
        or have an engines mismatch.
-    4. Prioritize versions that have a satisfied engines requirement over
+    5. Prioritize versions that have a satisfied engines requirement over
        those that do not.
-    5. Prioritize versions that are not are not deprecated (but have a
+    6. Prioritize versions that are not are not deprecated (but have a
        mismatched engines requirement) over those that are deprecated.
-    6. Prioritize higher SemVer precedence over lower SemVer precedence.
+    7. Prioritize higher SemVer precedence over lower SemVer precedence.
 7. If no manifest was selected, raise an `ETARGET` error.
 8. If the selected item is in the `policyRestrictions.versions` list, raise
    an `E403` error.
diff --git a/node_modules/npm-pick-manifest/index.js b/node_modules/npm-pick-manifest/index.js
index 5fb1279d5..2b3ea6ffa 100644
--- a/node_modules/npm-pick-manifest/index.js
+++ b/node_modules/npm-pick-manifest/index.js
@@ -16,17 +16,68 @@ const engineOk = (manifest, npmVersion, nodeVersion) => {
 const isBefore = (verTimes, ver, time) =>
   !verTimes || !verTimes[ver] || Date.parse(verTimes[ver]) <= time
 
+const avoidSemverOpt = { includePrerelease: true, loose: true }
+const shouldAvoid = (ver, avoid) =>
+  avoid && semver.satisfies(ver, avoid, avoidSemverOpt)
+
+const decorateAvoid = (result, avoid) =>
+  result && shouldAvoid(result.version, avoid)
+    ? { ...result, _shouldAvoid: true }
+    : result
+
 const pickManifest = (packument, wanted, opts) => {
   const {
     defaultTag = 'latest',
     before = null,
     nodeVersion = process.version,
     npmVersion = null,
-    includeStaged = false
+    includeStaged = false,
+    avoid = null,
+    avoidStrict = false
   } = opts
 
   const { name, time: verTimes } = packument
   const versions = packument.versions || {}
+
+  if (avoidStrict) {
+    const looseOpts = {
+      ...opts,
+      avoidStrict: false
+    }
+
+    const result = pickManifest(packument, wanted, looseOpts)
+    if (!result || !result._shouldAvoid) {
+      return result
+    }
+
+    const caret = pickManifest(packument, `^${result.version}`, looseOpts)
+    if (!caret || !caret._shouldAvoid) {
+      return {
+        ...caret,
+        _outsideDependencyRange: true,
+        _isSemVerMajor: false
+      }
+    }
+
+    const star = pickManifest(packument, '*', looseOpts)
+    if (!star || !star._shouldAvoid) {
+      return {
+        ...star,
+        _outsideDependencyRange: true,
+        _isSemVerMajor: true
+      }
+    }
+
+    throw Object.assign(new Error(`No avoidable versions for ${name}`), {
+      code: 'ETARGET',
+      name,
+      wanted,
+      avoid,
+      before,
+      versions: Object.keys(versions)
+    })
+  }
+
   const staged = (includeStaged && packument.stagedVersions &&
     packument.stagedVersions.versions) || {}
   const restricted = (packument.policyRestrictions &&
@@ -49,7 +100,7 @@ const pickManifest = (packument, wanted, opts) => {
     // we use that.  Otherwise, we get the highest precedence version
     // prior to the dist-tag.
     if (isBefore(verTimes, ver, time)) {
-      return versions[ver] || staged[ver] || restricted[ver]
+      return decorateAvoid(versions[ver] || staged[ver] || restricted[ver], avoid)
     } else {
       return pickManifest(packument, `<=${ver}`, opts)
     }
@@ -59,15 +110,19 @@ const pickManifest = (packument, wanted, opts) => {
   if (wanted && type === 'version') {
     const ver = semver.clean(wanted, { loose: true })
     const mani = versions[ver] || staged[ver] || restricted[ver]
-    return isBefore(verTimes, ver, time) ? mani : null
+    return isBefore(verTimes, ver, time) ? decorateAvoid(mani, avoid) : null
   }
 
   // ok, sort based on our heuristics, and pick the best fit
   const range = type === 'range' ? wanted : '*'
 
   // if the range is *, then we prefer the 'latest' if available
+  // but skip this if it should be avoided, in that case we have
+  // to try a little harder.
   const defaultVer = distTags[defaultTag]
-  if (defaultVer && (range === '*' || semver.satisfies(defaultVer, range, { loose: true }))) {
+  if (defaultVer &&
+      (range === '*' || semver.satisfies(defaultVer, range, { loose: true })) &&
+      !shouldAvoid(defaultVer, avoid)) {
     const mani = versions[defaultVer]
     if (mani && isBefore(verTimes, defaultVer, time)) {
       return mani
@@ -81,20 +136,24 @@ const pickManifest = (packument, wanted, opts) => {
     .filter(([ver, mani]) => isBefore(verTimes, ver, time))
 
   if (!allEntries.length) {
-    throw Object.assign(new Error(`No valid versions available for ${name}`), {
+    throw Object.assign(new Error(`No versions available for ${name}`), {
       code: 'ENOVERSIONS',
       name,
       type,
       wanted,
+      before,
       versions: Object.keys(versions)
     })
   }
 
+  const sortSemverOpt = { loose: true }
   const entries = allEntries.filter(([ver, mani]) =>
     semver.satisfies(ver, range, { loose: true }))
     .sort((a, b) => {
       const [vera, mania] = a
       const [verb, manib] = b
+      const notavoida = !shouldAvoid(vera, avoid)
+      const notavoidb = !shouldAvoid(verb, avoid)
       const notrestra = !restricted[a]
       const notrestrb = !restricted[b]
       const notstagea = !staged[a]
@@ -104,21 +163,23 @@ const pickManifest = (packument, wanted, opts) => {
       const enginea = engineOk(mania, npmVersion, nodeVersion)
       const engineb = engineOk(manib, npmVersion, nodeVersion)
       // sort by:
+      // - not an avoided version
       // - not restricted
       // - not staged
       // - not deprecated and engine ok
       // - engine ok
       // - not deprecated
       // - semver
-      return (notrestrb - notrestra) ||
+      return (notavoidb - notavoida) ||
+        (notrestrb - notrestra) ||
         (notstageb - notstagea) ||
         ((notdeprb && engineb) - (notdepra && enginea)) ||
         (engineb - enginea) ||
         (notdeprb - notdepra) ||
-        semver.rcompare(vera, verb, { loose: true })
+        semver.rcompare(vera, verb, sortSemverOpt)
     })
 
-  return entries[0] && entries[0][1]
+  return decorateAvoid(entries[0] && entries[0][1], avoid)
 }
 
 module.exports = (packument, wanted, opts = {}) => {
diff --git a/node_modules/npm-pick-manifest/package.json b/node_modules/npm-pick-manifest/package.json
index 04892a1dd..0dc131d97 100644
--- a/node_modules/npm-pick-manifest/package.json
+++ b/node_modules/npm-pick-manifest/package.json
@@ -1,11 +1,11 @@
 {
   "_from": "npm-pick-manifest@latest",
-  "_id": "npm-pick-manifest@6.0.0",
+  "_id": "npm-pick-manifest@6.1.0",
   "_inBundle": false,
-  "_integrity": "sha512-PdJpXMvjqt4nftNEDpCgjBUF8yI3Q3MyuAmVB9nemnnCg32F4BPL/JFBfdj8DubgHCYUFQhtLWmBPvdsFtjWMg==",
+  "_integrity": "sha512-ygs4k6f54ZxJXrzT0x34NybRlLeZ4+6nECAIbr2i0foTnijtS1TJiyzpqtuUAJOps/hO0tNDr8fRV5g+BtRlTw==",
   "_location": "/npm-pick-manifest",
   "_phantomChildren": {
-    "semver": "7.1.3"
+    "semver": "7.3.2"
   },
   "_requested": {
     "type": "tag",
@@ -20,10 +20,11 @@
   "_requiredBy": [
     "#USER",
     "/",
+    "/@npmcli/git",
     "/pacote"
   ],
-  "_resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-6.0.0.tgz",
-  "_shasum": "bfde7abe95f2670aed1629a3c18245ccb3cc2eb8",
+  "_resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-6.1.0.tgz",
+  "_shasum": "2befed87b0fce956790f62d32afb56d7539c022a",
   "_spec": "npm-pick-manifest@latest",
   "_where": "/Users/isaacs/dev/npm/cli",
   "author": {
@@ -75,5 +76,5 @@
   "tap": {
     "check-coverage": true
   },
-  "version": "6.0.0"
+  "version": "6.1.0"
 }