@npmcli/arborist@2.0.5

4 files changed, 31 insertions, 4 deletions

diff --git a/node_modules/pacote/README.md b/node_modules/pacote/README.md
index 81cd437ef..619e0ec44 100644
--- a/node_modules/pacote/README.md
+++ b/node_modules/pacote/README.md
@@ -162,6 +162,11 @@ resolved, and other properties, as they are determined.
   including information not strictly required for installation (author,
   description, etc.)  Defaults to `true` when `before` is set, since the
   version publish time is part of the extended packument metadata.
+* `packumentCache` For registry packuments only, you may provide a `Map`
+  object which will be used to cache packument requests between pacote
+  calls.  This allows you to easily avoid hitting the registry multiple
+  times (even just to validate the cache) for a given packument, since it
+  is unlikely to change in the span of a single command.
 
 ## Extracted File Modes
 
diff --git a/node_modules/pacote/lib/fetcher.js b/node_modules/pacote/lib/fetcher.js
index 33fbf79c6..a0a1447a3 100644
--- a/node_modules/pacote/lib/fetcher.js
+++ b/node_modules/pacote/lib/fetcher.js
@@ -60,6 +60,7 @@ class FetcherBase {
     // clone the opts object so that others aren't upset when we mutate it
     // by adding/modifying the integrity value.
     this.opts = {...opts}
+
     this.cache = opts.cache || cacheDir()
     this.resolved = opts.resolved || null
 
diff --git a/node_modules/pacote/lib/registry.js b/node_modules/pacote/lib/registry.js
index b9df03614..537610d29 100644
--- a/node_modules/pacote/lib/registry.js
+++ b/node_modules/pacote/lib/registry.js
@@ -20,6 +20,14 @@ class RegistryFetcher extends Fetcher {
   constructor (spec, opts) {
     super(spec, opts)
 
+    // you usually don't want to fetch the same packument multiple times in
+    // the span of a given script or command, no matter how many pacote calls
+    // are made, so this lets us avoid doing that.  It's only relevant for
+    // registry fetchers, because other types simulate their packument from
+    // the manifest, which they memoize on this.package, so it's very cheap
+    // already.
+    this.packumentCache = this.opts.packumentCache || null
+
     // handle case when npm-package-arg guesses wrong.
     if (this.spec.type === 'tag' &&
         this.spec.rawSpec === '' &&
@@ -64,11 +72,17 @@ class RegistryFetcher extends Fetcher {
     }
   }
 
-  packument () {
+  async packument () {
+    // note this might be either an in-flight promise for a request,
+    // or the actual packument, but we never want to make more than
+    // one request at a time for the same thing regardless.
+    if (this.packumentCache && this.packumentCache.has(this.packumentUrl))
+      return this.packumentCache.get(this.packumentUrl)
+
     // npm-registry-fetch the packument
     // set the appropriate header for corgis if fullMetadata isn't set
     // return the res.json() promise
-    return fetch(this.packumentUrl, {
+    const p = fetch(this.packumentUrl, {
       ...this.opts,
       headers: this[_headers](),
       spec: this.spec,
@@ -77,8 +91,12 @@ class RegistryFetcher extends Fetcher {
     }).then(res => res.json().then(packument => {
       packument._cached = res.headers.has('x-local-cache')
       packument._contentLength = +res.headers.get('content-length')
+      if (this.packumentCache)
+        this.packumentCache.set(this.packumentUrl, packument)
       return packument
     })).catch(er => {
+      if (this.packumentCache)
+        this.packumentCache.delete(this.packumentUrl)
       if (er.code === 'E404' && !this.fullMetadata) {
         // possible that corgis are not supported by this registry
         this.fullMetadata = true
@@ -86,6 +104,9 @@ class RegistryFetcher extends Fetcher {
       }
       throw er
     })
+    if (this.packumentCache)
+      this.packumentCache.set(this.packumentUrl, p)
+    return p
   }
 
   manifest () {
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
index 085e8f66a..8de6a07a2 100644
--- a/node_modules/pacote/package.json
+++ b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "11.1.14",
+  "version": "11.2.1",
   "description": "JavaScript package downloader",
   "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",
   "bin": {
@@ -13,7 +13,7 @@
     "snap": "tap",
     "preversion": "npm test",
     "postversion": "npm publish",
-    "postpublish": "git push origin --follow-tags"
+    "prepublishOnly": "git push origin --follow-tags"
   },
   "tap": {
     "timeout": 300,