tar@4.4.3

4 files changed, 97 insertions, 36 deletions

diff --git a/node_modules/tar/lib/unpack.js b/node_modules/tar/lib/unpack.js
index 3e1c527b6..5b79cda09 100644
--- a/node_modules/tar/lib/unpack.js
+++ b/node_modules/tar/lib/unpack.js
@@ -12,6 +12,7 @@ const wc = require('./winchars.js')
 
 const ONENTRY = Symbol('onEntry')
 const CHECKFS = Symbol('checkFs')
+const ISREUSABLE = Symbol('isReusable')
 const MAKEFS = Symbol('makeFs')
 const FILE = Symbol('file')
 const DIRECTORY = Symbol('directory')
@@ -32,6 +33,45 @@ const SKIP = Symbol('skip')
 const DOCHOWN = Symbol('doChown')
 const UID = Symbol('uid')
 const GID = Symbol('gid')
+const crypto = require('crypto')
+
+// Unlinks on Windows are not atomic.
+//
+// This means that if you have a file entry, followed by another
+// file entry with an identical name, and you cannot re-use the file
+// (because it's a hardlink, or because unlink:true is set, or it's
+// Windows, which does not have useful nlink values), then the unlink
+// will be committed to the disk AFTER the new file has been written
+// over the old one, deleting the new file.
+//
+// To work around this, on Windows systems, we rename the file and then
+// delete the renamed file.  It's a sloppy kludge, but frankly, I do not
+// know of a better way to do this, given windows' non-atomic unlink
+// semantics.
+//
+// See: https://github.com/npm/node-tar/issues/183
+/* istanbul ignore next */
+const unlinkFile = (path, cb) => {
+  if (process.platform !== 'win32')
+    return fs.unlink(path, cb)
+
+  const name = path + '.DELETE.' + crypto.randomBytes(16).toString('hex')
+  fs.rename(path, name, er => {
+    if (er)
+      return cb(er)
+    fs.unlink(name, cb)
+  })
+}
+
+/* istanbul ignore next */
+const unlinkFileSync = path => {
+  if (process.platform !== 'win32')
+    return fs.unlinkSync(path)
+
+  const name = path + '.DELETE.' + crypto.randomBytes(16).toString('hex')
+  fs.renameSync(path, name)
+  fs.unlinkSync(name)
+}
 
 // this.gid, entry.gid, this.processUid
 const uint32 = (a, b, c) =>
@@ -351,6 +391,17 @@ class Unpack extends Parser {
     entry.resume()
   }
 
+  // Check if we can reuse an existing filesystem entry safely and
+  // overwrite it, rather than unlinking and recreating
+  // Windows doesn't report a useful nlink, so we just never reuse entries
+  [ISREUSABLE] (entry, st) {
+    return entry.type === 'File' &&
+      !this.unlink &&
+      st.isFile() &&
+      st.nlink <= 1 &&
+      process.platform !== 'win32'
+  }
+
   // check if a thing is there, and if so, try to clobber it
   [CHECKFS] (entry) {
     this[PEND]()
@@ -360,7 +411,7 @@ class Unpack extends Parser {
       fs.lstat(entry.absolute, (er, st) => {
         if (st && (this.keep || this.newer && st.mtime > entry.mtime))
           this[SKIP](entry)
-        else if (er || (entry.type === 'File' && !this.unlink && st.isFile()))
+        else if (er || this[ISREUSABLE](entry, st))
           this[MAKEFS](null, entry)
         else if (st.isDirectory()) {
           if (entry.type === 'Directory') {
@@ -371,7 +422,7 @@ class Unpack extends Parser {
           } else
             fs.rmdir(entry.absolute, er => this[MAKEFS](er, entry))
         } else
-          fs.unlink(entry.absolute, er => this[MAKEFS](er, entry))
+          unlinkFile(entry.absolute, er => this[MAKEFS](er, entry))
       })
     })
   }
@@ -422,7 +473,7 @@ class UnpackSync extends Unpack {
       const st = fs.lstatSync(entry.absolute)
       if (this.keep || this.newer && st.mtime > entry.mtime)
         return this[SKIP](entry)
-      else if (entry.type === 'File' && !this.unlink && st.isFile())
+      else if (this[ISREUSABLE](entry, st))
         return this[MAKEFS](null, entry)
       else {
         try {
@@ -433,7 +484,7 @@ class UnpackSync extends Unpack {
             } else
               fs.rmdirSync(entry.absolute)
           } else
-            fs.unlinkSync(entry.absolute)
+            unlinkFileSync(entry.absolute)
           return this[MAKEFS](null, entry)
         } catch (er) {
           return this[ONERROR](er, entry)
diff --git a/node_modules/tar/node_modules/minipass/index.js b/node_modules/tar/node_modules/minipass/index.js
index 1616a4403..ae2dd9064 100644
--- a/node_modules/tar/node_modules/minipass/index.js
+++ b/node_modules/tar/node_modules/minipass/index.js
@@ -20,6 +20,7 @@ const BUFFERLENGTH = Symbol('bufferLength')
 const BUFFERPUSH = Symbol('bufferPush')
 const BUFFERSHIFT = Symbol('bufferShift')
 const OBJECTMODE = Symbol('objectMode')
+const SILENT_END = Symbol('silentEnd')
 
 // Buffer in node 4.x < 4.5.0 doesn't have working Buffer.from
 // or Buffer.alloc, and Buffer in node 10 deprecated the ctor.
@@ -33,6 +34,7 @@ if (!B.alloc) {
 module.exports = class MiniPass extends EE {
   constructor (options) {
     super()
+    this[SILENT_END] = false
     this[FLOWING] = false
     this.pipes = new Yallist()
     this.buffer = new Yallist()
@@ -237,8 +239,11 @@ module.exports = class MiniPass extends EE {
     try {
       return super.on(ev, fn)
     } finally {
-      if (ev === 'data' && !this.pipes.length && !this.flowing) {
+      if (ev === 'data' && !this.pipes.length && !this.flowing)
         this[RESUME]()
+      else if (ev === 'end' && this[SILENT_END] && this[EMITTED_END]) {
+        this[SILENT_END] = false
+        super.emit('end')
       }
     }
   }
@@ -265,6 +270,9 @@ module.exports = class MiniPass extends EE {
       if (this.pipes.length)
         this.pipes.forEach(p => p.dest.write(data) || this.pause())
     } else if (ev === 'end') {
+      if (this[EMITTED_END] === true)
+        return
+
       this[EMITTED_END] = true
       this.readable = false
 
@@ -298,7 +306,10 @@ module.exports = class MiniPass extends EE {
     }
 
     try {
-      return super.emit.apply(this, args)
+      const ret = super.emit.apply(this, args)
+      if (ev === 'end' && ret === false)
+        this[SILENT_END] = true
+      return ret
     } finally {
       if (ev !== 'end')
         this[MAYBE_EMIT_END]()
diff --git a/node_modules/tar/node_modules/minipass/package.json b/node_modules/tar/node_modules/minipass/package.json
index ff54d03d8..d4980cbcf 100644
--- a/node_modules/tar/node_modules/minipass/package.json
+++ b/node_modules/tar/node_modules/minipass/package.json
@@ -1,28 +1,28 @@
 {
-  "_from": "minipass@^2.2.4",
-  "_id": "minipass@2.3.1",
+  "_from": "minipass@^2.3.3",
+  "_id": "minipass@2.3.3",
   "_inBundle": false,
-  "_integrity": "sha512-liT0Gjaz7OHXg2qsfefVFfryBE9uAsqVFWQ6wVf4KNMzI2edsrCDjdGDpTxRaykbxhSKHu/SDtRRcMEcCcTQ2g==",
+  "_integrity": "sha512-/jAn9/tEX4gnpyRATxgHEOV6xbcyxgT7iUnxo9Y3+OB0zX00TgKIv/2FZCf5brBbICcwbLqVv2ImjvWWrQMSYw==",
   "_location": "/tar/minipass",
   "_phantomChildren": {},
   "_requested": {
     "type": "range",
     "registry": true,
-    "raw": "minipass@^2.2.4",
+    "raw": "minipass@^2.3.3",
     "name": "minipass",
     "escapedName": "minipass",
-    "rawSpec": "^2.2.4",
+    "rawSpec": "^2.3.3",
     "saveSpec": null,
-    "fetchSpec": "^2.2.4"
+    "fetchSpec": "^2.3.3"
   },
   "_requiredBy": [
     "/tar",
     "/tar/fs-minipass",
     "/tar/minizlib"
   ],
-  "_resolved": "https://registry.npmjs.org/minipass/-/minipass-2.3.1.tgz",
-  "_shasum": "4e872b959131a672837ab3cb554962bc84b1537d",
-  "_spec": "minipass@^2.2.4",
+  "_resolved": "https://registry.npmjs.org/minipass/-/minipass-2.3.3.tgz",
+  "_shasum": "a7dcc8b7b833f5d368759cce544dccb55f50f233",
+  "_spec": "minipass@^2.3.3",
   "_where": "/Users/zkat/Documents/code/work/npm/node_modules/tar",
   "author": {
     "name": "Isaac Z. Schlueter",
@@ -34,14 +34,14 @@
   },
   "bundleDependencies": false,
   "dependencies": {
-    "safe-buffer": "^5.1.1",
+    "safe-buffer": "^5.1.2",
     "yallist": "^3.0.0"
   },
   "deprecated": false,
   "description": "minimal implementation of a PassThrough stream",
   "devDependencies": {
     "end-of-stream": "^1.4.0",
-    "tap": "^11.1.4",
+    "tap": "^12.0.1",
     "through2": "^2.0.3"
   },
   "files": [
@@ -65,5 +65,5 @@
     "preversion": "npm test",
     "test": "tap test/*.js --100"
   },
-  "version": "2.3.1"
+  "version": "2.3.3"
 }
diff --git a/node_modules/tar/package.json b/node_modules/tar/package.json
index 52d6033d7..c950c5325 100644
--- a/node_modules/tar/package.json
+++ b/node_modules/tar/package.json
@@ -1,31 +1,30 @@
 {
-  "_from": "tar@4.4.1",
-  "_id": "tar@4.4.1",
+  "_from": "tar@latest",
+  "_id": "tar@4.4.3",
   "_inBundle": false,
-  "_integrity": "sha512-O+v1r9yN4tOsvl90p5HAP4AEqbYhx4036AGMm075fH9F8Qwi3oJ+v4u50FkT/KkvywNGtwkk0zRI+8eYm1X/xg==",
+  "_integrity": "sha512-LBw+tcY+/iCCTvF4i3SjqKWIgixSs/dB+Elg3BaY0MXh03D9jWclYskg3BiOkgg414NqpFI3nRgr2Qnw5jJs7Q==",
   "_location": "/tar",
   "_phantomChildren": {
     "safe-buffer": "5.1.2"
   },
   "_requested": {
-    "type": "version",
+    "type": "tag",
     "registry": true,
-    "raw": "tar@4.4.1",
+    "raw": "tar@latest",
     "name": "tar",
     "escapedName": "tar",
-    "rawSpec": "4.4.1",
+    "rawSpec": "latest",
     "saveSpec": null,
-    "fetchSpec": "4.4.1"
+    "fetchSpec": "latest"
   },
   "_requiredBy": [
     "#USER",
     "/",
-    "/libcipm/pacote",
-    "/pacote"
+    "/libcipm/pacote"
   ],
-  "_resolved": "https://registry.npmjs.org/tar/-/tar-4.4.1.tgz",
-  "_shasum": "b25d5a8470c976fd7a9a8a350f42c59e9fa81749",
-  "_spec": "tar@4.4.1",
+  "_resolved": "https://registry.npmjs.org/tar/-/tar-4.4.3.tgz",
+  "_shasum": "d6bd509dc7f6b5a5d2c13aa0f7d57b03269b8376",
+  "_spec": "tar@latest",
   "_where": "/Users/zkat/Documents/code/work/npm",
   "author": {
     "name": "Isaac Z. Schlueter",
@@ -39,10 +38,10 @@
   "dependencies": {
     "chownr": "^1.0.1",
     "fs-minipass": "^1.2.5",
-    "minipass": "^2.2.4",
+    "minipass": "^2.3.3",
     "minizlib": "^1.1.0",
     "mkdirp": "^0.5.0",
-    "safe-buffer": "^5.1.1",
+    "safe-buffer": "^5.1.2",
     "yallist": "^3.0.2"
   },
   "deprecated": false,
@@ -53,9 +52,9 @@
     "events-to-array": "^1.1.2",
     "mutate-fs": "^2.1.1",
     "rimraf": "^2.6.2",
-    "tap": "^11.1.3",
-    "tar-fs": "^1.16.0",
-    "tar-stream": "^1.5.2"
+    "tap": "^12.0.1",
+    "tar-fs": "^1.16.2",
+    "tar-stream": "^1.6.0"
   },
   "engines": {
     "node": ">=4.5"
@@ -79,5 +78,5 @@
     "preversion": "npm test",
     "test": "tap test/*.js --100 -J --coverage-report=text -c"
   },
-  "version": "4.4.1"
+  "version": "4.4.3"
 }