deps: pacote@13.2.0 (#4837)

3 files changed, 20 insertions, 10 deletions

diff --git a/node_modules/pacote/lib/fetcher.js b/node_modules/pacote/lib/fetcher.js
index 65e97e205..d88724c5d 100644
--- a/node_modules/pacote/lib/fetcher.js
+++ b/node_modules/pacote/lib/fetcher.js
@@ -105,8 +105,15 @@ class FetcherBase {
       this[_readPackageJson] = readPackageJsonFast
     }
 
-    // config values: npmjs (default), never
-    this.replaceRegistryHost = opts.replaceRegistryHost === 'never' ? 'never' : 'npmjs'
+    // config values: npmjs (default), never, always
+    // we don't want to mutate the original value
+    if (opts.replaceRegistryHost !== 'never'
+      && opts.replaceRegistryHost !== 'always'
+    ) {
+      this.replaceRegistryHost = 'npmjs'
+    } else {
+      this.replaceRegistryHost = opts.replaceRegistryHost
+    }
 
     this.defaultTag = opts.defaultTag || 'latest'
     this.registry = removeTrailingSlashes(opts.registry || 'https://registry.npmjs.org')
diff --git a/node_modules/pacote/lib/remote.js b/node_modules/pacote/lib/remote.js
index 3404ea947..14e687805 100644
--- a/node_modules/pacote/lib/remote.js
+++ b/node_modules/pacote/lib/remote.js
@@ -5,7 +5,7 @@ const pacoteVersion = require('../package.json').version
 const fetch = require('npm-registry-fetch')
 const Minipass = require('minipass')
 // The default registry URL is a string of great magic.
-const magic = /^https?:\/\/registry\.npmjs\.org\//
+const magicHost = 'https://registry.npmjs.org'
 
 const _cacheFetches = Symbol.for('pacote.Fetcher._cacheFetches')
 const _headers = Symbol('_headers')
@@ -13,10 +13,13 @@ class RemoteFetcher extends Fetcher {
   constructor (spec, opts) {
     super(spec, opts)
     this.resolved = this.spec.fetchSpec
-    if (this.replaceRegistryHost === 'npmjs'
-      && magic.test(this.resolved)
-      && !magic.test(this.registry + '/')) {
-      this.resolved = this.resolved.replace(magic, this.registry + '/')
+    const resolvedURL = new URL(this.resolved)
+    if (
+      (this.replaceRegistryHost === 'npmjs'
+        && resolvedURL.origin === magicHost)
+      || this.replaceRegistryHost === 'always'
+    ) {
+      this.resolved = new URL(resolvedURL.pathname, this.registry).href
     }
 
     // nam is a fermented pork sausage that is good to eat
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
index af8166d4e..a978852b2 100644
--- a/node_modules/pacote/package.json
+++ b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "13.1.1",
+  "version": "13.2.0",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -26,7 +26,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^3.0.1",
-    "@npmcli/template-oss": "3.2.2",
+    "@npmcli/template-oss": "3.4.2",
     "hosted-git-info": "^5.0.0",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
@@ -74,7 +74,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "3.2.2",
+    "version": "3.4.2",
     "windowsCI": false
   }
 }