deps: @npmcli/arborist@4.1.1 parse-conflict-json@2.0.1

* Fixes object property assignment bug in resolving package-locks with
  conflicts

PR-URL: https://github.com/npm/cli/pull/4141
Credit: @wraithgar
Close: #4141
Reviewed-by: @fritzy

12 files changed, 352 insertions, 45 deletions

diff --git a/node_modules/@npmcli/arborist/package.json b/node_modules/@npmcli/arborist/package.json
index 12fede685..cea3d5ecd 100644
--- a/node_modules/@npmcli/arborist/package.json
+++ b/node_modules/@npmcli/arborist/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/arborist",
-  "version": "4.1.0",
+  "version": "4.1.1",
   "description": "Manage node_modules trees",
   "dependencies": {
     "@isaacs/string-locale-compare": "^1.1.0",
@@ -24,7 +24,7 @@
     "npm-pick-manifest": "^6.1.0",
     "npm-registry-fetch": "^11.0.0",
     "pacote": "^12.0.2",
-    "parse-conflict-json": "^1.1.1",
+    "parse-conflict-json": "^2.0.1",
     "proc-log": "^1.0.0",
     "promise-all-reject-late": "^1.0.0",
     "promise-call-limit": "^1.0.1",
diff --git a/node_modules/just-diff-apply/index.mjs b/node_modules/just-diff-apply/index.mjs
new file mode 100644
index 000000000..fcd26c2f5
--- /dev/null
+++ b/node_modules/just-diff-apply/index.mjs
@@ -0,0 +1,110 @@
+/*
+  const obj1 = {a: 3, b: 5};
+  diffApply(obj1,
+    [
+      { "op": "remove", "path": ['b'] },
+      { "op": "replace", "path": ['a'], "value": 4 },
+      { "op": "add", "path": ['c'], "value": 5 }
+    ]
+  );
+  obj1; // {a: 4, c: 5}
+
+  // using converter to apply jsPatch standard paths
+  // see http://jsonpatch.com
+  import {diff, jsonPatchPathConverter} from 'just-diff'
+  const obj2 = {a: 3, b: 5};
+  diffApply(obj2, [
+    { "op": "remove", "path": '/b' },
+    { "op": "replace", "path": '/a', "value": 4 }
+    { "op": "add", "path": '/c', "value": 5 }
+  ], jsonPatchPathConverter);
+  obj2; // {a: 4, c: 5}
+
+  // arrays
+  const obj3 = {a: 4, b: [1, 2, 3]};
+  diffApply(obj3, [
+    { "op": "replace", "path": ['a'], "value": 3 }
+    { "op": "replace", "path": ['b', 2], "value": 4 }
+    { "op": "add", "path": ['b', 3], "value": 9 }
+  ]);
+  obj3; // {a: 3, b: [1, 2, 4, 9]}
+
+  // nested paths
+  const obj4 = {a: 4, b: {c: 3}};
+  diffApply(obj4, [
+    { "op": "replace", "path": ['a'], "value": 5 }
+    { "op": "remove", "path": ['b', 'c']}
+    { "op": "add", "path": ['b', 'd'], "value": 4 }
+  ]);
+  obj4; // {a: 5, b: {d: 4}}
+*/
+
+var REMOVE = 'remove';
+var REPLACE = 'replace';
+var ADD = 'add';
+
+function diffApply(obj, diff, pathConverter) {
+  if (!obj || typeof obj != 'object') {
+    throw new Error('base object must be an object or an array');
+  }
+
+  if (!Array.isArray(diff)) {
+    throw new Error('diff must be an array');
+  }
+
+  var diffLength = diff.length;
+  for (var i = 0; i < diffLength; i++) {
+    var thisDiff = diff[i];
+    var subObject = obj;
+    var thisOp = thisDiff.op;
+    var thisPath = thisDiff.path;
+    if (pathConverter) {
+      thisPath = pathConverter(thisPath);
+      if (!Array.isArray(thisPath)) {
+        throw new Error('pathConverter must return an array');
+      }
+    } else {
+      if (!Array.isArray(thisPath)) {
+        throw new Error(
+          'diff path must be an array, consider supplying a path converter'
+        );
+      }
+    }
+    var pathCopy = thisPath.slice();
+    var lastProp = pathCopy.pop();
+    if (lastProp == null) {
+      return false;
+    }
+    var thisProp;
+    while ((thisProp = pathCopy.shift()) != null) {
+      if (!(thisProp in subObject)) {
+        subObject[thisProp] = {};
+      }
+      subObject = subObject[thisProp];
+    }
+    if (thisOp === REMOVE || thisOp === REPLACE) {
+      if (!subObject.hasOwnProperty(lastProp)) {
+        throw new Error(
+          ['expected to find property', thisDiff.path, 'in object', obj].join(
+            ' '
+          )
+        );
+      }
+    }
+    if (thisOp === REMOVE) {
+      Array.isArray(subObject)
+        ? subObject.splice(lastProp, 1)
+        : delete subObject[lastProp];
+    }
+    if (thisOp === REPLACE || thisOp === ADD) {
+      subObject[lastProp] = thisDiff.value;
+    }
+  }
+  return subObject;
+}
+
+function jsonPatchPathConverter(stringPath) {
+  return stringPath.split('/').slice(1);
+}
+
+export {diffApply, jsonPatchPathConverter};
diff --git a/node_modules/just-diff-apply/package.json b/node_modules/just-diff-apply/package.json
index a5cc8a1fe..c38bd47aa 100644
--- a/node_modules/just-diff-apply/package.json
+++ b/node_modules/just-diff-apply/package.json
@@ -1,10 +1,18 @@
 {
   "name": "just-diff-apply",
-  "version": "3.0.0",
+  "version": "4.0.1",
   "description": "Apply a diff to an object. Optionally supports jsonPatch protocol",
   "main": "index.js",
+  "module": "index.mjs",
+  "exports": {
+    ".": {
+      "require": "./index.js",
+      "default": "./index.mjs"
+    }
+  },
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "build": "rollup -c"
   },
   "repository": "https://github.com/angus-c/just",
   "keywords": [
diff --git a/node_modules/just-diff-apply/rollup.config.js b/node_modules/just-diff-apply/rollup.config.js
new file mode 100644
index 000000000..fb9d24a3d
--- /dev/null
+++ b/node_modules/just-diff-apply/rollup.config.js
@@ -0,0 +1,3 @@
+const createRollupConfig = require('../../config/createRollupConfig');
+
+module.exports = createRollupConfig(__dirname);
diff --git a/node_modules/just-diff/index.mjs b/node_modules/just-diff/index.mjs
new file mode 100644
index 000000000..8da5b5cea
--- /dev/null
+++ b/node_modules/just-diff/index.mjs
@@ -0,0 +1,146 @@
+/*
+  const obj1 = {a: 4, b: 5};
+  const obj2 = {a: 3, b: 5};
+  const obj3 = {a: 4, c: 5};
+
+  diff(obj1, obj2);
+  [
+    { "op": "replace", "path": ['a'], "value": 3 }
+  ]
+
+  diff(obj2, obj3);
+  [
+    { "op": "remove", "path": ['b'] },
+    { "op": "replace", "path": ['a'], "value": 4 }
+    { "op": "add", "path": ['c'], "value": 5 }
+  ]
+
+  // using converter to generate jsPatch standard paths
+  // see http://jsonpatch.com
+  import {diff, jsonPatchPathConverter} from 'just-diff'
+  diff(obj1, obj2, jsonPatchPathConverter);
+  [
+    { "op": "replace", "path": '/a', "value": 3 }
+  ]
+
+  diff(obj2, obj3, jsonPatchPathConverter);
+  [
+    { "op": "remove", "path": '/b' },
+    { "op": "replace", "path": '/a', "value": 4 }
+    { "op": "add", "path": '/c', "value": 5 }
+  ]
+
+  // arrays
+  const obj4 = {a: 4, b: [1, 2, 3]};
+  const obj5 = {a: 3, b: [1, 2, 4]};
+  const obj6 = {a: 3, b: [1, 2, 4, 5]};
+
+  diff(obj4, obj5);
+  [
+    { "op": "replace", "path": ['a'], "value": 3 }
+    { "op": "replace", "path": ['b', 2], "value": 4 }
+  ]
+
+  diff(obj5, obj6);
+  [
+    { "op": "add", "path": ['b', 3], "value": 5 }
+  ]
+
+  // nested paths
+  const obj7 = {a: 4, b: {c: 3}};
+  const obj8 = {a: 4, b: {c: 4}};
+  const obj9 = {a: 5, b: {d: 4}};
+
+  diff(obj7, obj8);
+  [
+    { "op": "replace", "path": ['b', 'c'], "value": 4 }
+  ]
+
+  diff(obj8, obj9);
+  [
+    { "op": "replace", "path": ['a'], "value": 5 }
+    { "op": "remove", "path": ['b', 'c']}
+    { "op": "add", "path": ['b', 'd'], "value": 4 }
+  ]
+*/
+
+function diff(obj1, obj2, pathConverter) {
+  if (!obj1 || typeof obj1 != 'object' || !obj2 || typeof obj2 != 'object') {
+    throw new Error('both arguments must be objects or arrays');
+  }
+
+  pathConverter ||
+    (pathConverter = function(arr) {
+      return arr;
+    });
+
+  function getDiff(obj1, obj2, basePath, diffs) {
+    var obj1Keys = Object.keys(obj1);
+    var obj1KeysLength = obj1Keys.length;
+    var obj2Keys = Object.keys(obj2);
+    var obj2KeysLength = obj2Keys.length;
+    var path;
+
+    for (var i = 0; i < obj1KeysLength; i++) {
+      var key = Array.isArray(obj1) ? Number(obj1Keys[i]) : obj1Keys[i];
+      if (!(key in obj2)) {
+        path = basePath.concat(key);
+        diffs.remove.push({
+          op: 'remove',
+          path: pathConverter(path),
+        });
+      }
+    }
+
+    for (var i = 0; i < obj2KeysLength; i++) {
+      var key = Array.isArray(obj2) ? Number(obj2Keys[i]) : obj2Keys[i];
+      var obj1AtKey = obj1[key];
+      var obj2AtKey = obj2[key];
+      if (!(key in obj1)) {
+        path = basePath.concat(key);
+        var obj2Value = obj2[key];
+        diffs.add.push({
+          op: 'add',
+          path: pathConverter(path),
+          value: obj2Value,
+        });
+      } else if (obj1AtKey !== obj2AtKey) {
+        if (
+          Object(obj1AtKey) !== obj1AtKey ||
+          Object(obj2AtKey) !== obj2AtKey
+        ) {
+          path = pushReplace(path, basePath, key, diffs, pathConverter, obj2);
+        } else {
+          if (
+            !Object.keys(obj1AtKey).length &&
+            !Object.keys(obj2AtKey).length &&
+            String(obj1AtKey) != String(obj2AtKey)
+          ) {
+            path = pushReplace(path, basePath, key, diffs, pathConverter, obj2);
+          } else {
+            getDiff(obj1[key], obj2[key], basePath.concat(key), diffs);
+          }
+        }
+      }
+    }
+
+    return diffs.remove.reverse().concat(diffs.replace).concat(diffs.add);
+  }
+  return getDiff(obj1, obj2, [], {remove: [], replace: [], add: []});
+}
+
+function pushReplace(path, basePath, key, diffs, pathConverter, obj2) {
+  path = basePath.concat(key);
+  diffs.replace.push({
+    op: 'replace',
+    path: pathConverter(path),
+    value: obj2[key],
+  });
+  return path;
+}
+
+function jsonPatchPathConverter(arrayPath) {
+  return [''].concat(arrayPath).join('/');
+}
+
+export {diff, jsonPatchPathConverter};
diff --git a/node_modules/just-diff/index.tests.ts b/node_modules/just-diff/index.tests.ts
index c7ebb70d3..91eaecd8d 100644
--- a/node_modules/just-diff/index.tests.ts
+++ b/node_modules/just-diff/index.tests.ts
@@ -1,4 +1,4 @@
-import diffObj = require('./index');
+import * as diffObj from './index'
 
 const {diff, jsonPatchPathConverter} = diffObj;
 const obj1 = {a: 2, b: 3};
diff --git a/node_modules/just-diff/package.json b/node_modules/just-diff/package.json
index 00be1d50f..bab8a29ae 100644
--- a/node_modules/just-diff/package.json
+++ b/node_modules/just-diff/package.json
@@ -1,11 +1,19 @@
 {
   "name": "just-diff",
-  "version": "3.1.1",
+  "version": "5.0.1",
   "description": "Return an object representing the diffs between two objects. Supports jsonPatch protocol",
   "main": "index.js",
+  "module": "index.mjs",
+  "exports": {
+    ".": {
+      "require": "./index.js",
+      "default": "./index.mjs"
+    }
+  },
   "types": "index.d.ts",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "build": "rollup -c"
   },
   "repository": "https://github.com/angus-c/just",
   "keywords": [
@@ -20,4 +28,4 @@
   "bugs": {
     "url": "https://github.com/angus-c/just/issues"
   }
-}
\ No newline at end of file
+}
diff --git a/node_modules/just-diff/rollup.config.js b/node_modules/just-diff/rollup.config.js
new file mode 100644
index 000000000..fb9d24a3d
--- /dev/null
+++ b/node_modules/just-diff/rollup.config.js
@@ -0,0 +1,3 @@
+const createRollupConfig = require('../../config/createRollupConfig');
+
+module.exports = createRollupConfig(__dirname);
diff --git a/node_modules/parse-conflict-json/LICENSE b/node_modules/parse-conflict-json/LICENSE
deleted file mode 100644
index 20a476254..000000000
--- a/node_modules/parse-conflict-json/LICENSE
+++ /dev/null
@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) npm, Inc. and Contributors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/parse-conflict-json/LICENSE.md b/node_modules/parse-conflict-json/LICENSE.md
new file mode 100644
index 000000000..5fc208ff1
--- /dev/null
+++ b/node_modules/parse-conflict-json/LICENSE.md
@@ -0,0 +1,20 @@
+<!-- This file is automatically added by @npmcli/template-oss. Do not edit. -->
+
+ISC License
+
+Copyright npm, Inc.
+
+Permission to use, copy, modify, and/or distribute this
+software for any purpose with or without fee is hereby
+granted, provided that the above copyright notice and this
+permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND NPM DISCLAIMS ALL
+WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO
+EVENT SHALL NPM BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS,
+WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
+TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE
+USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/parse-conflict-json/index.js b/node_modules/parse-conflict-json/lib/index.js
index 8b5dbde40..21b295d04 100644
--- a/node_modules/parse-conflict-json/index.js
+++ b/node_modules/parse-conflict-json/lib/index.js
@@ -2,13 +2,16 @@ const parseJSON = require('json-parse-even-better-errors')
 const { diff } = require('just-diff')
 const { diffApply } = require('just-diff-apply')
 
+const globalObjectProperties = Object.getOwnPropertyNames(Object.prototype)
+
 const stripBOM = content => {
   content = content.toString()
   // Remove byte order marker. This catches EF BB BF (the UTF-8 BOM)
   // because the buffer-to-string conversion in `fs.readFileSync()`
   // translates it to FEFF, the UTF-16 BOM.
-  if (content.charCodeAt(0) === 0xFEFF)
+  if (content.charCodeAt(0) === 0xFEFF) {
     content = content.slice(1)
+  }
   return content
 }
 
@@ -22,37 +25,42 @@ const isDiff = str =>
 
 const parseConflictJSON = (str, reviver, prefer) => {
   prefer = prefer || 'ours'
-  if (prefer !== 'theirs' && prefer !== 'ours')
+  if (prefer !== 'theirs' && prefer !== 'ours') {
     throw new TypeError('prefer param must be "ours" or "theirs" if set')
+  }
 
   str = stripBOM(str)
 
-  if (!isDiff(str))
+  if (!isDiff(str)) {
     return parseJSON(str)
+  }
 
   const pieces = str.split(/[\n\r]+/g).reduce((acc, line) => {
-    if (line.match(PARENT_RE))
+    if (line.match(PARENT_RE)) {
       acc.state = 'parent'
-    else if (line.match(OURS_RE))
+    } else if (line.match(OURS_RE)) {
       acc.state = 'ours'
-    else if (line.match(THEIRS_RE))
+    } else if (line.match(THEIRS_RE)) {
       acc.state = 'theirs'
-    else if (line.match(END_RE))
+    } else if (line.match(END_RE)) {
       acc.state = 'top'
-    else {
-      if (acc.state === 'top' || acc.state === 'ours')
+    } else {
+      if (acc.state === 'top' || acc.state === 'ours') {
         acc.ours += line
-      if (acc.state === 'top' || acc.state === 'theirs')
+      }
+      if (acc.state === 'top' || acc.state === 'theirs') {
         acc.theirs += line
-      if (acc.state === 'top' || acc.state === 'parent')
+      }
+      if (acc.state === 'top' || acc.state === 'parent') {
         acc.parent += line
+      }
     }
     return acc
   }, {
     state: 'top',
     ours: '',
     theirs: '',
-    parent: ''
+    parent: '',
   })
 
   // this will throw if either piece is not valid JSON, that's intended
@@ -70,8 +78,9 @@ const isObj = obj => obj && typeof obj === 'object'
 const copyPath = (to, from, path, i) => {
   const p = path[i]
   if (isObj(to[p]) && isObj(from[p]) &&
-      Array.isArray(to[p]) === Array.isArray(from[p]))
+      Array.isArray(to[p]) === Array.isArray(from[p])) {
     return copyPath(to[p], from[p], path, i + 1)
+  }
   to[p] = from[p]
 }
 
@@ -80,6 +89,9 @@ const copyPath = (to, from, path, i) => {
 const resolve = (parent, ours, theirs) => {
   const dours = diff(parent, ours)
   for (let i = 0; i < dours.length; i++) {
+    if (globalObjectProperties.find(prop => dours[i].path.includes(prop))) {
+      continue
+    }
     try {
       diffApply(theirs, [dours[i]])
     } catch (e) {
diff --git a/node_modules/parse-conflict-json/package.json b/node_modules/parse-conflict-json/package.json
index 3962e22f3..bb633e158 100644
--- a/node_modules/parse-conflict-json/package.json
+++ b/node_modules/parse-conflict-json/package.json
@@ -1,32 +1,44 @@
 {
   "name": "parse-conflict-json",
-  "version": "1.1.1",
+  "version": "2.0.1",
   "description": "Parse a JSON string that has git merge conflicts, resolving if possible",
-  "author": "Isaac Z. Schlueter <i@izs.me> (https://izs.me)",
+  "author": "GitHub Inc.",
   "license": "ISC",
+  "main": "lib",
   "scripts": {
     "test": "tap",
     "snap": "tap",
     "preversion": "npm test",
     "postversion": "npm publish",
-    "postpublish": "git push origin --follow-tags"
+    "postpublish": "git push origin --follow-tags",
+    "lint": "eslint '**/*.js'",
+    "postlint": "npm-template-check",
+    "lintfix": "npm run lint -- --fix",
+    "prepublishOnly": "git push origin --follow-tags",
+    "posttest": "npm run lint"
   },
   "tap": {
     "check-coverage": true
   },
   "devDependencies": {
-    "tap": "^14.6.1"
+    "@npmcli/template-oss": "^2.3.1",
+    "tap": "^15.1.5"
   },
   "dependencies": {
-    "just-diff": "^3.0.1",
-    "just-diff-apply": "^3.0.0",
-    "json-parse-even-better-errors": "^2.3.0"
+    "json-parse-even-better-errors": "^2.3.1",
+    "just-diff": "^5.0.1",
+    "just-diff-apply": "^4.0.1"
   },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/npm/parse-conflict-json.git"
   },
   "files": [
-    "index.js"
-  ]
+    "bin",
+    "lib"
+  ],
+  "templateVersion": "2.3.1",
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16"
+  }
 }