12 files changed, 110 insertions, 38 deletions
diff --git a/node_modules/lock-verify/README.md b/node_modules/lock-verify/README.md
index 01f0633c0..0d7a6eae8 100644
--- a/node_modules/lock-verify/README.md
+++ b/node_modules/lock-verify/README.md
@@ -1,3 +1,11 @@
+# Note: pending imminent deprecation
+
+**This module will be deprecated once npm v7 is released.  Please do not rely
+on it more than absolutely necessary (ie, only if you are depending on
+it for use with npm v6 internal dependencies).**
+
+----
+
 # lock-verify
 
 Report if your package.json is out of sync with your package-lock.json.
diff --git a/node_modules/lock-verify/cli.js b/node_modules/lock-verify/cli.js
new file mode 100755
index 000000000..2cc5e16ab
--- /dev/null
+++ b/node_modules/lock-verify/cli.js
@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+'use strict'
+require('@iarna/cli')(main)
+  .usage('lock-verify [projectPath]')
+  .help()
+
+const lockVerify = require('./index.js')
+
+function main (opts, check) {
+  return lockVerify(check).then(result => {
+    result.warnings.forEach(w => console.error('Warning:', w))
+    if (!result.status) {
+      result.errors.forEach(e => console.error(e))
+      throw 1
+    }
+  })
+}
diff --git a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/CHANGELOG.md b/node_modules/lock-verify/node_modules/hosted-git-info/CHANGELOG.md
index 479f24b64..4f86601e0 100644
--- a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/CHANGELOG.md
+++ b/node_modules/lock-verify/node_modules/hosted-git-info/CHANGELOG.md
@@ -2,6 +2,32 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
+<a name="2.8.8"></a>
+## [2.8.8](https://github.com/npm/hosted-git-info/compare/v2.8.7...v2.8.8) (2020-02-29)
+
+
+### Bug Fixes
+
+* [#61](https://github.com/npm/hosted-git-info/issues/61) & [#65](https://github.com/npm/hosted-git-info/issues/65) addressing issues w/ url.URL implmentation which regressed node 6 support ([5038b18](https://github.com/npm/hosted-git-info/commit/5038b18)), closes [#66](https://github.com/npm/hosted-git-info/issues/66)
+
+
+
+<a name="2.8.7"></a>
+## [2.8.7](https://github.com/npm/hosted-git-info/compare/v2.8.6...v2.8.7) (2020-02-26)
+
+
+### Bug Fixes
+
+* Do not attempt to use url.URL when unavailable ([2d0bb66](https://github.com/npm/hosted-git-info/commit/2d0bb66)), closes [#61](https://github.com/npm/hosted-git-info/issues/61) [#62](https://github.com/npm/hosted-git-info/issues/62)
+* Do not pass scp-style URLs to the WhatWG url.URL ([f2cdfcf](https://github.com/npm/hosted-git-info/commit/f2cdfcf)), closes [#60](https://github.com/npm/hosted-git-info/issues/60)
+
+
+
+<a name="2.8.6"></a>
+## [2.8.6](https://github.com/npm/hosted-git-info/compare/v2.8.5...v2.8.6) (2020-02-25)
+
+
+
 <a name="2.8.5"></a>
 ## [2.8.5](https://github.com/npm/hosted-git-info/compare/v2.8.4...v2.8.5) (2019-10-07)
 
diff --git a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/LICENSE b/node_modules/lock-verify/node_modules/hosted-git-info/LICENSE
index 45055763d..45055763d 100644
--- a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/LICENSE
+++ b/node_modules/lock-verify/node_modules/hosted-git-info/LICENSE
diff --git a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/README.md b/node_modules/lock-verify/node_modules/hosted-git-info/README.md
index 7b723f6b9..7b723f6b9 100644
--- a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/README.md
+++ b/node_modules/lock-verify/node_modules/hosted-git-info/README.md
diff --git a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/git-host-info.js b/node_modules/lock-verify/node_modules/hosted-git-info/git-host-info.js
index 8147e3348..8147e3348 100644
--- a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/git-host-info.js
+++ b/node_modules/lock-verify/node_modules/hosted-git-info/git-host-info.js
diff --git a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/git-host.js b/node_modules/lock-verify/node_modules/hosted-git-info/git-host.js
index 9616fbaa6..9616fbaa6 100644
--- a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/git-host.js
+++ b/node_modules/lock-verify/node_modules/hosted-git-info/git-host.js
diff --git a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/index.js b/node_modules/lock-verify/node_modules/hosted-git-info/index.js
index fc959cb04..21e53fe37 100644
--- a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/index.js
+++ b/node_modules/lock-verify/node_modules/hosted-git-info/index.js
@@ -47,7 +47,7 @@ function fromUrl (giturl, opts) {
       var gitHostInfo = gitHosts[gitHostName]
       var auth = null
       if (parsed.auth && authProtocols[parsed.protocol]) {
-        auth = decodeURIComponent(parsed.auth)
+        auth = parsed.auth
       }
       var committish = parsed.hash ? decodeURIComponent(parsed.hash.substr(1)) : null
       var user = null
@@ -106,7 +106,30 @@ function fixupUnqualifiedGist (giturl) {
 
 function parseGitUrl (giturl) {
   var matched = giturl.match(/^([^@]+)@([^:/]+):[/]?((?:[^/]+[/])?[^/]+?)(?:[.]git)?(#.*)?$/)
-  if (!matched) return url.parse(giturl)
+  if (!matched) {
+    var legacy = url.parse(giturl)
+    // If we don't have url.URL, then sorry, this is just not fixable.
+    // This affects Node <= 6.12.
+    if (legacy.auth && typeof url.URL === 'function') {
+      // git urls can be in the form of scp-style/ssh-connect strings, like
+      // git+ssh://user@host.com:some/path, which the legacy url parser
+      // supports, but WhatWG url.URL class does not.  However, the legacy
+      // parser de-urlencodes the username and password, so something like
+      // https://user%3An%40me:p%40ss%3Aword@x.com/ becomes
+      // https://user:n@me:p@ss:word@x.com/ which is all kinds of wrong.
+      // Pull off just the auth and host, so we dont' get the confusing
+      // scp-style URL, then pass that to the WhatWG parser to get the
+      // auth properly escaped.
+      var authmatch = giturl.match(/[^@]+@[^:/]+/)
+      /* istanbul ignore else - this should be impossible */
+      if (authmatch) {
+        var whatwg = new url.URL(authmatch[0])
+        legacy.auth = whatwg.username || ''
+        if (whatwg.password) legacy.auth += ':' + whatwg.password
+      }
+    }
+    return legacy
+  }
   return {
     protocol: 'git+ssh:',
     slashes: true,
diff --git a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/package.json b/node_modules/lock-verify/node_modules/hosted-git-info/package.json
index 11f66e0ac..ec9f8df7e 100644
--- a/node_modules/lock-verify/node_modules/npm-package-arg/node_modules/hosted-git-info/package.json
+++ b/node_modules/lock-verify/node_modules/hosted-git-info/package.json
@@ -1,9 +1,9 @@
 {
   "_from": "hosted-git-info@^2.7.1",
-  "_id": "hosted-git-info@2.8.5",
+  "_id": "hosted-git-info@2.8.8",
   "_inBundle": false,
-  "_integrity": "sha512-kssjab8CvdXfcXMXVcvsXum4Hwdq9XGtRD3TteMEvEbq0LXyiNQr6AprqKqfeaDXze7SxWvRxdpwE6ku7ikLkg==",
-  "_location": "/lock-verify/npm-package-arg/hosted-git-info",
+  "_integrity": "sha512-f/wzC2QaWBs7t9IYqB4T3sR1xviIViXJRJTWBlx2Gf3g0Xi5vI7Yy4koXQ1c9OYDGHN9sBy1DQ2AB8fqZBWhUg==",
+  "_location": "/lock-verify/hosted-git-info",
   "_phantomChildren": {},
   "_requested": {
     "type": "range",
@@ -18,8 +18,8 @@
   "_requiredBy": [
     "/lock-verify/npm-package-arg"
   ],
-  "_resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.5.tgz",
-  "_shasum": "759cfcf2c4d156ade59b0b2dfabddc42a6b9c70c",
+  "_resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.8.tgz",
+  "_shasum": "7539bd4bc1e0e0a895815a2e0262420b12858488",
   "_spec": "hosted-git-info@^2.7.1",
   "_where": "/Users/isaacs/dev/npm/cli/node_modules/lock-verify/node_modules/npm-package-arg",
   "author": {
@@ -59,11 +59,11 @@
   },
   "scripts": {
     "postrelease": "npm publish --tag=ancient-legacy-fixes && git push --follow-tags",
+    "posttest": "standard",
     "prerelease": "npm t",
-    "pretest": "standard",
     "release": "standard-version -s",
-    "test": "tap -J --100 --no-esm test/*.js",
-    "test:coverage": "tap --coverage-report=html -J --100 --no-esm test/*.js"
+    "test": "tap -J --coverage=90 --no-esm test/*.js",
+    "test:coverage": "tap --coverage-report=html -J --coverage=90 --no-esm test/*.js"
   },
-  "version": "2.8.5"
+  "version": "2.8.8"
 }
diff --git a/node_modules/lock-verify/node_modules/npm-package-arg/package.json b/node_modules/lock-verify/node_modules/npm-package-arg/package.json
index ec4e5298a..0a8fcb1d7 100644
--- a/node_modules/lock-verify/node_modules/npm-package-arg/package.json
+++ b/node_modules/lock-verify/node_modules/npm-package-arg/package.json
@@ -21,7 +21,7 @@
   "_resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-6.1.1.tgz",
   "_shasum": "02168cb0a49a2b75bf988a28698de7b529df5cb7",
   "_spec": "npm-package-arg@^6.1.0",
-  "_where": "/Users/claudiahdz/npm/cli/node_modules/lock-verify",
+  "_where": "/Users/isaacs/dev/npm/cli/node_modules/lock-verify",
   "author": {
     "name": "Isaac Z. Schlueter",
     "email": "i@izs.me",
diff --git a/node_modules/lock-verify/node_modules/semver/package.json b/node_modules/lock-verify/node_modules/semver/package.json
index c223d36e8..04c318e9e 100644
--- a/node_modules/lock-verify/node_modules/semver/package.json
+++ b/node_modules/lock-verify/node_modules/semver/package.json
@@ -22,7 +22,7 @@
   "_resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
   "_shasum": "a954f931aeba508d307bbf069eff0c01c96116f7",
   "_spec": "semver@^5.4.1",
-  "_where": "/Users/mperrotte/npminc/cli/node_modules/lock-verify",
+  "_where": "/Users/isaacs/dev/npm/cli/node_modules/lock-verify",
   "bin": {
     "semver": "bin/semver"
   },
diff --git a/node_modules/lock-verify/package.json b/node_modules/lock-verify/package.json
index 621c12fb7..031d7b056 100644
--- a/node_modules/lock-verify/package.json
+++ b/node_modules/lock-verify/package.json
@@ -1,53 +1,54 @@
 {
-  "_from": "lock-verify@2.1.0",
-  "_id": "lock-verify@2.1.0",
+  "_from": "lock-verify@^2.1.0",
+  "_id": "lock-verify@2.2.1",
   "_inBundle": false,
-  "_integrity": "sha512-vcLpxnGvrqisKvLQ2C2v0/u7LVly17ak2YSgoK4PrdsYBXQIax19vhKiLfvKNFx7FRrpTnitrpzF/uuCMuorIg==",
+  "_integrity": "sha512-n0Zw2DVupKfZMazy/HIFVNohJ1z8fIoZ77WBnyyBGG6ixw83uJNyrbiJvvHWe1QKkGiBCjj8RCPlymltliqEww==",
   "_location": "/lock-verify",
-  "_phantomChildren": {},
+  "_phantomChildren": {
+    "osenv": "0.1.5",
+    "validate-npm-package-name": "3.0.0"
+  },
   "_requested": {
-    "type": "version",
+    "type": "range",
     "registry": true,
-    "raw": "lock-verify@2.1.0",
+    "raw": "lock-verify@^2.1.0",
     "name": "lock-verify",
     "escapedName": "lock-verify",
-    "rawSpec": "2.1.0",
+    "rawSpec": "^2.1.0",
     "saveSpec": null,
-    "fetchSpec": "2.1.0"
+    "fetchSpec": "^2.1.0"
   },
   "_requiredBy": [
-    "#USER",
-    "/",
-    "/libcipm",
-    "/libnpm"
+    "/"
   ],
-  "_resolved": "https://registry.npmjs.org/lock-verify/-/lock-verify-2.1.0.tgz",
-  "_shasum": "fff4c918b8db9497af0c5fa7f6d71555de3ceb47",
-  "_spec": "lock-verify@2.1.0",
-  "_where": "/Users/zkat/Documents/code/work/npm",
+  "_resolved": "https://registry.npmjs.org/lock-verify/-/lock-verify-2.2.1.tgz",
+  "_shasum": "81107948c51ed16f97b96ff8b60675affb243fc1",
+  "_spec": "lock-verify@^2.1.0",
+  "_where": "/Users/isaacs/dev/npm/cli",
   "author": {
     "name": "Rebecca Turner",
     "email": "me@re-becca.org",
     "url": "http://re-becca.org/"
   },
+  "bin": {
+    "lock-verify": "cli.js"
+  },
   "bugs": {
     "url": "https://github.com/iarna/lock-verify/issues"
   },
   "bundleDependencies": false,
   "dependencies": {
+    "@iarna/cli": "^1.2.0",
     "npm-package-arg": "^6.1.0",
     "semver": "^5.4.1"
   },
   "deprecated": false,
   "description": "Report if your package.json is out of sync with your package-lock.json.",
-  "devDependencies": {
-    "@iarna/cli": "^1.2.0"
-  },
   "files": [
-    "index.js"
+    "index.js",
+    "cli.js"
   ],
   "homepage": "https://github.com/iarna/lock-verify#readme",
-  "keywords": [],
   "license": "ISC",
   "main": "index.js",
   "name": "lock-verify",
@@ -55,8 +56,5 @@
     "type": "git",
     "url": "git+https://github.com/iarna/lock-verify.git"
   },
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
-  },
-  "version": "2.1.0"
+  "version": "2.2.1"
 }