fix: lazy loading of arborist and pacote (#6225)

lib/commands/audit.js

@@ -1,4 +1,3 @@
-const Arborist = require('@npmcli/arborist')
 const auditReport = require('npm-audit-report')
 const fetch = require('npm-registry-fetch')
 const localeCompare = require('@isaacs/string-locale-compare')('en')
@@ -413,6 +412,7 @@ class Audit extends ArboristWorkspaceCmd {
 
   async auditAdvisories (args) {
     const reporter = this.npm.config.get('json') ? 'json' : 'detail'
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       audit: true,
@@ -445,6 +445,7 @@ class Audit extends ArboristWorkspaceCmd {
     }
 
     log.verbose('loading installed dependencies')
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path: this.npm.prefix,

lib/commands/cache.js

@@ -1,5 +1,4 @@
 const cacache = require('cacache')
-const Arborist = require('@npmcli/arborist')
 const pacote = require('pacote')
 const fs = require('fs/promises')
 const { join } = require('path')
@@ -162,7 +161,7 @@ class Cache extends BaseCommand {
       return pacote.tarball.stream(spec, stream => {
         stream.resume()
         return stream.promise()
-      }, { ...this.npm.flatOptions, Arborist })
+      }, { ...this.npm.flatOptions })
     }))
   }
 

lib/commands/ci.js

@@ -1,4 +1,3 @@
-const Arborist = require('@npmcli/arborist')
 const reifyFinish = require('../utils/reify-finish.js')
 const runScript = require('@npmcli/run-script')
 const fs = require('fs/promises')
@@ -36,6 +35,7 @@ class CI extends ArboristWorkspaceCmd {
     }
 
     const where = this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       packageLock: true, // npm ci should never skip lock files

lib/commands/dedupe.js

@@ -1,5 +1,4 @@
 // dedupe duplicated packages, or find them in the tree
-const Arborist = require('@npmcli/arborist')
 const reifyFinish = require('../utils/reify-finish.js')
 
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
@@ -31,6 +30,7 @@ class Dedupe extends ArboristWorkspaceCmd {
 
     const dryRun = this.npm.config.get('dry-run')
     const where = this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path: where,

lib/commands/diff.js

@@ -2,7 +2,6 @@ const { resolve } = require('path')
 const semver = require('semver')
 const libnpmdiff = require('libnpmdiff')
 const npa = require('npm-package-arg')
-const Arborist = require('@npmcli/arborist')
 const pacote = require('pacote')
 const pickManifest = require('npm-pick-manifest')
 const log = require('../utils/log-shim')
@@ -146,6 +145,7 @@ class Diff extends BaseCommand {
     if (spec.registry) {
       let actualTree
       let node
+      const Arborist = require('@npmcli/arborist')
       try {
         const opts = {
           ...this.npm.flatOptions,
@@ -257,6 +257,7 @@ class Diff extends BaseCommand {
 
   async findVersionsByPackageName (specs) {
     let actualTree
+    const Arborist = require('@npmcli/arborist')
     try {
       const opts = {
         ...this.npm.flatOptions,

lib/commands/explain.js

@@ -1,6 +1,4 @@
 const { explainNode } = require('../utils/explain-dep.js')
-const completion = require('../utils/completion/installed-deep.js')
-const Arborist = require('@npmcli/arborist')
 const npa = require('npm-package-arg')
 const semver = require('semver')
 const { relative, resolve } = require('path')
@@ -21,6 +19,7 @@ class Explain extends ArboristWorkspaceCmd {
   // TODO
   /* istanbul ignore next */
   async completion (opts) {
+    const completion = require('../utils/completion/installed-deep.js')
     return completion(this.npm, opts)
   }
 
@@ -29,6 +28,7 @@ class Explain extends ArboristWorkspaceCmd {
       throw this.usageError()
     }
 
+    const Arborist = require('@npmcli/arborist')
     const arb = new Arborist({ path: this.npm.prefix, ...this.npm.flatOptions })
     const tree = await arb.loadActual()
 

lib/commands/fund.js

@@ -1,12 +1,10 @@
 const archy = require('archy')
-const Arborist = require('@npmcli/arborist')
 const pacote = require('pacote')
 const semver = require('semver')
 const npa = require('npm-package-arg')
 const { depth } = require('treeverse')
 const { readTree: getFundingInfo, normalizeFunding, isValidFunding } = require('libnpmfund')
 
-const completion = require('../utils/completion/installed-deep.js')
 const openUrl = require('../utils/open-url.js')
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 
@@ -39,6 +37,7 @@ class Fund extends ArboristWorkspaceCmd {
   // TODO
   /* istanbul ignore next */
   async completion (opts) {
+    const completion = require('../utils/completion/installed-deep.js')
     return completion(this.npm, opts)
   }
 
@@ -64,6 +63,7 @@ class Fund extends ArboristWorkspaceCmd {
     }
 
     const where = this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
     const arb = new Arborist({ ...this.npm.flatOptions, path: where })
     const tree = await arb.loadActual()
 
@@ -80,6 +80,7 @@ class Fund extends ArboristWorkspaceCmd {
     // TODO: add !workspacesEnabled option handling to libnpmfund
     const fundingInfo = getFundingInfo(tree, {
       ...this.flatOptions,
+      Arborist,
       workspaces: this.workspaceNames,
     })
 

lib/commands/install.js

@@ -5,7 +5,6 @@ const readdir = util.promisify(fs.readdir)
 const reifyFinish = require('../utils/reify-finish.js')
 const log = require('../utils/log-shim.js')
 const { resolve, join } = require('path')
-const Arborist = require('@npmcli/arborist')
 const runScript = require('@npmcli/run-script')
 const pacote = require('pacote')
 const checks = require('npm-install-checks')
@@ -136,6 +135,7 @@ class Install extends ArboristWorkspaceCmd {
       throw this.usageError()
     }
 
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       auditLevel: null,

lib/commands/link.js

@@ -3,7 +3,6 @@ const util = require('util')
 const readdir = util.promisify(fs.readdir)
 const { resolve } = require('path')
 
-const Arborist = require('@npmcli/arborist')
 const npa = require('npm-package-arg')
 const rpj = require('read-package-json-fast')
 const semver = require('semver')
@@ -67,8 +66,10 @@ class Link extends ArboristWorkspaceCmd {
     // load current packages from the global space,
     // and then add symlinks installs locally
     const globalTop = resolve(this.npm.globalDir, '..')
+    const Arborist = require('@npmcli/arborist')
     const globalOpts = {
       ...this.npm.flatOptions,
+      Arborist,
       path: globalTop,
       global: true,
       prune: false,
@@ -138,8 +139,10 @@ class Link extends ArboristWorkspaceCmd {
     const paths = wsp && wsp.length ? wsp : [this.npm.prefix]
     const add = paths.map(path => `file:${path.replace(/#/g, '%23')}`)
     const globalTop = resolve(this.npm.globalDir, '..')
+    const Arborist = require('@npmcli/arborist')
     const arb = new Arborist({
       ...this.npm.flatOptions,
+      Arborist,
       path: globalTop,
       global: true,
     })

lib/commands/ls.js

@@ -3,12 +3,9 @@ const relativePrefix = `.${sep}`
 const { EOL } = require('os')
 
 const archy = require('archy')
-const Arborist = require('@npmcli/arborist')
 const { breadth } = require('treeverse')
 const npa = require('npm-package-arg')
 
-const completion = require('../utils/completion/installed-deep.js')
-
 const _depth = Symbol('depth')
 const _dedupe = Symbol('dedupe')
 const _filteredBy = Symbol('filteredBy')
@@ -44,6 +41,7 @@ class LS extends ArboristWorkspaceCmd {
   // TODO
   /* istanbul ignore next */
   async completion (opts) {
+    const completion = require('../utils/completion/installed-deep.js')
     return completion(this.npm, opts)
   }
 
@@ -63,6 +61,8 @@ class LS extends ArboristWorkspaceCmd {
 
     const path = global ? resolve(this.npm.globalDir, '..') : this.npm.prefix
 
+    const Arborist = require('@npmcli/arborist')
+
     const arb = new Arborist({
       global,
       ...this.npm.flatOptions,

lib/commands/outdated.js

@@ -6,8 +6,6 @@ const npa = require('npm-package-arg')
 const pickManifest = require('npm-pick-manifest')
 const localeCompare = require('@isaacs/string-locale-compare')('en')
 
-const Arborist = require('@npmcli/arborist')
-
 const ansiTrim = require('../utils/ansi-trim.js')
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 
@@ -30,6 +28,7 @@ class Outdated extends ArboristWorkspaceCmd {
       ? global
       : this.npm.prefix
 
+    const Arborist = require('@npmcli/arborist')
     const arb = new Arborist({
       ...this.npm.flatOptions,
       path: where,

lib/commands/prune.js

@@ -1,5 +1,4 @@
 // prune extraneous packages
-const Arborist = require('@npmcli/arborist')
 const reifyFinish = require('../utils/reify-finish.js')
 
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
@@ -19,6 +18,7 @@ class Prune extends ArboristWorkspaceCmd {
 
   async exec () {
     const where = this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path: where,

lib/commands/query.js

@@ -1,7 +1,6 @@
 'use strict'
 
 const { resolve } = require('path')
-const Arborist = require('@npmcli/arborist')
 const BaseCommand = require('../base-command.js')
 
 class QuerySelectorItem {
@@ -58,6 +57,7 @@ class Query extends BaseCommand {
   async exec (args) {
     // one dir up from wherever node_modules lives
     const where = resolve(this.npm.dir, '..')
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path: where,
@@ -73,6 +73,7 @@ class Query extends BaseCommand {
 
   async execWorkspaces (args) {
     await this.setWorkspaces()
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path: this.npm.prefix,

lib/commands/rebuild.js

@@ -1,8 +1,6 @@
 const { resolve } = require('path')
-const Arborist = require('@npmcli/arborist')
 const npa = require('npm-package-arg')
 const semver = require('semver')
-const completion = require('../utils/completion/installed-deep.js')
 
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 class Rebuild extends ArboristWorkspaceCmd {
@@ -21,12 +19,14 @@ class Rebuild extends ArboristWorkspaceCmd {
   // TODO
   /* istanbul ignore next */
   async completion (opts) {
+    const completion = require('../utils/completion/installed-deep.js')
     return completion(this.npm, opts)
   }
 
   async exec (args) {
     const globalTop = resolve(this.npm.globalDir, '..')
     const where = this.npm.global ? globalTop : this.npm.prefix
+    const Arborist = require('@npmcli/arborist')
     const arb = new Arborist({
       ...this.npm.flatOptions,
       path: where,

lib/commands/shrinkwrap.js

@@ -1,6 +1,5 @@
 const { resolve, basename } = require('path')
 const { unlink } = require('fs').promises
-const Arborist = require('@npmcli/arborist')
 const log = require('../utils/log-shim')
 const BaseCommand = require('../base-command.js')
 class Shrinkwrap extends BaseCommand {
@@ -21,6 +20,7 @@ class Shrinkwrap extends BaseCommand {
       throw er
     }
 
+    const Arborist = require('@npmcli/arborist')
     const path = this.npm.prefix
     const sw = resolve(path, 'npm-shrinkwrap.json')
     const arb = new Arborist({ ...this.npm.flatOptions, path })

lib/commands/uninstall.js

@@ -1,5 +1,4 @@
 const { resolve } = require('path')
-const Arborist = require('@npmcli/arborist')
 const rpj = require('read-package-json-fast')
 
 const reifyFinish = require('../utils/reify-finish.js')
@@ -42,6 +41,7 @@ class Uninstall extends ArboristWorkspaceCmd {
       ? resolve(this.npm.globalDir, '..')
       : this.npm.localPrefix
 
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path,

lib/commands/update.js

@@ -1,10 +1,8 @@
 const path = require('path')
 
-const Arborist = require('@npmcli/arborist')
 const log = require('../utils/log-shim.js')
 
 const reifyFinish = require('../utils/reify-finish.js')
-const completion = require('../utils/completion/installed-deep.js')
 
 const ArboristWorkspaceCmd = require('../arborist-cmd.js')
 class Update extends ArboristWorkspaceCmd {
@@ -34,6 +32,7 @@ class Update extends ArboristWorkspaceCmd {
   // TODO
   /* istanbul ignore next */
   async completion (opts) {
+    const completion = require('../utils/completion/installed-deep.js')
     return completion(this.npm, opts)
   }
 
@@ -53,6 +52,7 @@ class Update extends ArboristWorkspaceCmd {
         'https://github.com/npm/rfcs/blob/latest/implemented/0019-remove-update-depth-option.md')
     }
 
+    const Arborist = require('@npmcli/arborist')
     const opts = {
       ...this.npm.flatOptions,
       path: where,

lib/npm.js

@@ -1,4 +1,3 @@
-const Arborist = require('@npmcli/arborist')
 const EventEmitter = require('events')
 const { resolve, dirname, join } = require('path')
 const Config = require('@npmcli/config')
@@ -310,10 +309,6 @@ class Npm extends EventEmitter {
 
   get flatOptions () {
     const { flat } = this.config
-    // the Arborist constructor is used almost everywhere we call pacote, it's
-    // easiest to attach it to flatOptions so it goes everywhere without having
-    // to touch every call
-    flat.Arborist = Arborist
     flat.nodeVersion = process.version
     flat.npmVersion = pkg.version
     if (this.command) {

lib/package-url-cmd.js

@@ -2,7 +2,6 @@
 
 const pacote = require('pacote')
 const hostedGitInfo = require('hosted-git-info')
-const Arborist = require('@npmcli/arborist')
 
 const openUrl = require('./utils/open-url.js')
 const log = require('./utils/log-shim')
@@ -33,7 +32,6 @@ class PackageUrlCommand extends BaseCommand {
         ...this.npm.flatOptions,
         where: this.npm.localPrefix,
         fullMetadata: true,
-        Arborist,
       }
       const mani = await pacote.manifest(arg, opts)
       const url = this.getUrl(arg, mani)

lib/utils/completion/installed-deep.js

@@ -1,8 +1,8 @@
 const { resolve } = require('path')
-const Arborist = require('@npmcli/arborist')
 const localeCompare = require('@isaacs/string-locale-compare')('en')
 
 const installedDeep = async (npm) => {
+  const Arborist = require('@npmcli/arborist')
   const {
     depth,
     global,