diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/LICENSE b/node_modules/npm-package-arg/node_modules/hosted-git-info/LICENSE
new file mode 100644
index 0000000000000..45055763dc838
--- /dev/null
+++ b/node_modules/npm-package-arg/node_modules/hosted-git-info/LICENSE
@@ -0,0 +1,13 @@
+Copyright (c) 2015, Rebecca Turner
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host-info.js b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host-info.js
new file mode 100644
index 0000000000000..9a9720fa3c339
--- /dev/null
+++ b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host-info.js
@@ -0,0 +1,185 @@
+/* eslint-disable max-len */
+'use strict'
+const maybeJoin = (...args) => args.every(arg => arg) ? args.join('') : ''
+const maybeEncode = (arg) => arg ? encodeURIComponent(arg) : ''
+
+const defaults = {
+  sshtemplate: ({ domain, user, project, committish }) => `git@${domain}:${user}/${project}.git${maybeJoin('#', committish)}`,
+  sshurltemplate: ({ domain, user, project, committish }) => `git+ssh://git@${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
+  browsetemplate: ({ domain, user, project, committish, treepath }) => `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish))}`,
+  browsefiletemplate: ({ domain, user, project, committish, treepath, path, fragment, hashformat }) => `https://${domain}/${user}/${project}/${treepath}/${maybeEncode(committish || 'master')}/${path}${maybeJoin('#', hashformat(fragment || ''))}`,
+  docstemplate: ({ domain, user, project, treepath, committish }) => `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish))}#readme`,
+  httpstemplate: ({ auth, domain, user, project, committish }) => `git+https://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
+  filetemplate: ({ domain, user, project, committish, path }) => `https://${domain}/${user}/${project}/raw/${maybeEncode(committish) || 'master'}/${path}`,
+  shortcuttemplate: ({ type, user, project, committish }) => `${type}:${user}/${project}${maybeJoin('#', committish)}`,
+  pathtemplate: ({ user, project, committish }) => `${user}/${project}${maybeJoin('#', committish)}`,
+  bugstemplate: ({ domain, user, project }) => `https://${domain}/${user}/${project}/issues`,
+  hashformat: formatHashFragment,
+}
+
+const gitHosts = {}
+gitHosts.github = Object.assign({}, defaults, {
+  // First two are insecure and generally shouldn't be used any more, but
+  // they are still supported.
+  protocols: ['git:', 'http:', 'git+ssh:', 'git+https:', 'ssh:', 'https:'],
+  domain: 'github.com',
+  treepath: 'tree',
+  filetemplate: ({ auth, user, project, committish, path }) => `https://${maybeJoin(auth, '@')}raw.githubusercontent.com/${user}/${project}/${maybeEncode(committish) || 'master'}/${path}`,
+  gittemplate: ({ auth, domain, user, project, committish }) => `git://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
+  tarballtemplate: ({ domain, user, project, committish }) => `https://codeload.${domain}/${user}/${project}/tar.gz/${maybeEncode(committish) || 'master'}`,
+  extract: (url) => {
+    let [, user, project, type, committish] = url.pathname.split('/', 5)
+    if (type && type !== 'tree') {
+      return
+    }
+
+    if (!type) {
+      committish = url.hash.slice(1)
+    }
+
+    if (project && project.endsWith('.git')) {
+      project = project.slice(0, -4)
+    }
+
+    if (!user || !project) {
+      return
+    }
+
+    return { user, project, committish }
+  },
+})
+
+gitHosts.bitbucket = Object.assign({}, defaults, {
+  protocols: ['git+ssh:', 'git+https:', 'ssh:', 'https:'],
+  domain: 'bitbucket.org',
+  treepath: 'src',
+  tarballtemplate: ({ domain, user, project, committish }) => `https://${domain}/${user}/${project}/get/${maybeEncode(committish) || 'master'}.tar.gz`,
+  extract: (url) => {
+    let [, user, project, aux] = url.pathname.split('/', 4)
+    if (['get'].includes(aux)) {
+      return
+    }
+
+    if (project && project.endsWith('.git')) {
+      project = project.slice(0, -4)
+    }
+
+    if (!user || !project) {
+      return
+    }
+
+    return { user, project, committish: url.hash.slice(1) }
+  },
+})
+
+gitHosts.gitlab = Object.assign({}, defaults, {
+  protocols: ['git+ssh:', 'git+https:', 'ssh:', 'https:'],
+  domain: 'gitlab.com',
+  treepath: 'tree',
+  httpstemplate: ({ auth, domain, user, project, committish }) => `git+https://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
+  tarballtemplate: ({ domain, user, project, committish }) => `https://${domain}/${user}/${project}/repository/archive.tar.gz?ref=${maybeEncode(committish) || 'master'}`,
+  extract: (url) => {
+    const path = url.pathname.slice(1)
+    if (path.includes('/-/') || path.includes('/archive.tar.gz')) {
+      return
+    }
+
+    const segments = path.split('/')
+    let project = segments.pop()
+    if (project.endsWith('.git')) {
+      project = project.slice(0, -4)
+    }
+
+    const user = segments.join('/')
+    if (!user || !project) {
+      return
+    }
+
+    return { user, project, committish: url.hash.slice(1) }
+  },
+})
+
+gitHosts.gist = Object.assign({}, defaults, {
+  protocols: ['git:', 'git+ssh:', 'git+https:', 'ssh:', 'https:'],
+  domain: 'gist.github.com',
+  sshtemplate: ({ domain, project, committish }) => `git@${domain}:${project}.git${maybeJoin('#', committish)}`,
+  sshurltemplate: ({ domain, project, committish }) => `git+ssh://git@${domain}/${project}.git${maybeJoin('#', committish)}`,
+  browsetemplate: ({ domain, project, committish }) => `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}`,
+  browsefiletemplate: ({ domain, project, committish, path, hashformat }) => `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}${maybeJoin('#', hashformat(path))}`,
+  docstemplate: ({ domain, project, committish }) => `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}`,
+  httpstemplate: ({ domain, project, committish }) => `git+https://${domain}/${project}.git${maybeJoin('#', committish)}`,
+  filetemplate: ({ user, project, committish, path }) => `https://gist.githubusercontent.com/${user}/${project}/raw${maybeJoin('/', maybeEncode(committish))}/${path}`,
+  shortcuttemplate: ({ type, project, committish }) => `${type}:${project}${maybeJoin('#', committish)}`,
+  pathtemplate: ({ project, committish }) => `${project}${maybeJoin('#', committish)}`,
+  bugstemplate: ({ domain, project }) => `https://${domain}/${project}`,
+  gittemplate: ({ domain, project, committish }) => `git://${domain}/${project}.git${maybeJoin('#', committish)}`,
+  tarballtemplate: ({ project, committish }) => `https://codeload.github.com/gist/${project}/tar.gz/${maybeEncode(committish) || 'master'}`,
+  extract: (url) => {
+    let [, user, project, aux] = url.pathname.split('/', 4)
+    if (aux === 'raw') {
+      return
+    }
+
+    if (!project) {
+      if (!user) {
+        return
+      }
+
+      project = user
+      user = null
+    }
+
+    if (project.endsWith('.git')) {
+      project = project.slice(0, -4)
+    }
+
+    return { user, project, committish: url.hash.slice(1) }
+  },
+  hashformat: function (fragment) {
+    return fragment && 'file-' + formatHashFragment(fragment)
+  },
+})
+
+gitHosts.sourcehut = Object.assign({}, defaults, {
+  protocols: ['git+ssh:', 'https:'],
+  domain: 'git.sr.ht',
+  treepath: 'tree',
+  browsefiletemplate: ({ domain, user, project, committish, treepath, path, fragment, hashformat }) => `https://${domain}/${user}/${project}/${treepath}/${maybeEncode(committish || 'main')}/${path}${maybeJoin('#', hashformat(fragment || ''))}`,
+  filetemplate: ({ domain, user, project, committish, path }) => `https://${domain}/${user}/${project}/blob/${maybeEncode(committish) || 'main'}/${path}`,
+  httpstemplate: ({ domain, user, project, committish }) => `https://${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
+  tarballtemplate: ({ domain, user, project, committish }) => `https://${domain}/${user}/${project}/archive/${maybeEncode(committish) || 'main'}.tar.gz`,
+  bugstemplate: ({ domain, user, project }) => `https://todo.sr.ht/${user}/${project}`,
+  docstemplate: ({ domain, user, project, treepath, committish }) => `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish))}#readme`,
+  extract: (url) => {
+    let [, user, project, aux] = url.pathname.split('/', 4)
+
+    // tarball url
+    if (['archive'].includes(aux)) {
+      return
+    }
+
+    if (project && project.endsWith('.git')) {
+      project = project.slice(0, -4)
+    }
+
+    if (!user || !project) {
+      return
+    }
+
+    return { user, project, committish: url.hash.slice(1) }
+  },
+})
+
+const names = Object.keys(gitHosts)
+gitHosts.byShortcut = {}
+gitHosts.byDomain = {}
+for (const name of names) {
+  gitHosts.byShortcut[`${name}:`] = name
+  gitHosts.byDomain[gitHosts[name].domain] = name
+}
+
+function formatHashFragment (fragment) {
+  return fragment.toLowerCase().replace(/^\W+|\/|\W+$/g, '').replace(/\W+/g, '-')
+}
+
+module.exports = gitHosts
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host.js b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host.js
new file mode 100644
index 0000000000000..8a975e92e58bb
--- /dev/null
+++ b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/git-host.js
@@ -0,0 +1,110 @@
+'use strict'
+const gitHosts = require('./git-host-info.js')
+
+class GitHost {
+  constructor (type, user, auth, project, committish, defaultRepresentation, opts = {}) {
+    Object.assign(this, gitHosts[type])
+    this.type = type
+    this.user = user
+    this.auth = auth
+    this.project = project
+    this.committish = committish
+    this.default = defaultRepresentation
+    this.opts = opts
+  }
+
+  hash () {
+    return this.committish ? `#${this.committish}` : ''
+  }
+
+  ssh (opts) {
+    return this._fill(this.sshtemplate, opts)
+  }
+
+  _fill (template, opts) {
+    if (typeof template === 'function') {
+      const options = { ...this, ...this.opts, ...opts }
+
+      // the path should always be set so we don't end up with 'undefined' in urls
+      if (!options.path) {
+        options.path = ''
+      }
+
+      // template functions will insert the leading slash themselves
+      if (options.path.startsWith('/')) {
+        options.path = options.path.slice(1)
+      }
+
+      if (options.noCommittish) {
+        options.committish = null
+      }
+
+      const result = template(options)
+      return options.noGitPlus && result.startsWith('git+') ? result.slice(4) : result
+    }
+
+    return null
+  }
+
+  sshurl (opts) {
+    return this._fill(this.sshurltemplate, opts)
+  }
+
+  browse (path, fragment, opts) {
+    // not a string, treat path as opts
+    if (typeof path !== 'string') {
+      return this._fill(this.browsetemplate, path)
+    }
+
+    if (typeof fragment !== 'string') {
+      opts = fragment
+      fragment = null
+    }
+    return this._fill(this.browsefiletemplate, { ...opts, fragment, path })
+  }
+
+  docs (opts) {
+    return this._fill(this.docstemplate, opts)
+  }
+
+  bugs (opts) {
+    return this._fill(this.bugstemplate, opts)
+  }
+
+  https (opts) {
+    return this._fill(this.httpstemplate, opts)
+  }
+
+  git (opts) {
+    return this._fill(this.gittemplate, opts)
+  }
+
+  shortcut (opts) {
+    return this._fill(this.shortcuttemplate, opts)
+  }
+
+  path (opts) {
+    return this._fill(this.pathtemplate, opts)
+  }
+
+  tarball (opts) {
+    return this._fill(this.tarballtemplate, { ...opts, noCommittish: false })
+  }
+
+  file (path, opts) {
+    return this._fill(this.filetemplate, { ...opts, path })
+  }
+
+  getDefaultRepresentation () {
+    return this.default
+  }
+
+  toString (opts) {
+    if (this.default && typeof this[this.default] === 'function') {
+      return this[this.default](opts)
+    }
+
+    return this.sshurl(opts)
+  }
+}
+module.exports = GitHost
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/index.js b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/index.js
new file mode 100644
index 0000000000000..8bce6b3c28d51
--- /dev/null
+++ b/node_modules/npm-package-arg/node_modules/hosted-git-info/lib/index.js
@@ -0,0 +1,244 @@
+'use strict'
+const url = require('url')
+const gitHosts = require('./git-host-info.js')
+const GitHost = module.exports = require('./git-host.js')
+const LRU = require('lru-cache')
+const cache = new LRU({ max: 1000 })
+
+const protocolToRepresentationMap = {
+  'git+ssh:': 'sshurl',
+  'git+https:': 'https',
+  'ssh:': 'sshurl',
+  'git:': 'git',
+}
+
+function protocolToRepresentation (protocol) {
+  return protocolToRepresentationMap[protocol] || protocol.slice(0, -1)
+}
+
+const authProtocols = {
+  'git:': true,
+  'https:': true,
+  'git+https:': true,
+  'http:': true,
+  'git+http:': true,
+}
+
+const knownProtocols = Object.keys(gitHosts.byShortcut)
+  .concat(['http:', 'https:', 'git:', 'git+ssh:', 'git+https:', 'ssh:'])
+
+module.exports.fromUrl = function (giturl, opts) {
+  if (typeof giturl !== 'string') {
+    return
+  }
+
+  const key = giturl + JSON.stringify(opts || {})
+
+  if (!cache.has(key)) {
+    cache.set(key, fromUrl(giturl, opts))
+  }
+
+  return cache.get(key)
+}
+
+function fromUrl (giturl, opts) {
+  if (!giturl) {
+    return
+  }
+
+  const url = isGitHubShorthand(giturl) ? 'github:' + giturl : correctProtocol(giturl)
+  const parsed = parseGitUrl(url)
+  if (!parsed) {
+    return parsed
+  }
+
+  const gitHostShortcut = gitHosts.byShortcut[parsed.protocol]
+  const gitHostDomain =
+    gitHosts.byDomain[parsed.hostname.startsWith('www.') ?
+      parsed.hostname.slice(4) :
+      parsed.hostname]
+  const gitHostName = gitHostShortcut || gitHostDomain
+  if (!gitHostName) {
+    return
+  }
+
+  const gitHostInfo = gitHosts[gitHostShortcut || gitHostDomain]
+  let auth = null
+  if (authProtocols[parsed.protocol] && (parsed.username || parsed.password)) {
+    auth = `${parsed.username}${parsed.password ? ':' + parsed.password : ''}`
+  }
+
+  let committish = null
+  let user = null
+  let project = null
+  let defaultRepresentation = null
+
+  try {
+    if (gitHostShortcut) {
+      let pathname = parsed.pathname.startsWith('/') ? parsed.pathname.slice(1) : parsed.pathname
+      const firstAt = pathname.indexOf('@')
+      // we ignore auth for shortcuts, so just trim it out
+      if (firstAt > -1) {
+        pathname = pathname.slice(firstAt + 1)
+      }
+
+      const lastSlash = pathname.lastIndexOf('/')
+      if (lastSlash > -1) {
+        user = decodeURIComponent(pathname.slice(0, lastSlash))
+        // we want nulls only, never empty strings
+        if (!user) {
+          user = null
+        }
+        project = decodeURIComponent(pathname.slice(lastSlash + 1))
+      } else {
+        project = decodeURIComponent(pathname)
+      }
+
+      if (project.endsWith('.git')) {
+        project = project.slice(0, -4)
+      }
+
+      if (parsed.hash) {
+        committish = decodeURIComponent(parsed.hash.slice(1))
+      }
+
+      defaultRepresentation = 'shortcut'
+    } else {
+      if (!gitHostInfo.protocols.includes(parsed.protocol)) {
+        return
+      }
+
+      const segments = gitHostInfo.extract(parsed)
+      if (!segments) {
+        return
+      }
+
+      user = segments.user && decodeURIComponent(segments.user)
+      project = decodeURIComponent(segments.project)
+      committish = decodeURIComponent(segments.committish)
+      defaultRepresentation = protocolToRepresentation(parsed.protocol)
+    }
+  } catch (err) {
+    /* istanbul ignore else */
+    if (err instanceof URIError) {
+      return
+    } else {
+      throw err
+    }
+  }
+
+  return new GitHost(gitHostName, user, auth, project, committish, defaultRepresentation, opts)
+}
+
+// accepts input like git:github.com:user/repo and inserts the // after the first :
+const correctProtocol = (arg) => {
+  const firstColon = arg.indexOf(':')
+  const proto = arg.slice(0, firstColon + 1)
+  if (knownProtocols.includes(proto)) {
+    return arg
+  }
+
+  const firstAt = arg.indexOf('@')
+  if (firstAt > -1) {
+    if (firstAt > firstColon) {
+      return `git+ssh://${arg}`
+    } else {
+      return arg
+    }
+  }
+
+  const doubleSlash = arg.indexOf('//')
+  if (doubleSlash === firstColon + 1) {
+    return arg
+  }
+
+  return arg.slice(0, firstColon + 1) + '//' + arg.slice(firstColon + 1)
+}
+
+// look for github shorthand inputs, such as npm/cli
+const isGitHubShorthand = (arg) => {
+  // it cannot contain whitespace before the first #
+  // it cannot start with a / because that's probably an absolute file path
+  // but it must include a slash since repos are username/repository
+  // it cannot start with a . because that's probably a relative file path
+  // it cannot start with an @ because that's a scoped package if it passes the other tests
+  // it cannot contain a : before a # because that tells us that there's a protocol
+  // a second / may not exist before a #
+  const firstHash = arg.indexOf('#')
+  const firstSlash = arg.indexOf('/')
+  const secondSlash = arg.indexOf('/', firstSlash + 1)
+  const firstColon = arg.indexOf(':')
+  const firstSpace = /\s/.exec(arg)
+  const firstAt = arg.indexOf('@')
+
+  const spaceOnlyAfterHash = !firstSpace || (firstHash > -1 && firstSpace.index > firstHash)
+  const atOnlyAfterHash = firstAt === -1 || (firstHash > -1 && firstAt > firstHash)
+  const colonOnlyAfterHash = firstColon === -1 || (firstHash > -1 && firstColon > firstHash)
+  const secondSlashOnlyAfterHash = secondSlash === -1 || (firstHash > -1 && secondSlash > firstHash)
+  const hasSlash = firstSlash > 0
+  // if a # is found, what we really want to know is that the character
+  // immediately before # is not a /
+  const doesNotEndWithSlash = firstHash > -1 ? arg[firstHash - 1] !== '/' : !arg.endsWith('/')
+  const doesNotStartWithDot = !arg.startsWith('.')
+
+  return spaceOnlyAfterHash && hasSlash && doesNotEndWithSlash &&
+    doesNotStartWithDot && atOnlyAfterHash && colonOnlyAfterHash &&
+    secondSlashOnlyAfterHash
+}
+
+// attempt to correct an scp style url so that it will parse with `new URL()`
+const correctUrl = (giturl) => {
+  const firstAt = giturl.indexOf('@')
+  const lastHash = giturl.lastIndexOf('#')
+  let firstColon = giturl.indexOf(':')
+  let lastColon = giturl.lastIndexOf(':', lastHash > -1 ? lastHash : Infinity)
+
+  let corrected
+  if (lastColon > firstAt) {
+    // the last : comes after the first @ (or there is no @)
+    // like it would in:
+    // proto://hostname.com:user/repo
+    // username@hostname.com:user/repo
+    // :password@hostname.com:user/repo
+    // username:password@hostname.com:user/repo
+    // proto://username@hostname.com:user/repo
+    // proto://:password@hostname.com:user/repo
+    // proto://username:password@hostname.com:user/repo
+    // then we replace the last : with a / to create a valid path
+    corrected = giturl.slice(0, lastColon) + '/' + giturl.slice(lastColon + 1)
+    // // and we find our new : positions
+    firstColon = corrected.indexOf(':')
+    lastColon = corrected.lastIndexOf(':')
+  }
+
+  if (firstColon === -1 && giturl.indexOf('//') === -1) {
+    // we have no : at all
+    // as it would be in:
+    // username@hostname.com/user/repo
+    // then we prepend a protocol
+    corrected = `git+ssh://${corrected}`
+  }
+
+  return corrected
+}
+
+// try to parse the url as its given to us, if that throws
+// then we try to clean the url and parse that result instead
+// THIS FUNCTION SHOULD NEVER THROW
+const parseGitUrl = (giturl) => {
+  let result
+  try {
+    result = new url.URL(giturl)
+  } catch (err) {}
+
+  if (result) {
+    return result
+  }
+
+  const correctedUrl = correctUrl(giturl)
+  try {
+    result = new url.URL(correctedUrl)
+  } catch (err) {}
+
+  return result
+}
diff --git a/node_modules/npm-package-arg/node_modules/hosted-git-info/package.json b/node_modules/npm-package-arg/node_modules/hosted-git-info/package.json
new file mode 100644
index 0000000000000..0153b0852cbf4
--- /dev/null
+++ b/node_modules/npm-package-arg/node_modules/hosted-git-info/package.json
@@ -0,0 +1,56 @@
+{
+  "name": "hosted-git-info",
+  "version": "5.0.0",
+  "description": "Provides metadata and conversions from repository urls for GitHub, Bitbucket and GitLab",
+  "main": "./lib/index.js",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/npm/hosted-git-info.git"
+  },
+  "keywords": [
+    "git",
+    "github",
+    "bitbucket",
+    "gitlab"
+  ],
+  "author": "GitHub Inc.",
+  "license": "ISC",
+  "bugs": {
+    "url": "https://github.com/npm/hosted-git-info/issues"
+  },
+  "homepage": "https://github.com/npm/hosted-git-info",
+  "scripts": {
+    "posttest": "npm run lint",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags",
+    "preversion": "npm test",
+    "snap": "tap",
+    "test": "tap",
+    "test:coverage": "tap --coverage-report=html",
+    "lint": "eslint '**/*.js'",
+    "postlint": "npm-template-check",
+    "template-copy": "npm-template-copy --force",
+    "lintfix": "npm run lint -- --fix"
+  },
+  "dependencies": {
+    "lru-cache": "^7.5.1"
+  },
+  "devDependencies": {
+    "@npmcli/template-oss": "^2.9.2",
+    "tap": "^15.1.6"
+  },
+  "files": [
+    "bin",
+    "lib"
+  ],
+  "engines": {
+    "node": "^12.13.0 || ^14.15.0 || >=16"
+  },
+  "tap": {
+    "color": 1,
+    "coverage": true
+  },
+  "templateOSS": {
+    "version": "2.9.2"
+  }
+}
diff --git a/node_modules/npm-package-arg/node_modules/lru-cache/LICENSE b/node_modules/npm-package-arg/node_modules/lru-cache/LICENSE
new file mode 100644
index 0000000000000..9b58a3e03d1df
--- /dev/null
+++ b/node_modules/npm-package-arg/node_modules/lru-cache/LICENSE
@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) 2010-2022 Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/npm-package-arg/node_modules/lru-cache/index.js b/node_modules/npm-package-arg/node_modules/lru-cache/index.js
new file mode 100644
index 0000000000000..e37f51616452e
--- /dev/null
+++ b/node_modules/npm-package-arg/node_modules/lru-cache/index.js
@@ -0,0 +1,615 @@
+const perf = typeof performance === 'object' && performance &&
+  typeof performance.now === 'function' ? performance : Date
+
+const warned = new Set()
+const deprecatedOption = (opt, instead) => {
+  const code = `LRU_CACHE_OPTION_${opt}`
+  if (shouldWarn(code)) {
+    warn(code, `${opt} option`, `options.${instead}`, LRUCache)
+  }
+}
+const deprecatedMethod = (method, instead) => {
+  const code = `LRU_CACHE_METHOD_${method}`
+  if (shouldWarn(code)) {
+    const { prototype } = LRUCache
+    const { get } = Object.getOwnPropertyDescriptor(prototype, method)
+    warn(code, `${method} method`, `cache.${instead}()`, get)
+  }
+}
+const deprecatedProperty = (field, instead) => {
+  const code = `LRU_CACHE_PROPERTY_${field}`
+  if (shouldWarn(code)) {
+    const { prototype } = LRUCache
+    const { get } = Object.getOwnPropertyDescriptor(prototype, field)
+    warn(code, `${field} property`, `cache.${instead}`, get)
+  }
+}
+const shouldWarn = (code) => typeof process === 'object' &&
+  process &&
+  !(process.noDeprecation || warned.has(code))
+const warn = (code, what, instead, fn) => {
+  warned.add(code)
+  process.emitWarning(`The ${what} is deprecated. Please use ${instead} instead.`, 'DeprecationWarning', code, fn)
+}
+
+const isPosInt = n => n && n === Math.floor(n) && n > 0 && isFinite(n)
+
+/* istanbul ignore next - This is a little bit ridiculous, tbh.
+ * The maximum array length is 2^32-1 or thereabouts on most JS impls.
+ * And well before that point, you're caching the entire world, I mean,
+ * that's ~32GB of just integers for the next/prev links, plus whatever
+ * else to hold that many keys and values.  Just filling the memory with
+ * zeroes at init time is brutal when you get that big.
+ * But why not be complete?
+ * Maybe in the future, these limits will have expanded. */
+const getUintArray = max => !isPosInt(max) ? null
+: max <= Math.pow(2, 8) ? Uint8Array
+: max <= Math.pow(2, 16) ? Uint16Array
+: max <= Math.pow(2, 32) ? Uint32Array
+: max <= Number.MAX_SAFE_INTEGER ? ZeroArray
+: null
+
+class ZeroArray extends Array {
+  constructor (size) {
+    super(size)
+    this.fill(0)
+  }
+}
+
+class Stack {
+  constructor (max) {
+    const UintArray = getUintArray(max)
+    this.heap = new UintArray(max)
+    this.length = 0
+  }
+  push (n) {
+    this.heap[this.length++] = n
+  }
+  pop () {
+    return this.heap[--this.length]
+  }
+}
+
+class LRUCache {
+  constructor (options = {}) {
+    const {
+      max,
+      ttl,
+      ttlResolution = 1,
+      ttlAutopurge,
+      updateAgeOnGet,
+      allowStale,
+      dispose,
+      disposeAfter,
+      noDisposeOnSet,
+      noUpdateTTL,
+      maxSize,
+      sizeCalculation,
+    } = options
+
+    // deprecated options, don't trigger a warning for getting them if
+    // the thing being passed in is another LRUCache we're copying.
+    const {
+      length,
+      maxAge,
+      stale,
+    } = options instanceof LRUCache ? {} : options
+
+    if (!isPosInt(max)) {
+      throw new TypeError('max option must be an integer')
+    }
+
+    const UintArray = getUintArray(max)
+    if (!UintArray) {
+      throw new Error('invalid max value: ' + max)
+    }
+
+    this.max = max
+    this.maxSize = maxSize || 0
+    this.sizeCalculation = sizeCalculation || length
+    if (this.sizeCalculation) {
+      if (!this.maxSize) {
+        throw new TypeError('cannot set sizeCalculation without setting maxSize')
+      }
+      if (typeof this.sizeCalculation !== 'function') {
+        throw new TypeError('sizeCalculating set to non-function')
+      }
+    }
+    this.keyMap = new Map()
+    this.keyList = new Array(max).fill(null)
+    this.valList = new Array(max).fill(null)
+    this.next = new UintArray(max)
+    this.prev = new UintArray(max)
+    this.head = 0
+    this.tail = 0
+    this.free = new Stack(max)
+    this.initialFill = 1
+    this.size = 0
+
+    if (typeof dispose === 'function') {
+      this.dispose = dispose
+    }
+    if (typeof disposeAfter === 'function') {
+      this.disposeAfter = disposeAfter
+      this.disposed = []
+    } else {
+      this.disposeAfter = null
+      this.disposed = null
+    }
+    this.noDisposeOnSet = !!noDisposeOnSet
+    this.noUpdateTTL = !!noUpdateTTL
+
+    if (this.maxSize) {
+      if (!isPosInt(this.maxSize)) {
+        throw new TypeError('maxSize must be a positive integer if specified')
+      }
+      this.initializeSizeTracking()
+    }
+
+    this.allowStale = !!allowStale || !!stale
+    this.updateAgeOnGet = !!updateAgeOnGet
+    this.ttlResolution = isPosInt(ttlResolution) || ttlResolution === 0
+      ? ttlResolution : 1
+    this.ttlAutopurge = !!ttlAutopurge
+    this.ttl = ttl || maxAge || 0
+    if (this.ttl) {
+      if (!isPosInt(this.ttl)) {
+        throw new TypeError('ttl must be a positive integer if specified')
+      }
+      this.initializeTTLTracking()
+    }
+
+    if (stale) {
+      deprecatedOption('stale', 'allowStale')
+    }
+    if (maxAge) {
+      deprecatedOption('maxAge', 'ttl')
+    }
+    if (length) {
+      deprecatedOption('length', 'sizeCalculation')
+    }
+  }
+
+  initializeTTLTracking () {
+    this.ttls = new ZeroArray(this.max)
+    this.starts = new ZeroArray(this.max)
+    this.setItemTTL = (index, ttl) => {
+      this.starts[index] = ttl !== 0 ? perf.now() : 0
+      this.ttls[index] = ttl
+      if (ttl !== 0 && this.ttlAutopurge) {
+        const t = setTimeout(() => {
+          if (this.isStale(index)) {
+            this.delete(this.keyList[index])
+          }
+        }, ttl + 1)
+        /* istanbul ignore else - unref() not supported on all platforms */
+        if (t.unref) {
+          t.unref()
+        }
+      }
+    }
+    this.updateItemAge = (index) => {
+      this.starts[index] = this.ttls[index] !== 0 ? perf.now() : 0
+    }
+    // debounce calls to perf.now() to 1s so we're not hitting
+    // that costly call repeatedly.
+    let cachedNow = 0
+    const getNow = () => {
+      const n = perf.now()
+      if (this.ttlResolution > 0) {
+        cachedNow = n
+        const t = setTimeout(() => cachedNow = 0, this.ttlResolution)
+        /* istanbul ignore else - not available on all platforms */
+        if (t.unref) {
+          t.unref()
+        }
+      }
+      return n
+    }
+    this.isStale = (index) => {
+      return this.ttls[index] !== 0 && this.starts[index] !== 0 &&
+        ((cachedNow || getNow()) - this.starts[index] > this.ttls[index])
+    }
+  }
+  updateItemAge (index) {}
+  setItemTTL (index, ttl) {}
+  isStale (index) { return false }
+
+  initializeSizeTracking () {
+    this.calculatedSize = 0
+    this.sizes = new ZeroArray(this.max)
+    this.removeItemSize = index => this.calculatedSize -= this.sizes[index]
+    this.addItemSize = (index, v, k, size, sizeCalculation) => {
+      const s = size || (sizeCalculation ? sizeCalculation(v, k) : 0)
+      this.sizes[index] = isPosInt(s) ? s : 0
+      const maxSize = this.maxSize - this.sizes[index]
+      while (this.calculatedSize > maxSize) {
+        this.evict()
+      }
+      this.calculatedSize += this.sizes[index]
+    }
+    this.delete = k => {
+      if (this.size !== 0) {
+        const index = this.keyMap.get(k)
+        if (index !== undefined) {
+          this.calculatedSize -= this.sizes[index]
+        }
+      }
+      return LRUCache.prototype.delete.call(this, k)
+    }
+  }
+  removeItemSize (index) {}
+  addItemSize (index, v, k, size, sizeCalculation) {}
+
+  *indexes ({ allowStale = this.allowStale } = {}) {
+    if (this.size) {
+      for (let i = this.tail, j; true; ) {
+        if (!this.isValidIndex(i)) {
+          break
+        }
+        j = i === this.head
+        if (allowStale || !this.isStale(i)) {
+          yield i
+        }
+        if (i === this.head) {
+          break
+        } else {
+          i = this.prev[i]
+        }
+      }
+    }
+  }
+
+  *rindexes ({ allowStale = this.allowStale } = {}) {
+    if (this.size) {
+      for (let i = this.head, j; true; ) {
+        if (!this.isValidIndex(i)) {
+          break
+        }
+        if (allowStale || !this.isStale(i)) {
+          yield i
+        }
+        // either the tail now, or WAS the tail, and deleted
+        if (i === this.tail) {
+          break
+        } else {
+          i = this.next[i]
+        }
+      }
+    }
+  }
+
+  isValidIndex (index) {
+    return this.keyMap.get(this.keyList[index]) === index
+  }
+
+  *entries () {
+    for (const i of this.indexes()) {
+      yield [this.keyList[i], this.valList[i]]
+    }
+  }
+  *rentries () {
+    for (const i of this.rindexes()) {
+      yield [this.keyList[i], this.valList[i]]
+    }
+  }
+
+  *keys () {
+    for (const i of this.indexes()) {
+      yield this.keyList[i]
+    }
+  }
+  *rkeys () {
+    for (const i of this.rindexes()) {
+      yield this.keyList[i]
+    }
+  }
+
+  *values () {
+    for (const i of this.indexes()) {
+      yield this.valList[i]
+    }
+  }
+  *rvalues () {
+    for (const i of this.rindexes()) {
+      yield this.valList[i]
+    }
+  }
+
+  [Symbol.iterator] () {
+    return this.entries()
+  }
+
+  find (fn, getOptions = {}) {
+    for (const i of this.indexes()) {
+      if (fn(this.valList[i], this.keyList[i], this)) {
+        return this.get(this.keyList[i], getOptions)
+      }
+    }
+  }
+
+  forEach (fn, thisp = this) {
+    for (const i of this.indexes()) {
+      fn.call(thisp, this.valList[i], this.keyList[i], this)
+    }
+  }
+
+  rforEach (fn, thisp = this) {
+    for (const i of this.rindexes()) {
+      fn.call(thisp, this.valList[i], this.keyList[i], this)
+    }
+  }
+
+  get prune () {
+    deprecatedMethod('prune', 'purgeStale')
+    return this.purgeStale
+  }
+
+  purgeStale () {
+    let deleted = false
+    for (const i of this.rindexes({ allowStale: true })) {
+      if (this.isStale(i)) {
+        this.delete(this.keyList[i])
+        deleted = true
+      }
+    }
+    return deleted
+  }
+
+  dump () {
+    const arr = []
+    for (const i of this.indexes()) {
+      const key = this.keyList[i]
+      const value = this.valList[i]
+      const entry = { value }
+      if (this.ttls) {
+        entry.ttl = this.ttls[i]
+      }
+      if (this.sizes) {
+        entry.size = this.sizes[i]
+      }
+      arr.unshift([key, entry])
+    }
+    return arr
+  }
+
+  load (arr) {
+    this.clear()
+    for (const [key, entry] of arr) {
+      this.set(key, entry.value, entry)
+    }
+  }
+
+  dispose (v, k, reason) {}
+
+  set (k, v, {
+    ttl = this.ttl,
+    noDisposeOnSet = this.noDisposeOnSet,
+    size = 0,
+    sizeCalculation = this.sizeCalculation,
+    noUpdateTTL = this.noUpdateTTL,
+  } = {}) {
+    let index = this.size === 0 ? undefined : this.keyMap.get(k)
+    if (index === undefined) {
+      // addition
+      index = this.newIndex()
+      this.keyList[index] = k
+      this.valList[index] = v
+      this.keyMap.set(k, index)
+      this.next[this.tail] = index
+      this.prev[index] = this.tail
+      this.tail = index
+      this.size ++
+      this.addItemSize(index, v, k, size, sizeCalculation)
+      noUpdateTTL = false
+    } else {
+      // update
+      const oldVal = this.valList[index]
+      if (v !== oldVal) {
+        if (!noDisposeOnSet) {
+          this.dispose(oldVal, k, 'set')
+          if (this.disposeAfter) {
+            this.disposed.push([oldVal, k, 'set'])
+          }
+        }
+        this.removeItemSize(index)
+        this.valList[index] = v
+        this.addItemSize(index, v, k, size, sizeCalculation)
+      }
+      this.moveToTail(index)
+    }
+    if (ttl !== 0 && this.ttl === 0 && !this.ttls) {
+      this.initializeTTLTracking()
+    }
+    if (!noUpdateTTL) {
+      this.setItemTTL(index, ttl)
+    }
+    if (this.disposeAfter) {
+      while (this.disposed.length) {
+        this.disposeAfter(...this.disposed.shift())
+      }
+    }
+    return this
+  }
+
+  newIndex () {
+    if (this.size === 0) {
+      return this.tail
+    }
+    if (this.size === this.max) {
+      return this.evict()
+    }
+    if (this.free.length !== 0) {
+      return this.free.pop()
+    }
+    // initial fill, just keep writing down the list
+    return this.initialFill++
+  }
+
+  pop () {
+    if (this.size) {
+      const val = this.valList[this.head]
+      this.evict()
+      return val
+    }
+  }
+
+  evict () {
+    const head = this.head
+    const k = this.keyList[head]
+    const v = this.valList[head]
+    this.dispose(v, k, 'evict')
+    if (this.disposeAfter) {
+      this.disposed.push([v, k, 'evict'])
+    }
+    this.removeItemSize(head)
+    this.head = this.next[head]
+    this.keyMap.delete(k)
+    this.size --
+    return head
+  }
+
+  has (k) {
+    return this.keyMap.has(k) && !this.isStale(this.keyMap.get(k))
+  }
+
+  // like get(), but without any LRU updating or TTL expiration
+  peek (k, { allowStale = this.allowStale } = {}) {
+    const index = this.keyMap.get(k)
+    if (index !== undefined && (allowStale || !this.isStale(index))) {
+      return this.valList[index]
+    }
+  }
+
+  get (k, {
+    allowStale = this.allowStale,
+    updateAgeOnGet = this.updateAgeOnGet,
+  } = {}) {
+    const index = this.keyMap.get(k)
+    if (index !== undefined) {
+      if (this.isStale(index)) {
+        const value = allowStale ? this.valList[index] : undefined
+        this.delete(k)
+        return value
+      } else {
+        this.moveToTail(index)
+        if (updateAgeOnGet) {
+          this.updateItemAge(index)
+        }
+        return this.valList[index]
+      }
+    }
+  }
+
+  connect (p, n) {
+    this.prev[n] = p
+    this.next[p] = n
+  }
+
+  moveToTail (index) {
+    // if tail already, nothing to do
+    // if head, move head to next[index]
+    // else
+    //   move next[prev[index]] to next[index] (head has no prev)
+    //   move prev[next[index]] to prev[index]
+    // prev[index] = tail
+    // next[tail] = index
+    // tail = index
+    if (index !== this.tail) {
+      if (index === this.head) {
+        this.head = this.next[index]
+      } else {
+        this.connect(this.prev[index], this.next[index])
+      }
+      this.connect(this.tail, index)
+      this.tail = index
+    }
+  }
+
+  get del () {
+    deprecatedMethod('del', 'delete')
+    return this.delete
+  }
+  delete (k) {
+    let deleted = false
+    if (this.size !== 0) {
+      const index = this.keyMap.get(k)
+      if (index !== undefined) {
+        deleted = true
+        if (this.size === 1) {
+          this.clear()
+        } else {
+          this.removeItemSize(index)
+          this.dispose(this.valList[index], k, 'delete')
+          if (this.disposeAfter) {
+            this.disposed.push([this.valList[index], k, 'delete'])
+          }
+          this.keyMap.delete(k)
+          this.keyList[index] = null
+          this.valList[index] = null
+          if (index === this.tail) {
+            this.tail = this.prev[index]
+          } else if (index === this.head) {
+            this.head = this.next[index]
+          } else {
+            this.next[this.prev[index]] = this.next[index]
+            this.prev[this.next[index]] = this.prev[index]
+          }
+          this.size --
+          this.free.push(index)
+        }
+      }
+    }
+    if (this.disposed) {
+      while (this.disposed.length) {
+        this.disposeAfter(...this.disposed.shift())
+      }
+    }
+    return deleted
+  }
+
+  clear () {
+    if (this.dispose !== LRUCache.prototype.dispose) {
+      for (const index of this.rindexes({ allowStale: true })) {
+        this.dispose(this.valList[index], this.keyList[index], 'delete')
+      }
+    }
+    if (this.disposeAfter) {
+      for (const index of this.rindexes({ allowStale: true })) {
+        this.disposed.push([this.valList[index], this.keyList[index], 'delete'])
+      }
+    }
+    this.keyMap.clear()
+    this.valList.fill(null)
+    this.keyList.fill(null)
+    if (this.ttls) {
+      this.ttls.fill(0)
+      this.starts.fill(0)
+    }
+    if (this.sizes) {
+      this.sizes.fill(0)
+    }
+    this.head = 0
+    this.tail = 0
+    this.initialFill = 1
+    this.free.length = 0
+    this.calculatedSize = 0
+    this.size = 0
+    if (this.disposed) {
+      while (this.disposed.length) {
+        this.disposeAfter(...this.disposed.shift())
+      }
+    }
+  }
+  get reset () {
+    deprecatedMethod('reset', 'clear')
+    return this.clear
+  }
+
+  get length () {
+    deprecatedProperty('length', 'size')
+    return this.size
+  }
+}
+
+module.exports = LRUCache
diff --git a/node_modules/npm-package-arg/node_modules/lru-cache/package.json b/node_modules/npm-package-arg/node_modules/lru-cache/package.json
new file mode 100644
index 0000000000000..a62f74c2b648a
--- /dev/null
+++ b/node_modules/npm-package-arg/node_modules/lru-cache/package.json
@@ -0,0 +1,43 @@
+{
+  "name": "lru-cache",
+  "description": "A cache object that deletes the least-recently-used items.",
+  "version": "7.5.1",
+  "author": "Isaac Z. Schlueter <i@izs.me>",
+  "keywords": [
+    "mru",
+    "lru",
+    "cache"
+  ],
+  "scripts": {
+    "build": "",
+    "test": "tap",
+    "snap": "tap",
+    "size": "size-limit",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublishOnly": "git push origin --follow-tags"
+  },
+  "main": "index.js",
+  "repository": "git://github.com/isaacs/node-lru-cache.git",
+  "devDependencies": {
+    "@size-limit/preset-small-lib": "^7.0.8",
+    "benchmark": "^2.1.4",
+    "size-limit": "^7.0.8",
+    "tap": "^15.1.6"
+  },
+  "license": "ISC",
+  "files": [
+    "index.js"
+  ],
+  "engines": {
+    "node": ">=12"
+  },
+  "tap": {
+    "coverage-map": "map.js"
+  },
+  "size-limit": [
+    {
+      "path": "./index.js"
+    }
+  ]
+}
diff --git a/node_modules/npm-package-arg/package.json b/node_modules/npm-package-arg/package.json
index b0821312a7f0d..25356af373982 100644
--- a/node_modules/npm-package-arg/package.json
+++ b/node_modules/npm-package-arg/package.json
@@ -1,6 +1,6 @@
 {
   "name": "npm-package-arg",
-  "version": "9.0.0",
+  "version": "9.0.1",
   "description": "Parse the things that can be arguments to `npm install`",
   "main": "./lib/npa.js",
   "directories": {
@@ -11,12 +11,12 @@
     "lib"
   ],
   "dependencies": {
-    "hosted-git-info": "^4.1.0",
+    "hosted-git-info": "^5.0.0",
     "semver": "^7.3.5",
     "validate-npm-package-name": "^3.0.0"
   },
   "devDependencies": {
-    "@npmcli/template-oss": "^2.7.1",
+    "@npmcli/template-oss": "^2.9.2",
     "tap": "^15.1.6"
   },
   "scripts": {
@@ -50,6 +50,6 @@
     "branches": 97
   },
   "templateOSS": {
-    "version": "2.7.1"
+    "version": "2.9.2"
   }
 }
diff --git a/package-lock.json b/package-lock.json
index af7cc17a28bba..6d400e5f4dd30 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -132,7 +132,7 @@
         "nopt": "^5.0.0",
         "npm-audit-report": "^2.1.5",
         "npm-install-checks": "^4.0.0",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "npm-pick-manifest": "^7.0.0",
         "npm-profile": "^6.0.2",
         "npm-registry-fetch": "^13.0.1",
@@ -5401,12 +5401,12 @@
       "inBundle": true
     },
     "node_modules/npm-package-arg": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-9.0.0.tgz",
-      "integrity": "sha512-yhzXxeor+Zfhe5MGwPdDumz6HtNlj2pMekWB95IX3CC6uDNgde0oPKHDCLDPoJqQfd0HqAWt+y4Hs5m7CK1+9Q==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-9.0.1.tgz",
+      "integrity": "sha512-Xs9wznfEAmZAR61qsYH3iN24V/qMYYkvAR5CRQNMvC6PjN2fHtO8y9XP/xdp5K+Icx+u1wMBMgWRPCmAEChSog==",
       "inBundle": true,
       "dependencies": {
-        "hosted-git-info": "^4.1.0",
+        "hosted-git-info": "^5.0.0",
         "semver": "^7.3.5",
         "validate-npm-package-name": "^3.0.0"
       },
@@ -5414,6 +5414,27 @@
         "node": "^12.13.0 || ^14.15.0 || >=16"
       }
     },
+    "node_modules/npm-package-arg/node_modules/hosted-git-info": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-5.0.0.tgz",
+      "integrity": "sha512-rRnjWu0Bxj+nIfUOkz0695C0H6tRrN5iYIzYejb0tDEefe2AekHu/U5Kn9pEie5vsJqpNQU02az7TGSH3qpz4Q==",
+      "inBundle": true,
+      "dependencies": {
+        "lru-cache": "^7.5.1"
+      },
+      "engines": {
+        "node": "^12.13.0 || ^14.15.0 || >=16"
+      }
+    },
+    "node_modules/npm-package-arg/node_modules/lru-cache": {
+      "version": "7.5.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-7.5.1.tgz",
+      "integrity": "sha512-q1TS8IqKvcg3aScamKCHpepSrHF537Ww7nHahBOxhDu9D2YoBXAsj/7uFdZFj1xJr9LmyeJ62AdyofCHafUbIA==",
+      "inBundle": true,
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/npm-packlist": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-4.0.0.tgz",
@@ -10350,7 +10371,7 @@
       "dependencies": {
         "aproba": "^2.0.0",
         "minipass": "^3.1.1",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "npm-registry-fetch": "^13.0.0"
       },
       "devDependencies": {
@@ -10386,7 +10407,7 @@
         "binary-extensions": "^2.2.0",
         "diff": "^5.0.0",
         "minimatch": "^3.0.4",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "pacote": "^13.0.5",
         "tar": "^6.1.0"
       },
@@ -10408,7 +10429,7 @@
         "@npmcli/run-script": "^3.0.0",
         "chalk": "^4.1.0",
         "mkdirp-infer-owner": "^2.0.0",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "npmlog": "^6.0.1",
         "pacote": "^13.0.5",
         "proc-log": "^2.0.0",
@@ -10551,7 +10572,7 @@
       "license": "ISC",
       "dependencies": {
         "@npmcli/run-script": "^3.0.0",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "pacote": "^13.0.5"
       },
       "devDependencies": {
@@ -10568,7 +10589,7 @@
       "license": "ISC",
       "dependencies": {
         "normalize-package-data": "^3.0.2",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "npm-registry-fetch": "^13.0.0",
         "semver": "^7.1.3",
         "ssri": "^8.0.1"
@@ -11265,7 +11286,7 @@
         "npm-pick-manifest": "^7.0.0",
         "npm-registry-fetch": "^13.0.0",
         "npmlog": "^6.0.1",
-        "pacote": "13.0.5",
+        "pacote": "^13.0.5",
         "parse-conflict-json": "^2.0.1",
         "proc-log": "^2.0.0",
         "promise-all-reject-late": "^1.0.0",
@@ -14128,7 +14149,7 @@
         "aproba": "^2.0.0",
         "minipass": "^3.1.1",
         "nock": "^12.0.1",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "npm-registry-fetch": "^13.0.0",
         "tap": "^15.1.0"
       },
@@ -14157,8 +14178,8 @@
         "diff": "^5.0.0",
         "eslint": "^8.1.0",
         "minimatch": "^3.0.4",
-        "npm-package-arg": "^9.0.0",
-        "pacote": "13.0.5",
+        "npm-package-arg": "^9.0.1",
+        "pacote": "^13.0.5",
         "tap": "^15.0.9",
         "tar": "^6.1.0"
       }
@@ -14173,9 +14194,9 @@
         "bin-links": "^3.0.0",
         "chalk": "^4.1.0",
         "mkdirp-infer-owner": "^2.0.0",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "npmlog": "^6.0.1",
-        "pacote": "13.0.5",
+        "pacote": "^13.0.5",
         "proc-log": "^2.0.0",
         "read": "^1.0.7",
         "read-package-json-fast": "^2.0.2",
@@ -14281,8 +14302,8 @@
         "@npmcli/run-script": "^3.0.0",
         "@npmcli/template-oss": "^2.4.2",
         "nock": "^13.0.7",
-        "npm-package-arg": "^9.0.0",
-        "pacote": "13.0.5",
+        "npm-package-arg": "^9.0.1",
+        "pacote": "^13.0.5",
         "tap": "^15.0.0"
       }
     },
@@ -14294,7 +14315,7 @@
         "lodash.clonedeep": "^4.5.0",
         "nock": "^12.0.2",
         "normalize-package-data": "^3.0.2",
-        "npm-package-arg": "^9.0.0",
+        "npm-package-arg": "^9.0.1",
         "npm-registry-fetch": "^13.0.0",
         "semver": "^7.1.3",
         "ssri": "^8.0.1",
@@ -14931,13 +14952,28 @@
       "integrity": "sha512-EPfafl6JL5/rU+ot6P3gRSCpPDW5VmIzX959Ob1+ySFUuuYHWHekXpwdUZcKP5C+DS4GEtdJluwBjnsNDl+fSA=="
     },
     "npm-package-arg": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-9.0.0.tgz",
-      "integrity": "sha512-yhzXxeor+Zfhe5MGwPdDumz6HtNlj2pMekWB95IX3CC6uDNgde0oPKHDCLDPoJqQfd0HqAWt+y4Hs5m7CK1+9Q==",
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-9.0.1.tgz",
+      "integrity": "sha512-Xs9wznfEAmZAR61qsYH3iN24V/qMYYkvAR5CRQNMvC6PjN2fHtO8y9XP/xdp5K+Icx+u1wMBMgWRPCmAEChSog==",
       "requires": {
-        "hosted-git-info": "^4.1.0",
+        "hosted-git-info": "^5.0.0",
         "semver": "^7.3.5",
         "validate-npm-package-name": "^3.0.0"
+      },
+      "dependencies": {
+        "hosted-git-info": {
+          "version": "5.0.0",
+          "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-5.0.0.tgz",
+          "integrity": "sha512-rRnjWu0Bxj+nIfUOkz0695C0H6tRrN5iYIzYejb0tDEefe2AekHu/U5Kn9pEie5vsJqpNQU02az7TGSH3qpz4Q==",
+          "requires": {
+            "lru-cache": "^7.5.1"
+          }
+        },
+        "lru-cache": {
+          "version": "7.5.1",
+          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-7.5.1.tgz",
+          "integrity": "sha512-q1TS8IqKvcg3aScamKCHpepSrHF537Ww7nHahBOxhDu9D2YoBXAsj/7uFdZFj1xJr9LmyeJ62AdyofCHafUbIA=="
+        }
       }
     },
     "npm-packlist": {
diff --git a/package.json b/package.json
index dad87cd2cf4df..29d47da5498b5 100644
--- a/package.json
+++ b/package.json
@@ -100,7 +100,7 @@
     "nopt": "^5.0.0",
     "npm-audit-report": "^2.1.5",
     "npm-install-checks": "^4.0.0",
-    "npm-package-arg": "^9.0.0",
+    "npm-package-arg": "^9.0.1",
     "npm-pick-manifest": "^7.0.0",
     "npm-profile": "^6.0.2",
     "npm-registry-fetch": "^13.0.1",
diff --git a/workspaces/libnpmaccess/package.json b/workspaces/libnpmaccess/package.json
index ac5e8e7b21247..6ee76c86cc7a7 100644
--- a/workspaces/libnpmaccess/package.json
+++ b/workspaces/libnpmaccess/package.json
@@ -33,7 +33,7 @@
   "dependencies": {
     "aproba": "^2.0.0",
     "minipass": "^3.1.1",
-    "npm-package-arg": "^9.0.0",
+    "npm-package-arg": "^9.0.1",
     "npm-registry-fetch": "^13.0.0"
   },
   "engines": {
diff --git a/workspaces/libnpmdiff/package.json b/workspaces/libnpmdiff/package.json
index 08089683c5d4a..8bf47df1200bf 100644
--- a/workspaces/libnpmdiff/package.json
+++ b/workspaces/libnpmdiff/package.json
@@ -58,7 +58,7 @@
     "binary-extensions": "^2.2.0",
     "diff": "^5.0.0",
     "minimatch": "^3.0.4",
-    "npm-package-arg": "^9.0.0",
+    "npm-package-arg": "^9.0.1",
     "pacote": "^13.0.5",
     "tar": "^6.1.0"
   },
diff --git a/workspaces/libnpmexec/package.json b/workspaces/libnpmexec/package.json
index f6faad30514f7..68b88578b4764 100644
--- a/workspaces/libnpmexec/package.json
+++ b/workspaces/libnpmexec/package.json
@@ -60,7 +60,7 @@
     "@npmcli/run-script": "^3.0.0",
     "chalk": "^4.1.0",
     "mkdirp-infer-owner": "^2.0.0",
-    "npm-package-arg": "^9.0.0",
+    "npm-package-arg": "^9.0.1",
     "npmlog": "^6.0.1",
     "pacote": "^13.0.5",
     "proc-log": "^2.0.0",
diff --git a/workspaces/libnpmpack/package.json b/workspaces/libnpmpack/package.json
index 3a342deda0de0..c25e1ef112904 100644
--- a/workspaces/libnpmpack/package.json
+++ b/workspaces/libnpmpack/package.json
@@ -41,7 +41,7 @@
   "homepage": "https://npmjs.com/package/libnpmpack",
   "dependencies": {
     "@npmcli/run-script": "^3.0.0",
-    "npm-package-arg": "^9.0.0",
+    "npm-package-arg": "^9.0.1",
     "pacote": "^13.0.5"
   },
   "engines": {
diff --git a/workspaces/libnpmpublish/package.json b/workspaces/libnpmpublish/package.json
index 441a10b17c0a4..50b470e134b29 100644
--- a/workspaces/libnpmpublish/package.json
+++ b/workspaces/libnpmpublish/package.json
@@ -45,7 +45,7 @@
   "homepage": "https://npmjs.com/package/libnpmpublish",
   "dependencies": {
     "normalize-package-data": "^3.0.2",
-    "npm-package-arg": "^9.0.0",
+    "npm-package-arg": "^9.0.1",
     "npm-registry-fetch": "^13.0.0",
     "semver": "^7.1.3",
     "ssri": "^8.0.1"