npm · wraithgar · Oct 8, 2025 · Oct 8, 2025 · Oct 8, 2025 · Oct 8, 2025
@@ -139,6 +139,7 @@ graph LR;
   npm-package-arg-->semver;
   npm-package-arg-->validate-npm-package-name;
   npm-packlist-->ignore-walk;
+  npm-packlist-->proc-log;
   npm-pick-manifest-->npm-install-checks;
   npm-pick-manifest-->npm-normalize-package-bin;
   npm-pick-manifest-->npm-package-arg;
@@ -528,6 +529,7 @@ graph LR;
   npm-package-arg-->semver;
   npm-package-arg-->validate-npm-package-name;
   npm-packlist-->ignore-walk;
+  npm-packlist-->proc-log;
   npm-pick-manifest-->npm-install-checks;
   npm-pick-manifest-->npm-normalize-package-bin;
   npm-pick-manifest-->npm-package-arg;

@@ -15,22 +15,24 @@ exports.name = null
 exports.isPR = null
 exports.id = null
 
-vendors.forEach(function (vendor) {
-  const envs = Array.isArray(vendor.env) ? vendor.env : [vendor.env]
-  const isCI = envs.every(function (obj) {
-    return checkEnv(obj)
-  })
+if (env.CI !== 'false') {
+  vendors.forEach(function (vendor) {
+    const envs = Array.isArray(vendor.env) ? vendor.env : [vendor.env]
+    const isCI = envs.every(function (obj) {
+      return checkEnv(obj)
+    })
 
-  exports[vendor.constant] = isCI
+    exports[vendor.constant] = isCI
 
-  if (!isCI) {
-    return
-  }
+    if (!isCI) {
+      return
+    }
 
-  exports.name = vendor.name
-  exports.isPR = checkPR(vendor)
-  exports.id = vendor.constant
-})
+    exports.name = vendor.name
+    exports.isPR = checkPR(vendor)
+    exports.id = vendor.constant
+  })
+}
 
 exports.isCI = !!(
   env.CI !== 'false' && // Bypass all checks if CI env is explicitly set to 'false'

@@ -1,6 +1,6 @@
 {
   "name": "ci-info",
-  "version": "4.3.0",
+  "version": "4.3.1",
   "description": "Get details about the current Continuous Integration environment",
   "main": "index.js",
   "typings": "index.d.ts",

@@ -1,6 +1,6 @@
 {
   "name": "cidr-regex",
-  "version": "5.0.0",
+  "version": "5.0.1",
   "description": "Regular expression for matching IP addresses in CIDR notation",
   "author": "silverwind <me@silverwind.io>",
   "contributors": [
@@ -20,18 +20,18 @@
     "node": ">=20"
   },
   "dependencies": {
-    "ip-regex": "^5.0.0"
+    "ip-regex": "5.0.0"
   },
   "devDependencies": {
-    "@types/node": "24.1.0",
-    "eslint": "8.57.0",
-    "eslint-config-silverwind": "101.4.1",
-    "typescript": "5.8.3",
-    "typescript-config-silverwind": "9.0.8",
-    "updates": "16.5.2",
-    "versions": "13.1.1",
-    "vite": "7.0.6",
-    "vite-config-silverwind": "5.4.0",
+    "@types/node": "24.5.2",
+    "eslint": "9.36.0",
+    "eslint-config-silverwind": "105.1.0",
+    "typescript": "5.9.2",
+    "typescript-config-silverwind": "10.0.1",
+    "updates": "16.7.2",
+    "versions": "13.1.2",
+    "vite": "7.1.7",
+    "vite-config-silverwind": "6.0.2",
     "vitest": "3.2.4",
     "vitest-config-silverwind": "10.2.0"
   }

@@ -109,8 +109,6 @@ hosts.gitlab = {
   treepath: 'tree',
   blobpath: 'tree',
   editpath: '-/edit',
-  httpstemplate: ({ auth, domain, user, project, committish }) =>
-    `git+https://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
   tarballtemplate: ({ domain, user, project, committish }) =>
     `https://${domain}/${user}/${project}/repository/archive.tar.gz?ref=${maybeEncode(committish || 'HEAD')}`,
   extract: (url) => {

@@ -21,20 +21,23 @@ const correctProtocol = (arg, protocols) => {
     return arg
   }
 
+  if (arg.substr(firstColon, 3) === '://') {
+    // If arg is given as <foo>://<bar>, then this is already a valid URL.
+    return arg
+  }
+
   const firstAt = arg.indexOf('@')
   if (firstAt > -1) {
     if (firstAt > firstColon) {
+      // URL has the form of <foo>:<bar>@<baz>. Assume this is a git+ssh URL.
       return `git+ssh://${arg}`
     } else {
+      // URL has the form 'git@github.com:npm/hosted-git-info.git'.
       return arg
     }
   }
 
-  const doubleSlash = arg.indexOf('//')
-  if (doubleSlash === firstColon + 1) {
-    return arg
-  }
-
+  // Correct <foo>:<bar> to <foo>://<bar>
   return `${arg.slice(0, firstColon + 1)}//${arg.slice(firstColon + 1)}`
 }
 

@@ -1,6 +1,6 @@
 {
   "name": "hosted-git-info",
-  "version": "9.0.0",
+  "version": "9.0.2",
   "description": "Provides metadata and conversions from repository urls for GitHub, Bitbucket and GitLab",
   "main": "./lib/index.js",
   "repository": {
@@ -35,7 +35,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "4.25.0",
+    "@npmcli/template-oss": "4.25.1",
     "tap": "^16.0.1"
   },
   "files": [
@@ -55,7 +55,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.25.0",
+    "version": "4.25.1",
     "publish": "true"
   }
 }
@@ -1,6 +1,6 @@
 {
   "name": "is-cidr",
-  "version": "6.0.0",
+  "version": "6.0.1",
   "description": "Check if a string is an IP address in CIDR notation",
   "author": "silverwind <me@silverwind.io>",
   "contributors": [
@@ -20,18 +20,18 @@
     "node": ">=20"
   },
   "dependencies": {
-    "cidr-regex": "^5.0.0"
+    "cidr-regex": "5.0.1"
   },
   "devDependencies": {
-    "@types/node": "24.1.0",
-    "eslint": "8.57.0",
-    "eslint-config-silverwind": "101.4.1",
-    "typescript": "5.8.3",
-    "typescript-config-silverwind": "9.0.8",
-    "updates": "16.5.2",
-    "versions": "13.1.1",
-    "vite": "7.0.6",
-    "vite-config-silverwind": "5.4.0",
+    "@types/node": "24.5.2",
+    "eslint": "9.36.0",
+    "eslint-config-silverwind": "105.1.0",
+    "typescript": "5.9.2",
+    "typescript-config-silverwind": "10.0.1",
+    "updates": "16.7.2",
+    "versions": "13.1.2",
+    "vite": "7.1.7",
+    "vite-config-silverwind": "6.0.2",
     "vitest": "3.2.4",
     "vitest-config-silverwind": "10.2.0"
   }

@@ -1170,7 +1170,11 @@ class LRUCache {
             }
             // either we didn't abort, and are still here, or we did, and ignored
             const bf = p;
-            if (this.#valList[index] === p) {
+            // if nothing else has been written there but we're set to update the
+            // cache and ignore the abort, or if it's still pending on this specific
+            // background request, then write it to the cache.
+            const vl = this.#valList[index];
+            if (vl === p || ignoreAbort && updateCache && vl === undefined) {
                 if (v === undefined) {
                     if (bf.__staleWhileFetching !== undefined) {
                         this.#valList[index] = bf.__staleWhileFetching;

@@ -1167,7 +1167,11 @@ export class LRUCache {
             }
             // either we didn't abort, and are still here, or we did, and ignored
             const bf = p;
-            if (this.#valList[index] === p) {
+            // if nothing else has been written there but we're set to update the
+            // cache and ignore the abort, or if it's still pending on this specific
+            // background request, then write it to the cache.
+            const vl = this.#valList[index];
+            if (vl === p || ignoreAbort && updateCache && vl === undefined) {
                 if (v === undefined) {
                     if (bf.__staleWhileFetching !== undefined) {
                         this.#valList[index] = bf.__staleWhileFetching;

@@ -1,7 +1,7 @@
 {
   "name": "lru-cache",
   "description": "A cache object that deletes the least-recently-used items.",
-  "version": "11.2.1",
+  "version": "11.2.2",
   "author": "Isaac Z. Schlueter <i@izs.me>",
   "keywords": [
     "mru",

@@ -14,7 +14,7 @@ const { log } = require('proc-log')
 const hasSlashes = isWindows ? /\\|[/]/ : /[/]/
 const isURL = /^(?:git[+])?[a-z]+:/i
 const isGit = /^[^@]+@[^:.]+\.[^:]+:.+$/i
-const isFileType = /[.](?:tgz|tar.gz|tar)$/i
+const isFileType = /[.](?:tgz|tar\.gz|tar)$/i
 const isPortNumber = /:[0-9]+(\/|$)/i
 const isWindowsFile = /^(?:[.]|~[/]|[/\\]|[a-zA-Z]:)/
 const isPosixFile = /^(?:[.]|~[/]|[/]|[a-zA-Z]:)/

@@ -1,6 +1,6 @@
 {
   "name": "npm-package-arg",
-  "version": "13.0.0",
+  "version": "13.0.1",
   "description": "Parse the things that can be arguments to `npm install`",
   "main": "./lib/npa.js",
   "directories": {

@@ -3,6 +3,7 @@
 const { Walker: IgnoreWalker } = require('ignore-walk')
 const { lstatSync: lstat, readFileSync: readFile } = require('fs')
 const { basename, dirname, extname, join, relative, resolve, sep } = require('path')
+const { log } = require('proc-log')
 
 // symbols used to represent synthetic rule sets
 const defaultRules = Symbol('npm-packlist.rules.default')
@@ -92,6 +93,7 @@ class PackWalker extends IgnoreWalker {
     }
 
     super(options)
+
     this.isPackage = options.isPackage
     this.seen = options.seen || new Set()
     this.tree = tree
@@ -168,6 +170,11 @@ class PackWalker extends IgnoreWalker {
     } else if (this.ignoreRules['.npmignore']) {
       // .npmignore means no .gitignore
       this.ignoreRules['.gitignore'] = null
+    } else if (this.ignoreRules['.gitignore'] && !this.ignoreRules['.npmignore']) {
+      log.warn(
+        'gitignore-fallback',
+        'No .npmignore file found, using .gitignore for file exclusion. Consider creating a .npmignore file to explicitly control published files.'
+      )
     }
 
     return super.filterEntries()

@@ -1,13 +1,14 @@
 {
   "name": "npm-packlist",
-  "version": "10.0.1",
+  "version": "10.0.2",
   "description": "Get a list of the files to add from a folder into an npm package",
   "directories": {
     "test": "test"
   },
   "main": "lib/index.js",
   "dependencies": {
-    "ignore-walk": "^8.0.0"
+    "ignore-walk": "^8.0.0",
+    "proc-log": "^5.0.0"
   },
   "author": "GitHub Inc.",
   "license": "ISC",
@@ -18,7 +19,7 @@
   "devDependencies": {
     "@npmcli/arborist": "^9.0.0",
     "@npmcli/eslint-config": "^5.0.1",
-    "@npmcli/template-oss": "4.25.0",
+    "@npmcli/template-oss": "4.25.1",
     "mutate-fs": "^2.1.1",
     "tap": "^16.0.1"
   },
@@ -55,7 +56,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.25.0",
+    "version": "4.25.1",
     "publish": true
   }
 }
@@ -255,6 +255,7 @@ const isSatisfiable = (comparators, options) => {
 // already replaced the hyphen ranges
 // turn into a set of JUST comparators.
 const parseComparator = (comp, options) => {
+  comp = comp.replace(re[t.BUILD], '')
   debug('comp', comp, options)
   comp = replaceCarets(comp, options)
   debug('caret', comp)

@@ -111,11 +111,25 @@ class SemVer {
       other = new SemVer(other, this.options)
     }
 
-    return (
-      compareIdentifiers(this.major, other.major) ||
-      compareIdentifiers(this.minor, other.minor) ||
-      compareIdentifiers(this.patch, other.patch)
-    )
+    if (this.major < other.major) {
+      return -1
+    }
+    if (this.major > other.major) {
+      return 1
+    }
+    if (this.minor < other.minor) {
+      return -1
+    }
+    if (this.minor > other.minor) {
+      return 1
+    }
+    if (this.patch < other.patch) {
+      return -1
+    }
+    if (this.patch > other.patch) {
+      return 1
+    }
+    return 0
   }
 
   comparePre (other) {

@@ -2,6 +2,10 @@
 
 const numeric = /^[0-9]+$/
 const compareIdentifiers = (a, b) => {
+  if (typeof a === 'number' && typeof b === 'number') {
+    return a === b ? 0 : a < b ? -1 : 1
+  }
+
   const anum = numeric.test(a)
   const bnum = numeric.test(b)
 

@@ -1,6 +1,6 @@
 {
   "name": "semver",
-  "version": "7.7.2",
+  "version": "7.7.3",
   "description": "The semantic version parser used by npm.",
   "main": "index.js",
   "scripts": {
@@ -15,7 +15,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "4.24.3",
+    "@npmcli/template-oss": "4.25.1",
     "benchmark": "^2.1.4",
     "tap": "^16.0.0"
   },
@@ -52,7 +52,7 @@
   "author": "GitHub Inc.",
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.24.3",
+    "version": "4.25.1",
     "engines": ">=10",
     "distPaths": [
       "classes/",