deps: pacote@21.5.1

owlstronaut · owlstronaut · commit cdaac1bed03a · 2026-06-11T11:17:08.000-07:00
diff --git a/node_modules/pacote/lib/util/add-git-sha.js b/node_modules/pacote/lib/util/add-git-sha.js
@@ -8,7 +8,10 @@ const addGitSha = (spec, sha) => {
     return `${base}#${sha}`
   } else {
     // don't use new URL for this, because it doesn't handle scp urls
-    return spec.rawSpec.replace(/#.*$/, '') + `#${sha}`
+    // strip the committish with indexOf/slice to avoid a regexp redos
+    const hashIndex = spec.rawSpec.indexOf('#')
+    const base = hashIndex === -1 ? spec.rawSpec : spec.rawSpec.slice(0, hashIndex)
+    return `${base}#${sha}`
   }
 }
 
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "21.5.0",
+  "version": "21.5.1",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -28,7 +28,7 @@
   "devDependencies": {
     "@npmcli/arborist": "^9.0.2",
     "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "4.29.0",
+    "@npmcli/template-oss": "5.1.0",
     "hosted-git-info": "^9.0.0",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
@@ -73,7 +73,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.29.0",
+    "version": "5.1.0",
     "windowsCI": false,
     "publish": "true"
   }
diff --git a/package-lock.json b/package-lock.json
@@ -133,7 +133,7 @@
         "npm-registry-fetch": "^19.1.1",
         "npm-user-validate": "^4.0.0",
         "p-map": "^7.0.4",
-        "pacote": "^21.5.0",
+        "pacote": "^21.5.1",
         "parse-conflict-json": "^5.0.1",
         "proc-log": "^6.1.0",
         "qrcode-terminal": "^0.12.0",
@@ -9277,9 +9277,9 @@
       "license": "BlueOak-1.0.0"
     },
     "node_modules/pacote": {
-      "version": "21.5.0",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-21.5.0.tgz",
-      "integrity": "sha512-VtZ0SB8mb5Tzw3dXDfVAIjhyVKUHZkS/ZH9/5mpKenwC9sFOXNI0JI7kEF7IMkwOnsWMFrvAZHzx1T5fmrp9FQ==",
+      "version": "21.5.1",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-21.5.1.tgz",
+      "integrity": "sha512-KvcJ9iy3crysCsgqc4+PknH/w6jkrp8JN36mpZBPwNaDRwTfMZD37YzRazNstiZUOhuF5pno9f78n9mEJBavwg==",
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
diff --git a/package.json b/package.json
@@ -101,7 +101,7 @@
     "npm-registry-fetch": "^19.1.1",
     "npm-user-validate": "^4.0.0",
     "p-map": "^7.0.4",
-    "pacote": "^21.5.0",
+    "pacote": "^21.5.1",
     "parse-conflict-json": "^5.0.1",
     "proc-log": "^6.1.0",
     "qrcode-terminal": "^0.12.0",

Original file line number	Diff line number	Diff line change
`@@ -8,7 +8,10 @@ const addGitSha = (spec, sha) => {`
`8`	`8`	return `${base}#${sha}`
`9`	`9`	`} else {`
`10`	`10`	`// don't use new URL for this, because it doesn't handle scp urls`
`11`		- return spec.rawSpec.replace(/#.*$/, '') + `#${sha}`
	`11`	`+ // strip the committish with indexOf/slice to avoid a regexp redos`
	`12`	`+ const hashIndex = spec.rawSpec.indexOf('#')`
	`13`	`+ const base = hashIndex === -1 ? spec.rawSpec : spec.rawSpec.slice(0, hashIndex)`
	`14`	+ return `${base}#${sha}`
`12`	`15`	`}`
`13`	`16`	`}`
`14`	`17`