deps: upgrade npm to 10.5.2

PR-URL: #52458
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Marco Ippolito <[email protected]>
Reviewed-By: Mohammed Keyvanzadeh <[email protected]>

Author: npm-cli-bot

deps/npm/docs/content/commands/npm-audit.md

@@ -90,7 +90,7 @@ The `sig` is generated using the following template: `${package.name}@${package.
 
 Keys response:
 
-- `expires`: null or a simplified extended [ISO 8601 format](https://en.wikipedia.org/wiki/ISO_8601"): `YYYY-MM-DDTHH:mm:ss.sssZ`
+- `expires`: null or a simplified extended [ISO 8601 format](https://en.wikipedia.org/wiki/ISO_8601): `YYYY-MM-DDTHH:mm:ss.sssZ`
 - `keydid`: sha256 fingerprint of the public key
 - `keytype`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI
 - `scheme`: only `ecdsa-sha2-nistp256` is currently supported by the npm CLI

deps/npm/docs/content/commands/npm-ls.md

@@ -27,7 +27,7 @@ packages will *also* show the paths to the specified packages.  For
 example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-[email protected].1 /path/to/npm
+[email protected].2 /path/to/npm
 └─┬ [email protected]
   └── [email protected]
 ```

deps/npm/docs/content/commands/npm.md

@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-10.5.1
+10.5.2
 
 ### Description
 

deps/npm/docs/output/commands/npm-audit.html

@@ -209,7 +209,7 @@ <h3 id="audit-signatures">Audit Signatures</h3>
 </code></pre>
 <p>Keys response:</p>
 <ul>
-<li><code>expires</code>: null or a simplified extended <a href="https://en.wikipedia.org/wiki/ISO_8601%22">ISO 8601 format</a>: <code>YYYY-MM-DDTHH:mm:ss.sssZ</code></li>
+<li><code>expires</code>: null or a simplified extended <a href="https://en.wikipedia.org/wiki/ISO_8601">ISO 8601 format</a>: <code>YYYY-MM-DDTHH:mm:ss.sssZ</code></li>
 <li><code>keydid</code>: sha256 fingerprint of the public key</li>
 <li><code>keytype</code>: only <code>ecdsa-sha2-nistp256</code> is currently supported by the npm CLI</li>
 <li><code>scheme</code>: only <code>ecdsa-sha2-nistp256</code> is currently supported by the npm CLI</li>

deps/npm/docs/output/commands/npm-ls.html

@@ -160,7 +160,7 @@ <h3 id="description">Description</h3>
 the results to only the paths to the packages named.  Note that nested
 packages will <em>also</em> show the paths to the specified packages.  For
 example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">[email protected].1 /path/to/npm
+<pre><code class="language-bash">[email protected].2 /path/to/npm
 └─┬ [email protected]
   └── [email protected]
 </code></pre>

deps/npm/docs/output/commands/npm.html

@@ -150,7 +150,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>10.5.1</p>
+<p>10.5.2</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.  It puts
 modules in place so that node can find them, and manages dependency

deps/npm/lib/base-command.js

@@ -3,7 +3,6 @@
 const { relative } = require('path')
 
 const { definitions } = require('@npmcli/config/lib/definitions')
-const getWorkspaces = require('./workspaces/get-workspaces.js')
 const { aliases: cmdAliases } = require('./utils/cmd-list')
 const log = require('./utils/log-shim.js')
 
@@ -170,6 +169,7 @@ class BaseCommand {
     const relativeFrom = prefixInsideCwd ? this.npm.localPrefix : process.cwd()
 
     const filters = this.npm.config.get('workspace')
+    const getWorkspaces = require('./workspaces/get-workspaces.js')
     const ws = await getWorkspaces(filters, {
       path: this.npm.localPrefix,
       includeWorkspaceRoot,

deps/npm/lib/commands/owner.js

@@ -5,6 +5,7 @@ const log = require('../utils/log-shim')
 const otplease = require('../utils/otplease.js')
 const pkgJson = require('@npmcli/package-json')
 const BaseCommand = require('../base-command.js')
+const { redact } = require('@npmcli/redact')
 
 const readJson = async (path) => {
   try {
@@ -119,7 +120,7 @@ class Owner extends BaseCommand {
         this.npm.output(maintainers.map(m => `${m.name} <${m.email}>`).join('\n'))
       }
     } catch (err) {
-      log.error('owner ls', "Couldn't get owner data", npmFetch.cleanUrl(pkg))
+      log.error('owner ls', "Couldn't get owner data", redact(pkg))
       throw err
     }
   }

deps/npm/lib/commands/ping.js

@@ -1,4 +1,4 @@
-const { cleanUrl } = require('npm-registry-fetch')
+const { redact } = require('@npmcli/redact')
 const log = require('../utils/log-shim')
 const pingUtil = require('../utils/ping.js')
 const BaseCommand = require('../base-command.js')
@@ -9,7 +9,7 @@ class Ping extends BaseCommand {
   static name = 'ping'
 
   async exec (args) {
-    const cleanRegistry = cleanUrl(this.npm.config.get('registry'))
+    const cleanRegistry = redact(this.npm.config.get('registry'))
     log.notice('PING', cleanRegistry)
     const start = Date.now()
     const details = await pingUtil({ ...this.npm.flatOptions })

deps/npm/lib/commands/publish.js

@@ -220,7 +220,12 @@ class Publish extends BaseCommand {
       })
     }
     if (manifest.publishConfig) {
-      flatten(manifest.publishConfig, opts)
+      const cliFlags = this.npm.config.data.get('cli').raw
+      // Filter out properties set in CLI flags to prioritize them over
+      // corresponding `publishConfig` settings
+      const filteredPublishConfig = Object.fromEntries(
+        Object.entries(manifest.publishConfig).filter(([key]) => !(key in cliFlags)))
+      flatten(filteredPublishConfig, opts)
     }
     return manifest
   }