Skip to content

Update pacote and use new allowGit flag #8943

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wraithgar wants to merge 2 commits into
base: latest
Choose a base branch
from
+207 −61
Open

Update pacote and use new allowGit flag #8943

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ebe5abd
deps: pacote@21.1.0
wraithgar Jan 28, 2026
0f88bcd
feat(config): add --allow-git
wraithgar Jan 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion lib/commands/cache.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,11 +181,12 @@ class Cache extends BaseCommand {
await pacote.tarball.stream(spec, stream => {
stream.resume()
return stream.promise()
}, { ...this.npm.flatOptions })
}, { ...this.npm.flatOptions, _isRoot: true })

await pacote.manifest(spec, {
...this.npm.flatOptions,
fullMetadata: true,
_isRoot: true,
})
}))
}
Expand Down
1 change: 1 addition & 0 deletions lib/commands/ci.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ class CI extends ArboristWorkspaceCmd {
'strict-peer-deps',
'foreground-scripts',
'ignore-scripts',
'allow-git',
'audit',
'bin-links',
'fund',
Expand Down
1 change: 1 addition & 0 deletions lib/commands/dedupe.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ class Dedupe extends ArboristWorkspaceCmd {
'omit',
'include',
'ignore-scripts',
'allow-git',
'audit',
'bin-links',
'fund',
Expand Down
1 change: 1 addition & 0 deletions lib/commands/diff.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,6 +198,7 @@ class Diff extends BaseCommand {
const packument = await pacote.packument(spec, {
...this.npm.flatOptions,
preferOnline: true,
_isRoot: true,
})
bSpec = pickManifest(
packument,
Expand Down
1 change: 1 addition & 0 deletions lib/commands/install.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ class Install extends ArboristWorkspaceCmd {
'package-lock-only',
'foreground-scripts',
'ignore-scripts',
'allow-git',
'audit',
'before',
'bin-links',
Expand Down
1 change: 1 addition & 0 deletions lib/commands/link.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@ class Link extends ArboristWorkspaceCmd {
'omit',
'include',
'ignore-scripts',
'allow-git',
'audit',
'bin-links',
'fund',
Expand Down
10 changes: 9 additions & 1 deletion lib/commands/owner.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ class Owner extends BaseCommand {
const data = await pacote.packument(spec, {
...npm.flatOptions,
fullMetadata: true,
_isRoot: true,
})
if (data && data.maintainers && data.maintainers.length) {
return data.maintainers.map(m => m.name)
Expand Down Expand Up @@ -112,7 +113,13 @@ class Owner extends BaseCommand {
const spec = npa(pkg)

try {
const packumentOpts = { ...this.npm.flatOptions, fullMetadata: true, preferOnline: true }
const packumentOpts = {
...this.npm.flatOptions,
fullMetadata:
true,
preferOnline: true,
_isRoot: true,
}
const { maintainers } = await pacote.packument(spec, packumentOpts)
if (!maintainers || !maintainers.length) {
output.standard('no admin found')
Expand Down Expand Up @@ -166,6 +173,7 @@ class Owner extends BaseCommand {
...this.npm.flatOptions,
fullMetadata: true,
preferOnline: true,
_isRoot: true,
})

const owners = data.maintainers || []
Expand Down
6 changes: 5 additions & 1 deletion lib/commands/pack.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,11 @@ class Pack extends BaseCommand {
const manifests = []
for (const arg of args) {
const spec = npa(arg)
const manifest = await pacote.manifest(spec, { ...this.npm.flatOptions, Arborist })
const manifest = await pacote.manifest(spec, {
...this.npm.flatOptions,
Arborist,
_isRoot: true,
})
if (!manifest._id) {
throw new Error('Invalid package, must have name and version')
}
Expand Down
1 change: 1 addition & 0 deletions lib/commands/publish.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,6 +221,7 @@ class Publish extends BaseCommand {
...this.npm.flatOptions,
preferOnline: true,
registry,
_isRoot: true,
})
if (typeof packument?.versions === 'undefined') {
return { versions: [], highestVersion: null }
Expand Down
1 change: 1 addition & 0 deletions lib/commands/unpublish.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ class Unpublish extends BaseCommand {
...opts,
spec: name,
query: { write: true },
_isRoot: true,
})
return Object.keys(packument.versions)
}
Expand Down
2 changes: 2 additions & 0 deletions lib/commands/view.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ class View extends BaseCommand {
...npm.flatOptions,
fullMetadata: true,
preferOnline: true,
_isRoot: true,
}
const spec = npa(opts.conf.argv.remain[2])
const pckmnt = await packument(spec, config)
Expand Down Expand Up @@ -136,6 +137,7 @@ class View extends BaseCommand {
...this.npm.flatOptions,
preferOnline: true,
fullMetadata: true,
_isRoot: true,
})

// get the data about this package
Expand Down
4 changes: 2 additions & 2 deletions lib/package-url-cmd.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,12 +23,12 @@ class PackageUrlCommand extends BaseCommand {
}

for (const arg of args) {
// XXX It is very odd that `where` is how pacote knows to look anywhere
// other than the cwd.
// XXX It is very odd that `where` is how pacote knows to look anywhere other than the cwd.
const opts = {
...this.npm.flatOptions,
where: this.npm.localPrefix,
fullMetadata: true,
_isRoot: true,
}
const mani = await pacote.manifest(arg, opts)
const url = this.getUrl(arg, mani)
Expand Down
5 changes: 5 additions & 0 deletions lib/utils/error-message.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,11 @@ const errorMessage = (er, npm) => {
break
}

case 'EALLOWGIT':
summary.push(['', er.message])
detail.push(['', `Refusing to fetch "${er.package}"`])
break

case 'ENOGIT':
summary.push(['', er.message])
detail.push(['', [
Expand Down
20 changes: 20 additions & 0 deletions node_modules/pacote/lib/fetcher.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -469,11 +469,31 @@ const FileFetcher = require('./file.js')
const DirFetcher = require('./dir.js')
const RemoteFetcher = require('./remote.js')

// possible values for allow: 'all', 'root', 'none'
const canUseGit = (allow = 'all', isRoot = false) => {
if (allow === 'all') {
return true
}
if (allow !== 'none' && isRoot) {
return true
}
return false
}

// Get an appropriate fetcher object from a spec and options
FetcherBase.get = (rawSpec, opts = {}) => {
const spec = npa(rawSpec, opts.where)
switch (spec.type) {
case 'git':
if (!canUseGit(opts.allowGit, opts._isRoot)) {
throw Object.assign(
new Error(`Fetching${opts.allowGit === 'root' ? ' non-root' : ''} packages from git has been disabled`),
{
code: 'EALLOWGIT',
package: spec.toString(),
}
)
}
return new GitFetcher(spec, opts)

case 'remote':
Expand Down
2 changes: 1 addition & 1 deletion node_modules/pacote/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "pacote",
"version": "21.0.4",
"version": "21.1.0",
"description": "JavaScript package downloader",
"author": "GitHub Inc.",
"bin": {
Expand Down
8 changes: 4 additions & 4 deletions package-lock.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@
"npm-registry-fetch": "^19.1.1",
"npm-user-validate": "^4.0.0",
"p-map": "^7.0.4",
"pacote": "^21.0.4",
"pacote": "^21.1.0",
"parse-conflict-json": "^5.0.1",
"proc-log": "^6.1.0",
"qrcode-terminal": "^0.12.0",
Expand Down Expand Up @@ -9232,9 +9232,9 @@
"license": "BlueOak-1.0.0"
},
"node_modules/pacote": {
"version": "21.0.4",
"resolved": "https://registry.npmjs.org/pacote/-/pacote-21.0.4.tgz",
"integrity": "sha512-RplP/pDW0NNNDh3pnaoIWYPvNenS7UqMbXyvMqJczosiFWTeGGwJC2NQBLqKf4rGLFfwCOnntw1aEp9Jiqm1MA==",
"version": "21.1.0",
"resolved": "https://registry.npmjs.org/pacote/-/pacote-21.1.0.tgz",
"integrity": "sha512-WF/PwrImIIVaLmtuCeO5L7n6DA0ZGCqmDPO/XbNjZgNUX+2O5z4f4Wdmu6erBWNICkl3ftKJvit2eIVcpegRRw==",
"inBundle": true,
"license": "ISC",
"dependencies": {
Expand Down
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@
"npm-registry-fetch": "^19.1.1",
"npm-user-validate": "^4.0.0",
"p-map": "^7.0.4",
"pacote": "^21.0.4",
"pacote": "^21.1.0",
"parse-conflict-json": "^5.0.1",
"proc-log": "^6.1.0",
"qrcode-terminal": "^0.12.0",
Expand Down
5 changes: 3 additions & 2 deletions smoke-tests/tap-snapshots/test/index.js.test.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,8 +57,9 @@ npm error Options:
npm error [--install-strategy <hoisted|nested|shallow|linked>] [--legacy-bundling]
npm error [--global-style] [--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
npm error [--include <prod|dev|optional|peer> [--include <prod|dev|optional|peer> ...]]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts] [--no-audit]
npm error [--no-bin-links] [--no-fund] [--dry-run]
npm error [--strict-peer-deps] [--foreground-scripts] [--ignore-scripts]
npm error [--allow-git <all|none|root>] [--no-audit] [--no-bin-links] [--no-fund]
npm error [--dry-run]
npm error [-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
npm error [--workspaces] [--include-workspace-root] [--install-links]
npm error
Expand Down
2 changes: 2 additions & 0 deletions tap-snapshots/test/lib/commands/config.js.test.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ exports[`test/lib/commands/config.js TAP config list --json > output matches sna
"access": null,
"all": false,
"allow-same-version": false,
"allow-git": "all",
"also": null,
"audit": true,
"audit-level": null,
Expand Down Expand Up @@ -189,6 +190,7 @@ exports[`test/lib/commands/config.js TAP config list --long > output matches sna
_auth = (protected)
access = null
all = false
allow-git = "all"
allow-same-version = false
also = null
audit = true
Expand Down
32 changes: 16 additions & 16 deletions tap-snapshots/test/lib/commands/view.js.test.cjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,22 @@
* Make sure to inspect the output below. Do not ignore changes!
*/
'use strict'
exports[`test/lib/commands/view.js TAP allow-git=root, package with multiple dist‑tags and no time > must match snapshot 1`] = `

gray@1.1.0 | Proprietary | deps: none | versions: 1

dist
.tarball: http://gray/1.1.0.tgz
.shasum: b

dist-tags:
latest: 1.1.0
stable: 1.1.0
old: 1.0.0
beta: 1.2.0-beta
alpha: 1.2.0-alpha
`

exports[`test/lib/commands/view.js TAP deprecated package with license, bugs, repository and other fields > must match snapshot 1`] = `

green@1.0.0 | ACME | deps: 2 | versions: 2
Expand Down Expand Up @@ -279,22 +295,6 @@ dist-tags:
latest: 1.0.0
`

exports[`test/lib/commands/view.js TAP package with multiple dist‑tags and no time > must match snapshot 1`] = `

gray@1.1.0 | Proprietary | deps: none | versions: 1

dist
.tarball: http://gray/1.1.0.tgz
.shasum: b

dist-tags:
latest: 1.1.0
stable: 1.1.0
old: 1.0.0
beta: 1.2.0-beta
alpha: 1.2.0-alpha
`

exports[`test/lib/commands/view.js TAP package with no modified time > must match snapshot 1`] = `

cyan@1.0.0 | Proprietary | deps: none | versions: 2
Expand Down
Loading
Loading