deps: upgrade npm to 9.1.3

PR-URL: https://github.com/nodejs/node/pull/45693
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruy Adorno <ruyadorno@google.com>

7 files changed, 196 insertions, 376 deletions

diff --git a/deps/npm/node_modules/which/CHANGELOG.md b/deps/npm/node_modules/which/CHANGELOG.md
deleted file mode 100644
index 7fb1f2033c..0000000000
--- a/deps/npm/node_modules/which/CHANGELOG.md
+++ /dev/null
@@ -1,166 +0,0 @@
-# Changes
-
-
-## 2.0.2
-
-* Rename bin to `node-which`
-
-## 2.0.1
-
-* generate changelog and publish on version bump
-* enforce 100% test coverage
-* Promise interface
-
-## 2.0.0
-
-* Parallel tests, modern JavaScript, and drop support for node < 8
-
-## 1.3.1
-
-* update deps
-* update travis
-
-## v1.3.0
-
-* Add nothrow option to which.sync
-* update tap
-
-## v1.2.14
-
-* appveyor: drop node 5 and 0.x
-* travis-ci: add node 6, drop 0.x
-
-## v1.2.13
-
-* test: Pass missing option to pass on windows
-* update tap
-* update isexe to 2.0.0
-* neveragain.tech pledge request
-
-## v1.2.12
-
-* Removed unused require
-
-## v1.2.11
-
-* Prevent changelog script from being included in package
-
-## v1.2.10
-
-* Use env.PATH only, not env.Path
-
-## v1.2.9
-
-* fix for paths starting with ../
-* Remove unused `is-absolute` module
-
-## v1.2.8
-
-* bullet items in changelog that contain (but don't start with) #
-
-## v1.2.7
-
-* strip 'update changelog' changelog entries out of changelog
-
-## v1.2.6
-
-* make the changelog bulleted
-
-## v1.2.5
-
-* make a changelog, and keep it up to date
-* don't include tests in package
-* Properly handle relative-path executables
-* appveyor
-* Attach error code to Not Found error
-* Make tests pass on Windows
-
-## v1.2.4
-
-* Fix typo
-
-## v1.2.3
-
-* update isexe, fix regression in pathExt handling
-
-## v1.2.2
-
-* update deps, use isexe module, test windows
-
-## v1.2.1
-
-* Sometimes windows PATH entries are quoted
-* Fixed a bug in the check for group and user mode bits. This bug was introduced during refactoring for supporting strict mode.
-* doc cli
-
-## v1.2.0
-
-* Add support for opt.all and -as cli flags
-* test the bin
-* update travis
-* Allow checking for multiple programs in bin/which
-* tap 2
-
-## v1.1.2
-
-* travis
-* Refactored and fixed undefined error on Windows
-* Support strict mode
-
-## v1.1.1
-
-* test +g exes against secondary groups, if available
-* Use windows exe semantics on cygwin & msys
-* cwd should be first in path on win32, not last
-* Handle lower-case 'env.Path' on Windows
-* Update docs
-* use single-quotes
-
-## v1.1.0
-
-* Add tests, depend on is-absolute
-
-## v1.0.9
-
-* which.js: root is allowed to execute files owned by anyone
-
-## v1.0.8
-
-* don't use graceful-fs
-
-## v1.0.7
-
-* add license to package.json
-
-## v1.0.6
-
-* isc license
-
-## 1.0.5
-
-* Awful typo
-
-## 1.0.4
-
-* Test for path absoluteness properly
-* win: Allow '' as a pathext if cmd has a . in it
-
-## 1.0.3
-
-* Remove references to execPath
-* Make `which.sync()` work on Windows by honoring the PATHEXT variable.
-* Make `isExe()` always return true on Windows.
-* MIT
-
-## 1.0.2
-
-* Only files can be exes
-
-## 1.0.1
-
-* Respect the PATHEXT env for win32 support
-* should 0755 the bin
-* binary
-* guts
-* package
-* 1st
diff --git a/deps/npm/node_modules/which/README.md b/deps/npm/node_modules/which/README.md
index cd833509f3..a6e86ab241 100644
--- a/deps/npm/node_modules/which/README.md
+++ b/deps/npm/node_modules/which/README.md
@@ -9,30 +9,24 @@ needed when the PATH changes.
 ## USAGE
 
 ```javascript
-var which = require('which')
+const which = require('which')
 
 // async usage
-which('node', function (er, resolvedPath) {
-  // er is returned if no "node" is found on the PATH
-  // if it is found, then the absolute path to the exec is returned
-})
+// rejects if not found
+const resolved = await which('node')
 
-// or promise
-which('node').then(resolvedPath => { ... }).catch(er => { ... not found ... })
+// if nothrow option is used, returns null if not found
+const resolvedOrNull = await which('node', { nothrow: true })
 
 // sync usage
 // throws if not found
-var resolved = which.sync('node')
+const resolved = which.sync('node')
 
 // if nothrow option is used, returns null if not found
-resolved = which.sync('node', {nothrow: true})
+const resolvedOrNull = which.sync('node', { nothrow: true })
 
 // Pass options to override the PATH and PATHEXT environment vars.
-which('node', { path: someOtherPath }, function (er, resolved) {
-  if (er)
-    throw er
-  console.log('found at %j', resolved)
-})
+await which('node', { path: someOtherPath, pathExt: somePathExt })
 ```
 
 ## CLI USAGE
diff --git a/deps/npm/node_modules/which/bin/node-which b/deps/npm/node_modules/which/bin/node-which
deleted file mode 100755
index 7cee3729ee..0000000000
--- a/deps/npm/node_modules/which/bin/node-which
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/usr/bin/env node
-var which = require("../")
-if (process.argv.length < 3)
-  usage()
-
-function usage () {
-  console.error('usage: which [-as] program ...')
-  process.exit(1)
-}
-
-var all = false
-var silent = false
-var dashdash = false
-var args = process.argv.slice(2).filter(function (arg) {
-  if (dashdash || !/^-/.test(arg))
-    return true
-
-  if (arg === '--') {
-    dashdash = true
-    return false
-  }
-
-  var flags = arg.substr(1).split('')
-  for (var f = 0; f < flags.length; f++) {
-    var flag = flags[f]
-    switch (flag) {
-      case 's':
-        silent = true
-        break
-      case 'a':
-        all = true
-        break
-      default:
-        console.error('which: illegal option -- ' + flag)
-        usage()
-    }
-  }
-  return false
-})
-
-process.exit(args.reduce(function (pv, current) {
-  try {
-    var f = which.sync(current, { all: all })
-    if (all)
-      f = f.join('\n')
-    if (!silent)
-      console.log(f)
-    return pv;
-  } catch (e) {
-    return 1;
-  }
-}, 0))
diff --git a/deps/npm/node_modules/which/bin/which.js b/deps/npm/node_modules/which/bin/which.js
new file mode 100755
index 0000000000..6df16f21ac
--- /dev/null
+++ b/deps/npm/node_modules/which/bin/which.js
@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+const which = require('../lib')
+const argv = process.argv.slice(2)
+
+const usage = (err) => {
+  if (err) {
+    console.error(`which: ${err}`)
+  }
+  console.error('usage: which [-as] program ...')
+  process.exit(1)
+}
+
+if (!argv.length) {
+  return usage()
+}
+
+let dashdash = false
+const [commands, flags] = argv.reduce((acc, arg) => {
+  if (dashdash || arg === '--') {
+    dashdash = true
+    return acc
+  }
+
+  if (!/^-/.test(arg)) {
+    acc[0].push(arg)
+    return acc
+  }
+
+  for (const flag of arg.slice(1).split('')) {
+    if (flag === 's') {
+      acc[1].silent = true
+    } else if (flag === 'a') {
+      acc[1].all = true
+    } else {
+      usage(`illegal option -- ${flag}`)
+    }
+  }
+
+  return acc
+}, [[], {}])
+
+for (const command of commands) {
+  try {
+    const res = which.sync(command, { all: flags.all })
+    if (!flags.silent) {
+      console.log([].concat(res).join('\n'))
+    }
+  } catch (err) {
+    process.exitCode = 1
+  }
+}
diff --git a/deps/npm/node_modules/which/lib/index.js b/deps/npm/node_modules/which/lib/index.js
new file mode 100644
index 0000000000..8de3388baf
--- /dev/null
+++ b/deps/npm/node_modules/which/lib/index.js
@@ -0,0 +1,110 @@
+const isexe = require('isexe')
+const { join, delimiter, sep, posix } = require('path')
+
+const isWindows = process.platform === 'win32'
+
+// used to check for slashed in commands passed in. always checks for the posix
+// seperator on all platforms, and checks for the current separator when not on
+// a posix platform. don't use the isWindows check for this since that is mocked
+// in tests but we still need the code to actually work when called. that is also
+// why it is ignored from coverage.
+/* istanbul ignore next */
+const rSlash = new RegExp(`[${posix.sep}${sep === posix.sep ? '' : sep}]`.replace(/(\\)/g, '\\$1'))
+const rRel = new RegExp(`^\\.${rSlash.source}`)
+
+const getNotFoundError = (cmd) =>
+  Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })
+
+const getPathInfo = (cmd, {
+  path: optPath = process.env.PATH,
+  pathExt: optPathExt = process.env.PATHEXT,
+  delimiter: optDelimiter = delimiter,
+}) => {
+  // If it has a slash, then we don't bother searching the pathenv.
+  // just check the file itself, and that's it.
+  const pathEnv = cmd.match(rSlash) ? [''] : [
+    // windows always checks the cwd first
+    ...(isWindows ? [process.cwd()] : []),
+    ...(optPath || /* istanbul ignore next: very unusual */ '').split(optDelimiter),
+  ]
+
+  if (isWindows) {
+    const pathExtExe = optPathExt || ['.EXE', '.CMD', '.BAT', '.COM'].join(optDelimiter)
+    const pathExt = pathExtExe.split(optDelimiter)
+    if (cmd.includes('.') && pathExt[0] !== '') {
+      pathExt.unshift('')
+    }
+    return { pathEnv, pathExt, pathExtExe }
+  }
+
+  return { pathEnv, pathExt: [''] }
+}
+
+const getPathPart = (raw, cmd) => {
+  const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw
+  const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : ''
+  return prefix + join(pathPart, cmd)
+}
+
+const which = async (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const envPart of pathEnv) {
+    const p = getPathPart(envPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = await isexe(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+const whichSync = (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const pathEnvPart of pathEnv) {
+    const p = getPathPart(pathEnvPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = isexe.sync(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+module.exports = which
+which.sync = whichSync
diff --git a/deps/npm/node_modules/which/package.json b/deps/npm/node_modules/which/package.json
index 97ad7fbabc..bde1563455 100644
--- a/deps/npm/node_modules/which/package.json
+++ b/deps/npm/node_modules/which/package.json
@@ -1,43 +1,50 @@
 {
-  "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
+  "author": "GitHub Inc.",
   "name": "which",
   "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",
-  "version": "2.0.2",
+  "version": "3.0.0",
   "repository": {
     "type": "git",
-    "url": "git://github.com/isaacs/node-which.git"
+    "url": "https://github.com/npm/node-which.git"
   },
-  "main": "which.js",
+  "main": "lib/index.js",
   "bin": {
-    "node-which": "./bin/node-which"
+    "node-which": "./bin/which.js"
   },
   "license": "ISC",
   "dependencies": {
     "isexe": "^2.0.0"
   },
   "devDependencies": {
-    "mkdirp": "^0.5.0",
-    "rimraf": "^2.6.2",
-    "tap": "^14.6.9"
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.8.0",
+    "tap": "^16.3.0"
   },
   "scripts": {
     "test": "tap",
-    "preversion": "npm test",
-    "postversion": "npm publish",
-    "prepublish": "npm run changelog",
-    "prechangelog": "bash gen-changelog.sh",
-    "changelog": "git add CHANGELOG.md",
-    "postchangelog": "git commit -m 'update changelog - '${npm_package_version}",
-    "postpublish": "git push origin --follow-tags"
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "snap": "tap",
+    "posttest": "npm run lint"
   },
   "files": [
-    "which.js",
-    "bin/node-which"
+    "bin/",
+    "lib/"
   ],
   "tap": {
-    "check-coverage": true
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   },
   "engines": {
-    "node": ">= 8"
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.8.0"
   }
 }
diff --git a/deps/npm/node_modules/which/which.js b/deps/npm/node_modules/which/which.js
deleted file mode 100644
index 82afffd214..0000000000
--- a/deps/npm/node_modules/which/which.js
+++ /dev/null
@@ -1,125 +0,0 @@
-const isWindows = process.platform === 'win32' ||
-    process.env.OSTYPE === 'cygwin' ||
-    process.env.OSTYPE === 'msys'
-
-const path = require('path')
-const COLON = isWindows ? ';' : ':'
-const isexe = require('isexe')
-
-const getNotFoundError = (cmd) =>
-  Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })
-
-const getPathInfo = (cmd, opt) => {
-  const colon = opt.colon || COLON
-
-  // If it has a slash, then we don't bother searching the pathenv.
-  // just check the file itself, and that's it.
-  const pathEnv = cmd.match(/\//) || isWindows && cmd.match(/\\/) ? ['']
-    : (
-      [
-        // windows always checks the cwd first
-        ...(isWindows ? [process.cwd()] : []),
-        ...(opt.path || process.env.PATH ||
-          /* istanbul ignore next: very unusual */ '').split(colon),
-      ]
-    )
-  const pathExtExe = isWindows
-    ? opt.pathExt || process.env.PATHEXT || '.EXE;.CMD;.BAT;.COM'
-    : ''
-  const pathExt = isWindows ? pathExtExe.split(colon) : ['']
-
-  if (isWindows) {
-    if (cmd.indexOf('.') !== -1 && pathExt[0] !== '')
-      pathExt.unshift('')
-  }
-
-  return {
-    pathEnv,
-    pathExt,
-    pathExtExe,
-  }
-}
-
-const which = (cmd, opt, cb) => {
-  if (typeof opt === 'function') {
-    cb = opt
-    opt = {}
-  }
-  if (!opt)
-    opt = {}
-
-  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
-  const found = []
-
-  const step = i => new Promise((resolve, reject) => {
-    if (i === pathEnv.length)
-      return opt.all && found.length ? resolve(found)
-        : reject(getNotFoundError(cmd))
-
-    const ppRaw = pathEnv[i]
-    const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw
-
-    const pCmd = path.join(pathPart, cmd)
-    const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd
-      : pCmd
-
-    resolve(subStep(p, i, 0))
-  })
-
-  const subStep = (p, i, ii) => new Promise((resolve, reject) => {
-    if (ii === pathExt.length)
-      return resolve(step(i + 1))
-    const ext = pathExt[ii]
-    isexe(p + ext, { pathExt: pathExtExe }, (er, is) => {
-      if (!er && is) {
-        if (opt.all)
-          found.push(p + ext)
-        else
-          return resolve(p + ext)
-      }
-      return resolve(subStep(p, i, ii + 1))
-    })
-  })
-
-  return cb ? step(0).then(res => cb(null, res), cb) : step(0)
-}
-
-const whichSync = (cmd, opt) => {
-  opt = opt || {}
-
-  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
-  const found = []
-
-  for (let i = 0; i < pathEnv.length; i ++) {
-    const ppRaw = pathEnv[i]
-    const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw
-
-    const pCmd = path.join(pathPart, cmd)
-    const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd
-      : pCmd
-
-    for (let j = 0; j < pathExt.length; j ++) {
-      const cur = p + pathExt[j]
-      try {
-        const is = isexe.sync(cur, { pathExt: pathExtExe })
-        if (is) {
-          if (opt.all)
-            found.push(cur)
-          else
-            return cur
-        }
-      } catch (ex) {}
-    }
-  }
-
-  if (opt.all && found.length)
-    return found
-
-  if (opt.nothrow)
-    return null
-
-  throw getNotFoundError(cmd)
-}
-
-module.exports = which
-which.sync = whichSync