deps: upgrade npm to 8.4.1

PR-URL: https://github.com/nodejs/node/pull/41836
Reviewed-By: Ruy Adorno <ruyadorno@github.com>
Reviewed-By: Mohammed Keyvanzadeh <mohammadkeyvanzade94@gmail.com>
Reviewed-By: Beth Griggs <bgriggs@redhat.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Mestery <mestery@protonmail.com>

13 files changed, 334 insertions, 67 deletions

diff --git a/deps/npm/test/lib/commands/access.js b/deps/npm/test/lib/commands/access.js
index 298897e4f5..c4e6f3167a 100644
--- a/deps/npm/test/lib/commands/access.js
+++ b/deps/npm/test/lib/commands/access.js
@@ -75,12 +75,13 @@ t.test('access public on unscoped package', async t => {
 })
 
 t.test('access public on scoped package', async t => {
-  t.plan(2)
+  t.plan(3)
   const name = '@scoped/npm-access-public-pkg'
   const { npm } = await loadMockNpm(t, {
     mocks: {
       libnpmaccess: {
-        public: (pkg, { registry }) => {
+        public: (pkg, { registry, log }) => {
+          t.ok(log, 'should pass a logger')
           t.equal(pkg, name, 'should use pkg name ref')
           t.equal(
             registry,
diff --git a/deps/npm/test/lib/commands/ci.js b/deps/npm/test/lib/commands/ci.js
index 537d0784f8..978cd03b87 100644
--- a/deps/npm/test/lib/commands/ci.js
+++ b/deps/npm/test/lib/commands/ci.js
@@ -19,6 +19,17 @@ t.test('should ignore scripts with --ignore-scripts', async t => {
       this.reify = () => {
         REIFY_CALLED = true
       }
+      this.buildIdealTree = () => {}
+      this.virtualTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
+      this.idealTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
     },
   })
 
@@ -99,6 +110,17 @@ t.test('should use Arborist and run-script', async t => {
       this.reify = () => {
         t.ok(true, 'reify is called')
       }
+      this.buildIdealTree = () => {}
+      this.virtualTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
+      this.idealTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
     },
     rimraf: (path, ...args) => {
       actualRimrafs++
@@ -138,6 +160,17 @@ t.test('should pass flatOptions to Arborist.reify', async t => {
       this.reify = async (options) => {
         t.equal(options.production, true, 'should pass flatOptions to Arborist.reify')
       }
+      this.buildIdealTree = () => {}
+      this.virtualTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
+      this.idealTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
     },
   })
   const npm = mockNpm({
@@ -199,7 +232,7 @@ t.test('should throw ECIGLOBAL', async t => {
 })
 
 t.test('should remove existing node_modules before installing', async t => {
-  t.plan(2)
+  t.plan(3)
   const testDir = t.testdir({
     node_modules: {
       'some-file': 'some contents',
@@ -212,12 +245,24 @@ t.test('should remove existing node_modules before installing', async t => {
     '@npmcli/arborist': function () {
       this.loadVirtual = () => Promise.resolve(true)
       this.reify = async (options) => {
+        t.equal(options.packageLock, true, 'npm ci should never ignore lock')
         t.equal(options.save, false, 'npm ci should never save')
         // check if node_modules was removed before reifying
         const contents = await readdir(testDir)
         const nodeModules = contents.filter((path) => path.startsWith('node_modules'))
         t.same(nodeModules, ['node_modules'], 'should only have the node_modules directory')
       }
+      this.buildIdealTree = () => {}
+      this.virtualTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
+      this.idealTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
     },
   })
 
@@ -231,3 +276,41 @@ t.test('should remove existing node_modules before installing', async t => {
 
   await ci.exec(null)
 })
+
+t.test('should throw error when ideal inventory mismatches virtual', async t => {
+  const CI = t.mock('../../../lib/commands/ci.js', {
+    '../../../lib/utils/reify-finish.js': async () => {},
+    '@npmcli/run-script': ({ event }) => {},
+    '@npmcli/arborist': function () {
+      this.loadVirtual = async () => {}
+      this.reify = () => {}
+      this.buildIdealTree = () => {}
+      this.virtualTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '1.0.0' }],
+        ]),
+      }
+      this.idealTree = {
+        inventory: new Map([
+          ['foo', { name: 'foo', version: '2.0.0' }],
+        ]),
+      }
+    },
+  })
+
+  const npm = mockNpm({
+    globalDir: 'path/to/node_modules/',
+    prefix: 'foo',
+    config: {
+      global: false,
+      'ignore-scripts': true,
+    },
+  })
+  const ci = new CI(npm)
+
+  try {
+    await ci.exec([])
+  } catch (err) {
+    t.matchSnapshot(err.message)
+  }
+})
diff --git a/deps/npm/test/lib/commands/deprecate.js b/deps/npm/test/lib/commands/deprecate.js
index 02256d08ed..aa158cca3a 100644
--- a/deps/npm/test/lib/commands/deprecate.js
+++ b/deps/npm/test/lib/commands/deprecate.js
@@ -2,12 +2,15 @@ const t = require('tap')
 
 let getIdentityImpl = () => 'someperson'
 let npmFetchBody = null
+let npmFetchLog = null
 
 const npmFetch = async (uri, opts) => {
   npmFetchBody = opts.body
+  npmFetchLog = opts.log
 }
 
 npmFetch.json = async (uri, opts) => {
+  npmFetchLog = opts.log
   return {
     versions: {
       '1.0.0': {},
@@ -82,7 +85,12 @@ t.test('invalid semver range', async t => {
 })
 
 t.test('undeprecate', async t => {
+  t.teardown(() => {
+    npmFetchBody = null
+    npmFetchLog = null
+  })
   await deprecate.exec(['foo', ''])
+  t.ok(npmFetchLog, 'was passed a logger')
   t.match(npmFetchBody, {
     versions: {
       '1.0.0': { deprecated: '' },
@@ -95,9 +103,11 @@ t.test('undeprecate', async t => {
 t.test('deprecates given range', async t => {
   t.teardown(() => {
     npmFetchBody = null
+    npmFetchLog = null
   })
 
   await deprecate.exec(['foo@1.0.0', 'this version is deprecated'])
+  t.ok(npmFetchLog, 'was passed a logger')
   t.match(npmFetchBody, {
     versions: {
       '1.0.0': {
diff --git a/deps/npm/test/lib/commands/diff.js b/deps/npm/test/lib/commands/diff.js
index ed0702e378..f73a543cb4 100644
--- a/deps/npm/test/lib/commands/diff.js
+++ b/deps/npm/test/lib/commands/diff.js
@@ -61,9 +61,10 @@ const diff = new Diff(npm)
 
 t.test('no args', t => {
   t.test('in a project dir', async t => {
-    t.plan(3)
+    t.plan(4)
 
     libnpmdiff = async ([a, b], opts) => {
+      t.ok(opts.log, 'should be passed a logger')
       t.equal(a, 'foo@latest', 'should have default spec comparison')
       t.equal(b, `file:${fooPath}`, 'should compare to cwd')
       t.match(opts, npm.flatOptions, 'should forward flat options')
diff --git a/deps/npm/test/lib/commands/dist-tag.js b/deps/npm/test/lib/commands/dist-tag.js
index 756a09d7de..b83c30e9c6 100644
--- a/deps/npm/test/lib/commands/dist-tag.js
+++ b/deps/npm/test/lib/commands/dist-tag.js
@@ -43,6 +43,7 @@ const routeMap = {
 // XXX overriding this does not appear to do anything, adding t.plan to things
 // that use it fails the test
 let npmRegistryFetchMock = (url, opts) => {
+  npmRegistryFetchLog = opts.log
   if (url === '/-/package/foo/dist-tags') {
     throw new Error('no package found')
   }
@@ -50,7 +51,11 @@ let npmRegistryFetchMock = (url, opts) => {
   return routeMap[url]
 }
 
-npmRegistryFetchMock.json = async (url, opts) => routeMap[url]
+let npmRegistryFetchLog
+npmRegistryFetchMock.json = async (url, opts) => {
+  npmRegistryFetchLog = opts.log
+  return routeMap[url]
+}
 
 const logger = (...msgs) => {
   for (const msg of [...msgs]) {
@@ -81,6 +86,10 @@ const npm = mockNpm({
 })
 const distTag = new DistTag(npm)
 
+t.afterEach(() => {
+  npmRegistryFetchLog = null
+})
+
 t.test('ls in current package', async t => {
   npm.prefix = t.testdir({
     'package.json': JSON.stringify({
@@ -88,6 +97,7 @@ t.test('ls in current package', async t => {
     }),
   })
   await distTag.exec(['ls'])
+  t.ok(npmRegistryFetchLog, 'is passed a logger')
   t.matchSnapshot(
     result,
     'should list available tags for current package'
@@ -289,6 +299,7 @@ t.test('add new tag', async t => {
   })
 
   npmRegistryFetchMock = async (url, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     t.equal(opts.method, 'PUT', 'should trigger request to add new tag')
     t.equal(opts.body, '7.7.7', 'should point to expected version')
   }
@@ -355,6 +366,7 @@ t.test('remove existing tag', async t => {
   }
   npm.prefix = t.testdir({})
   await distTag.exec(['rm', '@scoped/another', 'c'])
+  t.ok(npmRegistryFetchLog, 'is passed a logger')
   t.matchSnapshot(log, 'should log remove info')
   t.matchSnapshot(result, 'should return success msg')
 })
diff --git a/deps/npm/test/lib/commands/hook.js b/deps/npm/test/lib/commands/hook.js
index cd4b387872..a4eee711fe 100644
--- a/deps/npm/test/lib/commands/hook.js
+++ b/deps/npm/test/lib/commands/hook.js
@@ -78,7 +78,8 @@ t.test('npm hook add', async t => {
 
   await hook.exec(['add', 'semver', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       pkg: 'semver',
@@ -101,7 +102,8 @@ t.test('npm hook add - unicode output', async t => {
 
   await hook.exec(['add', 'semver', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       pkg: 'semver',
@@ -124,7 +126,8 @@ t.test('npm hook add - json output', async t => {
 
   await hook.exec(['add', '@npmcli', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       pkg: '@npmcli',
@@ -156,7 +159,8 @@ t.test('npm hook add - parseable output', async t => {
 
   await hook.exec(['add', '@npmcli', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       pkg: '@npmcli',
@@ -188,7 +192,8 @@ t.test('npm hook add - silent output', async t => {
 
   await hook.exec(['add', '@npmcli', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       pkg: '@npmcli',
@@ -209,7 +214,8 @@ t.test('npm hook ls', async t => {
 
   await hook.exec(['ls'])
 
-  t.strictSame(
+  t.ok(hookArgs.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       ...npm.flatOptions,
@@ -234,7 +240,8 @@ t.test('npm hook ls, no results', async t => {
 
   await hook.exec(['ls'])
 
-  t.strictSame(
+  t.ok(hookArgs.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       ...npm.flatOptions,
@@ -263,7 +270,8 @@ t.test('npm hook ls, single result', async t => {
 
   await hook.exec(['ls'])
 
-  t.strictSame(
+  t.ok(hookArgs.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       ...npm.flatOptions,
@@ -286,7 +294,8 @@ t.test('npm hook ls - json output', async t => {
 
   await hook.exec(['ls'])
 
-  t.strictSame(
+  t.ok(hookArgs.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       ...npm.flatOptions,
@@ -331,7 +340,8 @@ t.test('npm hook ls - parseable output', async t => {
 
   await hook.exec(['ls'])
 
-  t.strictSame(
+  t.ok(hookArgs.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       ...npm.flatOptions,
@@ -361,7 +371,8 @@ t.test('npm hook ls - silent output', async t => {
 
   await hook.exec(['ls'])
 
-  t.strictSame(
+  t.ok(hookArgs.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       ...npm.flatOptions,
@@ -380,7 +391,8 @@ t.test('npm hook rm', async t => {
 
   await hook.exec(['rm', '1'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -401,7 +413,8 @@ t.test('npm hook rm - unicode output', async t => {
 
   await hook.exec(['rm', '1'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -422,7 +435,8 @@ t.test('npm hook rm - silent output', async t => {
 
   await hook.exec(['rm', '1'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -443,7 +457,8 @@ t.test('npm hook rm - json output', async t => {
 
   await hook.exec(['rm', '1'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -473,7 +488,8 @@ t.test('npm hook rm - parseable output', async t => {
 
   await hook.exec(['rm', '1'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -499,7 +515,8 @@ t.test('npm hook update', async t => {
 
   await hook.exec(['update', '1', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -522,7 +539,8 @@ t.test('npm hook update - unicode', async t => {
 
   await hook.exec(['update', '1', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -545,7 +563,8 @@ t.test('npm hook update - json output', async t => {
 
   await hook.exec(['update', '1', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -577,7 +596,8 @@ t.test('npm hook update - parseable output', async t => {
 
   await hook.exec(['update', '1', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
@@ -607,7 +627,8 @@ t.test('npm hook update - silent output', async t => {
 
   await hook.exec(['update', '1', 'https://google.com', 'some-secret'])
 
-  t.strictSame(
+  t.ok(hookArgs.opts.log, 'is passed a logger')
+  t.match(
     hookArgs,
     {
       id: '1',
diff --git a/deps/npm/test/lib/commands/logout.js b/deps/npm/test/lib/commands/logout.js
index ee01e7500d..1a1fbb785c 100644
--- a/deps/npm/test/lib/commands/logout.js
+++ b/deps/npm/test/lib/commands/logout.js
@@ -31,7 +31,7 @@ t.afterEach(() => {
 })
 
 t.test('token logout', async t => {
-  t.plan(5)
+  t.plan(6)
 
   flatOptions['//registry.npmjs.org/:_authToken'] = '@foo/'
 
@@ -62,7 +62,8 @@ t.test('token logout', async t => {
 
   await logout.exec([])
 
-  t.same(
+  t.ok(result.opts.log, 'should pass a logger')
+  t.match(
     result,
     {
       url: '/-/user/token/%40foo%2F',
@@ -91,7 +92,7 @@ t.test('token scoped logout', async t => {
     config.save = null
   })
 
-  t.plan(7)
+  t.plan(8)
 
   flatOptions['//diff-registry.npmjs.com/:_authToken'] = '@bar/'
   flatOptions['//registry.npmjs.org/:_authToken'] = '@foo/'
@@ -132,7 +133,8 @@ t.test('token scoped logout', async t => {
 
   await logout.exec([])
 
-  t.same(
+  t.ok(result.opts.log, 'should pass a logger')
+  t.match(
     result,
     {
       url: '/-/user/token/%40bar%2F',
@@ -202,7 +204,7 @@ t.test('ignore invalid scoped registry config', async t => {
     config.delete = null
     config.save = null
   })
-  t.plan(4)
+  t.plan(5)
 
   flatOptions['//registry.npmjs.org/:_authToken'] = '@foo/'
   config.scope = '@myscope'
@@ -234,7 +236,8 @@ t.test('ignore invalid scoped registry config', async t => {
 
   await logout.exec([])
 
-  t.same(
+  t.ok(result.opts.log, 'should pass a logger')
+  t.match(
     result,
     {
       url: '/-/user/token/%40foo%2F',
diff --git a/deps/npm/test/lib/commands/outdated.js b/deps/npm/test/lib/commands/outdated.js
index 245e93039c..3bf42b10a2 100644
--- a/deps/npm/test/lib/commands/outdated.js
+++ b/deps/npm/test/lib/commands/outdated.js
@@ -609,3 +609,28 @@ t.test('workspaces', async t => {
   t.matchSnapshot(logs,
     'should display missing deps when filtering by ws')
 })
+
+t.test('aliases', async t => {
+  const testDir = t.testdir({
+    'package.json': JSON.stringify({
+      name: 'display-aliases',
+      version: '1.0.0',
+      dependencies: {
+        cat: 'npm:dog@latest',
+      },
+    }),
+    node_modules: {
+      cat: {
+        'package.json': JSON.stringify({
+          name: 'dog',
+          version: '1.0.0',
+        }),
+      },
+    },
+  })
+
+  await outdated(testDir, {}).exec([])
+
+  t.matchSnapshot(logs, 'should display aliased outdated dep output')
+  t.equal(process.exitCode, 1)
+})
diff --git a/deps/npm/test/lib/commands/owner.js b/deps/npm/test/lib/commands/owner.js
index b5d4d15842..a32a3df9b7 100644
--- a/deps/npm/test/lib/commands/owner.js
+++ b/deps/npm/test/lib/commands/owner.js
@@ -51,13 +51,14 @@ t.test('owner no args', async t => {
 })
 
 t.test('owner ls no args', async t => {
-  t.plan(4)
+  t.plan(5)
 
   result = ''
 
   readPackageNameResponse = '@npmcli/map-workspaces'
   pacote.packument = async (spec, opts) => {
     t.equal(spec.name, '@npmcli/map-workspaces', 'should use expect pkg name')
+    t.ok(opts.log, 'is passed a logger')
     t.match(
       opts,
       {
@@ -172,10 +173,11 @@ t.test('owner ls <pkg> no maintainers', async t => {
 })
 
 t.test('owner add <user> <pkg>', async t => {
-  t.plan(8)
+  t.plan(11)
 
   result = ''
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:foo') {
       t.ok('should request user info')
@@ -216,6 +218,7 @@ t.test('owner add <user> <pkg>', async t => {
     }
   }
   pacote.packument = async (spec, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     t.equal(spec.name, '@npmcli/map-workspaces', 'should use expect pkg name')
     t.match(
       opts,
@@ -244,6 +247,7 @@ t.test('owner add <user> cwd package', async t => {
   result = ''
   readPackageNameResponse = '@npmcli/map-workspaces'
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:foo') {
       return {
@@ -273,7 +277,7 @@ t.test('owner add <user> cwd package', async t => {
 })
 
 t.test('owner add <user> <pkg> already an owner', async t => {
-  t.plan(2)
+  t.plan(3)
 
   result = ''
   log.info = (title, msg) => {
@@ -285,6 +289,7 @@ t.test('owner add <user> <pkg> already an owner', async t => {
     )
   }
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:ruyadorno') {
       return {
@@ -316,6 +321,7 @@ t.test('owner add <user> <pkg> fails to retrieve user', async t => {
   result = ''
   readPackageNameResponse =
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve borked user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:foo') {
       return { ok: false }
@@ -346,6 +352,7 @@ t.test('owner add <user> <pkg> fails to retrieve user', async t => {
 t.test('owner add <user> <pkg> fails to PUT updates', async t => {
   result = ''
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:foo') {
       return {
@@ -382,7 +389,7 @@ t.test('owner add <user> <pkg> fails to PUT updates', async t => {
 })
 
 t.test('owner add <user> <pkg> fails to retrieve user info', async t => {
-  t.plan(3)
+  t.plan(4)
 
   result = ''
   log.error = (title, msg) => {
@@ -390,6 +397,7 @@ t.test('owner add <user> <pkg> fails to retrieve user info', async t => {
     t.equal(msg, 'Error getting user data for foo')
   }
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:foo') {
       throw Object.assign(
@@ -421,6 +429,7 @@ t.test('owner add <user> <pkg> fails to retrieve user info', async t => {
 t.test('owner add <user> <pkg> no previous maintainers property from server', async t => {
   result = ''
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:foo') {
       return {
@@ -487,10 +496,11 @@ t.test('owner add <user> no cwd package', async t => {
 })
 
 t.test('owner rm <user> <pkg>', async t => {
-  t.plan(8)
+  t.plan(11)
 
   result = ''
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:ruyadorno') {
       t.ok('should request user info')
@@ -524,6 +534,7 @@ t.test('owner rm <user> <pkg>', async t => {
     }
   }
   pacote.packument = async (spec, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     t.equal(spec.name, '@npmcli/map-workspaces', 'should use expect pkg name')
     t.match(
       opts,
@@ -549,7 +560,7 @@ t.test('owner rm <user> <pkg>', async t => {
 })
 
 t.test('owner rm <user> <pkg> not a current owner', async t => {
-  t.plan(2)
+  t.plan(3)
 
   result = ''
   log.info = (title, msg) => {
@@ -557,6 +568,7 @@ t.test('owner rm <user> <pkg> not a current owner', async t => {
     t.equal(msg, 'Not a package owner: foo', 'should log.info not a package owner msg')
   }
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:foo') {
       return {
@@ -590,6 +602,7 @@ t.test('owner rm <user> cwd package', async t => {
   result = ''
   readPackageNameResponse = '@npmcli/map-workspaces'
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:ruyadorno') {
       return {
@@ -622,6 +635,7 @@ t.test('owner rm <user> only user', async t => {
   result = ''
   readPackageNameResponse = 'ipt'
   npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
     // retrieve user info from couchdb request
     if (uri === '/-/user/org.couchdb.user:ruyadorno') {
       return {
diff --git a/deps/npm/test/lib/commands/ping.js b/deps/npm/test/lib/commands/ping.js
index f808e0ac3b..19ba9d586b 100644
--- a/deps/npm/test/lib/commands/ping.js
+++ b/deps/npm/test/lib/commands/ping.js
@@ -2,12 +2,13 @@ const t = require('tap')
 const { fake: mockNpm } = require('../../fixtures/mock-npm')
 
 t.test('pings', async t => {
-  t.plan(6)
+  t.plan(7)
 
   const registry = 'https://registry.npmjs.org'
   let noticeCalls = 0
   const Ping = t.mock('../../../lib/commands/ping.js', {
     '../../../lib/utils/ping.js': function (spec) {
+      t.ok(spec.log, 'is passed a logger')
       t.equal(spec.registry, registry, 'passes flatOptions')
       return {}
     },
@@ -35,13 +36,14 @@ t.test('pings', async t => {
 })
 
 t.test('pings and logs details', async t => {
-  t.plan(8)
+  t.plan(9)
 
   const registry = 'https://registry.npmjs.org'
   const details = { extra: 'data' }
   let noticeCalls = 0
   const Ping = t.mock('../../../lib/commands/ping.js', {
     '../../../lib/utils/ping.js': function (spec) {
+      t.ok(spec.log, 'is passed a logger')
       t.equal(spec.registry, registry, 'passes flatOptions')
       return details
     },
@@ -73,13 +75,14 @@ t.test('pings and logs details', async t => {
 })
 
 t.test('pings and returns json', async t => {
-  t.plan(9)
+  t.plan(10)
 
   const registry = 'https://registry.npmjs.org'
   const details = { extra: 'data' }
   let noticeCalls = 0
   const Ping = t.mock('../../../lib/commands/ping.js', {
     '../../../lib/utils/ping.js': function (spec) {
+      t.ok(spec.log, 'is passed a logger')
       t.equal(spec.registry, registry, 'passes flatOptions')
       return details
     },
diff --git a/deps/npm/test/lib/commands/publish.js b/deps/npm/test/lib/commands/publish.js
index 2a591fd4c7..52d4c1b342 100644
--- a/deps/npm/test/lib/commands/publish.js
+++ b/deps/npm/test/lib/commands/publish.js
@@ -25,7 +25,7 @@ t.test(
   /* eslint-disable-next-line max-len */
   'should publish with libnpmpublish, passing through flatOptions and respecting publishConfig.registry',
   async t => {
-    t.plan(6)
+    t.plan(7)
 
     const registry = 'https://some.registry'
     const publishConfig = { registry }
@@ -59,6 +59,7 @@ t.test(
           t.match(manifest, { name: 'my-cool-pkg', version: '1.0.0' }, 'gets manifest')
           t.type(tarData, Buffer, 'tarData is a buffer')
           t.ok(opts, 'gets opts object')
+          t.ok(opts.log, 'gets passed a logger')
           t.same(opts.customValue, true, 'flatOptions values are passed through')
           t.same(opts.registry, registry, 'publishConfig.registry is passed through')
         },
@@ -81,7 +82,7 @@ t.test(
 )
 
 t.test('re-loads publishConfig.registry if added during script process', async t => {
-  t.plan(5)
+  t.plan(6)
   const registry = 'https://some.registry'
   const publishConfig = { registry }
   const testDir = t.testdir({
@@ -112,6 +113,7 @@ t.test('re-loads publishConfig.registry if added during script process', async t
         t.match(manifest, { name: 'my-cool-pkg', version: '1.0.0' }, 'gets manifest')
         t.type(tarData, Buffer, 'tarData is a buffer')
         t.ok(opts, 'gets opts object')
+        t.ok(opts.log, 'gets passed a logger')
         t.same(opts.registry, registry, 'publishConfig.registry is passed through')
       },
     },
@@ -292,7 +294,7 @@ t.test('throws when invalid tag', async t => {
 })
 
 t.test('can publish a tarball', async t => {
-  t.plan(3)
+  t.plan(4)
 
   const testDir = t.testdir({
     tarball: {},
@@ -317,6 +319,7 @@ t.test('can publish a tarball', async t => {
   const Publish = t.mock('../../../lib/commands/publish.js', {
     libnpmpublish: {
       publish: (manifest, tarData, opts) => {
+        t.ok(opts.log, 'gets passed a logger')
         t.match(
           manifest,
           {
@@ -412,7 +415,7 @@ t.test('should check auth for scope specific registry', async t => {
 })
 
 t.test('should use auth for scope specific registry', async t => {
-  t.plan(3)
+  t.plan(4)
   const registry = 'https://some.registry'
   const testDir = t.testdir({
     'package.json': JSON.stringify(
@@ -429,6 +432,7 @@ t.test('should use auth for scope specific registry', async t => {
     libnpmpublish: {
       publish: (manifest, tarData, opts) => {
         t.ok(opts, 'gets opts object')
+        t.ok(opts.log, 'gets passed a logger')
         t.same(opts['@npm:registry'], registry, 'scope specific registry is passed through')
       },
     },
@@ -446,7 +450,7 @@ t.test('should use auth for scope specific registry', async t => {
 })
 
 t.test('read registry only from publishConfig', async t => {
-  t.plan(3)
+  t.plan(4)
 
   const registry = 'https://some.registry'
   const publishConfig = { registry }
@@ -465,6 +469,7 @@ t.test('read registry only from publishConfig', async t => {
   const Publish = t.mock('../../../lib/commands/publish.js', {
     libnpmpublish: {
       publish: (manifest, tarData, opts) => {
+        t.ok(opts.log, 'gets passed a logger')
         t.match(manifest, { name: 'my-cool-pkg', version: '1.0.0' }, 'gets manifest')
         t.same(opts.registry, registry, 'publishConfig is passed through')
       },
@@ -481,7 +486,7 @@ t.test('read registry only from publishConfig', async t => {
 })
 
 t.test('able to publish after if encountered multiple configs', async t => {
-  t.plan(2)
+  t.plan(3)
 
   const registry = 'https://some.registry'
   const tag = 'better-tag'
@@ -510,6 +515,7 @@ t.test('able to publish after if encountered multiple configs', async t => {
   const Publish = t.mock('../../../lib/commands/publish.js', {
     libnpmpublish: {
       publish: (manifest, tarData, opts) => {
+        t.ok(opts.log, 'gets passed a logger')
         t.same(opts.defaultTag, tag, 'gets option for expected tag')
       },
     },
@@ -748,7 +754,7 @@ t.test('private workspaces', async t => {
           if (manifest.private) {
             throw new Error('ERR')
           }
-
+          t.ok(opts.log, 'gets passed a logger')
           publishes.push(manifest)
         },
       },
diff --git a/deps/npm/test/lib/commands/star.js b/deps/npm/test/lib/commands/star.js
index 9a49036422..2f4ddc9dc6 100644
--- a/deps/npm/test/lib/commands/star.js
+++ b/deps/npm/test/lib/commands/star.js
@@ -42,17 +42,20 @@ t.test('no args', async t => {
 })
 
 t.test('star a package', async t => {
-  t.plan(4)
+  t.plan(6)
   const pkgName = '@npmcli/arborist'
-  npmFetch.json = async (uri, opts) => ({
-    _id: pkgName,
-    _rev: 'hash',
-    users: (
-      opts.method === 'PUT'
-        ? { foo: true }
-        : {}
-    ),
-  })
+  npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
+    return {
+      _id: pkgName,
+      _rev: 'hash',
+      users: (
+        opts.method === 'PUT'
+          ? { foo: true }
+          : {}
+      ),
+    }
+  }
   log.info = (title, msg, id) => {
     t.equal(title, 'star', 'should use expected title')
     t.equal(msg, 'starring', 'should use expected msg')
@@ -67,17 +70,20 @@ t.test('star a package', async t => {
 })
 
 t.test('unstar a package', async t => {
-  t.plan(4)
+  t.plan(6)
   const pkgName = '@npmcli/arborist'
   config['star.unstar'] = true
-  npmFetch.json = async (uri, opts) => ({
-    _id: pkgName,
-    _rev: 'hash',
-    ...(opts.method === 'PUT'
-      ? {}
-      : { foo: true }
-    ),
-  })
+  npmFetch.json = async (uri, opts) => {
+    t.ok(opts.log, 'is passed a logger')
+    return {
+      _id: pkgName,
+      _rev: 'hash',
+      ...(opts.method === 'PUT'
+        ? {}
+        : { foo: true }
+      ),
+    }
+  }
   log.info = (title, msg, id) => {
     t.equal(title, 'unstar', 'should use expected title')
     t.equal(msg, 'unstarring', 'should use expected msg')
diff --git a/deps/npm/test/lib/utils/validate-lockfile.js b/deps/npm/test/lib/utils/validate-lockfile.js
new file mode 100644
index 0000000000..25939c5f89
--- /dev/null
+++ b/deps/npm/test/lib/utils/validate-lockfile.js
@@ -0,0 +1,82 @@
+const t = require('tap')
+const validateLockfile = require('../../../lib/utils/validate-lockfile.js')
+
+t.test('identical inventory for both idealTree and virtualTree', async t => {
+  t.matchSnapshot(
+    validateLockfile(
+      new Map([
+        ['foo', { name: 'foo', version: '1.0.0' }],
+        ['bar', { name: 'bar', version: '2.0.0' }],
+      ]),
+      new Map([
+        ['foo', { name: 'foo', version: '1.0.0' }],
+        ['bar', { name: 'bar', version: '2.0.0' }],
+      ])
+    ),
+    'should have no errors on identical inventories'
+  )
+})
+
+t.test('extra inventory items on idealTree', async t => {
+  t.matchSnapshot(
+    validateLockfile(
+      new Map([
+        ['foo', { name: 'foo', version: '1.0.0' }],
+        ['bar', { name: 'bar', version: '2.0.0' }],
+      ]),
+      new Map([
+        ['foo', { name: 'foo', version: '1.0.0' }],
+        ['bar', { name: 'bar', version: '2.0.0' }],
+        ['baz', { name: 'baz', version: '3.0.0' }],
+      ])
+    ),
+    'should have missing entries error'
+  )
+})
+
+t.test('extra inventory items on virtualTree', async t => {
+  t.matchSnapshot(
+    validateLockfile(
+      new Map([
+        ['foo', { name: 'foo', version: '1.0.0' }],
+        ['bar', { name: 'bar', version: '2.0.0' }],
+        ['baz', { name: 'baz', version: '3.0.0' }],
+      ]),
+      new Map([
+        ['foo', { name: 'foo', version: '1.0.0' }],
+        ['bar', { name: 'bar', version: '2.0.0' }],
+      ])
+    ),
+    'should have no errors if finding virtualTree extra items'
+  )
+})
+
+t.test('mismatching versions on inventory', async t => {
+  t.matchSnapshot(
+    validateLockfile(
+      new Map([
+        ['foo', { name: 'foo', version: '1.0.0' }],
+        ['bar', { name: 'bar', version: '2.0.0' }],
+      ]),
+      new Map([
+        ['foo', { name: 'foo', version: '2.0.0' }],
+        ['bar', { name: 'bar', version: '3.0.0' }],
+      ])
+    ),
+    'should have errors for each mismatching version'
+  )
+})
+
+t.test('missing virtualTree inventory', async t => {
+  t.matchSnapshot(
+    validateLockfile(
+      new Map([]),
+      new Map([
+        ['foo', { name: 'foo', version: '1.0.0' }],
+        ['bar', { name: 'bar', version: '2.0.0' }],
+        ['baz', { name: 'baz', version: '3.0.0' }],
+      ])
+    ),
+    'should have errors for each mismatching version'
+  )
+})