fix: use @npmcli/package-json

lib/dir.js

@@ -87,7 +87,7 @@ class DirFetcher extends Fetcher {
  return Promise.resolve(this.package)
  }
 
- return this[_readPackageJson](this.resolved + '/package.json')
+ return this[_readPackageJson](this.resolved)
  .then(mani => this.package = {
  ...mani,
  _integrity: this.integrity && String(this.integrity),

lib/fetcher.js

@@ -5,7 +5,6 @@
 
 const npa = require('npm-package-arg')
 const ssri = require('ssri')
-const { promisify } = require('util')
 const { basename, dirname } = require('path')
 const tar = require('tar')
 const { log } = require('proc-log')
@@ -16,12 +15,14 @@ const cacache = require('cacache')
 const isPackageBin = require('./util/is-package-bin.js')
 const removeTrailingSlashes = require('./util/trailing-slashes.js')
 const getContents = require('@npmcli/installed-package-contents')
-const readPackageJsonFast = require('read-package-json-fast')
-const readPackageJson = promisify(require('read-package-json'))
+const PackageJson = require('@npmcli/package-json')
 const { Minipass } = require('minipass')
-
 const cacheDir = require('./util/cache-dir.js')
 
+// Pacote is only concerned with the package.json contents
+const packageJsonPrepare = (p) => PackageJson.prepare(p).then(pkg => pkg.content)
+const packageJsonNormalize = (p) => PackageJson.normalize(p).then(pkg => pkg.content)
+
 // Private methods.
 // Child classes should not have to override these.
 // Users should never call them.
@@ -93,9 +94,9 @@ class FetcherBase {
  this.fullMetadata = this.before ? true : !!opts.fullMetadata
  this.fullReadJson = !!opts.fullReadJson
  if (this.fullReadJson) {
- this[_readPackageJson] = readPackageJson
+ this[_readPackageJson] = packageJsonPrepare
  } else {
- this[_readPackageJson] = readPackageJsonFast
+ this[_readPackageJson] = packageJsonNormalize
  }
 
  // rrh is a registry hostname or 'never' or 'always'

lib/file.js

@@ -1,10 +1,11 @@
-const Fetcher = require('./fetcher.js')
 const fsm = require('fs-minipass')
 const cacache = require('cacache')
-const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
-const _exeBins = Symbol('_exeBins')
 const { resolve } = require('path')
-const fs = require('fs')
+const { stat, chmod } = require('fs/promises')
+const Fetcher = require('./fetcher.js')
+
+const _exeBins = Symbol('_exeBins')
+const _tarballFromResolved = Symbol.for('pacote.Fetcher._tarballFromResolved')
 const _readPackageJson = Symbol.for('package.Fetcher._readPackageJson')
 
 class FileFetcher extends Fetcher {
@@ -26,7 +27,7 @@ class FileFetcher extends Fetcher {
  // have to unpack the tarball for this.
  return cacache.tmp.withTmp(this.cache, this.opts, dir =>
  this.extract(dir)
- .then(() => this[_readPackageJson](dir + '/package.json'))
+ .then(() => this[_readPackageJson](dir))
  .then(mani => this.package = {
  ...mani,
  _integrity: this.integrity && String(this.integrity),
@@ -40,31 +41,31 @@ class FileFetcher extends Fetcher {
  return Promise.resolve()
  }
 
- return Promise.all(Object.keys(pkg.bin).map(k => new Promise(res => {
+ return Promise.all(Object.keys(pkg.bin).map(async k => {
  const script = resolve(dest, pkg.bin[k])
  // Best effort. Ignore errors here, the only result is that
  // a bin script is not executable. But if it's missing or
  // something, we just leave it for a later stage to trip over
  // when we can provide a more useful contextual error.
- fs.stat(script, (er, st) => {
- if (er) {
- return res()
- }
+ try {
+ const st = await stat(script)
  const mode = st.mode | 0o111
  if (mode === st.mode) {
- return res()
+ return
  }
- fs.chmod(script, mode, res)
- })
- })))
+ await chmod(script, mode)
+ } catch {
+ // Ignore errors here
+ }
+ }))
  }
 
  extract (dest) {
  // if we've already loaded the manifest, then the super got it.
  // but if not, read the unpacked manifest and chmod properly.
  return super.extract(dest)
  .then(result => this.package ? result
- : this[_readPackageJson](dest + '/package.json').then(pkg =>
+ : this[_readPackageJson](dest).then(pkg =>
  this[_exeBins](pkg, dest)).then(() => result))
  }
 

lib/git.js

@@ -160,7 +160,7 @@ class GitFetcher extends Fetcher {
  }
 
  [_prepareDir] (dir) {
- return this[_readPackageJson](dir + '/package.json').then(mani => {
+ return this[_readPackageJson](dir).then(mani => {
  // no need if we aren't going to do any preparation.
  const scripts = mani.scripts
  if (!mani.workspaces && (!scripts || !(
@@ -312,7 +312,7 @@ class GitFetcher extends Fetcher {
  return this.spec.hosted && this.resolved
  ? FileFetcher.prototype.manifest.apply(this)
  : this[_clone](dir =>
- this[_readPackageJson](dir + '/package.json')
+ this[_readPackageJson](dir)
  .then(mani => this.package = {
  ...mani,
  _resolved: this.resolved,

package.json

@@ -46,6 +46,7 @@
  "dependencies": {
  "@npmcli/git": "^5.0.0",
  "@npmcli/installed-package-contents": "^2.0.1",
+ "@npmcli/package-json": "^5.0.3",
  "@npmcli/promise-spawn": "^7.0.0",
  "@npmcli/run-script": "^8.0.0",
  "cacache": "^18.0.0",
@@ -57,8 +58,6 @@
  "npm-registry-fetch": "^16.0.0",
  "proc-log": "^4.0.0",
  "promise-retry": "^2.0.1",
- "read-package-json": "^7.0.0",
- "read-package-json-fast": "^3.0.0",
  "sigstore": "^2.2.0",
  "ssri": "^10.0.0",
  "tar": "^6.1.11"