diff --git a/node_modules/cacache/lib/content/read.js b/node_modules/cacache/lib/content/read.js
index f41b539df65dc..a1fa8a08cc0f9 100644
--- a/node_modules/cacache/lib/content/read.js
+++ b/node_modules/cacache/lib/content/read.js
@@ -13,18 +13,20 @@ async function read (cache, integrity, opts = {}) {
   const { size } = opts
   const { stat, cpath, sri } = await withContentSri(cache, integrity, async (cpath, sri) => {
     // get size
-    const stat = await fs.stat(cpath)
+    const stat = size ? { size } : await fs.stat(cpath)
     return { stat, cpath, sri }
   })
-  if (typeof size === 'number' && stat.size !== size) {
-    throw sizeError(size, stat.size)
-  }
 
   if (stat.size > MAX_SINGLE_READ_SIZE) {
     return readPipeline(cpath, stat.size, sri, new Pipeline()).concat()
   }
 
   const data = await fs.readFile(cpath, { encoding: null })
+
+  if (stat.size !== data.length) {
+    throw sizeError(stat.size, data.length)
+  }
+
   if (!ssri.checkData(data, sri)) {
     throw integrityError(sri, cpath)
   }
@@ -55,13 +57,10 @@ function readStream (cache, integrity, opts = {}) {
   // Set all this up to run on the stream and then just return the stream
   Promise.resolve().then(async () => {
     const { stat, cpath, sri } = await withContentSri(cache, integrity, async (cpath, sri) => {
-      // just stat to ensure it exists
-      const stat = await fs.stat(cpath)
+      // get size
+      const stat = size ? { size } : await fs.stat(cpath)
       return { stat, cpath, sri }
     })
-    if (typeof size === 'number' && size !== stat.size) {
-      return stream.emit('error', sizeError(size, stat.size))
-    }
 
     return readPipeline(cpath, stat.size, sri, stream)
   }).catch(err => stream.emit('error', err))
diff --git a/node_modules/cacache/package.json b/node_modules/cacache/package.json
index 83037c33fd7db..3f87af3e7dbce 100644
--- a/node_modules/cacache/package.json
+++ b/node_modules/cacache/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cacache",
-  "version": "18.0.1",
+  "version": "18.0.2",
   "cache-version": {
     "content": "2",
     "index": "5"
@@ -16,7 +16,7 @@
     "snap": "tap",
     "coverage": "tap",
     "test-docker": "docker run -it --rm --name pacotest -v \"$PWD\":/tmp -w /tmp node:latest npm test",
-    "lint": "eslint \"**/*.js\"",
+    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
     "npmclilint": "npmcli-lint",
     "lintfix": "npm run lint -- --fix",
     "postsnap": "npm run lintfix --",
@@ -60,7 +60,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.19.0",
+    "@npmcli/template-oss": "4.21.3",
     "tap": "^16.0.0"
   },
   "engines": {
@@ -69,7 +69,7 @@
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
     "windowsCI": false,
-    "version": "4.19.0",
+    "version": "4.21.3",
     "publish": "true"
   },
   "author": "GitHub Inc.",
diff --git a/package-lock.json b/package-lock.json
index c10dc48837f89..4a12afc0d56e2 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -100,7 +100,7 @@
         "@sigstore/tuf": "^2.2.0",
         "abbrev": "^2.0.0",
         "archy": "~1.0.0",
-        "cacache": "^18.0.1",
+        "cacache": "^18.0.2",
         "chalk": "^5.3.0",
         "ci-info": "^4.0.0",
         "cli-columns": "^4.0.0",
@@ -3109,9 +3109,9 @@
       }
     },
     "node_modules/cacache": {
-      "version": "18.0.1",
-      "resolved": "https://registry.npmjs.org/cacache/-/cacache-18.0.1.tgz",
-      "integrity": "sha512-g4Uf2CFZPaxtJKre6qr4zqLDOOPU7bNVhWjlNhvzc51xaTOx2noMOLhfFkTAqwtrAZAKQUuDfyjitzilpA8WsQ==",
+      "version": "18.0.2",
+      "resolved": "https://registry.npmjs.org/cacache/-/cacache-18.0.2.tgz",
+      "integrity": "sha512-r3NU8h/P+4lVUHfeRw1dtgQYar3DZMm4/cm2bZgOvrFC/su7budSOeqh52VJIC4U4iG1WWwV6vRW0znqBvxNuw==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/fs": "^3.1.0",
diff --git a/package.json b/package.json
index 450743a19b58a..a6a9fa5920719 100644
--- a/package.json
+++ b/package.json
@@ -62,7 +62,7 @@
     "@sigstore/tuf": "^2.2.0",
     "abbrev": "^2.0.0",
     "archy": "~1.0.0",
-    "cacache": "^18.0.1",
+    "cacache": "^18.0.2",
     "chalk": "^5.3.0",
     "ci-info": "^4.0.0",
     "cli-columns": "^4.0.0",