From f334466c53669e7debd4b9c67eafca74955509ee Mon Sep 17 00:00:00 2001
From: Luke Karrys <luke@lukekarrys.com>
Date: Wed, 30 Aug 2023 10:44:43 -0700
Subject: [PATCH] deps: pacote@17.0.4

---
 mock-registry/package.json                    |   2 +-
 node_modules/.gitignore                       |   7 -
 .../@npmcli/promise-spawn/LICENSE             |  15 --
 .../@npmcli/promise-spawn/lib/escape.js       |  68 ------
 .../@npmcli/promise-spawn/lib/index.js        | 195 ------------------
 .../@npmcli/promise-spawn/package.json        |  50 -----
 .../node_modules/@npmcli/run-script/LICENSE   |  15 --
 .../run-script/lib/is-server-package.js       |  12 --
 .../@npmcli/run-script/lib/is-windows.js      |   2 -
 .../@npmcli/run-script/lib/make-spawn-args.js |  40 ----
 .../run-script/lib/node-gyp-bin/node-gyp      |   2 -
 .../run-script/lib/node-gyp-bin/node-gyp.cmd  |   1 -
 .../@npmcli/run-script/lib/package-envs.js    |  26 ---
 .../@npmcli/run-script/lib/run-script-pkg.js  | 112 ----------
 .../@npmcli/run-script/lib/run-script.js      |  14 --
 .../@npmcli/run-script/lib/set-path.js        |  45 ----
 .../@npmcli/run-script/lib/signal-manager.js  |  49 -----
 .../run-script/lib/validate-options.js        |  39 ----
 .../@npmcli/run-script/package.json           |  53 -----
 .../pacote/node_modules/which/LICENSE         |  15 --
 .../pacote/node_modules/which/bin/which.js    |  52 -----
 .../pacote/node_modules/which/lib/index.js    | 115 -----------
 .../pacote/node_modules/which/package.json    |  51 -----
 node_modules/pacote/package.json              |   6 +-
 package-lock.json                             |  65 +-----
 package.json                                  |   2 +-
 workspaces/arborist/package.json              |   2 +-
 workspaces/libnpmdiff/package.json            |   2 +-
 workspaces/libnpmexec/package.json            |   2 +-
 workspaces/libnpmpack/package.json            |   2 +-
 30 files changed, 20 insertions(+), 1041 deletions(-)
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/promise-spawn/LICENSE
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/promise-spawn/lib/escape.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/promise-spawn/lib/index.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/promise-spawn/package.json
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/LICENSE
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/is-server-package.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/is-windows.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/make-spawn-args.js
 delete mode 100755 node_modules/pacote/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp
 delete mode 100755 node_modules/pacote/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp.cmd
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/package-envs.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/run-script-pkg.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/run-script.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/set-path.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/signal-manager.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/lib/validate-options.js
 delete mode 100644 node_modules/pacote/node_modules/@npmcli/run-script/package.json
 delete mode 100644 node_modules/pacote/node_modules/which/LICENSE
 delete mode 100755 node_modules/pacote/node_modules/which/bin/which.js
 delete mode 100644 node_modules/pacote/node_modules/which/lib/index.js
 delete mode 100644 node_modules/pacote/node_modules/which/package.json

diff --git a/mock-registry/package.json b/mock-registry/package.json
index eb7544d8cfeaf..205c420e3c6d8 100644
--- a/mock-registry/package.json
+++ b/mock-registry/package.json
@@ -56,7 +56,7 @@
     "json-stringify-safe": "^5.0.1",
     "nock": "^13.3.3",
     "npm-package-arg": "^11.0.0",
-    "pacote": "^17.0.3",
+    "pacote": "^17.0.4",
     "tap": "^16.3.8"
   }
 }
diff --git a/node_modules/.gitignore b/node_modules/.gitignore
index 580fc628b2609..93e03b09bef97 100644
--- a/node_modules/.gitignore
+++ b/node_modules/.gitignore
@@ -229,13 +229,6 @@
 !/once
 !/p-map
 !/pacote
-!/pacote/node_modules/
-/pacote/node_modules/*
-!/pacote/node_modules/@npmcli/
-/pacote/node_modules/@npmcli/*
-!/pacote/node_modules/@npmcli/promise-spawn
-!/pacote/node_modules/@npmcli/run-script
-!/pacote/node_modules/which
 !/parse-conflict-json
 !/path-is-absolute
 !/path-key
diff --git a/node_modules/pacote/node_modules/@npmcli/promise-spawn/LICENSE b/node_modules/pacote/node_modules/@npmcli/promise-spawn/LICENSE
deleted file mode 100644
index 8f90f96f4c6c5..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/promise-spawn/LICENSE
+++ /dev/null
@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) npm, Inc.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE NPM DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
-FITNESS. IN NO EVENT SHALL THE NPM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT,
-OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE,
-DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
-ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
-SOFTWARE.
diff --git a/node_modules/pacote/node_modules/@npmcli/promise-spawn/lib/escape.js b/node_modules/pacote/node_modules/@npmcli/promise-spawn/lib/escape.js
deleted file mode 100644
index 9aca8bde70a6e..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/promise-spawn/lib/escape.js
+++ /dev/null
@@ -1,68 +0,0 @@
-'use strict'
-
-// eslint-disable-next-line max-len
-// this code adapted from: https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/
-const cmd = (input, doubleEscape) => {
-  if (!input.length) {
-    return '""'
-  }
-
-  let result
-  if (!/[ \t\n\v"]/.test(input)) {
-    result = input
-  } else {
-    result = '"'
-    for (let i = 0; i <= input.length; ++i) {
-      let slashCount = 0
-      while (input[i] === '\\') {
-        ++i
-        ++slashCount
-      }
-
-      if (i === input.length) {
-        result += '\\'.repeat(slashCount * 2)
-        break
-      }
-
-      if (input[i] === '"') {
-        result += '\\'.repeat(slashCount * 2 + 1)
-        result += input[i]
-      } else {
-        result += '\\'.repeat(slashCount)
-        result += input[i]
-      }
-    }
-    result += '"'
-  }
-
-  // and finally, prefix shell meta chars with a ^
-  result = result.replace(/[ !%^&()<>|"]/g, '^$&')
-  if (doubleEscape) {
-    result = result.replace(/[ !%^&()<>|"]/g, '^$&')
-  }
-
-  return result
-}
-
-const sh = (input) => {
-  if (!input.length) {
-    return `''`
-  }
-
-  if (!/[\t\n\r "#$&'()*;<>?\\`|~]/.test(input)) {
-    return input
-  }
-
-  // replace single quotes with '\'' and wrap the whole result in a fresh set of quotes
-  const result = `'${input.replace(/'/g, `'\\''`)}'`
-    // if the input string already had single quotes around it, clean those up
-    .replace(/^(?:'')+(?!$)/, '')
-    .replace(/\\'''/g, `\\'`)
-
-  return result
-}
-
-module.exports = {
-  cmd,
-  sh,
-}
diff --git a/node_modules/pacote/node_modules/@npmcli/promise-spawn/lib/index.js b/node_modules/pacote/node_modules/@npmcli/promise-spawn/lib/index.js
deleted file mode 100644
index 571ff6b9169c9..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/promise-spawn/lib/index.js
+++ /dev/null
@@ -1,195 +0,0 @@
-'use strict'
-
-const { spawn } = require('child_process')
-const os = require('os')
-const which = require('which')
-
-const escape = require('./escape.js')
-
-// 'extra' object is for decorating the error a bit more
-const promiseSpawn = (cmd, args, opts = {}, extra = {}) => {
-  if (opts.shell) {
-    return spawnWithShell(cmd, args, opts, extra)
-  }
-
-  let proc
-
-  const p = new Promise((res, rej) => {
-    proc = spawn(cmd, args, opts)
-
-    const stdout = []
-    const stderr = []
-
-    const reject = er => rej(Object.assign(er, {
-      cmd,
-      args,
-      ...stdioResult(stdout, stderr, opts),
-      ...extra,
-    }))
-
-    proc.on('error', reject)
-
-    if (proc.stdout) {
-      proc.stdout.on('data', c => stdout.push(c)).on('error', reject)
-      proc.stdout.on('error', er => reject(er))
-    }
-
-    if (proc.stderr) {
-      proc.stderr.on('data', c => stderr.push(c)).on('error', reject)
-      proc.stderr.on('error', er => reject(er))
-    }
-
-    proc.on('close', (code, signal) => {
-      const result = {
-        cmd,
-        args,
-        code,
-        signal,
-        ...stdioResult(stdout, stderr, opts),
-        ...extra,
-      }
-
-      if (code || signal) {
-        rej(Object.assign(new Error('command failed'), result))
-      } else {
-        res(result)
-      }
-    })
-  })
-
-  p.stdin = proc.stdin
-  p.process = proc
-  return p
-}
-
-const spawnWithShell = (cmd, args, opts, extra) => {
-  let command = opts.shell
-  // if shell is set to true, we use a platform default. we can't let the core
-  // spawn method decide this for us because we need to know what shell is in use
-  // ahead of time so that we can escape arguments properly. we don't need coverage here.
-  if (command === true) {
-    // istanbul ignore next
-    command = process.platform === 'win32' ? process.env.ComSpec : 'sh'
-  }
-
-  const options = { ...opts, shell: false }
-  const realArgs = []
-  let script = cmd
-
-  // first, determine if we're in windows because if we are we need to know if we're
-  // running an .exe or a .cmd/.bat since the latter requires extra escaping
-  const isCmd = /(?:^|\\)cmd(?:\.exe)?$/i.test(command)
-  if (isCmd) {
-    let doubleEscape = false
-
-    // find the actual command we're running
-    let initialCmd = ''
-    let insideQuotes = false
-    for (let i = 0; i < cmd.length; ++i) {
-      const char = cmd.charAt(i)
-      if (char === ' ' && !insideQuotes) {
-        break
-      }
-
-      initialCmd += char
-      if (char === '"' || char === "'") {
-        insideQuotes = !insideQuotes
-      }
-    }
-
-    let pathToInitial
-    try {
-      pathToInitial = which.sync(initialCmd, {
-        path: (options.env && options.env.PATH) || process.env.PATH,
-        pathext: (options.env && options.env.PATHEXT) || process.env.PATHEXT,
-      }).toLowerCase()
-    } catch (err) {
-      pathToInitial = initialCmd.toLowerCase()
-    }
-
-    doubleEscape = pathToInitial.endsWith('.cmd') || pathToInitial.endsWith('.bat')
-    for (const arg of args) {
-      script += ` ${escape.cmd(arg, doubleEscape)}`
-    }
-    realArgs.push('/d', '/s', '/c', script)
-    options.windowsVerbatimArguments = true
-  } else {
-    for (const arg of args) {
-      script += ` ${escape.sh(arg)}`
-    }
-    realArgs.push('-c', script)
-  }
-
-  return promiseSpawn(command, realArgs, options, extra)
-}
-
-// open a file with the default application as defined by the user's OS
-const open = (_args, opts = {}, extra = {}) => {
-  const options = { ...opts, shell: true }
-  const args = [].concat(_args)
-
-  let platform = process.platform
-  // process.platform === 'linux' may actually indicate WSL, if that's the case
-  // we want to treat things as win32 anyway so the host can open the argument
-  if (platform === 'linux' && os.release().toLowerCase().includes('microsoft')) {
-    platform = 'win32'
-  }
-
-  let command = options.command
-  if (!command) {
-    if (platform === 'win32') {
-      // spawnWithShell does not do the additional os.release() check, so we
-      // have to force the shell here to make sure we treat WSL as windows.
-      options.shell = process.env.ComSpec
-      // also, the start command accepts a title so to make sure that we don't
-      // accidentally interpret the first arg as the title, we stick an empty
-      // string immediately after the start command
-      command = 'start ""'
-    } else if (platform === 'darwin') {
-      command = 'open'
-    } else {
-      command = 'xdg-open'
-    }
-  }
-
-  return spawnWithShell(command, args, options, extra)
-}
-promiseSpawn.open = open
-
-const isPipe = (stdio = 'pipe', fd) => {
-  if (stdio === 'pipe' || stdio === null) {
-    return true
-  }
-
-  if (Array.isArray(stdio)) {
-    return isPipe(stdio[fd], fd)
-  }
-
-  return false
-}
-
-const stdioResult = (stdout, stderr, { stdioString = true, stdio }) => {
-  const result = {
-    stdout: null,
-    stderr: null,
-  }
-
-  // stdio is [stdin, stdout, stderr]
-  if (isPipe(stdio, 1)) {
-    result.stdout = Buffer.concat(stdout)
-    if (stdioString) {
-      result.stdout = result.stdout.toString().trim()
-    }
-  }
-
-  if (isPipe(stdio, 2)) {
-    result.stderr = Buffer.concat(stderr)
-    if (stdioString) {
-      result.stderr = result.stderr.toString().trim()
-    }
-  }
-
-  return result
-}
-
-module.exports = promiseSpawn
diff --git a/node_modules/pacote/node_modules/@npmcli/promise-spawn/package.json b/node_modules/pacote/node_modules/@npmcli/promise-spawn/package.json
deleted file mode 100644
index 2080d9f5be9f0..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/promise-spawn/package.json
+++ /dev/null
@@ -1,50 +0,0 @@
-{
-  "name": "@npmcli/promise-spawn",
-  "version": "6.0.2",
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "main": "./lib/index.js",
-  "description": "spawn processes the way the npm cli likes to do",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/promise-spawn.git"
-  },
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "scripts": {
-    "test": "tap",
-    "snap": "tap",
-    "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
-    "posttest": "npm run lint",
-    "postsnap": "npm run lintfix --",
-    "postlint": "template-oss-check",
-    "template-oss-apply": "template-oss-apply --force"
-  },
-  "tap": {
-    "check-coverage": true,
-    "nyc-arg": [
-      "--exclude",
-      "tap-snapshots/**"
-    ]
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.11.0",
-    "minipass": "^4.0.0",
-    "spawk": "^1.7.1",
-    "tap": "^16.0.1"
-  },
-  "engines": {
-    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.11.0"
-  },
-  "dependencies": {
-    "which": "^3.0.0"
-  }
-}
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/LICENSE b/node_modules/pacote/node_modules/@npmcli/run-script/LICENSE
deleted file mode 100644
index 19cec97b18468..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/LICENSE
+++ /dev/null
@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) npm, Inc.
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/is-server-package.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/is-server-package.js
deleted file mode 100644
index d168623247527..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/is-server-package.js
+++ /dev/null
@@ -1,12 +0,0 @@
-const util = require('util')
-const fs = require('fs')
-const { stat } = fs.promises || { stat: util.promisify(fs.stat) }
-const { resolve } = require('path')
-module.exports = async path => {
-  try {
-    const st = await stat(resolve(path, 'server.js'))
-    return st.isFile()
-  } catch (er) {
-    return false
-  }
-}
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/is-windows.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/is-windows.js
deleted file mode 100644
index 651917e6ad27a..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/is-windows.js
+++ /dev/null
@@ -1,2 +0,0 @@
-const platform = process.env.__FAKE_TESTING_PLATFORM__ || process.platform
-module.exports = platform === 'win32'
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/make-spawn-args.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/make-spawn-args.js
deleted file mode 100644
index 2b2f96a91c8d5..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/make-spawn-args.js
+++ /dev/null
@@ -1,40 +0,0 @@
-/* eslint camelcase: "off" */
-const setPATH = require('./set-path.js')
-const { resolve } = require('path')
-const npm_config_node_gyp = require.resolve('node-gyp/bin/node-gyp.js')
-
-const makeSpawnArgs = options => {
-  const {
-    event,
-    path,
-    scriptShell = true,
-    binPaths,
-    env = {},
-    stdio,
-    cmd,
-    args = [],
-    stdioString,
-  } = options
-
-  const spawnEnv = setPATH(path, binPaths, {
-    // we need to at least save the PATH environment var
-    ...process.env,
-    ...env,
-    npm_package_json: resolve(path, 'package.json'),
-    npm_lifecycle_event: event,
-    npm_lifecycle_script: cmd,
-    npm_config_node_gyp,
-  })
-
-  const spawnOpts = {
-    env: spawnEnv,
-    stdioString,
-    stdio,
-    cwd: path,
-    shell: scriptShell,
-  }
-
-  return [cmd, args, spawnOpts]
-}
-
-module.exports = makeSpawnArgs
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp b/node_modules/pacote/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp
deleted file mode 100755
index 5bec64d961a3a..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp
+++ /dev/null
@@ -1,2 +0,0 @@
-#!/usr/bin/env sh
-node "$npm_config_node_gyp" "$@"
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp.cmd b/node_modules/pacote/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp.cmd
deleted file mode 100755
index 4c6987ac9868b..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/node-gyp-bin/node-gyp.cmd
+++ /dev/null
@@ -1 +0,0 @@
-@node "%npm_config_node_gyp%" %*
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/package-envs.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/package-envs.js
deleted file mode 100644
index 6b538e50247fd..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/package-envs.js
+++ /dev/null
@@ -1,26 +0,0 @@
-// https://github.com/npm/rfcs/pull/183
-
-const envVal = val => Array.isArray(val) ? val.map(v => envVal(v)).join('\n\n')
-  : val === null || val === false ? ''
-  : String(val)
-
-const packageEnvs = (env, vals, prefix) => {
-  for (const [key, val] of Object.entries(vals)) {
-    if (val === undefined) {
-      continue
-    } else if (val && !Array.isArray(val) && typeof val === 'object') {
-      packageEnvs(env, val, `${prefix}${key}_`)
-    } else {
-      env[`${prefix}${key}`] = envVal(val)
-    }
-  }
-  return env
-}
-
-module.exports = (env, pkg) => packageEnvs({ ...env }, {
-  name: pkg.name,
-  version: pkg.version,
-  config: pkg.config,
-  engines: pkg.engines,
-  bin: pkg.bin,
-}, 'npm_package_')
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/run-script-pkg.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/run-script-pkg.js
deleted file mode 100644
index a5518285d1af1..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/run-script-pkg.js
+++ /dev/null
@@ -1,112 +0,0 @@
-const makeSpawnArgs = require('./make-spawn-args.js')
-const promiseSpawn = require('@npmcli/promise-spawn')
-const packageEnvs = require('./package-envs.js')
-const { isNodeGypPackage, defaultGypInstallScript } = require('@npmcli/node-gyp')
-const signalManager = require('./signal-manager.js')
-const isServerPackage = require('./is-server-package.js')
-
-// you wouldn't like me when I'm angry...
-const bruce = (id, event, cmd, args) => {
-  let banner = id
-    ? `\n> ${id} ${event}\n`
-    : `\n> ${event}\n`
-  banner += `> ${cmd.trim().replace(/\n/g, '\n> ')}`
-  if (args.length) {
-    banner += ` ${args.join(' ')}`
-  }
-  banner += '\n'
-  return banner
-}
-
-const runScriptPkg = async options => {
-  const {
-    event,
-    path,
-    scriptShell,
-    binPaths = false,
-    env = {},
-    stdio = 'pipe',
-    pkg,
-    args = [],
-    stdioString,
-    // note: only used when stdio:inherit
-    banner = true,
-    // how long to wait for a process.kill signal
-    // only exposed here so that we can make the test go a bit faster.
-    signalTimeout = 500,
-  } = options
-
-  const { scripts = {}, gypfile } = pkg
-  let cmd = null
-  if (options.cmd) {
-    cmd = options.cmd
-  } else if (pkg.scripts && pkg.scripts[event]) {
-    cmd = pkg.scripts[event]
-  } else if (
-    // If there is no preinstall or install script, default to rebuilding node-gyp packages.
-    event === 'install' &&
-    !scripts.install &&
-    !scripts.preinstall &&
-    gypfile !== false &&
-    await isNodeGypPackage(path)
-  ) {
-    cmd = defaultGypInstallScript
-  } else if (event === 'start' && await isServerPackage(path)) {
-    cmd = 'node server.js'
-  }
-
-  if (!cmd) {
-    return { code: 0, signal: null }
-  }
-
-  if (stdio === 'inherit' && banner !== false) {
-    // we're dumping to the parent's stdout, so print the banner
-    console.log(bruce(pkg._id, event, cmd, args))
-  }
-
-  const [spawnShell, spawnArgs, spawnOpts] = makeSpawnArgs({
-    event,
-    path,
-    scriptShell,
-    binPaths,
-    env: packageEnvs(env, pkg),
-    stdio,
-    cmd,
-    args,
-    stdioString,
-  })
-
-  const p = promiseSpawn(spawnShell, spawnArgs, spawnOpts, {
-    event,
-    script: cmd,
-    pkgid: pkg._id,
-    path,
-  })
-
-  if (stdio === 'inherit') {
-    signalManager.add(p.process)
-  }
-
-  if (p.stdin) {
-    p.stdin.end()
-  }
-
-  return p.catch(er => {
-    const { signal } = er
-    if (stdio === 'inherit' && signal) {
-      // by the time we reach here, the child has already exited. we send the
-      // signal back to ourselves again so that npm will exit with the same
-      // status as the child
-      process.kill(process.pid, signal)
-
-      // just in case we don't die, reject after 500ms
-      // this also keeps the node process open long enough to actually
-      // get the signal, rather than terminating gracefully.
-      return new Promise((res, rej) => setTimeout(() => rej(er), signalTimeout))
-    } else {
-      throw er
-    }
-  })
-}
-
-module.exports = runScriptPkg
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/run-script.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/run-script.js
deleted file mode 100644
index e9d18261a2c1f..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/run-script.js
+++ /dev/null
@@ -1,14 +0,0 @@
-const rpj = require('read-package-json-fast')
-const runScriptPkg = require('./run-script-pkg.js')
-const validateOptions = require('./validate-options.js')
-const isServerPackage = require('./is-server-package.js')
-
-const runScript = options => {
-  validateOptions(options)
-  const { pkg, path } = options
-  return pkg ? runScriptPkg(options)
-    : rpj(path + '/package.json')
-      .then(readPackage => runScriptPkg({ ...options, pkg: readPackage }))
-}
-
-module.exports = Object.assign(runScript, { isServerPackage })
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/set-path.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/set-path.js
deleted file mode 100644
index c59c270d9969a..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/set-path.js
+++ /dev/null
@@ -1,45 +0,0 @@
-const { resolve, dirname, delimiter } = require('path')
-// the path here is relative, even though it does not need to be
-// in order to make the posix tests pass in windows
-const nodeGypPath = resolve(__dirname, '../lib/node-gyp-bin')
-
-// Windows typically calls its PATH environ 'Path', but this is not
-// guaranteed, nor is it guaranteed to be the only one.  Merge them
-// all together in the order they appear in the object.
-const setPATH = (projectPath, binPaths, env) => {
-  const PATH = Object.keys(env).filter(p => /^path$/i.test(p) && env[p])
-    .map(p => env[p].split(delimiter))
-    .reduce((set, p) => set.concat(p.filter(concatted => !set.includes(concatted))), [])
-    .join(delimiter)
-
-  const pathArr = []
-  if (binPaths) {
-    pathArr.push(...binPaths)
-  }
-  // unshift the ./node_modules/.bin from every folder
-  // walk up until dirname() does nothing, at the root
-  // XXX we should specify a cwd that we don't go above
-  let p = projectPath
-  let pp
-  do {
-    pathArr.push(resolve(p, 'node_modules', '.bin'))
-    pp = p
-    p = dirname(p)
-  } while (p !== pp)
-  pathArr.push(nodeGypPath, PATH)
-
-  const pathVal = pathArr.join(delimiter)
-
-  // XXX include the node-gyp-bin path somehow?  Probably better for
-  // npm or arborist or whoever to just provide that by putting it in
-  // the PATH environ, since that's preserved anyway.
-  for (const key of Object.keys(env)) {
-    if (/^path$/i.test(key)) {
-      env[key] = pathVal
-    }
-  }
-
-  return env
-}
-
-module.exports = setPATH
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/signal-manager.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/signal-manager.js
deleted file mode 100644
index efc00b488063f..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/signal-manager.js
+++ /dev/null
@@ -1,49 +0,0 @@
-const runningProcs = new Set()
-let handlersInstalled = false
-
-// NOTE: these signals aren't actually forwarded anywhere. they're trapped and
-// ignored until all child processes have exited. in our next breaking change
-// we should rename this
-const forwardedSignals = [
-  'SIGINT',
-  'SIGTERM',
-]
-
-// no-op, this is so receiving the signal doesn't cause us to exit immediately
-// instead, we exit after all children have exited when we re-send the signal
-// to ourselves. see the catch handler at the bottom of run-script-pkg.js
-// istanbul ignore next - this function does nothing
-const handleSignal = () => {}
-const setupListeners = () => {
-  for (const signal of forwardedSignals) {
-    process.on(signal, handleSignal)
-  }
-  handlersInstalled = true
-}
-
-const cleanupListeners = () => {
-  if (runningProcs.size === 0) {
-    for (const signal of forwardedSignals) {
-      process.removeListener(signal, handleSignal)
-    }
-    handlersInstalled = false
-  }
-}
-
-const add = proc => {
-  runningProcs.add(proc)
-  if (!handlersInstalled) {
-    setupListeners()
-  }
-
-  proc.once('exit', () => {
-    runningProcs.delete(proc)
-    cleanupListeners()
-  })
-}
-
-module.exports = {
-  add,
-  handleSignal,
-  forwardedSignals,
-}
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/lib/validate-options.js b/node_modules/pacote/node_modules/@npmcli/run-script/lib/validate-options.js
deleted file mode 100644
index 8d855916ecd15..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/lib/validate-options.js
+++ /dev/null
@@ -1,39 +0,0 @@
-const validateOptions = options => {
-  if (typeof options !== 'object' || !options) {
-    throw new TypeError('invalid options object provided to runScript')
-  }
-
-  const {
-    event,
-    path,
-    scriptShell,
-    env = {},
-    stdio = 'pipe',
-    args = [],
-    cmd,
-  } = options
-
-  if (!event || typeof event !== 'string') {
-    throw new TypeError('valid event not provided to runScript')
-  }
-  if (!path || typeof path !== 'string') {
-    throw new TypeError('valid path not provided to runScript')
-  }
-  if (scriptShell !== undefined && typeof scriptShell !== 'string') {
-    throw new TypeError('invalid scriptShell option provided to runScript')
-  }
-  if (typeof env !== 'object' || !env) {
-    throw new TypeError('invalid env option provided to runScript')
-  }
-  if (typeof stdio !== 'string' && !Array.isArray(stdio)) {
-    throw new TypeError('invalid stdio option provided to runScript')
-  }
-  if (!Array.isArray(args) || args.some(a => typeof a !== 'string')) {
-    throw new TypeError('invalid args option provided to runScript')
-  }
-  if (cmd !== undefined && typeof cmd !== 'string') {
-    throw new TypeError('invalid cmd option provided to runScript')
-  }
-}
-
-module.exports = validateOptions
diff --git a/node_modules/pacote/node_modules/@npmcli/run-script/package.json b/node_modules/pacote/node_modules/@npmcli/run-script/package.json
deleted file mode 100644
index 38f6f72fa6ad9..0000000000000
--- a/node_modules/pacote/node_modules/@npmcli/run-script/package.json
+++ /dev/null
@@ -1,53 +0,0 @@
-{
-  "name": "@npmcli/run-script",
-  "version": "6.0.2",
-  "description": "Run a lifecycle script for a package (descendant of npm-lifecycle)",
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "scripts": {
-    "test": "tap",
-    "eslint": "eslint",
-    "lint": "eslint \"**/*.js\"",
-    "lintfix": "npm run lint -- --fix",
-    "postlint": "template-oss-check",
-    "snap": "tap",
-    "posttest": "npm run lint",
-    "template-oss-apply": "template-oss-apply --force"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.15.1",
-    "require-inject": "^1.4.4",
-    "tap": "^16.0.1"
-  },
-  "dependencies": {
-    "@npmcli/node-gyp": "^3.0.0",
-    "@npmcli/promise-spawn": "^6.0.0",
-    "node-gyp": "^9.0.0",
-    "read-package-json-fast": "^3.0.0",
-    "which": "^3.0.0"
-  },
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "main": "lib/run-script.js",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/run-script.git"
-  },
-  "engines": {
-    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.15.1",
-    "publish": "true"
-  },
-  "tap": {
-    "nyc-arg": [
-      "--exclude",
-      "tap-snapshots/**"
-    ]
-  }
-}
diff --git a/node_modules/pacote/node_modules/which/LICENSE b/node_modules/pacote/node_modules/which/LICENSE
deleted file mode 100644
index 19129e315fe59..0000000000000
--- a/node_modules/pacote/node_modules/which/LICENSE
+++ /dev/null
@@ -1,15 +0,0 @@
-The ISC License
-
-Copyright (c) Isaac Z. Schlueter and Contributors
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/pacote/node_modules/which/bin/which.js b/node_modules/pacote/node_modules/which/bin/which.js
deleted file mode 100755
index 6df16f21acf93..0000000000000
--- a/node_modules/pacote/node_modules/which/bin/which.js
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/usr/bin/env node
-
-const which = require('../lib')
-const argv = process.argv.slice(2)
-
-const usage = (err) => {
-  if (err) {
-    console.error(`which: ${err}`)
-  }
-  console.error('usage: which [-as] program ...')
-  process.exit(1)
-}
-
-if (!argv.length) {
-  return usage()
-}
-
-let dashdash = false
-const [commands, flags] = argv.reduce((acc, arg) => {
-  if (dashdash || arg === '--') {
-    dashdash = true
-    return acc
-  }
-
-  if (!/^-/.test(arg)) {
-    acc[0].push(arg)
-    return acc
-  }
-
-  for (const flag of arg.slice(1).split('')) {
-    if (flag === 's') {
-      acc[1].silent = true
-    } else if (flag === 'a') {
-      acc[1].all = true
-    } else {
-      usage(`illegal option -- ${flag}`)
-    }
-  }
-
-  return acc
-}, [[], {}])
-
-for (const command of commands) {
-  try {
-    const res = which.sync(command, { all: flags.all })
-    if (!flags.silent) {
-      console.log([].concat(res).join('\n'))
-    }
-  } catch (err) {
-    process.exitCode = 1
-  }
-}
diff --git a/node_modules/pacote/node_modules/which/lib/index.js b/node_modules/pacote/node_modules/which/lib/index.js
deleted file mode 100644
index 52e9ea62377e7..0000000000000
--- a/node_modules/pacote/node_modules/which/lib/index.js
+++ /dev/null
@@ -1,115 +0,0 @@
-const isexe = require('isexe')
-const { join, delimiter, sep, posix } = require('path')
-
-const isWindows = process.platform === 'win32'
-
-// used to check for slashed in commands passed in. always checks for the posix
-// seperator on all platforms, and checks for the current separator when not on
-// a posix platform. don't use the isWindows check for this since that is mocked
-// in tests but we still need the code to actually work when called. that is also
-// why it is ignored from coverage.
-/* istanbul ignore next */
-const rSlash = new RegExp(`[${posix.sep}${sep === posix.sep ? '' : sep}]`.replace(/(\\)/g, '\\$1'))
-const rRel = new RegExp(`^\\.${rSlash.source}`)
-
-const getNotFoundError = (cmd) =>
-  Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })
-
-const getPathInfo = (cmd, {
-  path: optPath = process.env.PATH,
-  pathExt: optPathExt = process.env.PATHEXT,
-  delimiter: optDelimiter = delimiter,
-}) => {
-  // If it has a slash, then we don't bother searching the pathenv.
-  // just check the file itself, and that's it.
-  const pathEnv = cmd.match(rSlash) ? [''] : [
-    // windows always checks the cwd first
-    ...(isWindows ? [process.cwd()] : []),
-    ...(optPath || /* istanbul ignore next: very unusual */ '').split(optDelimiter),
-  ]
-
-  if (isWindows) {
-    const pathExtExe = optPathExt ||
-      ['.EXE', '.CMD', '.BAT', '.COM'].join(optDelimiter)
-    const pathExt = pathExtExe.split(optDelimiter).reduce((acc, item) => {
-      acc.push(item)
-      acc.push(item.toLowerCase())
-      return acc
-    }, [])
-    if (cmd.includes('.') && pathExt[0] !== '') {
-      pathExt.unshift('')
-    }
-    return { pathEnv, pathExt, pathExtExe }
-  }
-
-  return { pathEnv, pathExt: [''] }
-}
-
-const getPathPart = (raw, cmd) => {
-  const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw
-  const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : ''
-  return prefix + join(pathPart, cmd)
-}
-
-const which = async (cmd, opt = {}) => {
-  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
-  const found = []
-
-  for (const envPart of pathEnv) {
-    const p = getPathPart(envPart, cmd)
-
-    for (const ext of pathExt) {
-      const withExt = p + ext
-      const is = await isexe(withExt, { pathExt: pathExtExe, ignoreErrors: true })
-      if (is) {
-        if (!opt.all) {
-          return withExt
-        }
-        found.push(withExt)
-      }
-    }
-  }
-
-  if (opt.all && found.length) {
-    return found
-  }
-
-  if (opt.nothrow) {
-    return null
-  }
-
-  throw getNotFoundError(cmd)
-}
-
-const whichSync = (cmd, opt = {}) => {
-  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
-  const found = []
-
-  for (const pathEnvPart of pathEnv) {
-    const p = getPathPart(pathEnvPart, cmd)
-
-    for (const ext of pathExt) {
-      const withExt = p + ext
-      const is = isexe.sync(withExt, { pathExt: pathExtExe, ignoreErrors: true })
-      if (is) {
-        if (!opt.all) {
-          return withExt
-        }
-        found.push(withExt)
-      }
-    }
-  }
-
-  if (opt.all && found.length) {
-    return found
-  }
-
-  if (opt.nothrow) {
-    return null
-  }
-
-  throw getNotFoundError(cmd)
-}
-
-module.exports = which
-which.sync = whichSync
diff --git a/node_modules/pacote/node_modules/which/package.json b/node_modules/pacote/node_modules/which/package.json
deleted file mode 100644
index 989e01c9a3683..0000000000000
--- a/node_modules/pacote/node_modules/which/package.json
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  "author": "GitHub Inc.",
-  "name": "which",
-  "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",
-  "version": "3.0.1",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/npm/node-which.git"
-  },
-  "main": "lib/index.js",
-  "bin": {
-    "node-which": "./bin/which.js"
-  },
-  "license": "ISC",
-  "dependencies": {
-    "isexe": "^2.0.0"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.14.1",
-    "tap": "^16.3.0"
-  },
-  "scripts": {
-    "test": "tap",
-    "lint": "eslint \"**/*.js\"",
-    "postlint": "template-oss-check",
-    "template-oss-apply": "template-oss-apply --force",
-    "lintfix": "npm run lint -- --fix",
-    "snap": "tap",
-    "posttest": "npm run lint"
-  },
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "tap": {
-    "check-coverage": true,
-    "nyc-arg": [
-      "--exclude",
-      "tap-snapshots/**"
-    ]
-  },
-  "engines": {
-    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.14.1",
-    "publish": "true"
-  }
-}
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
index 44236542285c8..4654b03d988c3 100644
--- a/node_modules/pacote/package.json
+++ b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "17.0.3",
+  "version": "17.0.4",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -46,8 +46,8 @@
   "dependencies": {
     "@npmcli/git": "^5.0.0",
     "@npmcli/installed-package-contents": "^2.0.1",
-    "@npmcli/promise-spawn": "^6.0.1",
-    "@npmcli/run-script": "^6.0.0",
+    "@npmcli/promise-spawn": "^7.0.0",
+    "@npmcli/run-script": "^7.0.0",
     "cacache": "^18.0.0",
     "fs-minipass": "^3.0.0",
     "minipass": "^7.0.2",
diff --git a/package-lock.json b/package-lock.json
index fd926e1d2637c..2f71fd3ecdaf9 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -139,7 +139,7 @@
         "npm-user-validate": "^2.0.0",
         "npmlog": "^7.0.1",
         "p-map": "^4.0.0",
-        "pacote": "^17.0.3",
+        "pacote": "^17.0.4",
         "parse-conflict-json": "^3.0.1",
         "proc-log": "^3.0.0",
         "qrcode-terminal": "^0.12.0",
@@ -230,7 +230,7 @@
         "json-stringify-safe": "^5.0.1",
         "nock": "^13.3.3",
         "npm-package-arg": "^11.0.0",
-        "pacote": "^17.0.3",
+        "pacote": "^17.0.4",
         "tap": "^16.3.8"
       },
       "engines": {
@@ -10529,15 +10529,15 @@
       }
     },
     "node_modules/pacote": {
-      "version": "17.0.3",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-17.0.3.tgz",
-      "integrity": "sha512-nT66y5NK2u/d7qV9lP6ye+powAufDl6OHT+aOZ4Cmtq89GSqgB05Ar6aQ7DM+0+bIE5NCdYUcqFlkK4m/0LVHA==",
+      "version": "17.0.4",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-17.0.4.tgz",
+      "integrity": "sha512-eGdLHrV/g5b5MtD5cTPyss+JxOlaOloSMG3UwPMAvL8ywaLJ6beONPF40K4KKl/UI6q5hTKCJq5rCu8tkF+7Dg==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/git": "^5.0.0",
         "@npmcli/installed-package-contents": "^2.0.1",
-        "@npmcli/promise-spawn": "^6.0.1",
-        "@npmcli/run-script": "^6.0.0",
+        "@npmcli/promise-spawn": "^7.0.0",
+        "@npmcli/run-script": "^7.0.0",
         "cacache": "^18.0.0",
         "fs-minipass": "^3.0.0",
         "minipass": "^7.0.2",
@@ -10560,49 +10560,6 @@
         "node": "^16.14.0 || >=18.0.0"
       }
     },
-    "node_modules/pacote/node_modules/@npmcli/promise-spawn": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-6.0.2.tgz",
-      "integrity": "sha512-gGq0NJkIGSwdbUt4yhdF8ZrmkGKVz9vAdVzpOfnom+V8PLSmSOVhZwbNvZZS1EYcJN5hzzKBxmmVVAInM6HQLg==",
-      "inBundle": true,
-      "dependencies": {
-        "which": "^3.0.0"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
-    },
-    "node_modules/pacote/node_modules/@npmcli/run-script": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-6.0.2.tgz",
-      "integrity": "sha512-NCcr1uQo1k5U+SYlnIrbAh3cxy+OQT1VtqiAbxdymSlptbzBb62AjH2xXgjNCoP073hoa1CfCAcwoZ8k96C4nA==",
-      "inBundle": true,
-      "dependencies": {
-        "@npmcli/node-gyp": "^3.0.0",
-        "@npmcli/promise-spawn": "^6.0.0",
-        "node-gyp": "^9.0.0",
-        "read-package-json-fast": "^3.0.0",
-        "which": "^3.0.0"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
-    },
-    "node_modules/pacote/node_modules/which": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/which/-/which-3.0.1.tgz",
-      "integrity": "sha512-XA1b62dzQzLfaEOSQFTCOd5KFf/1VSzZo7/7TUjnya6u0vGGKzU96UQBZTAThCb2j4/xjBAyii1OhRLJEivHvg==",
-      "inBundle": true,
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/which.js"
-      },
-      "engines": {
-        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
-      }
-    },
     "node_modules/parent-module": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
@@ -16054,7 +16011,7 @@
         "npm-pick-manifest": "^9.0.0",
         "npm-registry-fetch": "^16.0.0",
         "npmlog": "^7.0.1",
-        "pacote": "^17.0.3",
+        "pacote": "^17.0.4",
         "parse-conflict-json": "^3.0.0",
         "proc-log": "^3.0.0",
         "promise-all-reject-late": "^1.0.0",
@@ -16135,7 +16092,7 @@
         "diff": "^5.1.0",
         "minimatch": "^9.0.0",
         "npm-package-arg": "^11.0.0",
-        "pacote": "^17.0.3",
+        "pacote": "^17.0.4",
         "tar": "^6.1.13"
       },
       "devDependencies": {
@@ -16156,7 +16113,7 @@
         "ci-info": "^3.7.1",
         "npm-package-arg": "^11.0.0",
         "npmlog": "^7.0.1",
-        "pacote": "^17.0.3",
+        "pacote": "^17.0.4",
         "proc-log": "^3.0.0",
         "read": "^2.0.0",
         "read-package-json-fast": "^3.0.2",
@@ -16234,7 +16191,7 @@
         "@npmcli/arborist": "^6.3.0",
         "@npmcli/run-script": "^7.0.0",
         "npm-package-arg": "^11.0.0",
-        "pacote": "^17.0.3"
+        "pacote": "^17.0.4"
       },
       "devDependencies": {
         "@npmcli/eslint-config": "^4.0.0",
diff --git a/package.json b/package.json
index 1e47c14a69e5a..677722dcc0b30 100644
--- a/package.json
+++ b/package.json
@@ -104,7 +104,7 @@
     "npm-user-validate": "^2.0.0",
     "npmlog": "^7.0.1",
     "p-map": "^4.0.0",
-    "pacote": "^17.0.3",
+    "pacote": "^17.0.4",
     "parse-conflict-json": "^3.0.1",
     "proc-log": "^3.0.0",
     "qrcode-terminal": "^0.12.0",
diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index 74c23da3a1dae..ade1e8e80c35e 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -26,7 +26,7 @@
     "npm-pick-manifest": "^9.0.0",
     "npm-registry-fetch": "^16.0.0",
     "npmlog": "^7.0.1",
-    "pacote": "^17.0.3",
+    "pacote": "^17.0.4",
     "parse-conflict-json": "^3.0.0",
     "proc-log": "^3.0.0",
     "promise-all-reject-late": "^1.0.0",
diff --git a/workspaces/libnpmdiff/package.json b/workspaces/libnpmdiff/package.json
index d2fe63d07219f..aa621ae418c52 100644
--- a/workspaces/libnpmdiff/package.json
+++ b/workspaces/libnpmdiff/package.json
@@ -53,7 +53,7 @@
     "diff": "^5.1.0",
     "minimatch": "^9.0.0",
     "npm-package-arg": "^11.0.0",
-    "pacote": "^17.0.3",
+    "pacote": "^17.0.4",
     "tar": "^6.1.13"
   },
   "templateOSS": {
diff --git a/workspaces/libnpmexec/package.json b/workspaces/libnpmexec/package.json
index 2ca73add6dbc5..c6f638aba6553 100644
--- a/workspaces/libnpmexec/package.json
+++ b/workspaces/libnpmexec/package.json
@@ -64,7 +64,7 @@
     "ci-info": "^3.7.1",
     "npm-package-arg": "^11.0.0",
     "npmlog": "^7.0.1",
-    "pacote": "^17.0.3",
+    "pacote": "^17.0.4",
     "proc-log": "^3.0.0",
     "read": "^2.0.0",
     "read-package-json-fast": "^3.0.2",
diff --git a/workspaces/libnpmpack/package.json b/workspaces/libnpmpack/package.json
index aef88b5da7d6d..4294794519fb2 100644
--- a/workspaces/libnpmpack/package.json
+++ b/workspaces/libnpmpack/package.json
@@ -39,7 +39,7 @@
     "@npmcli/arborist": "^6.3.0",
     "@npmcli/run-script": "^7.0.0",
     "npm-package-arg": "^11.0.0",
-    "pacote": "^17.0.3"
+    "pacote": "^17.0.4"
   },
   "engines": {
     "node": "^16.14.0 || >=18.0.0"