fix(deps): update dependency @npmcli/arborist to v9

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@npmcli/arborist (source)	^4.0.0 -> ^9.0.0

---

Release Notes

npm/cli (@​npmcli/arborist)

v9.1.6

Compare Source

Bug Fixes

• 0a8b8c2 #​8621 typo bugs and other spelling fixes (#​8621) (@​jsoref)
• 54fd27f #​8602 refactor node.ideallyInert to node.inert (#​8602) (@​liamcmitchell)
• 13d8df6 #​8537 optional set calculation (#​8537) (@​liamcmitchell)

Chores

• 180e9f7 #​8610 fix spelling in workspaces/arborist (#​8610) (@​jsoref)
• 91393de #​8599 Update references for arborist to cli (#​8599) (@​jsoref)

v9.1.5

Compare Source

Bug Fixes

• 60aa94b #​8576 attach path to json parse error (@​wraithgar)
• 1eedf82 #​8576 use @​npmcli/package-json to parse package.json (@​wraithgar)
• f6c868d #​8566 calculate omit in diff (#​8566) (@​liamcmitchell, Liam Mitchell)
• d389614 #​8579 corrects peer dependency flag propagation (@​owlstronaut)

Dependencies

• 566f1b7 #​8576 [email protected]
• ea7ca5f #​8576 [email protected]
• bf6b686 #​8576 [email protected]
• 9392488 #​8576 [email protected]
• 633c4ed #​8576 [email protected]
• 1149971 #​8576 [email protected]
• 6221e27 #​8576 @npmcli/[email protected]
• da81a37 #​8576 [email protected]
• 6b4c5f9 #​8576 @npmcli/[email protected]
• b6bb9ae #​8576 [email protected]
• 1b4433f #​8576 @npmcli/[email protected]
• ceae674 #​8576 @npmcli/[email protected]
• 4f37534 #​8576 remove read-package-json-fast

Chores

• 4059dfa #​8576 properly use arborist and cache in test (@​owlstronaut)
• 402a0ab #​8576 @npmcli/[email protected] (@​wraithgar)

v9.1.4

Compare Source

Bug Fixes

• 208c06e #​8448 peer edge crash due to no parent or detached node (#​8448) (@​milaninfy)
• 3b54e9c #​8534 installLinks works with transitive external file dependencies (#​8534) (@​owlstronaut)
• ed71acb #​8473 arborist: #​8472 Keeps the registry protocol when modifying resolve URL (#​8473) (@​Jeepsboucher, Jean-Philippe Boucher)

Chores

• 619d43e #​8540 fix pruner and reify tests for optional peer deps (#​8540) (@​liamcmitchell, Liam Mitchell)

v9.1.3

Compare Source

Bug Fixes

• 6dbe21a #​8436 local transitive dependencies with --install-links=true (@​owlstronaut)
• 8042af3 #​8431 prune optional peer dependencies that are no longer explicitly depended on (#​8431) (@​G-Rath)
• c457c75 #​8430 remove duplicate loop (#​8430) (@​G-Rath)
• f7b056f #​8400 clean up audit-report code (#​8400) (@​wraithgar)
• f163d01 #​8372 use omit when checking ideal tree engine (#​8372) (@​owlstronaut)

Chores

• 3f60b5f #​8383 @npmcli/[email protected] (#​8383) (@​wraithgar)
• 01f8cc6 #​8381 @npmcli/[email protected] (#​8381) (@​wraithgar)

v9.1.2

Compare Source

Bug Fixes

• 887385d #​8356 arborist: use hosted-git-info to correctly parse resolved git urls (#​8356) (@​milaninfy)

v9.1.1

Compare Source

Bug Fixes

• 8f6eb6b #​8312 arborist: fix file dep making wrong link (#​8312) (@​alexsch01)

v9.1.0

Compare Source

Features

• 57aa89f #​8265 use run by default and run-script as the alias (#​8265) (@​owlstronaut)

Bug Fixes

• d5bcf38 #​8268 arborist: Add better error message when lockfile is malformed (#​8268) (@​owlstronaut)
• 5e1fed9 #​8290 arborist: improve README markdown (#​8290) (@​mbtools)
• 0886e7a #​8222 preserve registry path when replacing a host (@​owlstronaut)
• 815311b #​8206 arborist: workspaces correctly path to file: packages from overrides (@​owlstronaut)

v9.0.2

Compare Source

Bug Fixes

• a96d8f6 #​8184 arborist: omit failed optional dependencies from installed deps (#​8184) (@​owlstronaut, @​zkat)
• 04f53ce #​8180 arborist: safely fallback on unresolved $ dependency references (#​8180) (@​owlstronaut)
• 885accd #​8185 arborist: only replace hostname for resolved URL (#​8185) (@​billy-briggs-dev)
• 8b7bb12 #​8168 arborist: Allow downgrades to hoisted version dedupe workspace i… (#​8168) (@​owlstronaut)
• 1642556 #​8160 arborist: workspaces respect overrides on subsequent installs (#​8160) (@​owlstronaut)

Chores

• 88a7b52 #​8174 add load-virtual and reify tests for workspace override test coverage (#​8174) (@​owlstronaut, @​TrevorBurnham)

v9.0.1

Compare Source

Bug Fixes

• b9225e5 #​8089 resolve override conflicts and apply correct versions (#​8089) (@​owlstronaut)
• d586f3b #​8117 remove duplicate var (#​8117) (@​TrevorBurnham)
• 811ca29 #​8115 stop working around bug fixed in [email protected] (@​TrevorBurnham)

v9.0.0

Features

• a7bfc6d #​7972 trigger release process (#​7972) (@​wraithgar)

Chores

• a07f4e0 #​7976 @npmcli/[email protected] (@​wraithgar)

v8.0.0

Compare Source

⚠️ BREAKING CHANGES

• @npmcli/arborist now supports node ^18.17.0 || >=20.5.0

Features

• 4d57928 #​7766 devEngines (#​7766) (@​reggi)

Bug Fixes

• 365580a #​7803 align @​npmcli/arborist to npm 10 node engine range (@​reggi)

Dependencies

• 5795987 #​7803 update [email protected]
• 99ccae3 #​7803 update [email protected]
• 75786ad #​7803 update @npmcli/[email protected]
• 1c25a1d #​7803 update @npmcli/[email protected]
• 2d7fc3d #​7803 update @npmcli/[email protected]
• 1e09334 #​7803 update @npmcli/[email protected]
• 820e983 #​7803 update @npmcli/[email protected]
• 9cd6603 #​7803 update [email protected]
• 8206c4f #​7803 update [email protected]
• f6909a0 #​7803 update [email protected]
• f9b2e18 #​7803 update [email protected]
• e7ab206 #​7803 update [email protected]
• d13a20b #​7803 update [email protected]
• 092f41f #​7803 update [email protected]
• 50a7bc8 #​7803 update [email protected]
• 591130d #​7803 update [email protected]
• 105fa2b #​7803 update [email protected]
• 7214149 #​7803 update [email protected]
• 6deae9e #​7803 update [email protected]
• 034c729 #​7803 update [email protected]
• 538a4cc #​7803 update @npmcli/[email protected]
• b80d048 #​7803 update @npmcli/[email protected]
• 2076368 #​7803 update @npmcli/[email protected]
• feac87c #​7803 update @npmcli/[email protected]
• dd90f9e #​7803 update @npmcli/[email protected]

Chores

• be1e6da #​7803 update [email protected] (@​reggi)
• 2072705 #​7803 update @npmcli/[email protected] (@​reggi)
• 8035725 #​7756 @npmcli/[email protected] (@​wraithgar)

v7.5.4

Compare Source

Bug Fixes

• 6f33d74 #​7579 arborist: safeguard against null node.target in flag calculation (#​7579) (@​AmirSa12)
• a8e666e #​7602 arborist: condition to include name field in package-lock fixed (#​7602) (@​milaninfy)

v7.5.3

Compare Source

Bug Fixes

• 2d1d8d0 #​7559 adds node: specifier to all native node modules (#​7559) (@​reggi)

Chores

• 4a36d78 #​7568 fix linting in arborist debugger (@​wraithgar)

v7.5.2

Compare Source

Bug Fixes

• 12f103c #​7533 add first param titles to logs where missing (#​7533) (@​lukekarrys)
• e290352 #​7499 revert DepsQueue to re-sort on pop() (#​7499) (@​lukekarrys)
• 56a27fa #​7494 avoid caching manifests as promises (@​wraithgar)
• 722c0fa #​7463 limit packument cache size based on heap size (@​wraithgar)
• effe910 #​7475 don't omit license from stored manifests (#​7475) (@​lukekarrys)

Dependencies

• fd42986 #​7498 @npmcli/[email protected]
• ea0b07d #​7482 [email protected]
• 5b2317b #​7463 add lru-cache
• 7e15b6d #​7480 @npmcli/[email protected]
• 8b20f8c #​7480 [email protected]
• a9a6dcd #​7480 [email protected]
• e2fdb65 #​7480 [email protected]
• e71f541 #​7480 [email protected]
• 18c3b40 #​7480 [email protected]
• 714e3e1 #​7480 [email protected]
• f94d672 #​7480 [email protected]
• 43331e4 #​7480 [email protected]
• 63ef498 #​7457 [email protected]

Chores

• 9c4d3c4 #​7467 template-oss-apply (@​lukekarrys)
• 2b7ec54 #​7467 [email protected] (@​lukekarrys)

v7.5.1

Compare Source

Bug Fixes

• a1b95eb #​7453 linting: no-unused-vars (@​wraithgar)
• abcbc54 #​7430 reify: cleanup of Symbols (#​7430) (@​wraithgar)
• 57ebebf #​7418 update repository.url in package.json (#​7418) (@​wraithgar)

Dependencies

• 80eec03 #​7453 @npmcli/[email protected]
• a7145d4 #​7453 [email protected]
• 9da5738 #​7437 @npmcli/[email protected] (#​7437)

v7.5.0

Compare Source

Features

• 9123de4 #​7373 do all output over proc-log events (@​lukekarrys)
• 9622597 #​7339 refactor terminal display (#​7339) (@​lukekarrys)

Bug Fixes

• 78447d7 #​7399 prefer fs/promises over promisify (#​7399) (@​lukekarrys)
• 6512112 #​7378 use proc-log for all timers (@​lukekarrys)

Dependencies

• 36adff3 #​7408 [email protected]
• 486d46c #​7408 @npmcli/[email protected]
• 157d0ae #​7408 @npmcli/[email protected]
• fc6e291 #​7392 [email protected] (#​7392)
• 38ed048 #​7378 @npmcli/[email protected]
• 7678a3d #​7378 [email protected]
• 87f6c09 #​7373 @npmcli/[email protected]
• b8f8b41 #​7373 @npmcli/[email protected]
• 79f79c7 #​7373 [email protected]
• 9027266 #​7373 [email protected]
• ee4b3e0 #​7373 [email protected]
• ac98fd3 #​7373 [email protected]
• 9351570 #​7373 @npmcli/[email protected]

Chores

• dd39de7 #​7411 disable selflink test on apple silicon (#​7411) (@​lukekarrys)

v7.4.2

Compare Source

Bug Fixes

• ef381b1 #​7363 use @​npmcli/redact for url cleaning (#​7363) (@​lukekarrys)

v7.4.1

Compare Source

Bug Fixes

• 8cab136 #​7324 ensure maxSockets is respected (#​7324) (@​lukekarrys)
• 9bffa13 #​7320 query: properly return :missing nodes (#​7320) (@​wraithgar)

Dependencies

• 87a61fc #​7334 [email protected]
• 6fd94f2 #​7329 [email protected]
• 8cab136 #​7324 [email protected] (@​lukekarrys)

Chores

• 8cab136 #​7324 add smoke-test for large prod installs (@​lukekarrys)

v7.4.0

Features

• 2366edc #​7218 query: add :vuln pseudo selector (@​wraithgar)

Bug Fixes

• 6d1789c #​7237 Arborist code cleanup (#​7237) (@​wraithgar)
• ed17276 #​7218 query-selector: don't look up private packages on :outdated (@​wraithgar)

Dependencies

• 16d4c9f #​7218 @npmcli/[email protected]

v7.3.1

Bug Fixes

• d3f1845 #​7124 clean up idealTree code (@​wraithgar)
• 8382fb3 #​7126 fetch full packument so that libc can be assessed (@​styfle, @​ljharb)

Dependencies

• ec77e81 #​7124 [email protected]

v7.3.0

Features

• 6673c77 #​6914 add --libc option to override platform specific install (#​6914) (@​wraithgar, @​Brooooooklyn)

v7.2.2

Bug Fixes

• ae2d982 #​7027 arborist: node.target can be null when it is a file dep or symlink (#​7027) (@​ljharb, @​lukekarrys)
• f875caa #​6998 clean up shrinkwrap code (#​6998) (@​wraithgar)

Chores

• f656b66 #​7062 @npmcli/[email protected] (#​7062) (@​lukekarrys)
• 9754b17 #​7051 use global npm for workspace tests (@​lukekarrys)
• 3891757 #​7051 @npmcli/[email protected] (@​lukekarrys)

v7.2.1

Compare Source

Dependencies

• dfb6298 #​6937 [email protected] (#​6937)

v7.2.0

Compare Source

Features

• 81a460f #​6732 add package-lock-only mode to npm query (@​wraithgar)
• 0d29855 #​6732 add no-package-lock mode to npm audit (@​wraithgar)

Bug Fixes

• 0860159 #​6829 ensure workspace links query parents correctly (#​6829) (@​Carl-Foster)
• bef7481 #​6782 query with workspace descendents (#​6782) (@​bdehamer)

Dependencies

• aa6728b #​6859 [email protected]
• ce9089f #​6859 [email protected]
• 0a47af5 #​6859 [email protected]
• 3ebc474 #​6859 @npmcli/[email protected]

v7.1.0

Compare Source

Features

• 1c93c44 #​6755 Add --cpu and --os option to override platform specific install (#​6755) (@​yukukotani)

v7.0.0

Features

• fb31c7e trigger release process (@​lukekarrys)

v6.5.0

Compare Source

NEW FEATURES

• fc1a8d185 Backronym npm ci to npm clean-install. (@​zkat)
• 4be51a9cc #​81 Adds 'Homepage' to outdated --long output. (@​jbottigliero)

BUGFIXES

• 89652cb9b npm.community#1661 Fix sign-git-commit options. They were previously totally wrong. (@​zkat)
• 414f2d1a1 npm.community#1742 Set lowercase headers for npm audit requests. (@​maartenba)
• a34246baf #​75 Fix npm edit handling of scoped packages.
  (@​larsgw)* d3e8a7c72 npm.community#2303 Make summary output for npm ci go to stdout, not stderr. (@​alopezsanchez)
• 71d8fb4a9 npm.community#1377 Close the file descriptor during publish if exiting upload via an error. This will prevent strange error messages when the upload fails and make sure
  cleanup happens correctly. (@​macdja38)

DOCS UPDATES

• b1a8729c8 #​60 Mention --otp flag when prompting for OTP. (@​bakkot)
• bcae4ea81 #​64 Clarify that git dependencies use the default branch, not just master. (@​zckrs)
• 15da82690 #​72 bash_completion.d dir is sometimes found in /etc not /usr/local. (@​RobertKielty)
• 8a6ecc793 #​74 Update OTP documentation for dist-tag add to clarify --otp is needed right now. (@​scotttrinh)
• dcc03ec85 #​82 Note that prepare runs when installing git dependencies. (@​seishun)
• a91a470b7 #​83 Specify that --dry-run isn't available in older versions of npm publish. (@​kjin)
• 1b2fabcce #​96 Fix inline code tag issue in docs. (@​midare)
• 6cc70cc19 #​68 Add semver link and a note on empty string format to deprecate doc. (@​neverett)
• 61dbbb7c3 Fix semver docs after version update. (@​zkat)
• 4acd45a3d #​78 Correct spelling across various docs. (@​hugovk)

DEPENDENCIES

• 4f761283e [email protected] (@​zkat)
• 3706db0bc npm.community#1764 [email protected] (@​zkat)
• 83c2b117d [email protected] (@​petkaantonov)
• 2702f46bd [email protected] (@​watson)
• 4db6c3898 [email protected]:2 (@​dawsbot)
• 70bee4f69 [email protected] (@​isaacs)
• e469fd6be
[email protected]: Fix browser opening under Windows Subsystem for Linux (WSL). (@​thijsputman)
• 03840dced
[email protected] (@​iarna)
• 161dc0b41 [email protected] (@​petkaantonov)
• bb6f94395 [email protected]:5 (@​isaacs)
• 43b1f4c91 [email protected] (@​isaacs)
• ab62afcc4 [email protected]:2 (@​isaacs)
• 027f06be3 [email protected] (@​watson)

MISCELLANEOUS

• 27217dae8 #​70 Automatically audit dependency licenses for npm itself. (@​kemitchell)

v6.4.0

Compare Source

NEW FEATURES

• 6e9f04b0b npm/cli#8 Search for authentication token defined by environment variables by preventing the translation layer from env variable to npm option from breaking :_authToken. (@​mkhl)
• 84bfd23e7 npm/cli#35 Stop filtering out non-IPv4 addresses from local-addrs, making npm actually use IPv6 addresses when it must. (@​valentin2105)
• 792c8c709 npm/cli#31 configurable audit level for non-zero exit npm audit currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of --audit-level to npm audit to allow it to pass if only vulnerabilities below a certain level are found. Example: npm audit --audit-level=high will exit with 0 if only low or moderate level vulns are detected. (@​lennym)

BUGFIXES

• d81146181 [cli: don't check for updates to npm when we are updating npm itself npm/cli#32](https://redirect.github.com/npm/

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.