Merge branch 'npm:main' into tests_win32

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "19.0.1"
+  ".": "20.0.0"
 }

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [20.0.0](https://github.com/npm/pacote/compare/v19.0.1...v20.0.0) (2024-10-17)
+### ⚠️ BREAKING CHANGES
+* honors `ignoreScripts` property within options
+### Bug Fixes
+* [`f27af63`](https://github.com/npm/pacote/commit/f27af6334daa0a51af547f1aef64035d4bebd359) [#407](https://github.com/npm/pacote/pull/407) honors `ignoreScripts` option to prevent `prepare` lifecycle script (@reggi)
+
 ## [19.0.1](https://github.com/npm/pacote/compare/v19.0.0...v19.0.1) (2024-10-15)
 ### Bug Fixes
 * [`cbf94e8`](https://github.com/npm/pacote/commit/cbf94e8b0486e80f8f2e4c9ed7c7d18c3282096b) [#389](https://github.com/npm/pacote/pull/389) prepare script respects scriptshell config (#389) (@milaninfy)

lib/dir.js

@@ -32,6 +32,9 @@ class DirFetcher extends Fetcher {
       if (!mani.scripts || !mani.scripts.prepare) {
         return
       }
+      if (this.opts.ignoreScripts) {
+        return
+      }
 
       // we *only* run prepare.
       // pre/post-pack is run by the npm CLI for publish and pack,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "19.0.1",
+  "version": "20.0.0",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {

test/dir.js

@@ -175,3 +175,29 @@ t.test('fails without a tree or constructor', async t => {
   const f = new DirFetcher(abbrevspec, {})
   t.rejects(() => f.extract(me + '/prepare'))
 })
+
+t.test('with prepare script and ignoreScripts true', async t => {
+  let shouldNotBePopulated = false
+
+  const DirFetcherIsolate = t.mock('../lib/dir.js', {
+    '@npmcli/run-script': () => {
+      shouldNotBePopulated = true
+    },
+  })
+
+  const dir = t.testdir({
+    'package.json': JSON.stringify({
+      name: 'meow',
+      version: '1.0.0',
+      scripts: {
+        prepare: 'noop',
+      },
+    }),
+  })
+  const f = new DirFetcherIsolate(`file:${relative(process.cwd(), dir)}`, {
+    tree: await loadActual(dir),
+    ignoreScripts: true,
+  })
+  await f.extract(me + '/prepare-ignore')
+  t.ok(!shouldNotBePopulated)
+})