deps updates

DEPENDENCIES.md

@@ -226,7 +226,6 @@ graph LR;
   npmcli-run-script-->npmcli-package-json["@npmcli/package-json"];
   npmcli-run-script-->npmcli-promise-spawn["@npmcli/promise-spawn"];
   npmcli-run-script-->proc-log;
-  npmcli-run-script-->which;
   npmcli-smoke-tests-->npmcli-eslint-config["@npmcli/eslint-config"];
   npmcli-smoke-tests-->npmcli-mock-registry["@npmcli/mock-registry"];
   npmcli-smoke-tests-->npmcli-promise-spawn["@npmcli/promise-spawn"];
@@ -643,7 +642,6 @@ graph LR;
   npmcli-run-script-->npmcli-package-json["@npmcli/package-json"];
   npmcli-run-script-->npmcli-promise-spawn["@npmcli/promise-spawn"];
   npmcli-run-script-->proc-log;
-  npmcli-run-script-->which;
   npmcli-smoke-tests-->npmcli-eslint-config["@npmcli/eslint-config"];
   npmcli-smoke-tests-->npmcli-mock-registry["@npmcli/mock-registry"];
   npmcli-smoke-tests-->npmcli-promise-spawn["@npmcli/promise-spawn"];
@@ -721,7 +719,6 @@ graph LR;
   unique-filename-->unique-slug;
   unique-slug-->imurmurhash;
   which-->isexe;
-  write-file-atomic-->imurmurhash;
   write-file-atomic-->signal-exit;
 ```
 

node_modules/@npmcli/run-script/lib/set-path.js

@@ -1,3 +1,4 @@
+const { log } = require('proc-log')
 const { resolve, dirname, delimiter } = require('path')
 // the path here is relative, even though it does not need to be
 // in order to make the posix tests pass in windows
@@ -14,6 +15,13 @@ const setPATH = (projectPath, binPaths, env) => {
 
   const pathArr = []
   if (binPaths) {
+    for (const bin of binPaths) {
+      if (bin.includes(delimiter)) {
+        const event = env.npm_lifecycle_event
+        const context = event ? `"${event}" script` : 'script execution'
+        log.warn('run-script', `Path contains delimiter ("${delimiter}"), ${context} may not behave as expected.`)
+      }
+    }
     pathArr.push(...binPaths)
   }
   // unshift the ./node_modules/.bin from every folder

node_modules/@npmcli/run-script/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/run-script",
-  "version": "10.0.3",
+  "version": "10.0.4",
   "description": "Run a lifecycle script for a package (descendant of npm-lifecycle)",
   "author": "GitHub Inc.",
   "license": "ISC",
@@ -16,7 +16,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^6.0.0",
-    "@npmcli/template-oss": "4.28.0",
+    "@npmcli/template-oss": "4.29.0",
     "spawk": "^1.8.1",
     "tap": "^16.0.1"
   },
@@ -25,8 +25,7 @@
     "@npmcli/package-json": "^7.0.0",
     "@npmcli/promise-spawn": "^9.0.0",
     "node-gyp": "^12.1.0",
-    "proc-log": "^6.0.0",
-    "which": "^6.0.0"
+    "proc-log": "^6.0.0"
   },
   "files": [
     "bin/",
@@ -42,7 +41,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.28.0",
+    "version": "4.29.0",
     "publish": "true"
   },
   "tap": {

node_modules/brace-expansion/dist/commonjs/index.js

@@ -17,7 +17,7 @@ const slashPattern = /\\\\/g;
 const openPattern = /\\{/g;
 const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
-const periodPattern = /\\./g;
+const periodPattern = /\\\./g;
 exports.EXPANSION_MAX = 100_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);

node_modules/brace-expansion/dist/esm/index.js

@@ -13,7 +13,7 @@ const slashPattern = /\\\\/g;
 const openPattern = /\\{/g;
 const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
-const periodPattern = /\\./g;
+const periodPattern = /\\\./g;
 export const EXPANSION_MAX = 100_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);

node_modules/brace-expansion/package.json

@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "5.0.3",
+  "version": "5.0.4",
   "files": [
     "dist"
   ],