deps: update @npmcli/package-json@6.0.1

Author: reggi

node_modules/.gitignore

@@ -24,30 +24,38 @@
 /@npmcli/map-workspaces/node_modules/*
 !/@npmcli/map-workspaces/node_modules/@npmcli/
 /@npmcli/map-workspaces/node_modules/@npmcli/*
-!/@npmcli/map-workspaces/node_modules/@npmcli/git
 !/@npmcli/map-workspaces/node_modules/@npmcli/name-from-folder
-!/@npmcli/map-workspaces/node_modules/@npmcli/package-json
-!/@npmcli/map-workspaces/node_modules/@npmcli/promise-spawn
-!/@npmcli/map-workspaces/node_modules/hosted-git-info
-!/@npmcli/map-workspaces/node_modules/ini
-!/@npmcli/map-workspaces/node_modules/isexe
-!/@npmcli/map-workspaces/node_modules/json-parse-even-better-errors
-!/@npmcli/map-workspaces/node_modules/normalize-package-data
-!/@npmcli/map-workspaces/node_modules/npm-install-checks
-!/@npmcli/map-workspaces/node_modules/npm-normalize-package-bin
-!/@npmcli/map-workspaces/node_modules/npm-package-arg
-!/@npmcli/map-workspaces/node_modules/npm-pick-manifest
-!/@npmcli/map-workspaces/node_modules/proc-log
-!/@npmcli/map-workspaces/node_modules/validate-npm-package-name
-!/@npmcli/map-workspaces/node_modules/which
 !/@npmcli/metavuln-calculator
 !/@npmcli/name-from-folder
 !/@npmcli/node-gyp
 !/@npmcli/package-json
+!/@npmcli/package-json/node_modules/
+/@npmcli/package-json/node_modules/*
+!/@npmcli/package-json/node_modules/@npmcli/
+/@npmcli/package-json/node_modules/@npmcli/*
+!/@npmcli/package-json/node_modules/@npmcli/git
+!/@npmcli/package-json/node_modules/@npmcli/promise-spawn
+!/@npmcli/package-json/node_modules/hosted-git-info
+!/@npmcli/package-json/node_modules/ini
+!/@npmcli/package-json/node_modules/isexe
+!/@npmcli/package-json/node_modules/json-parse-even-better-errors
+!/@npmcli/package-json/node_modules/normalize-package-data
+!/@npmcli/package-json/node_modules/npm-install-checks
+!/@npmcli/package-json/node_modules/npm-normalize-package-bin
+!/@npmcli/package-json/node_modules/npm-package-arg
+!/@npmcli/package-json/node_modules/npm-pick-manifest
+!/@npmcli/package-json/node_modules/proc-log
+!/@npmcli/package-json/node_modules/validate-npm-package-name
+!/@npmcli/package-json/node_modules/which
 !/@npmcli/promise-spawn
 !/@npmcli/query
 !/@npmcli/redact
 !/@npmcli/run-script
+!/@npmcli/run-script/node_modules/
+/@npmcli/run-script/node_modules/*
+!/@npmcli/run-script/node_modules/@npmcli/
+/@npmcli/run-script/node_modules/@npmcli/*
+!/@npmcli/run-script/node_modules/@npmcli/package-json
 !/@pkgjs/
 /@pkgjs/*
 !/@pkgjs/parseargs
@@ -121,6 +129,11 @@
 !/indent-string
 !/ini
 !/init-package-json
+!/init-package-json/node_modules/
+/init-package-json/node_modules/*
+!/init-package-json/node_modules/@npmcli/
+/init-package-json/node_modules/@npmcli/*
+!/init-package-json/node_modules/@npmcli/package-json
 !/ip-address
 !/ip-regex
 !/is-cidr
@@ -176,6 +189,11 @@
 !/p-map
 !/package-json-from-dist
 !/pacote
+!/pacote/node_modules/
+/pacote/node_modules/*
+!/pacote/node_modules/@npmcli/
+/pacote/node_modules/@npmcli/*
+!/pacote/node_modules/@npmcli/package-json
 !/parse-conflict-json
 !/path-key
 !/path-scurry

node_modules/@npmcli/package-json/lib/normalize.js

@@ -127,13 +127,9 @@ function unixifyPath (ref) {
   return ref.replace(/\\|:/g, '/')
 }
 
-function securePath (ref) {
-  const secured = path.join('.', path.join('/', unixifyPath(ref)))
-  return secured.startsWith('.') ? '' : secured
-}
-
 function secureAndUnixifyPath (ref) {
-  return unixifyPath(securePath(ref))
+  const secured = unixifyPath(path.join('.', path.join('/', unixifyPath(ref))))
+  return secured.startsWith('./') ? '' : secured
 }
 
 // We don't want the `changes` array in here by default because this is a hot
@@ -376,7 +372,7 @@ const normalize = async (pkg, { strict, steps, root, changes, allowLegacyCase })
 
   // expand "directories.bin"
   if (steps.includes('binDir') && data.directories?.bin && !data.bin) {
-    const binsDir = path.resolve(pkg.path, securePath(data.directories.bin))
+    const binsDir = path.resolve(pkg.path, secureAndUnixifyPath(data.directories.bin))
     const bins = await lazyLoadGlob()('**', { cwd: binsDir })
     data.bin = bins.reduce((acc, binFile) => {
       if (binFile && !binFile.startsWith('.')) {