diff --git a/node_modules/.gitignore b/node_modules/.gitignore
index 7cb3ba1c3c00a..317d50a50c8ab 100644
--- a/node_modules/.gitignore
+++ b/node_modules/.gitignore
@@ -51,7 +51,6 @@
 /@npmcli/package-json/node_modules/@npmcli/*
 !/@npmcli/package-json/node_modules/@npmcli/git
 !/@npmcli/package-json/node_modules/isexe
-!/@npmcli/package-json/node_modules/normalize-package-data
 !/@npmcli/package-json/node_modules/npm-install-checks
 !/@npmcli/package-json/node_modules/npm-normalize-package-bin
 !/@npmcli/package-json/node_modules/npm-package-arg
@@ -232,9 +231,6 @@
 /nopt/node_modules/*
 !/nopt/node_modules/abbrev
 !/normalize-package-data
-!/normalize-package-data/node_modules/
-/normalize-package-data/node_modules/*
-!/normalize-package-data/node_modules/hosted-git-info
 !/npm-audit-report
 !/npm-bundled
 !/npm-install-checks
@@ -273,6 +269,7 @@
 !/pacote/node_modules/cacache
 !/pacote/node_modules/hosted-git-info
 !/pacote/node_modules/json-parse-even-better-errors
+!/pacote/node_modules/normalize-package-data
 !/pacote/node_modules/unique-filename
 !/pacote/node_modules/unique-slug
 !/parse-conflict-json
diff --git a/node_modules/normalize-package-data/node_modules/hosted-git-info/LICENSE b/node_modules/normalize-package-data/node_modules/hosted-git-info/LICENSE
deleted file mode 100644
index 45055763dc838..0000000000000
--- a/node_modules/normalize-package-data/node_modules/hosted-git-info/LICENSE
+++ /dev/null
@@ -1,13 +0,0 @@
-Copyright (c) 2015, Rebecca Turner
-
-Permission to use, copy, modify, and/or distribute this software for any
-purpose with or without fee is hereby granted, provided that the above
-copyright notice and this permission notice appear in all copies.
-
-THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
-REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
-FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
-INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
-LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
-OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
-PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/from-url.js b/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/from-url.js
deleted file mode 100644
index efc1247d59d12..0000000000000
--- a/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/from-url.js
+++ /dev/null
@@ -1,122 +0,0 @@
-'use strict'
-
-const parseUrl = require('./parse-url')
-
-// look for github shorthand inputs, such as npm/cli
-const isGitHubShorthand = (arg) => {
-  // it cannot contain whitespace before the first #
-  // it cannot start with a / because that's probably an absolute file path
-  // but it must include a slash since repos are username/repository
-  // it cannot start with a . because that's probably a relative file path
-  // it cannot start with an @ because that's a scoped package if it passes the other tests
-  // it cannot contain a : before a # because that tells us that there's a protocol
-  // a second / may not exist before a #
-  const firstHash = arg.indexOf('#')
-  const firstSlash = arg.indexOf('/')
-  const secondSlash = arg.indexOf('/', firstSlash + 1)
-  const firstColon = arg.indexOf(':')
-  const firstSpace = /\s/.exec(arg)
-  const firstAt = arg.indexOf('@')
-
-  const spaceOnlyAfterHash = !firstSpace || (firstHash > -1 && firstSpace.index > firstHash)
-  const atOnlyAfterHash = firstAt === -1 || (firstHash > -1 && firstAt > firstHash)
-  const colonOnlyAfterHash = firstColon === -1 || (firstHash > -1 && firstColon > firstHash)
-  const secondSlashOnlyAfterHash = secondSlash === -1 || (firstHash > -1 && secondSlash > firstHash)
-  const hasSlash = firstSlash > 0
-  // if a # is found, what we really want to know is that the character
-  // immediately before # is not a /
-  const doesNotEndWithSlash = firstHash > -1 ? arg[firstHash - 1] !== '/' : !arg.endsWith('/')
-  const doesNotStartWithDot = !arg.startsWith('.')
-
-  return spaceOnlyAfterHash && hasSlash && doesNotEndWithSlash &&
-    doesNotStartWithDot && atOnlyAfterHash && colonOnlyAfterHash &&
-    secondSlashOnlyAfterHash
-}
-
-module.exports = (giturl, opts, { gitHosts, protocols }) => {
-  if (!giturl) {
-    return
-  }
-
-  const correctedUrl = isGitHubShorthand(giturl) ? `github:${giturl}` : giturl
-  const parsed = parseUrl(correctedUrl, protocols)
-  if (!parsed) {
-    return
-  }
-
-  const gitHostShortcut = gitHosts.byShortcut[parsed.protocol]
-  const gitHostDomain = gitHosts.byDomain[parsed.hostname.startsWith('www.')
-    ? parsed.hostname.slice(4)
-    : parsed.hostname]
-  const gitHostName = gitHostShortcut || gitHostDomain
-  if (!gitHostName) {
-    return
-  }
-
-  const gitHostInfo = gitHosts[gitHostShortcut || gitHostDomain]
-  let auth = null
-  if (protocols[parsed.protocol]?.auth && (parsed.username || parsed.password)) {
-    auth = `${parsed.username}${parsed.password ? ':' + parsed.password : ''}`
-  }
-
-  let committish = null
-  let user = null
-  let project = null
-  let defaultRepresentation = null
-
-  try {
-    if (gitHostShortcut) {
-      let pathname = parsed.pathname.startsWith('/') ? parsed.pathname.slice(1) : parsed.pathname
-      const firstAt = pathname.indexOf('@')
-      // we ignore auth for shortcuts, so just trim it out
-      if (firstAt > -1) {
-        pathname = pathname.slice(firstAt + 1)
-      }
-
-      const lastSlash = pathname.lastIndexOf('/')
-      if (lastSlash > -1) {
-        user = decodeURIComponent(pathname.slice(0, lastSlash))
-        // we want nulls only, never empty strings
-        if (!user) {
-          user = null
-        }
-        project = decodeURIComponent(pathname.slice(lastSlash + 1))
-      } else {
-        project = decodeURIComponent(pathname)
-      }
-
-      if (project.endsWith('.git')) {
-        project = project.slice(0, -4)
-      }
-
-      if (parsed.hash) {
-        committish = decodeURIComponent(parsed.hash.slice(1))
-      }
-
-      defaultRepresentation = 'shortcut'
-    } else {
-      if (!gitHostInfo.protocols.includes(parsed.protocol)) {
-        return
-      }
-
-      const segments = gitHostInfo.extract(parsed)
-      if (!segments) {
-        return
-      }
-
-      user = segments.user && decodeURIComponent(segments.user)
-      project = decodeURIComponent(segments.project)
-      committish = decodeURIComponent(segments.committish)
-      defaultRepresentation = protocols[parsed.protocol]?.name || parsed.protocol.slice(0, -1)
-    }
-  } catch (err) {
-    /* istanbul ignore else */
-    if (err instanceof URIError) {
-      return
-    } else {
-      throw err
-    }
-  }
-
-  return [gitHostName, user, auth, project, committish, defaultRepresentation, opts]
-}
diff --git a/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/hosts.js b/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/hosts.js
deleted file mode 100644
index 9a08efd1b2d7e..0000000000000
--- a/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/hosts.js
+++ /dev/null
@@ -1,227 +0,0 @@
-/* eslint-disable max-len */
-
-'use strict'
-
-const maybeJoin = (...args) => args.every(arg => arg) ? args.join('') : ''
-const maybeEncode = (arg) => arg ? encodeURIComponent(arg) : ''
-const formatHashFragment = (f) => f.toLowerCase().replace(/^\W+|\/|\W+$/g, '').replace(/\W+/g, '-')
-
-const defaults = {
-  sshtemplate: ({ domain, user, project, committish }) =>
-    `git@${domain}:${user}/${project}.git${maybeJoin('#', committish)}`,
-  sshurltemplate: ({ domain, user, project, committish }) =>
-    `git+ssh://git@${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  edittemplate: ({ domain, user, project, committish, editpath, path }) =>
-    `https://${domain}/${user}/${project}${maybeJoin('/', editpath, '/', maybeEncode(committish || 'HEAD'), '/', path)}`,
-  browsetemplate: ({ domain, user, project, committish, treepath }) =>
-    `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish))}`,
-  browsetreetemplate: ({ domain, user, project, committish, treepath, path, fragment, hashformat }) =>
-    `https://${domain}/${user}/${project}/${treepath}/${maybeEncode(committish || 'HEAD')}/${path}${maybeJoin('#', hashformat(fragment || ''))}`,
-  browseblobtemplate: ({ domain, user, project, committish, blobpath, path, fragment, hashformat }) =>
-    `https://${domain}/${user}/${project}/${blobpath}/${maybeEncode(committish || 'HEAD')}/${path}${maybeJoin('#', hashformat(fragment || ''))}`,
-  docstemplate: ({ domain, user, project, treepath, committish }) =>
-    `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish))}#readme`,
-  httpstemplate: ({ auth, domain, user, project, committish }) =>
-    `git+https://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  filetemplate: ({ domain, user, project, committish, path }) =>
-    `https://${domain}/${user}/${project}/raw/${maybeEncode(committish || 'HEAD')}/${path}`,
-  shortcuttemplate: ({ type, user, project, committish }) =>
-    `${type}:${user}/${project}${maybeJoin('#', committish)}`,
-  pathtemplate: ({ user, project, committish }) =>
-    `${user}/${project}${maybeJoin('#', committish)}`,
-  bugstemplate: ({ domain, user, project }) =>
-    `https://${domain}/${user}/${project}/issues`,
-  hashformat: formatHashFragment,
-}
-
-const hosts = {}
-hosts.github = {
-  // First two are insecure and generally shouldn't be used any more, but
-  // they are still supported.
-  protocols: ['git:', 'http:', 'git+ssh:', 'git+https:', 'ssh:', 'https:'],
-  domain: 'github.com',
-  treepath: 'tree',
-  blobpath: 'blob',
-  editpath: 'edit',
-  filetemplate: ({ auth, user, project, committish, path }) =>
-    `https://${maybeJoin(auth, '@')}raw.githubusercontent.com/${user}/${project}/${maybeEncode(committish || 'HEAD')}/${path}`,
-  gittemplate: ({ auth, domain, user, project, committish }) =>
-    `git://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  tarballtemplate: ({ domain, user, project, committish }) =>
-    `https://codeload.${domain}/${user}/${project}/tar.gz/${maybeEncode(committish || 'HEAD')}`,
-  extract: (url) => {
-    let [, user, project, type, committish] = url.pathname.split('/', 5)
-    if (type && type !== 'tree') {
-      return
-    }
-
-    if (!type) {
-      committish = url.hash.slice(1)
-    }
-
-    if (project && project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    if (!user || !project) {
-      return
-    }
-
-    return { user, project, committish }
-  },
-}
-
-hosts.bitbucket = {
-  protocols: ['git+ssh:', 'git+https:', 'ssh:', 'https:'],
-  domain: 'bitbucket.org',
-  treepath: 'src',
-  blobpath: 'src',
-  editpath: '?mode=edit',
-  edittemplate: ({ domain, user, project, committish, treepath, path, editpath }) =>
-    `https://${domain}/${user}/${project}${maybeJoin('/', treepath, '/', maybeEncode(committish || 'HEAD'), '/', path, editpath)}`,
-  tarballtemplate: ({ domain, user, project, committish }) =>
-    `https://${domain}/${user}/${project}/get/${maybeEncode(committish || 'HEAD')}.tar.gz`,
-  extract: (url) => {
-    let [, user, project, aux] = url.pathname.split('/', 4)
-    if (['get'].includes(aux)) {
-      return
-    }
-
-    if (project && project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    if (!user || !project) {
-      return
-    }
-
-    return { user, project, committish: url.hash.slice(1) }
-  },
-}
-
-hosts.gitlab = {
-  protocols: ['git+ssh:', 'git+https:', 'ssh:', 'https:'],
-  domain: 'gitlab.com',
-  treepath: 'tree',
-  blobpath: 'tree',
-  editpath: '-/edit',
-  httpstemplate: ({ auth, domain, user, project, committish }) =>
-    `git+https://${maybeJoin(auth, '@')}${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  tarballtemplate: ({ domain, user, project, committish }) =>
-    `https://${domain}/${user}/${project}/repository/archive.tar.gz?ref=${maybeEncode(committish || 'HEAD')}`,
-  extract: (url) => {
-    const path = url.pathname.slice(1)
-    if (path.includes('/-/') || path.includes('/archive.tar.gz')) {
-      return
-    }
-
-    const segments = path.split('/')
-    let project = segments.pop()
-    if (project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    const user = segments.join('/')
-    if (!user || !project) {
-      return
-    }
-
-    return { user, project, committish: url.hash.slice(1) }
-  },
-}
-
-hosts.gist = {
-  protocols: ['git:', 'git+ssh:', 'git+https:', 'ssh:', 'https:'],
-  domain: 'gist.github.com',
-  editpath: 'edit',
-  sshtemplate: ({ domain, project, committish }) =>
-    `git@${domain}:${project}.git${maybeJoin('#', committish)}`,
-  sshurltemplate: ({ domain, project, committish }) =>
-    `git+ssh://git@${domain}/${project}.git${maybeJoin('#', committish)}`,
-  edittemplate: ({ domain, user, project, committish, editpath }) =>
-    `https://${domain}/${user}/${project}${maybeJoin('/', maybeEncode(committish))}/${editpath}`,
-  browsetemplate: ({ domain, project, committish }) =>
-    `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}`,
-  browsetreetemplate: ({ domain, project, committish, path, hashformat }) =>
-    `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}${maybeJoin('#', hashformat(path))}`,
-  browseblobtemplate: ({ domain, project, committish, path, hashformat }) =>
-    `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}${maybeJoin('#', hashformat(path))}`,
-  docstemplate: ({ domain, project, committish }) =>
-    `https://${domain}/${project}${maybeJoin('/', maybeEncode(committish))}`,
-  httpstemplate: ({ domain, project, committish }) =>
-    `git+https://${domain}/${project}.git${maybeJoin('#', committish)}`,
-  filetemplate: ({ user, project, committish, path }) =>
-    `https://gist.githubusercontent.com/${user}/${project}/raw${maybeJoin('/', maybeEncode(committish))}/${path}`,
-  shortcuttemplate: ({ type, project, committish }) =>
-    `${type}:${project}${maybeJoin('#', committish)}`,
-  pathtemplate: ({ project, committish }) =>
-    `${project}${maybeJoin('#', committish)}`,
-  bugstemplate: ({ domain, project }) =>
-    `https://${domain}/${project}`,
-  gittemplate: ({ domain, project, committish }) =>
-    `git://${domain}/${project}.git${maybeJoin('#', committish)}`,
-  tarballtemplate: ({ project, committish }) =>
-    `https://codeload.github.com/gist/${project}/tar.gz/${maybeEncode(committish || 'HEAD')}`,
-  extract: (url) => {
-    let [, user, project, aux] = url.pathname.split('/', 4)
-    if (aux === 'raw') {
-      return
-    }
-
-    if (!project) {
-      if (!user) {
-        return
-      }
-
-      project = user
-      user = null
-    }
-
-    if (project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    return { user, project, committish: url.hash.slice(1) }
-  },
-  hashformat: function (fragment) {
-    return fragment && 'file-' + formatHashFragment(fragment)
-  },
-}
-
-hosts.sourcehut = {
-  protocols: ['git+ssh:', 'https:'],
-  domain: 'git.sr.ht',
-  treepath: 'tree',
-  blobpath: 'tree',
-  filetemplate: ({ domain, user, project, committish, path }) =>
-    `https://${domain}/${user}/${project}/blob/${maybeEncode(committish) || 'HEAD'}/${path}`,
-  httpstemplate: ({ domain, user, project, committish }) =>
-    `https://${domain}/${user}/${project}.git${maybeJoin('#', committish)}`,
-  tarballtemplate: ({ domain, user, project, committish }) =>
-    `https://${domain}/${user}/${project}/archive/${maybeEncode(committish) || 'HEAD'}.tar.gz`,
-  bugstemplate: () => null,
-  extract: (url) => {
-    let [, user, project, aux] = url.pathname.split('/', 4)
-
-    // tarball url
-    if (['archive'].includes(aux)) {
-      return
-    }
-
-    if (project && project.endsWith('.git')) {
-      project = project.slice(0, -4)
-    }
-
-    if (!user || !project) {
-      return
-    }
-
-    return { user, project, committish: url.hash.slice(1) }
-  },
-}
-
-for (const [name, host] of Object.entries(hosts)) {
-  hosts[name] = Object.assign({}, defaults, host)
-}
-
-module.exports = hosts
diff --git a/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/index.js b/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/index.js
deleted file mode 100644
index 0c9d0b08c866b..0000000000000
--- a/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/index.js
+++ /dev/null
@@ -1,179 +0,0 @@
-'use strict'
-
-const { LRUCache } = require('lru-cache')
-const hosts = require('./hosts.js')
-const fromUrl = require('./from-url.js')
-const parseUrl = require('./parse-url.js')
-
-const cache = new LRUCache({ max: 1000 })
-
-class GitHost {
-  constructor (type, user, auth, project, committish, defaultRepresentation, opts = {}) {
-    Object.assign(this, GitHost.#gitHosts[type], {
-      type,
-      user,
-      auth,
-      project,
-      committish,
-      default: defaultRepresentation,
-      opts,
-    })
-  }
-
-  static #gitHosts = { byShortcut: {}, byDomain: {} }
-  static #protocols = {
-    'git+ssh:': { name: 'sshurl' },
-    'ssh:': { name: 'sshurl' },
-    'git+https:': { name: 'https', auth: true },
-    'git:': { auth: true },
-    'http:': { auth: true },
-    'https:': { auth: true },
-    'git+http:': { auth: true },
-  }
-
-  static addHost (name, host) {
-    GitHost.#gitHosts[name] = host
-    GitHost.#gitHosts.byDomain[host.domain] = name
-    GitHost.#gitHosts.byShortcut[`${name}:`] = name
-    GitHost.#protocols[`${name}:`] = { name }
-  }
-
-  static fromUrl (giturl, opts) {
-    if (typeof giturl !== 'string') {
-      return
-    }
-
-    const key = giturl + JSON.stringify(opts || {})
-
-    if (!cache.has(key)) {
-      const hostArgs = fromUrl(giturl, opts, {
-        gitHosts: GitHost.#gitHosts,
-        protocols: GitHost.#protocols,
-      })
-      cache.set(key, hostArgs ? new GitHost(...hostArgs) : undefined)
-    }
-
-    return cache.get(key)
-  }
-
-  static parseUrl (url) {
-    return parseUrl(url)
-  }
-
-  #fill (template, opts) {
-    if (typeof template !== 'function') {
-      return null
-    }
-
-    const options = { ...this, ...this.opts, ...opts }
-
-    // the path should always be set so we don't end up with 'undefined' in urls
-    if (!options.path) {
-      options.path = ''
-    }
-
-    // template functions will insert the leading slash themselves
-    if (options.path.startsWith('/')) {
-      options.path = options.path.slice(1)
-    }
-
-    if (options.noCommittish) {
-      options.committish = null
-    }
-
-    const result = template(options)
-    return options.noGitPlus && result.startsWith('git+') ? result.slice(4) : result
-  }
-
-  hash () {
-    return this.committish ? `#${this.committish}` : ''
-  }
-
-  ssh (opts) {
-    return this.#fill(this.sshtemplate, opts)
-  }
-
-  sshurl (opts) {
-    return this.#fill(this.sshurltemplate, opts)
-  }
-
-  browse (path, ...args) {
-    // not a string, treat path as opts
-    if (typeof path !== 'string') {
-      return this.#fill(this.browsetemplate, path)
-    }
-
-    if (typeof args[0] !== 'string') {
-      return this.#fill(this.browsetreetemplate, { ...args[0], path })
-    }
-
-    return this.#fill(this.browsetreetemplate, { ...args[1], fragment: args[0], path })
-  }
-
-  // If the path is known to be a file, then browseFile should be used. For some hosts
-  // the url is the same as browse, but for others like GitHub a file can use both `/tree/`
-  // and `/blob/` in the path. When using a default committish of `HEAD` then the `/tree/`
-  // path will redirect to a specific commit. Using the `/blob/` path avoids this and
-  // does not redirect to a different commit.
-  browseFile (path, ...args) {
-    if (typeof args[0] !== 'string') {
-      return this.#fill(this.browseblobtemplate, { ...args[0], path })
-    }
-
-    return this.#fill(this.browseblobtemplate, { ...args[1], fragment: args[0], path })
-  }
-
-  docs (opts) {
-    return this.#fill(this.docstemplate, opts)
-  }
-
-  bugs (opts) {
-    return this.#fill(this.bugstemplate, opts)
-  }
-
-  https (opts) {
-    return this.#fill(this.httpstemplate, opts)
-  }
-
-  git (opts) {
-    return this.#fill(this.gittemplate, opts)
-  }
-
-  shortcut (opts) {
-    return this.#fill(this.shortcuttemplate, opts)
-  }
-
-  path (opts) {
-    return this.#fill(this.pathtemplate, opts)
-  }
-
-  tarball (opts) {
-    return this.#fill(this.tarballtemplate, { ...opts, noCommittish: false })
-  }
-
-  file (path, opts) {
-    return this.#fill(this.filetemplate, { ...opts, path })
-  }
-
-  edit (path, opts) {
-    return this.#fill(this.edittemplate, { ...opts, path })
-  }
-
-  getDefaultRepresentation () {
-    return this.default
-  }
-
-  toString (opts) {
-    if (this.default && typeof this[this.default] === 'function') {
-      return this[this.default](opts)
-    }
-
-    return this.sshurl(opts)
-  }
-}
-
-for (const [name, host] of Object.entries(hosts)) {
-  GitHost.addHost(name, host)
-}
-
-module.exports = GitHost
diff --git a/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/parse-url.js b/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/parse-url.js
deleted file mode 100644
index 7d5489c008ab4..0000000000000
--- a/node_modules/normalize-package-data/node_modules/hosted-git-info/lib/parse-url.js
+++ /dev/null
@@ -1,78 +0,0 @@
-const url = require('url')
-
-const lastIndexOfBefore = (str, char, beforeChar) => {
-  const startPosition = str.indexOf(beforeChar)
-  return str.lastIndexOf(char, startPosition > -1 ? startPosition : Infinity)
-}
-
-const safeUrl = (u) => {
-  try {
-    return new url.URL(u)
-  } catch {
-    // this fn should never throw
-  }
-}
-
-// accepts input like git:github.com:user/repo and inserts the // after the first :
-const correctProtocol = (arg, protocols) => {
-  const firstColon = arg.indexOf(':')
-  const proto = arg.slice(0, firstColon + 1)
-  if (Object.prototype.hasOwnProperty.call(protocols, proto)) {
-    return arg
-  }
-
-  const firstAt = arg.indexOf('@')
-  if (firstAt > -1) {
-    if (firstAt > firstColon) {
-      return `git+ssh://${arg}`
-    } else {
-      return arg
-    }
-  }
-
-  const doubleSlash = arg.indexOf('//')
-  if (doubleSlash === firstColon + 1) {
-    return arg
-  }
-
-  return `${arg.slice(0, firstColon + 1)}//${arg.slice(firstColon + 1)}`
-}
-
-// attempt to correct an scp style url so that it will parse with `new URL()`
-const correctUrl = (giturl) => {
-  // ignore @ that come after the first hash since the denotes the start
-  // of a committish which can contain @ characters
-  const firstAt = lastIndexOfBefore(giturl, '@', '#')
-  // ignore colons that come after the hash since that could include colons such as:
-  // git@github.com:user/package-2#semver:^1.0.0
-  const lastColonBeforeHash = lastIndexOfBefore(giturl, ':', '#')
-
-  if (lastColonBeforeHash > firstAt) {
-    // the last : comes after the first @ (or there is no @)
-    // like it would in:
-    // proto://hostname.com:user/repo
-    // username@hostname.com:user/repo
-    // :password@hostname.com:user/repo
-    // username:password@hostname.com:user/repo
-    // proto://username@hostname.com:user/repo
-    // proto://:password@hostname.com:user/repo
-    // proto://username:password@hostname.com:user/repo
-    // then we replace the last : with a / to create a valid path
-    giturl = giturl.slice(0, lastColonBeforeHash) + '/' + giturl.slice(lastColonBeforeHash + 1)
-  }
-
-  if (lastIndexOfBefore(giturl, ':', '#') === -1 && giturl.indexOf('//') === -1) {
-    // we have no : at all
-    // as it would be in:
-    // username@hostname.com/user/repo
-    // then we prepend a protocol
-    giturl = `git+ssh://${giturl}`
-  }
-
-  return giturl
-}
-
-module.exports = (giturl, protocols) => {
-  const withProtocol = protocols ? correctProtocol(giturl, protocols) : giturl
-  return safeUrl(withProtocol) || safeUrl(correctUrl(withProtocol))
-}
diff --git a/node_modules/normalize-package-data/node_modules/hosted-git-info/package.json b/node_modules/normalize-package-data/node_modules/hosted-git-info/package.json
deleted file mode 100644
index d7eebd474f625..0000000000000
--- a/node_modules/normalize-package-data/node_modules/hosted-git-info/package.json
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  "name": "hosted-git-info",
-  "version": "7.0.2",
-  "description": "Provides metadata and conversions from repository urls for GitHub, Bitbucket and GitLab",
-  "main": "./lib/index.js",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/npm/hosted-git-info.git"
-  },
-  "keywords": [
-    "git",
-    "github",
-    "bitbucket",
-    "gitlab"
-  ],
-  "author": "GitHub Inc.",
-  "license": "ISC",
-  "bugs": {
-    "url": "https://github.com/npm/hosted-git-info/issues"
-  },
-  "homepage": "https://github.com/npm/hosted-git-info",
-  "scripts": {
-    "posttest": "npm run lint",
-    "snap": "tap",
-    "test": "tap",
-    "test:coverage": "tap --coverage-report=html",
-    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
-    "postlint": "template-oss-check",
-    "lintfix": "npm run lint -- --fix",
-    "template-oss-apply": "template-oss-apply --force"
-  },
-  "dependencies": {
-    "lru-cache": "^10.0.1"
-  },
-  "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.22.0",
-    "tap": "^16.0.1"
-  },
-  "files": [
-    "bin/",
-    "lib/"
-  ],
-  "engines": {
-    "node": "^16.14.0 || >=18.0.0"
-  },
-  "tap": {
-    "color": 1,
-    "coverage": true,
-    "nyc-arg": [
-      "--exclude",
-      "tap-snapshots/**"
-    ]
-  },
-  "templateOSS": {
-    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.22.0",
-    "publish": "true"
-  }
-}
diff --git a/node_modules/normalize-package-data/package.json b/node_modules/normalize-package-data/package.json
index 04a7647abe65c..a849ea3a84839 100644
--- a/node_modules/normalize-package-data/package.json
+++ b/node_modules/normalize-package-data/package.json
@@ -1,6 +1,6 @@
 {
   "name": "normalize-package-data",
-  "version": "6.0.2",
+  "version": "7.0.0",
   "author": "GitHub Inc.",
   "description": "Normalizes data that can be found in package.json files.",
   "license": "BSD-2-Clause",
@@ -12,22 +12,23 @@
   "scripts": {
     "test": "tap",
     "npmclilint": "npmcli-lint",
-    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
-    "lintfix": "npm run lint -- --fix",
+    "lint": "npm run eslint",
+    "lintfix": "npm run eslint -- --fix",
     "posttest": "npm run lint",
     "postsnap": "npm run lintfix --",
     "postlint": "template-oss-check",
     "snap": "tap",
-    "template-oss-apply": "template-oss-apply --force"
+    "template-oss-apply": "template-oss-apply --force",
+    "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
   },
   "dependencies": {
-    "hosted-git-info": "^7.0.0",
+    "hosted-git-info": "^8.0.0",
     "semver": "^7.3.5",
     "validate-npm-package-license": "^3.0.4"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.22.0",
+    "@npmcli/eslint-config": "^5.0.0",
+    "@npmcli/template-oss": "4.23.3",
     "tap": "^16.0.1"
   },
   "files": [
@@ -35,11 +36,11 @@
     "lib/"
   ],
   "engines": {
-    "node": "^16.14.0 || >=18.0.0"
+    "node": "^18.17.0 || >=20.5.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.22.0",
+    "version": "4.23.3",
     "publish": "true"
   },
   "tap": {
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/LICENSE b/node_modules/pacote/node_modules/normalize-package-data/LICENSE
similarity index 100%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/LICENSE
rename to node_modules/pacote/node_modules/normalize-package-data/LICENSE
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/extract_description.js b/node_modules/pacote/node_modules/normalize-package-data/lib/extract_description.js
similarity index 100%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/extract_description.js
rename to node_modules/pacote/node_modules/normalize-package-data/lib/extract_description.js
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/fixer.js b/node_modules/pacote/node_modules/normalize-package-data/lib/fixer.js
similarity index 100%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/fixer.js
rename to node_modules/pacote/node_modules/normalize-package-data/lib/fixer.js
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/make_warning.js b/node_modules/pacote/node_modules/normalize-package-data/lib/make_warning.js
similarity index 100%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/make_warning.js
rename to node_modules/pacote/node_modules/normalize-package-data/lib/make_warning.js
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/normalize.js b/node_modules/pacote/node_modules/normalize-package-data/lib/normalize.js
similarity index 100%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/normalize.js
rename to node_modules/pacote/node_modules/normalize-package-data/lib/normalize.js
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/safe_format.js b/node_modules/pacote/node_modules/normalize-package-data/lib/safe_format.js
similarity index 100%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/safe_format.js
rename to node_modules/pacote/node_modules/normalize-package-data/lib/safe_format.js
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/typos.json b/node_modules/pacote/node_modules/normalize-package-data/lib/typos.json
similarity index 100%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/typos.json
rename to node_modules/pacote/node_modules/normalize-package-data/lib/typos.json
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/warning_messages.json b/node_modules/pacote/node_modules/normalize-package-data/lib/warning_messages.json
similarity index 100%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/lib/warning_messages.json
rename to node_modules/pacote/node_modules/normalize-package-data/lib/warning_messages.json
diff --git a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/package.json b/node_modules/pacote/node_modules/normalize-package-data/package.json
similarity index 73%
rename from node_modules/@npmcli/package-json/node_modules/normalize-package-data/package.json
rename to node_modules/pacote/node_modules/normalize-package-data/package.json
index a849ea3a84839..04a7647abe65c 100644
--- a/node_modules/@npmcli/package-json/node_modules/normalize-package-data/package.json
+++ b/node_modules/pacote/node_modules/normalize-package-data/package.json
@@ -1,6 +1,6 @@
 {
   "name": "normalize-package-data",
-  "version": "7.0.0",
+  "version": "6.0.2",
   "author": "GitHub Inc.",
   "description": "Normalizes data that can be found in package.json files.",
   "license": "BSD-2-Clause",
@@ -12,23 +12,22 @@
   "scripts": {
     "test": "tap",
     "npmclilint": "npmcli-lint",
-    "lint": "npm run eslint",
-    "lintfix": "npm run eslint -- --fix",
+    "lint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\"",
+    "lintfix": "npm run lint -- --fix",
     "posttest": "npm run lint",
     "postsnap": "npm run lintfix --",
     "postlint": "template-oss-check",
     "snap": "tap",
-    "template-oss-apply": "template-oss-apply --force",
-    "eslint": "eslint \"**/*.{js,cjs,ts,mjs,jsx,tsx}\""
+    "template-oss-apply": "template-oss-apply --force"
   },
   "dependencies": {
-    "hosted-git-info": "^8.0.0",
+    "hosted-git-info": "^7.0.0",
     "semver": "^7.3.5",
     "validate-npm-package-license": "^3.0.4"
   },
   "devDependencies": {
-    "@npmcli/eslint-config": "^5.0.0",
-    "@npmcli/template-oss": "4.23.3",
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.22.0",
     "tap": "^16.0.1"
   },
   "files": [
@@ -36,11 +35,11 @@
     "lib/"
   ],
   "engines": {
-    "node": "^18.17.0 || >=20.5.0"
+    "node": "^16.14.0 || >=18.0.0"
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.23.3",
+    "version": "4.22.0",
     "publish": "true"
   },
   "tap": {
diff --git a/package-lock.json b/package-lock.json
index 7c308a4eef16b..eb8bb6eae0b99 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -129,7 +129,7 @@
         "ms": "^2.1.2",
         "node-gyp": "^10.2.0",
         "nopt": "^8.0.0",
-        "normalize-package-data": "^6.0.2",
+        "normalize-package-data": "^7.0.0",
         "npm-audit-report": "^5.0.0",
         "npm-install-checks": "^6.3.0",
         "npm-package-arg": "^11.0.3",
@@ -1832,21 +1832,6 @@
         "node": ">=16"
       }
     },
-    "node_modules/@npmcli/package-json/node_modules/normalize-package-data": {
-      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-7.0.0.tgz",
-      "integrity": "sha512-k6U0gKRIuNCTkwHGZqblCfLfBRh+w1vI6tBo+IeJwq2M8FUiOqhX7GH+GArQGScA7azd1WfyRCvxoXDO3hQDIA==",
-      "inBundle": true,
-      "license": "BSD-2-Clause",
-      "dependencies": {
-        "hosted-git-info": "^8.0.0",
-        "semver": "^7.3.5",
-        "validate-npm-package-license": "^3.0.4"
-      },
-      "engines": {
-        "node": "^18.17.0 || >=20.5.0"
-      }
-    },
     "node_modules/@npmcli/package-json/node_modules/npm-install-checks": {
       "version": "7.1.0",
       "resolved": "https://registry.npmjs.org/npm-install-checks/-/npm-install-checks-7.1.0.tgz",
@@ -2184,6 +2169,21 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
+    "node_modules/@npmcli/template-oss/node_modules/normalize-package-data": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-6.0.2.tgz",
+      "integrity": "sha512-V6gygoYb/5EmNI+MEGrWkC+e6+Rr7mTmfHrxDbLzxQogBkgzo76rkok0Am6thgSF7Mv2nLOajAJj5vDJZEFn7g==",
+      "dev": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "hosted-git-info": "^7.0.0",
+        "semver": "^7.3.5",
+        "validate-npm-package-license": "^3.0.4"
+      },
+      "engines": {
+        "node": "^16.14.0 || >=18.0.0"
+      }
+    },
     "node_modules/@octokit/auth-token": {
       "version": "3.0.4",
       "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-3.0.4.tgz",
@@ -10223,31 +10223,18 @@
       }
     },
     "node_modules/normalize-package-data": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-6.0.2.tgz",
-      "integrity": "sha512-V6gygoYb/5EmNI+MEGrWkC+e6+Rr7mTmfHrxDbLzxQogBkgzo76rkok0Am6thgSF7Mv2nLOajAJj5vDJZEFn7g==",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-7.0.0.tgz",
+      "integrity": "sha512-k6U0gKRIuNCTkwHGZqblCfLfBRh+w1vI6tBo+IeJwq2M8FUiOqhX7GH+GArQGScA7azd1WfyRCvxoXDO3hQDIA==",
       "inBundle": true,
       "license": "BSD-2-Clause",
       "dependencies": {
-        "hosted-git-info": "^7.0.0",
+        "hosted-git-info": "^8.0.0",
         "semver": "^7.3.5",
         "validate-npm-package-license": "^3.0.4"
       },
       "engines": {
-        "node": "^16.14.0 || >=18.0.0"
-      }
-    },
-    "node_modules/normalize-package-data/node_modules/hosted-git-info": {
-      "version": "7.0.2",
-      "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-7.0.2.tgz",
-      "integrity": "sha512-puUZAUKT5m8Zzvs72XWy3HtvVbTWljRE66cP60bxJzAqf2DgICo7lYTY2IHUmLnNpjYvw5bvmoHvPc0QO2a62w==",
-      "inBundle": true,
-      "license": "ISC",
-      "dependencies": {
-        "lru-cache": "^10.0.1"
-      },
-      "engines": {
-        "node": "^16.14.0 || >=18.0.0"
+        "node": "^18.17.0 || >=20.5.0"
       }
     },
     "node_modules/normalize-path": {
@@ -11258,6 +11245,21 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
+    "node_modules/pacote/node_modules/normalize-package-data": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-6.0.2.tgz",
+      "integrity": "sha512-V6gygoYb/5EmNI+MEGrWkC+e6+Rr7mTmfHrxDbLzxQogBkgzo76rkok0Am6thgSF7Mv2nLOajAJj5vDJZEFn7g==",
+      "inBundle": true,
+      "license": "BSD-2-Clause",
+      "dependencies": {
+        "hosted-git-info": "^7.0.0",
+        "semver": "^7.3.5",
+        "validate-npm-package-license": "^3.0.4"
+      },
+      "engines": {
+        "node": "^16.14.0 || >=18.0.0"
+      }
+    },
     "node_modules/pacote/node_modules/unique-filename": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-3.0.0.tgz",
@@ -17240,7 +17242,7 @@
       "license": "ISC",
       "dependencies": {
         "ci-info": "^4.0.0",
-        "normalize-package-data": "^6.0.1",
+        "normalize-package-data": "^7.0.0",
         "npm-package-arg": "^11.0.2",
         "npm-registry-fetch": "^17.0.1",
         "proc-log": "^4.2.0",
diff --git a/package.json b/package.json
index e2becb0b02469..18820c69e2a0d 100644
--- a/package.json
+++ b/package.json
@@ -94,7 +94,7 @@
     "ms": "^2.1.2",
     "node-gyp": "^10.2.0",
     "nopt": "^8.0.0",
-    "normalize-package-data": "^6.0.2",
+    "normalize-package-data": "^7.0.0",
     "npm-audit-report": "^5.0.0",
     "npm-install-checks": "^6.3.0",
     "npm-package-arg": "^11.0.3",
diff --git a/workspaces/libnpmpublish/package.json b/workspaces/libnpmpublish/package.json
index 69a6f3a272d51..f6364e0ed8df7 100644
--- a/workspaces/libnpmpublish/package.json
+++ b/workspaces/libnpmpublish/package.json
@@ -40,7 +40,7 @@
   "homepage": "https://npmjs.com/package/libnpmpublish",
   "dependencies": {
     "ci-info": "^4.0.0",
-    "normalize-package-data": "^6.0.1",
+    "normalize-package-data": "^7.0.0",
     "npm-package-arg": "^11.0.2",
     "npm-registry-fetch": "^17.0.1",
     "proc-log": "^4.2.0",