That's a lot of duping of 3 down into the tree. Are there other packages we control that need to get on minipass@4 first?

some of them are ours, but not all i don't think.. here's a list of everything still on minipass@3 for our future selves:

• fs-minipass
• minipass-collect (not ours)
• minipass-fetch
• minipass-flush (not ours)
• minipass-json-stream (not ours)
• minipass-pipeline (not ours)
• minipass-sized (not ours)
• minizlib (not ours)
• node-gyp (not ours)

fs-minipass isn't on template-oss yet so that didn't get updated. minipass-fetch did get updated to minipass@4 but it also depends on minizlib and minipass-sized.

Is this worth merging in the meantime even though we are at minipass@4 used by 7 deps and minipass@3 used by 9?

Got some data on tarball size from packing before and after this PR showing the total increase in tarball size is 14.08 kB after gzip.

latest

❯ node . pack

npm notice === Tarball Details ===
npm notice name:          npm
npm notice version:       9.1.3
npm notice filename:      npm-9.1.3.tgz
npm notice package size:  2.4 MB
npm notice unpacked size: 9.7 MB
npm notice shasum:        b4e60b63041e1c582c44ad570ab94c3cd50bb343
npm notice integrity:     sha512-/lKNkqYzebc6D[...]ZCIrmu53DapjA==
npm notice bundled deps:  194
npm notice bundled files: 0
npm notice own files:     2031
npm notice total files:   2031
npm notice
npm-9.1.3.tgz

❯ stat --printf="%s" npm-9.1.3.tgz
2421762

this PR

❯ node . pack

npm notice === Tarball Details ===
npm notice name:          npm
npm notice version:       9.1.3
npm notice filename:      npm-9.1.3.tgz
npm notice package size:  2.4 MB
npm notice unpacked size: 9.9 MB
npm notice shasum:        e1fc2455a8213229302c564f10b936dd5628fa52
npm notice integrity:     sha512-Dfp6DxTxZleO1[...]6Xs1097wM69HQ==
npm notice bundled deps:  194
npm notice bundled files: 0
npm notice own files:     2067
npm notice total files:   2067
npm notice
npm-9.1.3.tgz

❯ stat --printf="%s" npm-9.1.3
2435842