npm · wraithgar · Mar 18, 2026 · Mar 18, 2026 · Mar 18, 2026 · Mar 18, 2026
@@ -53,7 +53,6 @@
     "@npmcli/promise-spawn",
     "npm-install-checks",
     "npm-package-arg",
-    "unique-filename",
     "npm-packlist",
     "bin-links",
     "nopt",
@@ -75,7 +74,6 @@
     "validate-npm-package-name",
     "json-parse-even-better-errors",
     "ssri",
-    "unique-slug",
     "@npmcli/node-gyp",
     "@npmcli/redact",
     "@npmcli/agent",

@@ -12,7 +12,6 @@ graph LR;
   bin-links-->write-file-atomic;
   cacache-->npmcli-fs["@npmcli/fs"];
   cacache-->ssri;
-  cacache-->unique-filename;
   init-package-json-->npm-package-arg;
   init-package-json-->npmcli-package-json["@npmcli/package-json"];
   init-package-json-->promzard;
@@ -80,6 +79,7 @@ graph LR;
   make-fetch-happen-->cacache;
   make-fetch-happen-->minipass-fetch;
   make-fetch-happen-->npmcli-agent["@npmcli/agent"];
+  make-fetch-happen-->npmcli-redact["@npmcli/redact"];
   make-fetch-happen-->proc-log;
   make-fetch-happen-->ssri;
   nopt-->abbrev;
@@ -246,7 +246,6 @@ graph LR;
   parse-conflict-json-->json-parse-even-better-errors;
   promzard-->read;
   read-->mute-stream;
-  unique-filename-->unique-slug;
 ```
 
 ## all dependencies
@@ -268,7 +267,6 @@ graph LR;
   cacache-->npmcli-fs["@npmcli/fs"];
   cacache-->p-map;
   cacache-->ssri;
-  cacache-->unique-filename;
   debug-->ms;
   fdir-->picomatch;
   fs-minipass-->minipass;
@@ -390,6 +388,7 @@ graph LR;
   make-fetch-happen-->minipass;
   make-fetch-happen-->negotiator;
   make-fetch-happen-->npmcli-agent["@npmcli/agent"];
+  make-fetch-happen-->npmcli-redact["@npmcli/redact"];
   make-fetch-happen-->proc-log;
   make-fetch-happen-->ssri;
   minimatch-->brace-expansion;
@@ -716,8 +715,6 @@ graph LR;
   tuf-js-->tufjs-models["@tufjs/models"];
   tufjs-models-->minimatch;
   tufjs-models-->tufjs-canonical-json["@tufjs/canonical-json"];
-  unique-filename-->unique-slug;
-  unique-slug-->imurmurhash;
   which-->isexe;
   write-file-atomic-->signal-exit;
 ```
@@ -737,5 +734,5 @@ packages higher up the chain.
  - @npmcli/package-json, npm-registry-fetch
  - @npmcli/git, make-fetch-happen
  - @npmcli/smoke-tests, @npmcli/installed-package-contents, npm-pick-manifest, cacache, promzard
- - @npmcli/docs, @npmcli/fs, npm-bundled, @npmcli/promise-spawn, npm-install-checks, npm-package-arg, unique-filename, npm-packlist, bin-links, nopt, parse-conflict-json, @npmcli/mock-globals, read
- - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, which, ini, hosted-git-info, proc-log, validate-npm-package-name, json-parse-even-better-errors, ssri, unique-slug, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate
+ - @npmcli/docs, @npmcli/fs, npm-bundled, @npmcli/promise-spawn, npm-install-checks, npm-package-arg, npm-packlist, bin-links, nopt, parse-conflict-json, @npmcli/mock-globals, read
+ - @npmcli/eslint-config, @npmcli/template-oss, ignore-walk, semver, npm-normalize-package-bin, @npmcli/name-from-folder, which, ini, hosted-git-info, proc-log, validate-npm-package-name, json-parse-even-better-errors, ssri, @npmcli/node-gyp, @npmcli/redact, @npmcli/agent, minipass-fetch, @npmcli/query, cmd-shim, read-cmd-shim, write-file-atomic, abbrev, proggy, minify-registry-metadata, mute-stream, npm-audit-report, npm-user-validate
@@ -71,7 +71,6 @@
 !/https-proxy-agent
 !/iconv-lite
 !/ignore-walk
-!/imurmurhash
 !/ini
 !/init-package-json
 !/ip-address
@@ -152,8 +151,6 @@
 !/tinyglobby/node_modules/picomatch
 !/treeverse
 !/tuf-js
-!/unique-filename
-!/unique-slug
 !/util-deprecate
 !/validate-npm-package-name
 !/walk-up-path

@@ -10,7 +10,7 @@ const Pipeline = require('minipass-pipeline')
 const Flush = require('minipass-flush')
 const path = require('path')
 const ssri = require('ssri')
-const uniqueFilename = require('unique-filename')
+const { tmpName } = require('../util/tmp')
 const fsm = require('fs-minipass')
 
 module.exports = write
@@ -152,7 +152,7 @@ async function pipeToTmp (inputStream, cache, tmpTarget, opts) {
 }
 
 async function makeTmp (cache, opts) {
-  const tmpTarget = uniqueFilename(path.join(cache, 'tmp'), opts.tmpPrefix)
+  const tmpTarget = tmpName(cache, opts.tmpPrefix)
   await fs.mkdir(path.dirname(tmpTarget), { recursive: true })
   return {
     target: tmpTarget,

@@ -12,7 +12,7 @@ const {
 const { Minipass } = require('minipass')
 const path = require('path')
 const ssri = require('ssri')
-const uniqueFilename = require('unique-filename')
+const { tmpName } = require('./util/tmp')
 
 const contentPath = require('./content/path')
 const hashToSegments = require('./util/hash-to-segments')
@@ -69,7 +69,7 @@ async function compact (cache, key, matchFn, opts = {}) {
   }).join('\n')
 
   const setup = async () => {
-    const target = uniqueFilename(path.join(cache, 'tmp'), opts.tmpPrefix)
+    const target = tmpName(cache, opts.tmpPrefix)
     await mkdir(path.dirname(target), { recursive: true })
     return {
       target,

@@ -1,11 +1,17 @@
 'use strict'
 
+const crypto = require('crypto')
 const { withTempDir } = require('@npmcli/fs')
 const fs = require('fs/promises')
 const path = require('path')
 
 module.exports.mkdir = mktmpdir
 
+module.exports.tmpName = function tmpName (cache, tmpPrefix) {
+  const id = crypto.randomUUID()
+  return path.join(cache, 'tmp', tmpPrefix ? `${tmpPrefix}-${id}` : id)
+}
+
 async function mktmpdir (cache, opts = {}) {
   const { tmpPrefix } = opts
   const tmpDir = path.join(cache, 'tmp')

@@ -1,6 +1,6 @@
 {
   "name": "cacache",
-  "version": "20.0.3",
+  "version": "20.0.4",
   "cache-version": {
     "content": "2",
     "index": "5"
@@ -55,12 +55,11 @@
     "minipass-flush": "^1.0.5",
     "minipass-pipeline": "^1.2.4",
     "p-map": "^7.0.2",
-    "ssri": "^13.0.0",
-    "unique-filename": "^5.0.0"
+    "ssri": "^13.0.0"
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^6.0.1",
-    "@npmcli/template-oss": "4.28.0",
+    "@npmcli/template-oss": "4.29.0",
     "tap": "^16.0.0"
   },
   "engines": {
@@ -69,7 +68,7 @@
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
     "windowsCI": false,
-    "version": "4.28.0",
+    "version": "4.29.0",
     "publish": "true"
   },
   "author": "GitHub Inc.",