vlt v1.6.1: bug fixes

vlt v1.6.1 is a small maintenance release. There are no new features, just a handful of bug fixes for things reported since v1.6.0.

Changes

Git dependencies with a ref install from a cold cache. A dependency like github:owner/repo#v2 was locked with the bare shorthand as its resolved value, so a cold vlt ci or vlt install from that lockfile failed with ERR_INVALID_URL. The lockfile now records the host's tarball URL, and lockfiles written by earlier versions install as they are, without being rewritten.
vlt pack includes nested files globs. vlt pack and vlt publish skipped files matched by patterns like dist/**/*.js, since the filter never descended into subdirectories. They are packed now, and files entries are normalized the way npm does (./dist, /dist and trailing slashes work).
vlt pkg delete leaves arrays alone. Deleting a missing array property, as in vlt pkg delete keywords.missing, removed the first item of the array and exited 0. It now does nothing, while keywords[1] still deletes the second item.
#name finds aliased packages. The #name selector dropped a package that was also installed under an alias, so vlt query '#abbrev' came back empty when abbrev was aliased elsewhere in the graph. A node is now kept as long as one matching edge links to it, and :not(#alias) excludes it as expected.
Brotli tarballs keep their integrity in the lockfile. A .tar.br linked from the global store with no pinned hash left its vlt-lock.json node without an integrity, and reinstalling never repaired it. The hash is now pinned on store hits, and a lockfile node no longer picks up the hash of a different tarball kind.
vlt init in an empty directory. It printed "package.json already exists" because install read a stale cached error and ran init a second time. Both share the same manifest instance now.
Faster exit when telemetry is unreachable. An unreachable or erroring telemetry endpoint held every command's exit for about ten seconds and dumped a stack trace to stderr. It now makes one attempt and stays quiet; you can also turn it off with --telemetry=false.

Thanks to @drawliin for reporting the pack and pkg delete bugs, and to @pujitha24 for the pkg delete fix.

Try it

You can find every patch note in the GitHub releases. To install or update vlt, run:

bash

curl -fsSL https://install.vlt.sh | bash

Already on vlt? Run vlt install -g vlt to update.