diff --git a/DEPENDENCIES.md b/DEPENDENCIES.md
index 7e9e26ec99102..6bdb9fc3a2ebb 100644
--- a/DEPENDENCIES.md
+++ b/DEPENDENCIES.md
@@ -527,7 +527,6 @@ graph LR;
   npm-->npmcli-run-script["@npmcli/run-script"];
   npm-->npmcli-template-oss["@npmcli/template-oss"];
   npm-->npmlog;
-  npm-->opener;
   npm-->p-map;
   npm-->pacote;
   npm-->parse-conflict-json;
@@ -658,6 +657,7 @@ graph LR;
   npmcli-move-file-->mkdirp;
   npmcli-move-file-->rimraf;
   npmcli-package-json-->json-parse-even-better-errors;
+  npmcli-promise-spawn-->which;
   npmcli-query-->postcss-selector-parser;
   npmcli-run-script-->node-gyp;
   npmcli-run-script-->npmcli-node-gyp["@npmcli/node-gyp"];
diff --git a/lib/commands/ci.js b/lib/commands/ci.js
index 0adf203a9856e..38ee1426d982a 100644
--- a/lib/commands/ci.js
+++ b/lib/commands/ci.js
@@ -94,7 +94,6 @@ class CI extends ArboristWorkspaceCmd {
           args: [],
           scriptShell,
           stdio: 'inherit',
-          stdioString: true,
           banner: !this.npm.silent,
           event,
         })
diff --git a/lib/commands/explore.js b/lib/commands/explore.js
index 5b97673b90eaa..0d915cb4c6958 100644
--- a/lib/commands/explore.js
+++ b/lib/commands/explore.js
@@ -59,7 +59,6 @@ class Explore extends BaseCommand {
         pkg,
         banner: false,
         path,
-        stdioString: true,
         event: '_explore',
         stdio: 'inherit',
       }).catch(er => {
diff --git a/lib/commands/install.js b/lib/commands/install.js
index 512226c6b5a05..246d7fdf8f02e 100644
--- a/lib/commands/install.js
+++ b/lib/commands/install.js
@@ -161,7 +161,6 @@ class Install extends ArboristWorkspaceCmd {
           args: [],
           scriptShell,
           stdio: 'inherit',
-          stdioString: true,
           banner: !this.npm.silent,
           event,
         })
diff --git a/lib/commands/run-script.js b/lib/commands/run-script.js
index 8507dbe79a90e..3852f7ba1820f 100644
--- a/lib/commands/run-script.js
+++ b/lib/commands/run-script.js
@@ -117,7 +117,6 @@ class RunScript extends BaseCommand {
       args,
       scriptShell,
       stdio: 'inherit',
-      stdioString: true,
       pkg,
       banner: !this.npm.silent,
     }
diff --git a/lib/utils/config/definitions.js b/lib/utils/config/definitions.js
index 85d13762eef67..245b9170d56fc 100644
--- a/lib/utils/config/definitions.js
+++ b/lib/utils/config/definitions.js
@@ -60,7 +60,7 @@ const buildOmitList = obj => {
 
 const editor = process.env.EDITOR ||
   process.env.VISUAL ||
-  (isWindows ? 'notepad.exe' : 'vi')
+  (isWindows ? `${process.env.SYSTEMROOT}\\notepad.exe` : 'vi')
 
 const shell = isWindows ? process.env.ComSpec || 'cmd'
   : process.env.SHELL || 'sh'
@@ -628,8 +628,8 @@ define('dry-run', {
 define('editor', {
   default: editor,
   defaultDescription: `
-    The EDITOR or VISUAL environment variables, or 'notepad.exe' on Windows,
-    or 'vim' on Unix systems
+    The EDITOR or VISUAL environment variables, or '%SYSTEMROOT%\\notepad.exe' on Windows,
+    or 'vi' on Unix systems
   `,
   type: String,
   description: `
diff --git a/lib/utils/open-url-prompt.js b/lib/utils/open-url-prompt.js
index 290040e5d14aa..df0c9709c0774 100644
--- a/lib/utils/open-url-prompt.js
+++ b/lib/utils/open-url-prompt.js
@@ -1,5 +1,5 @@
 const readline = require('readline')
-const opener = require('opener')
+const promiseSpawn = require('@npmcli/promise-spawn')
 
 function print (npm, title, url) {
   const json = npm.config.get('json')
@@ -64,15 +64,7 @@ const promptOpen = async (npm, url, title, prompt, emitter) => {
   }
 
   const command = browser === true ? null : browser
-  await new Promise((resolve, reject) => {
-    opener(url, { command }, err => {
-      if (err) {
-        return reject(err)
-      }
-
-      return resolve()
-    })
-  })
+  await promiseSpawn.open(url, { command })
 }
 
 module.exports = promptOpen
diff --git a/lib/utils/open-url.js b/lib/utils/open-url.js
index eed2449dcce51..379640773fa6e 100644
--- a/lib/utils/open-url.js
+++ b/lib/utils/open-url.js
@@ -1,4 +1,4 @@
-const opener = require('opener')
+const promiseSpawn = require('@npmcli/promise-spawn')
 
 const { URL } = require('url')
 
@@ -37,18 +37,14 @@ const open = async (npm, url, errMsg, isFile) => {
   }
 
   const command = browser === true ? null : browser
-  await new Promise((resolve, reject) => {
-    opener(url, { command }, (err) => {
-      if (err) {
-        if (err.code === 'ENOENT') {
-          printAlternateMsg()
-        } else {
-          return reject(err)
-        }
+  await promiseSpawn.open(url, { command })
+    .catch((err) => {
+      if (err.code !== 'ENOENT') {
+        throw err
       }
-      return resolve()
+
+      printAlternateMsg()
     })
-  })
 }
 
 module.exports = open
diff --git a/node_modules/.gitignore b/node_modules/.gitignore
index feac3f375b300..92d5c9cce5e3a 100644
--- a/node_modules/.gitignore
+++ b/node_modules/.gitignore
@@ -175,6 +175,7 @@
 !/node-gyp/node_modules/ssri
 !/node-gyp/node_modules/unique-filename
 !/node-gyp/node_modules/unique-slug
+!/node-gyp/node_modules/which
 !/nopt
 !/normalize-package-data
 !/npm-audit-report
@@ -189,7 +190,6 @@
 !/npm-user-validate
 !/npmlog
 !/once
-!/opener
 !/p-map
 !/pacote
 !/parse-conflict-json
diff --git a/node_modules/@npmcli/git/package.json b/node_modules/@npmcli/git/package.json
index 1f28874cdc37f..f3ce2fcfc9232 100644
--- a/node_modules/@npmcli/git/package.json
+++ b/node_modules/@npmcli/git/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/git",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "main": "lib/index.js",
   "files": [
     "bin/",
@@ -32,14 +32,14 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.7.1",
+    "@npmcli/template-oss": "4.8.0",
     "npm-package-arg": "^10.0.0",
     "rimraf": "^3.0.2",
     "slash": "^3.0.0",
     "tap": "^16.0.1"
   },
   "dependencies": {
-    "@npmcli/promise-spawn": "^5.0.0",
+    "@npmcli/promise-spawn": "^6.0.0",
     "lru-cache": "^7.4.4",
     "mkdirp": "^1.0.4",
     "npm-pick-manifest": "^8.0.0",
@@ -47,7 +47,7 @@
     "promise-inflight": "^1.0.1",
     "promise-retry": "^2.0.1",
     "semver": "^7.3.5",
-    "which": "^2.0.2"
+    "which": "^3.0.0"
   },
   "engines": {
     "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
@@ -55,6 +55,6 @@
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
     "windowsCI": false,
-    "version": "4.7.1"
+    "version": "4.8.0"
   }
 }
diff --git a/node_modules/@npmcli/run-script/lib/escape.js b/node_modules/@npmcli/promise-spawn/lib/escape.js
similarity index 100%
rename from node_modules/@npmcli/run-script/lib/escape.js
rename to node_modules/@npmcli/promise-spawn/lib/escape.js
diff --git a/node_modules/@npmcli/promise-spawn/lib/index.js b/node_modules/@npmcli/promise-spawn/lib/index.js
index 8fa8151770059..1d422045d558c 100644
--- a/node_modules/@npmcli/promise-spawn/lib/index.js
+++ b/node_modules/@npmcli/promise-spawn/lib/index.js
@@ -1,32 +1,44 @@
+'use strict'
+
 const { spawn } = require('child_process')
+const os = require('os')
+const which = require('which')
 
-const isPipe = (stdio = 'pipe', fd) =>
-  stdio === 'pipe' || stdio === null ? true
-  : Array.isArray(stdio) ? isPipe(stdio[fd], fd)
-  : false
+const escape = require('./escape.js')
 
 // 'extra' object is for decorating the error a bit more
 const promiseSpawn = (cmd, args, opts = {}, extra = {}) => {
+  if (opts.shell) {
+    return spawnWithShell(cmd, args, opts, extra)
+  }
+
   let proc
+
   const p = new Promise((res, rej) => {
     proc = spawn(cmd, args, opts)
+
     const stdout = []
     const stderr = []
+
     const reject = er => rej(Object.assign(er, {
       cmd,
       args,
       ...stdioResult(stdout, stderr, opts),
       ...extra,
     }))
+
     proc.on('error', reject)
+
     if (proc.stdout) {
       proc.stdout.on('data', c => stdout.push(c)).on('error', reject)
       proc.stdout.on('error', er => reject(er))
     }
+
     if (proc.stderr) {
       proc.stderr.on('data', c => stderr.push(c)).on('error', reject)
       proc.stderr.on('error', er => reject(er))
     }
+
     proc.on('close', (code, signal) => {
       const result = {
         cmd,
@@ -36,6 +48,7 @@ const promiseSpawn = (cmd, args, opts = {}, extra = {}) => {
         ...stdioResult(stdout, stderr, opts),
         ...extra,
       }
+
       if (code || signal) {
         rej(Object.assign(new Error('command failed'), result))
       } else {
@@ -49,14 +62,134 @@ const promiseSpawn = (cmd, args, opts = {}, extra = {}) => {
   return p
 }
 
-const stdioResult = (stdout, stderr, { stdioString, stdio }) =>
-  stdioString ? {
-    stdout: isPipe(stdio, 1) ? Buffer.concat(stdout).toString().trim() : null,
-    stderr: isPipe(stdio, 2) ? Buffer.concat(stderr).toString().trim() : null,
+const spawnWithShell = (cmd, args, opts, extra) => {
+  let command = opts.shell
+  // if shell is set to true, we use a platform default. we can't let the core
+  // spawn method decide this for us because we need to know what shell is in use
+  // ahead of time so that we can escape arguments properly. we don't need coverage here.
+  if (command === true) {
+    // istanbul ignore next
+    command = process.platform === 'win32' ? process.env.ComSpec : 'sh'
   }
-  : {
-    stdout: isPipe(stdio, 1) ? Buffer.concat(stdout) : null,
-    stderr: isPipe(stdio, 2) ? Buffer.concat(stderr) : null,
+
+  const options = { ...opts, shell: false }
+  const realArgs = []
+  let script = cmd
+
+  // first, determine if we're in windows because if we are we need to know if we're
+  // running an .exe or a .cmd/.bat since the latter requires extra escaping
+  const isCmd = /(?:^|\\)cmd(?:\.exe)?$/i.test(command)
+  if (isCmd) {
+    let doubleEscape = false
+
+    // find the actual command we're running
+    let initialCmd = ''
+    let insideQuotes = false
+    for (let i = 0; i < cmd.length; ++i) {
+      const char = cmd.charAt(i)
+      if (char === ' ' && !insideQuotes) {
+        break
+      }
+
+      initialCmd += char
+      if (char === '"' || char === "'") {
+        insideQuotes = !insideQuotes
+      }
+    }
+
+    let pathToInitial
+    try {
+      pathToInitial = which.sync(initialCmd, {
+        path: (options.env && options.env.PATH) || process.env.PATH,
+        pathext: (options.env && options.env.PATHEXT) || process.env.PATHEXT,
+      }).toLowerCase()
+    } catch (err) {
+      pathToInitial = initialCmd.toLowerCase()
+    }
+
+    doubleEscape = pathToInitial.endsWith('.cmd') || pathToInitial.endsWith('.bat')
+    for (const arg of args) {
+      script += ` ${escape.cmd(arg, doubleEscape)}`
+    }
+    realArgs.push('/d', '/s', '/c', script)
+    options.windowsVerbatimArguments = true
+  } else {
+    for (const arg of args) {
+      script += ` ${escape.sh(arg)}`
+    }
+    realArgs.push('-c', script)
   }
 
+  return promiseSpawn(command, realArgs, options, extra)
+}
+
+// open a file with the default application as defined by the user's OS
+const open = (_args, opts = {}, extra = {}) => {
+  const options = { ...opts, shell: true }
+  const args = [].concat(_args)
+
+  let platform = process.platform
+  // process.platform === 'linux' may actually indicate WSL, if that's the case
+  // we want to treat things as win32 anyway so the host can open the argument
+  if (platform === 'linux' && os.release().includes('Microsoft')) {
+    platform = 'win32'
+  }
+
+  let command = options.command
+  if (!command) {
+    if (platform === 'win32') {
+      // spawnWithShell does not do the additional os.release() check, so we
+      // have to force the shell here to make sure we treat WSL as windows.
+      options.shell = process.env.ComSpec
+      // also, the start command accepts a title so to make sure that we don't
+      // accidentally interpret the first arg as the title, we stick an empty
+      // string immediately after the start command
+      command = 'start ""'
+    } else if (platform === 'darwin') {
+      command = 'open'
+    } else {
+      command = 'xdg-open'
+    }
+  }
+
+  return spawnWithShell(command, args, options, extra)
+}
+promiseSpawn.open = open
+
+const isPipe = (stdio = 'pipe', fd) => {
+  if (stdio === 'pipe' || stdio === null) {
+    return true
+  }
+
+  if (Array.isArray(stdio)) {
+    return isPipe(stdio[fd], fd)
+  }
+
+  return false
+}
+
+const stdioResult = (stdout, stderr, { stdioString = true, stdio }) => {
+  const result = {
+    stdout: null,
+    stderr: null,
+  }
+
+  // stdio is [stdin, stdout, stderr]
+  if (isPipe(stdio, 1)) {
+    result.stdout = Buffer.concat(stdout)
+    if (stdioString) {
+      result.stdout = result.stdout.toString().trim()
+    }
+  }
+
+  if (isPipe(stdio, 2)) {
+    result.stderr = Buffer.concat(stderr)
+    if (stdioString) {
+      result.stderr = result.stderr.toString().trim()
+    }
+  }
+
+  return result
+}
+
 module.exports = promiseSpawn
diff --git a/node_modules/@npmcli/promise-spawn/package.json b/node_modules/@npmcli/promise-spawn/package.json
index 93ae0259c4b7f..c21e84fe83599 100644
--- a/node_modules/@npmcli/promise-spawn/package.json
+++ b/node_modules/@npmcli/promise-spawn/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/promise-spawn",
-  "version": "5.0.0",
+  "version": "6.0.1",
   "files": [
     "bin/",
     "lib/"
@@ -32,8 +32,9 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.7.1",
+    "@npmcli/template-oss": "4.8.0",
     "minipass": "^3.1.1",
+    "spawk": "^1.7.1",
     "tap": "^16.0.1"
   },
   "engines": {
@@ -41,6 +42,9 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.7.1"
+    "version": "4.8.0"
+  },
+  "dependencies": {
+    "which": "^3.0.0"
   }
 }
diff --git a/node_modules/@npmcli/run-script/lib/make-spawn-args.js b/node_modules/@npmcli/run-script/lib/make-spawn-args.js
index 5b06db3c16eac..2b2f96a91c8d5 100644
--- a/node_modules/@npmcli/run-script/lib/make-spawn-args.js
+++ b/node_modules/@npmcli/run-script/lib/make-spawn-args.js
@@ -1,22 +1,19 @@
 /* eslint camelcase: "off" */
-const isWindows = require('./is-windows.js')
 const setPATH = require('./set-path.js')
 const { resolve } = require('path')
-const which = require('which')
 const npm_config_node_gyp = require.resolve('node-gyp/bin/node-gyp.js')
-const escape = require('./escape.js')
 
 const makeSpawnArgs = options => {
   const {
     event,
     path,
-    scriptShell = isWindows ? process.env.ComSpec || 'cmd' : 'sh',
+    scriptShell = true,
     binPaths,
     env = {},
     stdio,
     cmd,
     args = [],
-    stdioString = false,
+    stdioString,
   } = options
 
   const spawnEnv = setPATH(path, binPaths, {
@@ -29,55 +26,15 @@ const makeSpawnArgs = options => {
     npm_config_node_gyp,
   })
 
-  let doubleEscape = false
-  const isCmd = /(?:^|\\)cmd(?:\.exe)?$/i.test(scriptShell)
-  if (isCmd) {
-    let initialCmd = ''
-    let insideQuotes = false
-    for (let i = 0; i < cmd.length; ++i) {
-      const char = cmd.charAt(i)
-      if (char === ' ' && !insideQuotes) {
-        break
-      }
-
-      initialCmd += char
-      if (char === '"' || char === "'") {
-        insideQuotes = !insideQuotes
-      }
-    }
-
-    let pathToInitial
-    try {
-      pathToInitial = which.sync(initialCmd, {
-        path: spawnEnv.path,
-        pathext: spawnEnv.pathext,
-      }).toLowerCase()
-    } catch (err) {
-      pathToInitial = initialCmd.toLowerCase()
-    }
-
-    doubleEscape = pathToInitial.endsWith('.cmd') || pathToInitial.endsWith('.bat')
-  }
-
-  let script = cmd
-  for (const arg of args) {
-    script += isCmd
-      ? ` ${escape.cmd(arg, doubleEscape)}`
-      : ` ${escape.sh(arg)}`
-  }
-  const spawnArgs = isCmd
-    ? ['/d', '/s', '/c', script]
-    : ['-c', '--', script]
-
   const spawnOpts = {
     env: spawnEnv,
     stdioString,
     stdio,
     cwd: path,
-    ...(isCmd ? { windowsVerbatimArguments: true } : {}),
+    shell: scriptShell,
   }
 
-  return [scriptShell, spawnArgs, spawnOpts]
+  return [cmd, args, spawnOpts]
 }
 
 module.exports = makeSpawnArgs
diff --git a/node_modules/@npmcli/run-script/lib/run-script-pkg.js b/node_modules/@npmcli/run-script/lib/run-script-pkg.js
index c10d20bb73480..cbb0a0b3a5e73 100644
--- a/node_modules/@npmcli/run-script/lib/run-script-pkg.js
+++ b/node_modules/@npmcli/run-script/lib/run-script-pkg.js
@@ -28,7 +28,7 @@ const runScriptPkg = async options => {
     stdio = 'pipe',
     pkg,
     args = [],
-    stdioString = false,
+    stdioString,
     // note: only used when stdio:inherit
     banner = true,
     // how long to wait for a process.kill signal
diff --git a/node_modules/@npmcli/run-script/package.json b/node_modules/@npmcli/run-script/package.json
index 2b4494ff7e8d2..dbae5733a368b 100644
--- a/node_modules/@npmcli/run-script/package.json
+++ b/node_modules/@npmcli/run-script/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@npmcli/run-script",
-  "version": "5.0.1",
+  "version": "6.0.0",
   "description": "Run a lifecycle script for a package (descendant of npm-lifecycle)",
   "author": "GitHub Inc.",
   "license": "ISC",
@@ -16,17 +16,17 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.7.1",
+    "@npmcli/template-oss": "4.8.0",
     "minipass": "^3.1.6",
     "require-inject": "^1.4.4",
     "tap": "^16.0.1"
   },
   "dependencies": {
     "@npmcli/node-gyp": "^3.0.0",
-    "@npmcli/promise-spawn": "^5.0.0",
+    "@npmcli/promise-spawn": "^6.0.0",
     "node-gyp": "^9.0.0",
     "read-package-json-fast": "^3.0.0",
-    "which": "^2.0.2"
+    "which": "^3.0.0"
   },
   "files": [
     "bin/",
@@ -42,7 +42,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.7.1"
+    "version": "4.8.0"
   },
   "tap": {
     "nyc-arg": [
diff --git a/node_modules/node-gyp/node_modules/which/LICENSE b/node_modules/node-gyp/node_modules/which/LICENSE
new file mode 100644
index 0000000000000..19129e315fe59
--- /dev/null
+++ b/node_modules/node-gyp/node_modules/which/LICENSE
@@ -0,0 +1,15 @@
+The ISC License
+
+Copyright (c) Isaac Z. Schlueter and Contributors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
diff --git a/node_modules/which/bin/node-which b/node_modules/node-gyp/node_modules/which/bin/node-which
similarity index 100%
rename from node_modules/which/bin/node-which
rename to node_modules/node-gyp/node_modules/which/bin/node-which
diff --git a/node_modules/node-gyp/node_modules/which/package.json b/node_modules/node-gyp/node_modules/which/package.json
new file mode 100644
index 0000000000000..97ad7fbabc52b
--- /dev/null
+++ b/node_modules/node-gyp/node_modules/which/package.json
@@ -0,0 +1,43 @@
+{
+  "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
+  "name": "which",
+  "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",
+  "version": "2.0.2",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/isaacs/node-which.git"
+  },
+  "main": "which.js",
+  "bin": {
+    "node-which": "./bin/node-which"
+  },
+  "license": "ISC",
+  "dependencies": {
+    "isexe": "^2.0.0"
+  },
+  "devDependencies": {
+    "mkdirp": "^0.5.0",
+    "rimraf": "^2.6.2",
+    "tap": "^14.6.9"
+  },
+  "scripts": {
+    "test": "tap",
+    "preversion": "npm test",
+    "postversion": "npm publish",
+    "prepublish": "npm run changelog",
+    "prechangelog": "bash gen-changelog.sh",
+    "changelog": "git add CHANGELOG.md",
+    "postchangelog": "git commit -m 'update changelog - '${npm_package_version}",
+    "postpublish": "git push origin --follow-tags"
+  },
+  "files": [
+    "which.js",
+    "bin/node-which"
+  ],
+  "tap": {
+    "check-coverage": true
+  },
+  "engines": {
+    "node": ">= 8"
+  }
+}
diff --git a/node_modules/which/which.js b/node_modules/node-gyp/node_modules/which/which.js
similarity index 100%
rename from node_modules/which/which.js
rename to node_modules/node-gyp/node_modules/which/which.js
diff --git a/node_modules/opener/LICENSE.txt b/node_modules/opener/LICENSE.txt
deleted file mode 100644
index f74bd1310f4e0..0000000000000
--- a/node_modules/opener/LICENSE.txt
+++ /dev/null
@@ -1,47 +0,0 @@
-Dual licensed under WTFPL and MIT:
-
----
-
-Copyright © 2012–2020 Domenic Denicola <d@domenic.me>
-
-This work is free. You can redistribute it and/or modify it under the
-terms of the Do What The Fuck You Want To Public License, Version 2,
-as published by Sam Hocevar. See below for more details.
-
-        DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
-                    Version 2, December 2004
-
- Copyright (C) 2004 Sam Hocevar <sam@hocevar.net>
-
- Everyone is permitted to copy and distribute verbatim or modified
- copies of this license document, and changing it is allowed as long
- as the name is changed.
-
-            DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE
-   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
-
-  0. You just DO WHAT THE FUCK YOU WANT TO.
-
----
-
-The MIT License (MIT)
-
-Copyright © 2012–2020 Domenic Denicola <d@domenic.me>
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
diff --git a/node_modules/opener/bin/opener-bin.js b/node_modules/opener/bin/opener-bin.js
deleted file mode 100755
index a051ea8f03f19..0000000000000
--- a/node_modules/opener/bin/opener-bin.js
+++ /dev/null
@@ -1,10 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-
-var opener = require("..");
-
-opener(process.argv.slice(2), function (error) {
-    if (error) {
-        throw error;
-    }
-});
diff --git a/node_modules/opener/lib/opener.js b/node_modules/opener/lib/opener.js
deleted file mode 100644
index 08888c6bb8a2a..0000000000000
--- a/node_modules/opener/lib/opener.js
+++ /dev/null
@@ -1,66 +0,0 @@
-"use strict";
-var childProcess = require("child_process");
-var os = require("os");
-
-module.exports = function opener(args, options, callback) {
-    var platform = process.platform;
-
-    // Attempt to detect Windows Subystem for Linux (WSL). WSL  itself as Linux (which works in most cases), but in
-    // this specific case we need to treat it as actually being Windows. The "Windows-way" of opening things through
-    // cmd.exe works just fine here, whereas using xdg-open does not, since there is no X Windows in WSL.
-    if (platform === "linux" && os.release().indexOf("Microsoft") !== -1) {
-        platform = "win32";
-    }
-
-    // http://stackoverflow.com/q/1480971/3191, but see below for Windows.
-    var command;
-    switch (platform) {
-        case "win32": {
-            command = "cmd.exe";
-            break;
-        }
-        case "darwin": {
-            command = "open";
-            break;
-        }
-        default: {
-            command = "xdg-open";
-            break;
-        }
-    }
-
-    if (typeof args === "string") {
-        args = [args];
-    }
-
-    if (typeof options === "function") {
-        callback = options;
-        options = {};
-    }
-
-    if (options && typeof options === "object" && options.command) {
-        if (platform === "win32") {
-            // *always* use cmd on windows
-            args = [options.command].concat(args);
-        } else {
-            command = options.command;
-        }
-    }
-
-    if (platform === "win32") {
-        // On Windows, we really want to use the "start" command. But, the rules regarding arguments with spaces, and
-        // escaping them with quotes, can get really arcane. So the easiest way to deal with this is to pass off the
-        // responsibility to "cmd /c", which has that logic built in.
-        //
-        // Furthermore, if "cmd /c" double-quoted the first parameter, then "start" will interpret it as a window title,
-        // so we need to add a dummy empty-string window title: http://stackoverflow.com/a/154090/3191
-        //
-        // Additionally, on Windows ampersand and caret need to be escaped when passed to "start"
-        args = args.map(function (value) {
-            return value.replace(/[&^]/g, "^$&");
-        });
-        args = ["/c", "start", "\"\""].concat(args);
-    }
-
-    return childProcess.execFile(command, args, options, callback);
-};
diff --git a/node_modules/opener/package.json b/node_modules/opener/package.json
deleted file mode 100644
index 0af377d15f72a..0000000000000
--- a/node_modules/opener/package.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-    "name": "opener",
-    "description": "Opens stuff, like webpages and files and executables, cross-platform",
-    "version": "1.5.2",
-    "author": "Domenic Denicola <d@domenic.me> (https://domenic.me/)",
-    "license": "(WTFPL OR MIT)",
-    "repository": "domenic/opener",
-    "main": "lib/opener.js",
-    "bin": "bin/opener-bin.js",
-    "files": [
-        "lib/",
-        "bin/"
-    ],
-    "scripts": {
-        "lint": "eslint ."
-    },
-    "devDependencies": {
-        "eslint": "^7.7.0"
-    }
-}
diff --git a/node_modules/pacote/lib/dir.js b/node_modules/pacote/lib/dir.js
index df04cd08c51e5..923fdd65c22f3 100644
--- a/node_modules/pacote/lib/dir.js
+++ b/node_modules/pacote/lib/dir.js
@@ -49,7 +49,6 @@ class DirFetcher extends Fetcher {
         pkg: mani,
         event: 'prepare',
         path: this.resolved,
-        stdioString: true,
         stdio,
         banner,
         env: {
diff --git a/node_modules/pacote/lib/util/npm.js b/node_modules/pacote/lib/util/npm.js
index c444d788ad192..a3005c255565f 100644
--- a/node_modules/pacote/lib/util/npm.js
+++ b/node_modules/pacote/lib/util/npm.js
@@ -10,5 +10,5 @@ module.exports = (npmBin, npmCommand, cwd, env, extra) => {
   // in temp directories.  this lets us link previously-seen repos that
   // are also being prepared.
 
-  return spawn(cmd, args, { cwd, stdioString: true, env }, extra)
+  return spawn(cmd, args, { cwd, env }, extra)
 }
diff --git a/node_modules/pacote/package.json b/node_modules/pacote/package.json
index 66a4b695e4bbf..e595e80f39e88 100644
--- a/node_modules/pacote/package.json
+++ b/node_modules/pacote/package.json
@@ -1,6 +1,6 @@
 {
   "name": "pacote",
-  "version": "15.0.4",
+  "version": "15.0.6",
   "description": "JavaScript package downloader",
   "author": "GitHub Inc.",
   "bin": {
@@ -27,7 +27,7 @@
   "devDependencies": {
     "@npmcli/arborist": "^6.0.0 || ^6.0.0-pre.0",
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/template-oss": "4.7.1",
+    "@npmcli/template-oss": "4.8.0",
     "hosted-git-info": "^6.0.0",
     "mutate-fs": "^2.1.1",
     "nock": "^13.2.4",
@@ -46,8 +46,8 @@
   "dependencies": {
     "@npmcli/git": "^4.0.0",
     "@npmcli/installed-package-contents": "^2.0.1",
-    "@npmcli/promise-spawn": "^5.0.0",
-    "@npmcli/run-script": "^5.0.0",
+    "@npmcli/promise-spawn": "^6.0.1",
+    "@npmcli/run-script": "^6.0.0",
     "cacache": "^17.0.0",
     "fs-minipass": "^2.1.0",
     "minipass": "^3.1.6",
@@ -71,7 +71,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "4.7.1",
+    "version": "4.8.0",
     "windowsCI": false
   }
 }
diff --git a/node_modules/which/bin/which.js b/node_modules/which/bin/which.js
new file mode 100755
index 0000000000000..6df16f21acf93
--- /dev/null
+++ b/node_modules/which/bin/which.js
@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+
+const which = require('../lib')
+const argv = process.argv.slice(2)
+
+const usage = (err) => {
+  if (err) {
+    console.error(`which: ${err}`)
+  }
+  console.error('usage: which [-as] program ...')
+  process.exit(1)
+}
+
+if (!argv.length) {
+  return usage()
+}
+
+let dashdash = false
+const [commands, flags] = argv.reduce((acc, arg) => {
+  if (dashdash || arg === '--') {
+    dashdash = true
+    return acc
+  }
+
+  if (!/^-/.test(arg)) {
+    acc[0].push(arg)
+    return acc
+  }
+
+  for (const flag of arg.slice(1).split('')) {
+    if (flag === 's') {
+      acc[1].silent = true
+    } else if (flag === 'a') {
+      acc[1].all = true
+    } else {
+      usage(`illegal option -- ${flag}`)
+    }
+  }
+
+  return acc
+}, [[], {}])
+
+for (const command of commands) {
+  try {
+    const res = which.sync(command, { all: flags.all })
+    if (!flags.silent) {
+      console.log([].concat(res).join('\n'))
+    }
+  } catch (err) {
+    process.exitCode = 1
+  }
+}
diff --git a/node_modules/which/lib/index.js b/node_modules/which/lib/index.js
new file mode 100644
index 0000000000000..8de3388baf94f
--- /dev/null
+++ b/node_modules/which/lib/index.js
@@ -0,0 +1,110 @@
+const isexe = require('isexe')
+const { join, delimiter, sep, posix } = require('path')
+
+const isWindows = process.platform === 'win32'
+
+// used to check for slashed in commands passed in. always checks for the posix
+// seperator on all platforms, and checks for the current separator when not on
+// a posix platform. don't use the isWindows check for this since that is mocked
+// in tests but we still need the code to actually work when called. that is also
+// why it is ignored from coverage.
+/* istanbul ignore next */
+const rSlash = new RegExp(`[${posix.sep}${sep === posix.sep ? '' : sep}]`.replace(/(\\)/g, '\\$1'))
+const rRel = new RegExp(`^\\.${rSlash.source}`)
+
+const getNotFoundError = (cmd) =>
+  Object.assign(new Error(`not found: ${cmd}`), { code: 'ENOENT' })
+
+const getPathInfo = (cmd, {
+  path: optPath = process.env.PATH,
+  pathExt: optPathExt = process.env.PATHEXT,
+  delimiter: optDelimiter = delimiter,
+}) => {
+  // If it has a slash, then we don't bother searching the pathenv.
+  // just check the file itself, and that's it.
+  const pathEnv = cmd.match(rSlash) ? [''] : [
+    // windows always checks the cwd first
+    ...(isWindows ? [process.cwd()] : []),
+    ...(optPath || /* istanbul ignore next: very unusual */ '').split(optDelimiter),
+  ]
+
+  if (isWindows) {
+    const pathExtExe = optPathExt || ['.EXE', '.CMD', '.BAT', '.COM'].join(optDelimiter)
+    const pathExt = pathExtExe.split(optDelimiter)
+    if (cmd.includes('.') && pathExt[0] !== '') {
+      pathExt.unshift('')
+    }
+    return { pathEnv, pathExt, pathExtExe }
+  }
+
+  return { pathEnv, pathExt: [''] }
+}
+
+const getPathPart = (raw, cmd) => {
+  const pathPart = /^".*"$/.test(raw) ? raw.slice(1, -1) : raw
+  const prefix = !pathPart && rRel.test(cmd) ? cmd.slice(0, 2) : ''
+  return prefix + join(pathPart, cmd)
+}
+
+const which = async (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const envPart of pathEnv) {
+    const p = getPathPart(envPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = await isexe(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+const whichSync = (cmd, opt = {}) => {
+  const { pathEnv, pathExt, pathExtExe } = getPathInfo(cmd, opt)
+  const found = []
+
+  for (const pathEnvPart of pathEnv) {
+    const p = getPathPart(pathEnvPart, cmd)
+
+    for (const ext of pathExt) {
+      const withExt = p + ext
+      const is = isexe.sync(withExt, { pathExt: pathExtExe, ignoreErrors: true })
+      if (is) {
+        if (!opt.all) {
+          return withExt
+        }
+        found.push(withExt)
+      }
+    }
+  }
+
+  if (opt.all && found.length) {
+    return found
+  }
+
+  if (opt.nothrow) {
+    return null
+  }
+
+  throw getNotFoundError(cmd)
+}
+
+module.exports = which
+which.sync = whichSync
diff --git a/node_modules/which/package.json b/node_modules/which/package.json
index 97ad7fbabc52b..bde15634556fd 100644
--- a/node_modules/which/package.json
+++ b/node_modules/which/package.json
@@ -1,43 +1,50 @@
 {
-  "author": "Isaac Z. Schlueter <i@izs.me> (http://blog.izs.me)",
+  "author": "GitHub Inc.",
   "name": "which",
   "description": "Like which(1) unix command. Find the first instance of an executable in the PATH.",
-  "version": "2.0.2",
+  "version": "3.0.0",
   "repository": {
     "type": "git",
-    "url": "git://github.com/isaacs/node-which.git"
+    "url": "https://github.com/npm/node-which.git"
   },
-  "main": "which.js",
+  "main": "lib/index.js",
   "bin": {
-    "node-which": "./bin/node-which"
+    "node-which": "./bin/which.js"
   },
   "license": "ISC",
   "dependencies": {
     "isexe": "^2.0.0"
   },
   "devDependencies": {
-    "mkdirp": "^0.5.0",
-    "rimraf": "^2.6.2",
-    "tap": "^14.6.9"
+    "@npmcli/eslint-config": "^4.0.0",
+    "@npmcli/template-oss": "4.8.0",
+    "tap": "^16.3.0"
   },
   "scripts": {
     "test": "tap",
-    "preversion": "npm test",
-    "postversion": "npm publish",
-    "prepublish": "npm run changelog",
-    "prechangelog": "bash gen-changelog.sh",
-    "changelog": "git add CHANGELOG.md",
-    "postchangelog": "git commit -m 'update changelog - '${npm_package_version}",
-    "postpublish": "git push origin --follow-tags"
+    "lint": "eslint \"**/*.js\"",
+    "postlint": "template-oss-check",
+    "template-oss-apply": "template-oss-apply --force",
+    "lintfix": "npm run lint -- --fix",
+    "snap": "tap",
+    "posttest": "npm run lint"
   },
   "files": [
-    "which.js",
-    "bin/node-which"
+    "bin/",
+    "lib/"
   ],
   "tap": {
-    "check-coverage": true
+    "check-coverage": true,
+    "nyc-arg": [
+      "--exclude",
+      "tap-snapshots/**"
+    ]
   },
   "engines": {
-    "node": ">= 8"
+    "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+  },
+  "templateOSS": {
+    "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
+    "version": "4.8.0"
   }
 }
diff --git a/package-lock.json b/package-lock.json
index 2b468079d68db..5a7377cfc83dc 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -58,7 +58,6 @@
         "npm-registry-fetch",
         "npm-user-validate",
         "npmlog",
-        "opener",
         "p-map",
         "pacote",
         "parse-conflict-json",
@@ -92,7 +91,7 @@
         "@npmcli/config": "^6.0.1",
         "@npmcli/map-workspaces": "^3.0.0",
         "@npmcli/package-json": "^3.0.0",
-        "@npmcli/run-script": "^5.0.0",
+        "@npmcli/run-script": "^6.0.0",
         "abbrev": "~1.1.1",
         "archy": "~1.0.0",
         "cacache": "^17.0.1",
@@ -136,9 +135,8 @@
         "npm-registry-fetch": "^14.0.2",
         "npm-user-validate": "^1.0.1",
         "npmlog": "^7.0.1",
-        "opener": "^1.5.2",
         "p-map": "^4.0.0",
-        "pacote": "^15.0.2",
+        "pacote": "^15.0.6",
         "parse-conflict-json": "^3.0.0",
         "proc-log": "^3.0.0",
         "qrcode-terminal": "^0.12.0",
@@ -154,7 +152,7 @@
         "tiny-relative-date": "^1.3.0",
         "treeverse": "^3.0.0",
         "validate-npm-package-name": "^5.0.0",
-        "which": "^2.0.2",
+        "which": "^3.0.0",
         "write-file-atomic": "^5.0.0"
       },
       "bin": {
@@ -166,7 +164,7 @@
         "@npmcli/eslint-config": "^4.0.0",
         "@npmcli/fs": "^3.0.0",
         "@npmcli/git": "^4.0.1",
-        "@npmcli/promise-spawn": "^5.0.0",
+        "@npmcli/promise-spawn": "^6.0.1",
         "@npmcli/template-oss": "4.8.0",
         "licensee": "^9.0.0",
         "nock": "^13.2.4",
@@ -2091,6 +2089,21 @@
         "eslint-plugin-promise": "^6.0.0"
       }
     },
+    "node_modules/@npmcli/eslint-config/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/@npmcli/fs": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-3.0.0.tgz",
@@ -2104,12 +2117,12 @@
       }
     },
     "node_modules/@npmcli/git": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/@npmcli/git/-/git-4.0.2.tgz",
-      "integrity": "sha512-jBSmCI3F6KTZrWwez6mH6lJPWg3llZlQiHR05/sOw83H1vMc9nnL39ceP8x3SEkDJkaluXG/w4drdYS4FDONgA==",
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/@npmcli/git/-/git-4.0.3.tgz",
+      "integrity": "sha512-8cXNkDIbnXPVbhXMmQ7/bklCAjtmPaXfI9aEM4iH+xSuEHINLMHhlfESvVwdqmHJRJkR48vNJTSUvoF6GRPSFA==",
       "inBundle": true,
       "dependencies": {
-        "@npmcli/promise-spawn": "^5.0.0",
+        "@npmcli/promise-spawn": "^6.0.0",
         "lru-cache": "^7.4.4",
         "mkdirp": "^1.0.4",
         "npm-pick-manifest": "^8.0.0",
@@ -2117,7 +2130,7 @@
         "promise-inflight": "^1.0.1",
         "promise-retry": "^2.0.1",
         "semver": "^7.3.5",
-        "which": "^2.0.2"
+        "which": "^3.0.0"
       },
       "engines": {
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
@@ -2208,10 +2221,13 @@
       }
     },
     "node_modules/@npmcli/promise-spawn": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-5.0.0.tgz",
-      "integrity": "sha512-q+Le2urM3NdxSFHj+VZXLTHKgmWxqHXUSqM5m9bjnV3EtThtJor64f5inmBkO9uEGZnhpjW0wL67Qf5qcgZkxw==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-6.0.1.tgz",
+      "integrity": "sha512-+hcUpxgx0vEpDJI9Cn+lkTdKLoqKBXFCVps5H7FujEU2vLOp6KwqjLlxbnz8Wzgm8oEqW/u5FeNAXSFjLdCD0A==",
       "inBundle": true,
+      "dependencies": {
+        "which": "^3.0.0"
+      },
       "engines": {
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
@@ -2228,16 +2244,16 @@
       }
     },
     "node_modules/@npmcli/run-script": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-5.0.1.tgz",
-      "integrity": "sha512-co/A+5LzdHQVLukfYT71x5e8+6HtIk2W9Jk5c8mE8LaGrkHazzRuZeyUmb6Ciaak7MRXRVOSoTaZ0zYEFVA/Gw==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-6.0.0.tgz",
+      "integrity": "sha512-ql+AbRur1TeOdl1FY+RAwGW9fcr4ZwiVKabdvm93mujGREVuVLbdkXRJDrkTXSdCjaxYydr1wlA2v67jxWG5BQ==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/node-gyp": "^3.0.0",
-        "@npmcli/promise-spawn": "^5.0.0",
+        "@npmcli/promise-spawn": "^6.0.0",
         "node-gyp": "^9.0.0",
         "read-package-json-fast": "^3.0.0",
-        "which": "^2.0.2"
+        "which": "^3.0.0"
       },
       "engines": {
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
@@ -3686,6 +3702,21 @@
         "node": ">= 8"
       }
     },
+    "node_modules/cross-spawn/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/css-select": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/css-select/-/css-select-4.3.0.tgz",
@@ -7544,6 +7575,21 @@
         "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
       }
     },
+    "node_modules/licensee/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/licensee/node_modules/write-file-atomic": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-4.0.2.tgz",
@@ -8459,6 +8505,21 @@
         "node": "^12.13.0 || ^14.15.0 || >=16.0.0"
       }
     },
+    "node_modules/node-gyp/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "inBundle": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/node-html-parser": {
       "version": "5.4.2",
       "resolved": "https://registry.npmjs.org/node-html-parser/-/node-html-parser-5.4.2.tgz",
@@ -9021,7 +9082,7 @@
     },
     "node_modules/opener": {
       "version": "1.5.2",
-      "inBundle": true,
+      "dev": true,
       "license": "(WTFPL OR MIT)",
       "bin": {
         "opener": "bin/opener-bin.js"
@@ -9166,15 +9227,15 @@
       }
     },
     "node_modules/pacote": {
-      "version": "15.0.4",
-      "resolved": "https://registry.npmjs.org/pacote/-/pacote-15.0.4.tgz",
-      "integrity": "sha512-6lSP0ly54fKrPIvXmVcmslqrcF8DL3y/RlNLwBWG1A3wd8sWcPF8hikTJDWqXUPMw6L04p6gqsJ/iLgRjth+6A==",
+      "version": "15.0.6",
+      "resolved": "https://registry.npmjs.org/pacote/-/pacote-15.0.6.tgz",
+      "integrity": "sha512-dQwcz/sME7QIL+cdrw/jftQfMMXxSo17i2kJ/gnhBhUvvBAsxoBu1lw9B5IzCH/Ce8CvEkG/QYZ6txzKfn0bTw==",
       "inBundle": true,
       "dependencies": {
         "@npmcli/git": "^4.0.0",
         "@npmcli/installed-package-contents": "^2.0.1",
-        "@npmcli/promise-spawn": "^5.0.0",
-        "@npmcli/run-script": "^5.0.0",
+        "@npmcli/promise-spawn": "^6.0.1",
+        "@npmcli/run-script": "^6.0.0",
         "cacache": "^17.0.0",
         "fs-minipass": "^2.1.0",
         "minipass": "^3.1.6",
@@ -10516,6 +10577,21 @@
         "node": ">=8"
       }
     },
+    "node_modules/spawn-wrap/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/spdx-compare": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/spdx-compare/-/spdx-compare-1.0.0.tgz",
@@ -12746,6 +12822,21 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/tap/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/tap/node_modules/widest-line": {
       "version": "3.1.0",
       "dev": true,
@@ -13522,17 +13613,18 @@
       }
     },
     "node_modules/which": {
-      "version": "2.0.2",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/which/-/which-3.0.0.tgz",
+      "integrity": "sha512-nla//68K9NU6yRiwDY/Q8aU6siKlSs64aEC7+IV56QoAuyQT2ovsJcgGYGyqMOmI/CGN1BOR6mM5EN0FBO+zyQ==",
       "inBundle": true,
-      "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
       },
       "bin": {
-        "node-which": "bin/node-which"
+        "node-which": "bin/which.js"
       },
       "engines": {
-        "node": ">= 8"
+        "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
     "node_modules/which-boxed-primitive": {
@@ -13842,7 +13934,7 @@
       "license": "ISC",
       "devDependencies": {
         "@npmcli/eslint-config": "^4.0.0",
-        "@npmcli/promise-spawn": "^5.0.0",
+        "@npmcli/promise-spawn": "^6.0.1",
         "@npmcli/template-oss": "4.8.0",
         "minify-registry-metadata": "^2.2.0",
         "rimraf": "^3.0.2",
@@ -13853,6 +13945,21 @@
         "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
       }
     },
+    "smoke-tests/node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "workspaces/arborist": {
       "name": "@npmcli/arborist",
       "version": "6.1.0",
@@ -13867,7 +13974,7 @@
         "@npmcli/node-gyp": "^3.0.0",
         "@npmcli/package-json": "^3.0.0",
         "@npmcli/query": "^3.0.0",
-        "@npmcli/run-script": "^5.0.0",
+        "@npmcli/run-script": "^6.0.0",
         "bin-links": "^4.0.1",
         "cacache": "^17.0.1",
         "common-ancestor-path": "^1.0.1",
@@ -13978,7 +14085,7 @@
       "dependencies": {
         "@npmcli/arborist": "^6.1.0",
         "@npmcli/ci-detect": "^3.0.0",
-        "@npmcli/run-script": "^5.0.0",
+        "@npmcli/run-script": "^6.0.0",
         "chalk": "^4.1.0",
         "npm-package-arg": "^10.0.0",
         "npmlog": "^7.0.1",
@@ -14056,7 +14163,7 @@
       "license": "ISC",
       "dependencies": {
         "@npmcli/arborist": "^6.1.0",
-        "@npmcli/run-script": "^5.0.0",
+        "@npmcli/run-script": "^6.0.0",
         "npm-package-arg": "^10.0.0",
         "pacote": "^15.0.2"
       },
@@ -14131,7 +14238,7 @@
       "license": "ISC",
       "dependencies": {
         "@npmcli/git": "^4.0.1",
-        "@npmcli/run-script": "^5.0.0",
+        "@npmcli/run-script": "^6.0.0",
         "json-parse-even-better-errors": "^3.0.0",
         "proc-log": "^3.0.0",
         "semver": "^7.3.7"
diff --git a/package.json b/package.json
index 6f745f8b994b2..30a5e248199e3 100644
--- a/package.json
+++ b/package.json
@@ -61,7 +61,7 @@
     "@npmcli/config": "^6.0.1",
     "@npmcli/map-workspaces": "^3.0.0",
     "@npmcli/package-json": "^3.0.0",
-    "@npmcli/run-script": "^5.0.0",
+    "@npmcli/run-script": "^6.0.0",
     "abbrev": "~1.1.1",
     "archy": "~1.0.0",
     "cacache": "^17.0.1",
@@ -105,9 +105,8 @@
     "npm-registry-fetch": "^14.0.2",
     "npm-user-validate": "^1.0.1",
     "npmlog": "^7.0.1",
-    "opener": "^1.5.2",
     "p-map": "^4.0.0",
-    "pacote": "^15.0.2",
+    "pacote": "^15.0.6",
     "parse-conflict-json": "^3.0.0",
     "proc-log": "^3.0.0",
     "qrcode-terminal": "^0.12.0",
@@ -123,7 +122,7 @@
     "tiny-relative-date": "^1.3.0",
     "treeverse": "^3.0.0",
     "validate-npm-package-name": "^5.0.0",
-    "which": "^2.0.2",
+    "which": "^3.0.0",
     "write-file-atomic": "^5.0.0"
   },
   "bundleDependencies": [
@@ -177,7 +176,6 @@
     "npm-registry-fetch",
     "npm-user-validate",
     "npmlog",
-    "opener",
     "p-map",
     "pacote",
     "parse-conflict-json",
@@ -203,7 +201,7 @@
     "@npmcli/eslint-config": "^4.0.0",
     "@npmcli/fs": "^3.0.0",
     "@npmcli/git": "^4.0.1",
-    "@npmcli/promise-spawn": "^5.0.0",
+    "@npmcli/promise-spawn": "^6.0.1",
     "@npmcli/template-oss": "4.8.0",
     "licensee": "^9.0.0",
     "nock": "^13.2.4",
diff --git a/scripts/util.js b/scripts/util.js
index 91611bcf91be2..7e74eee3fb099 100644
--- a/scripts/util.js
+++ b/scripts/util.js
@@ -55,7 +55,6 @@ const spawn = async (cmd, ...allArgs) => {
   let res = null
   try {
     const spawnOpts = {
-      stdioString: true,
       stdio: quiet || out || lines ? 'pipe' : 'inherit',
       cwd: CWD,
       ...opts,
diff --git a/smoke-tests/package.json b/smoke-tests/package.json
index 456211809caa6..04577ae822adc 100644
--- a/smoke-tests/package.json
+++ b/smoke-tests/package.json
@@ -19,7 +19,7 @@
   },
   "devDependencies": {
     "@npmcli/eslint-config": "^4.0.0",
-    "@npmcli/promise-spawn": "^5.0.0",
+    "@npmcli/promise-spawn": "^6.0.1",
     "@npmcli/template-oss": "4.8.0",
     "minify-registry-metadata": "^2.2.0",
     "rimraf": "^3.0.2",
diff --git a/smoke-tests/test/index.js b/smoke-tests/test/index.js
index d9a2a8833884e..65a0363f2d441 100644
--- a/smoke-tests/test/index.js
+++ b/smoke-tests/test/index.js
@@ -93,8 +93,8 @@ const exec = async (...args) => {
     env: {
       HOME: path,
       PATH: `${PATH}:${binLocation}`,
+      COMSPEC: process.env.COMSPEC,
     },
-    stdioString: true,
     encoding: 'utf-8',
   })
 
diff --git a/tap-snapshots/test/lib/docs.js.test.cjs b/tap-snapshots/test/lib/docs.js.test.cjs
index b1b7d5b6b493e..3c6a1b5025989 100644
--- a/tap-snapshots/test/lib/docs.js.test.cjs
+++ b/tap-snapshots/test/lib/docs.js.test.cjs
@@ -874,8 +874,8 @@ Note: This is NOT honored by other network related commands, eg \`dist-tags\`,
 
 #### \`editor\`
 
-* Default: The EDITOR or VISUAL environment variables, or 'notepad.exe' on
-  Windows, or 'vim' on Unix systems
+* Default: The EDITOR or VISUAL environment variables, or
+  '%SYSTEMROOT%\\notepad.exe' on Windows, or 'vi' on Unix systems
 * Type: String
 
 The command to run for \`npm edit\` and \`npm config edit\`.
diff --git a/test/bin/windows-shims.js b/test/bin/windows-shims.js
index 8d08e603b03e3..e06e41bf8901d 100644
--- a/test/bin/windows-shims.js
+++ b/test/bin/windows-shims.js
@@ -100,7 +100,6 @@ for (const [name, bash] of bashes) {
       const result = await spawn(bash, args, {
         env: { PATH: path, npm_config_update_notifier: 'false' },
         cwd: path,
-        stdioString: true,
       })
       t.match(result, {
         cmd: bash,
@@ -119,7 +118,6 @@ for (const [name, bash] of bashes) {
       const result = await spawn(bash, args, {
         env: { PATH: path, npm_config_update_notifier: 'false' },
         cwd: path,
-        stdioString: true,
       })
       t.match(result, {
         cmd: bash,
diff --git a/test/fixtures/sandbox.js b/test/fixtures/sandbox.js
index b53c8f173a3a0..c7bb8218dc60a 100644
--- a/test/fixtures/sandbox.js
+++ b/test/fixtures/sandbox.js
@@ -166,14 +166,14 @@ class Sandbox extends EventEmitter {
       // replace default config values with placeholders
       for (const name of redactedDefaults) {
         const value = this[_npm].config.defaults[name]
-        clean = clean.split(value).join(`{${name.toUpperCase()}}`)
+        clean = clean.split(normalize(value)).join(`{${name.toUpperCase()}}`)
       }
 
       // replace vague default config values that are present within quotes
       // with placeholders
       for (const name of vagueRedactedDefaults) {
         const value = this[_npm].config.defaults[name]
-        clean = clean.split(`"${value}"`).join(`"{${name.toUpperCase()}}"`)
+        clean = clean.split(`"${normalize(value)}"`).join(`"{${name.toUpperCase()}}"`)
       }
     }
 
diff --git a/test/lib/commands/edit.js b/test/lib/commands/edit.js
index 22543f8e3cdc6..dc7114892970d 100644
--- a/test/lib/commands/edit.js
+++ b/test/lib/commands/edit.js
@@ -5,15 +5,11 @@ const { load: loadMockNpm } = require('../../fixtures/mock-npm')
 
 const spawk = tspawk(t)
 
-// TODO this ... smells.  npm "script-shell" config mentions defaults but those
-// are handled by run-script, not npm.  So for now we have to tie tests to some
-// pretty specific internals of runScript
-const makeSpawnArgs = require('@npmcli/run-script/lib/make-spawn-args.js')
-
 const npmConfig = {
   config: {
     'ignore-scripts': false,
     editor: 'testeditor',
+    scriptShell: process.platform === 'win32' ? process.env.COMSPEC : 'sh',
   },
   prefixDir: {
     node_modules: {
@@ -34,30 +30,34 @@ const npmConfig = {
   },
 }
 
+const isCmdRe = /(?:^|\\)cmd(?:\.exe)?$/i
+
 t.test('npm edit', async t => {
   const { npm, joinedOutput } = await loadMockNpm(t, npmConfig)
 
   const semverPath = path.resolve(npm.prefix, 'node_modules', 'semver')
-  const [scriptShell, scriptArgs] = makeSpawnArgs({
-    event: 'install',
-    path: npm.prefix,
-    cmd: 'testinstall',
-  })
   spawk.spawn('testeditor', [semverPath])
+
+  const scriptShell = npm.config.get('scriptShell')
+  const scriptArgs = isCmdRe.test(scriptShell)
+    ? ['/d', '/s', '/c', 'testinstall']
+    : ['-c', 'testinstall']
   spawk.spawn(scriptShell, scriptArgs, { cwd: semverPath })
+
   await npm.exec('edit', ['semver'])
   t.match(joinedOutput(), 'rebuilt dependencies successfully')
 })
 
 t.test('rebuild failure', async t => {
   const { npm } = await loadMockNpm(t, npmConfig)
+
   const semverPath = path.resolve(npm.prefix, 'node_modules', 'semver')
-  const [scriptShell, scriptArgs] = makeSpawnArgs({
-    event: 'install',
-    path: npm.prefix,
-    cmd: 'testinstall',
-  })
   spawk.spawn('testeditor', [semverPath])
+
+  const scriptShell = npm.config.get('scriptShell')
+  const scriptArgs = isCmdRe.test(scriptShell)
+    ? ['/d', '/s', '/c', 'testinstall']
+    : ['-c', 'testinstall']
   spawk.spawn(scriptShell, scriptArgs, { cwd: semverPath }).exit(1).stdout('test error')
   await t.rejects(
     npm.exec('edit', ['semver']),
@@ -67,8 +67,10 @@ t.test('rebuild failure', async t => {
 
 t.test('editor failure', async t => {
   const { npm } = await loadMockNpm(t, npmConfig)
+
   const semverPath = path.resolve(npm.prefix, 'node_modules', 'semver')
   spawk.spawn('testeditor', [semverPath]).exit(1).stdout('test editor failure')
+
   await t.rejects(
     npm.exec('edit', ['semver']),
     { message: 'editor process exited with code: 1' }
@@ -85,13 +87,14 @@ t.test('npm edit editor has flags', async t => {
   })
 
   const semverPath = path.resolve(npm.prefix, 'node_modules', 'semver')
-  const [scriptShell, scriptArgs] = makeSpawnArgs({
-    event: 'install',
-    path: npm.prefix,
-    cmd: 'testinstall',
-  })
   spawk.spawn('testeditor', ['--flag', semverPath])
+
+  const scriptShell = npm.config.get('scriptShell')
+  const scriptArgs = isCmdRe.test(scriptShell)
+    ? ['/d', '/s', '/c', 'testinstall']
+    : ['-c', 'testinstall']
   spawk.spawn(scriptShell, scriptArgs, { cwd: semverPath })
+
   await npm.exec('edit', ['semver'])
 })
 
diff --git a/test/lib/commands/restart.js b/test/lib/commands/restart.js
index c2257b8cebf84..f9745acdd11b7 100644
--- a/test/lib/commands/restart.js
+++ b/test/lib/commands/restart.js
@@ -4,10 +4,7 @@ const { load: loadMockNpm } = require('../../fixtures/mock-npm')
 
 const spawk = tspawk(t)
 
-// TODO this ... smells.  npm "script-shell" config mentions defaults but those
-// are handled by run-script, not npm.  So for now we have to tie tests to some
-// pretty specific internals of runScript
-const makeSpawnArgs = require('@npmcli/run-script/lib/make-spawn-args.js')
+const isCmdRe = /(?:^|\\)cmd(?:\.exe)?$/i
 
 t.test('should run restart script from package.json', async t => {
   const { npm } = await loadMockNpm(t, {
@@ -22,15 +19,14 @@ t.test('should run restart script from package.json', async t => {
     },
     config: {
       loglevel: 'silent',
+      scriptShell: process.platform === 'win32' ? process.env.COMSPEC : 'sh',
     },
   })
-  const [scriptShell, scriptArgs] = makeSpawnArgs({
-    path: npm.prefix,
-    cmd: 'node ./test-restart.js',
-  })
-  let scriptContent = scriptArgs.pop()
-  scriptContent += ' foo'
-  scriptArgs.push(scriptContent)
+
+  const scriptShell = npm.config.get('scriptShell')
+  const scriptArgs = isCmdRe.test(scriptShell)
+    ? ['/d', '/s', '/c', 'node ./test-restart.js foo']
+    : ['-c', 'node ./test-restart.js foo']
   const script = spawk.spawn(scriptShell, scriptArgs)
   await npm.exec('restart', ['foo'])
   t.ok(script.called, 'script ran')
diff --git a/test/lib/commands/run-script.js b/test/lib/commands/run-script.js
index 440c8dbad072a..8aafebcaf8d11 100644
--- a/test/lib/commands/run-script.js
+++ b/test/lib/commands/run-script.js
@@ -125,7 +125,6 @@ t.test('default env, start, and restart scripts', t => {
         args: [],
         scriptShell: undefined,
         stdio: 'inherit',
-        stdioString: true,
         pkg: { name: 'x', version: '1.2.3', _id: 'x@1.2.3', scripts: {} },
         event: 'start',
       },
@@ -140,7 +139,6 @@ t.test('default env, start, and restart scripts', t => {
         args: [],
         scriptShell: undefined,
         stdio: 'inherit',
-        stdioString: true,
         pkg: {
           name: 'x',
           version: '1.2.3',
@@ -162,7 +160,6 @@ t.test('default env, start, and restart scripts', t => {
         args: [],
         scriptShell: undefined,
         stdio: 'inherit',
-        stdioString: true,
         pkg: {
           name: 'x',
           version: '1.2.3',
@@ -185,7 +182,6 @@ t.test('default env, start, and restart scripts', t => {
         args: [],
         scriptShell: undefined,
         stdio: 'inherit',
-        stdioString: true,
         pkg: {
           name: 'x',
           version: '1.2.3',
@@ -220,7 +216,6 @@ t.test('non-default env script', t => {
         args: [],
         scriptShell: undefined,
         stdio: 'inherit',
-        stdioString: true,
         pkg: {
           name: 'x',
           version: '1.2.3',
@@ -242,7 +237,6 @@ t.test('non-default env script', t => {
         args: [],
         scriptShell: undefined,
         stdio: 'inherit',
-        stdioString: true,
         pkg: {
           name: 'x',
           version: '1.2.3',
@@ -305,7 +299,6 @@ t.test('run pre/post hooks', async t => {
       args: [],
       scriptShell: undefined,
       stdio: 'inherit',
-      stdioString: true,
       pkg: {
         name: 'x',
         version: '1.2.3',
@@ -342,7 +335,6 @@ t.test('skip pre/post hooks when using ignoreScripts', async t => {
       args: [],
       scriptShell: undefined,
       stdio: 'inherit',
-      stdioString: true,
       pkg: {
         name: 'x',
         version: '1.2.3',
@@ -385,7 +377,6 @@ t.test('run silent', async t => {
       args: [],
       scriptShell: undefined,
       stdio: 'inherit',
-      stdioString: true,
       pkg: {
         name: 'x',
         version: '1.2.3',
diff --git a/test/lib/commands/start.js b/test/lib/commands/start.js
index 3caaa478f02e3..47f7f1a6e0f51 100644
--- a/test/lib/commands/start.js
+++ b/test/lib/commands/start.js
@@ -4,10 +4,7 @@ const { load: loadMockNpm } = require('../../fixtures/mock-npm')
 
 const spawk = tspawk(t)
 
-// TODO this ... smells.  npm "script-shell" config mentions defaults but those
-// are handled by run-script, not npm.  So for now we have to tie tests to some
-// pretty specific internals of runScript
-const makeSpawnArgs = require('@npmcli/run-script/lib/make-spawn-args.js')
+const isCmdRe = /(?:^|\\)cmd(?:\.exe)?$/i
 
 t.test('should run start script from package.json', async t => {
   const { npm } = await loadMockNpm(t, {
@@ -22,13 +19,14 @@ t.test('should run start script from package.json', async t => {
     },
     config: {
       loglevel: 'silent',
+      scriptShell: process.platform === 'win32' ? process.env.COMSPEC : 'sh',
     },
   })
-  const [scriptShell, scriptArgs] = makeSpawnArgs({ path: npm.prefix, cmd: 'node ./test-start.js' })
-  // we're calling the script with 'foo' as an argument, so add that to the script
-  let scriptContent = scriptArgs.pop()
-  scriptContent += ' foo'
-  scriptArgs.push(scriptContent)
+
+  const scriptShell = npm.config.get('scriptShell')
+  const scriptArgs = isCmdRe.test(scriptShell)
+    ? ['/d', '/s', '/c', 'node ./test-start.js foo']
+    : ['-c', 'node ./test-start.js foo']
   const script = spawk.spawn(scriptShell, scriptArgs)
   await npm.exec('start', ['foo'])
   t.ok(script.called, 'script ran')
diff --git a/test/lib/commands/stop.js b/test/lib/commands/stop.js
index 72c2843adec9d..9ca774288446b 100644
--- a/test/lib/commands/stop.js
+++ b/test/lib/commands/stop.js
@@ -4,10 +4,7 @@ const { load: loadMockNpm } = require('../../fixtures/mock-npm')
 
 const spawk = tspawk(t)
 
-// TODO this ... smells.  npm "script-shell" config mentions defaults but those
-// are handled by run-script, not npm.  So for now we have to tie tests to some
-// pretty specific internals of runScript
-const makeSpawnArgs = require('@npmcli/run-script/lib/make-spawn-args.js')
+const isCmdRe = /(?:^|\\)cmd(?:\.exe)?$/i
 
 t.test('should run stop script from package.json', async t => {
   const { npm } = await loadMockNpm(t, {
@@ -22,12 +19,14 @@ t.test('should run stop script from package.json', async t => {
     },
     config: {
       loglevel: 'silent',
+      scriptShell: process.platform === 'win32' ? process.env.COMSPEC : 'sh',
     },
   })
-  const [scriptShell, scriptArgs] = makeSpawnArgs({ path: npm.prefix, cmd: 'node ./test-stop.js' })
-  let scriptContent = scriptArgs.pop()
-  scriptContent += ' foo'
-  scriptArgs.push(scriptContent)
+
+  const scriptShell = npm.config.get('scriptShell')
+  const scriptArgs = isCmdRe.test(scriptShell)
+    ? ['/d', '/s', '/c', 'node ./test-stop.js foo']
+    : ['-c', 'node ./test-stop.js foo']
   const script = spawk.spawn(scriptShell, scriptArgs)
   await npm.exec('stop', ['foo'])
   t.ok(script.called, 'script ran')
diff --git a/test/lib/commands/test.js b/test/lib/commands/test.js
index a6a6f723afe7d..3a62b6a2d31b8 100644
--- a/test/lib/commands/test.js
+++ b/test/lib/commands/test.js
@@ -4,10 +4,7 @@ const { load: loadMockNpm } = require('../../fixtures/mock-npm')
 
 const spawk = tspawk(t)
 
-// TODO this ... smells.  npm "script-shell" config mentions defaults but those
-// are handled by run-script, not npm.  So for now we have to tie tests to some
-// pretty specific internals of runScript
-const makeSpawnArgs = require('@npmcli/run-script/lib/make-spawn-args.js')
+const isCmdRe = /(?:^|\\)cmd(?:\.exe)?$/i
 
 t.test('should run test script from package.json', async t => {
   const { npm } = await loadMockNpm(t, {
@@ -22,12 +19,14 @@ t.test('should run test script from package.json', async t => {
     },
     config: {
       loglevel: 'silent',
+      scriptShell: process.platform === 'win32' ? process.env.COMSPEC : 'sh',
     },
   })
-  const [scriptShell, scriptArgs] = makeSpawnArgs({ path: npm.prefix, cmd: 'node ./test-test.js' })
-  let scriptContent = scriptArgs.pop()
-  scriptContent += ' foo'
-  scriptArgs.push(scriptContent)
+
+  const scriptShell = npm.config.get('scriptShell')
+  const scriptArgs = isCmdRe.test(scriptShell)
+    ? ['/d', '/s', '/c', 'node ./test-test.js foo']
+    : ['-c', 'node ./test-test.js foo']
   const script = spawk.spawn(scriptShell, scriptArgs)
   await npm.exec('test', ['foo'])
   t.ok(script.called, 'script ran')
diff --git a/test/lib/utils/config/definitions.js b/test/lib/utils/config/definitions.js
index 21eba1617affd..da53ac3aea03f 100644
--- a/test/lib/utils/config/definitions.js
+++ b/test/lib/utils/config/definitions.js
@@ -33,9 +33,15 @@ t.test('editor', t => {
     t.end()
   })
   t.test('has neither EDITOR nor VISUAL, system specific', t => {
-    mockGlobals(t, { 'process.env': { EDITOR: undefined, VISUAL: undefined } })
+    mockGlobals(t, {
+      'process.env': {
+        EDITOR: undefined,
+        VISUAL: undefined,
+        SYSTEMROOT: 'C:\\Windows',
+      },
+    })
     const defsWin = mockDefs(isWin(true))
-    t.equal(defsWin.editor.default, 'notepad.exe')
+    t.equal(defsWin.editor.default, 'C:\\Windows\\notepad.exe')
     const defsNix = mockDefs(isWin(false))
     t.equal(defsNix.editor.default, 'vi')
     t.end()
diff --git a/test/lib/utils/open-url-prompt.js b/test/lib/utils/open-url-prompt.js
index 03f6b596d7643..a18fe85f68751 100644
--- a/test/lib/utils/open-url-prompt.js
+++ b/test/lib/utils/open-url-prompt.js
@@ -21,10 +21,13 @@ const npm = {
 let openerUrl = null
 let openerOpts = null
 let openerResult = null
-const opener = (url, opts, cb) => {
+
+const open = async (url, options) => {
   openerUrl = url
-  openerOpts = opts
-  return cb(openerResult)
+  openerOpts = options
+  if (openerResult) {
+    throw openerResult
+  }
 }
 
 let questionShouldResolve = true
@@ -47,7 +50,9 @@ const readline = {
 }
 
 const openUrlPrompt = t.mock('../../../lib/utils/open-url-prompt.js', {
-  opener,
+  '@npmcli/promise-spawn': {
+    open,
+  },
   readline,
 })
 
diff --git a/test/lib/utils/open-url.js b/test/lib/utils/open-url.js
index 1bf47d8bbaedc..70afd550333f7 100644
--- a/test/lib/utils/open-url.js
+++ b/test/lib/utils/open-url.js
@@ -19,14 +19,19 @@ const npm = {
 let openerUrl = null
 let openerOpts = null
 let openerResult = null
-const opener = (url, opts, cb) => {
+
+const open = async (url, options) => {
   openerUrl = url
-  openerOpts = opts
-  return cb(openerResult)
+  openerOpts = options
+  if (openerResult) {
+    throw openerResult
+  }
 }
 
 const openUrl = t.mock('../../../lib/utils/open-url.js', {
-  opener,
+  '@npmcli/promise-spawn': {
+    open,
+  },
 })
 
 t.test('opens a url', async t => {
diff --git a/workspaces/arborist/lib/arborist/rebuild.js b/workspaces/arborist/lib/arborist/rebuild.js
index 7e97984c06aa7..6a675320d864b 100644
--- a/workspaces/arborist/lib/arborist/rebuild.js
+++ b/workspaces/arborist/lib/arborist/rebuild.js
@@ -345,7 +345,6 @@ module.exports = cls => class Builder extends cls {
         event,
         path,
         pkg,
-        stdioString: true,
         stdio,
         env,
         scriptShell: this[_scriptShell],
diff --git a/workspaces/arborist/lib/arborist/reify.js b/workspaces/arborist/lib/arborist/reify.js
index 08b38d002b6a9..c3cbf02b31080 100644
--- a/workspaces/arborist/lib/arborist/reify.js
+++ b/workspaces/arborist/lib/arborist/reify.js
@@ -1558,7 +1558,6 @@ module.exports = cls => class Reifier extends cls {
               event,
               path,
               pkg,
-              stdioString: true,
               stdio,
               scriptShell: this.options.scriptShell,
             })
diff --git a/workspaces/arborist/package.json b/workspaces/arborist/package.json
index 7e1d42c832c0e..7bdfbb6d6c313 100644
--- a/workspaces/arborist/package.json
+++ b/workspaces/arborist/package.json
@@ -12,7 +12,7 @@
     "@npmcli/node-gyp": "^3.0.0",
     "@npmcli/package-json": "^3.0.0",
     "@npmcli/query": "^3.0.0",
-    "@npmcli/run-script": "^5.0.0",
+    "@npmcli/run-script": "^6.0.0",
     "bin-links": "^4.0.1",
     "cacache": "^17.0.1",
     "common-ancestor-path": "^1.0.1",
diff --git a/workspaces/arborist/test/arborist/rebuild.js b/workspaces/arborist/test/arborist/rebuild.js
index ba31c5a209c3d..df383c6ce772c 100644
--- a/workspaces/arborist/test/arborist/rebuild.js
+++ b/workspaces/arborist/test/arborist/rebuild.js
@@ -421,7 +421,6 @@ t.test('rebuild node-gyp dependencies lacking both preinstall and install script
       event: 'install',
       path: resolve(path, 'node_modules/dep'),
       pkg: { scripts: { install: 'node-gyp rebuild' } },
-      stdioString: true,
       env: {
         npm_package_resolved: null,
         npm_package_integrity: null,
diff --git a/workspaces/arborist/test/arborist/reify.js b/workspaces/arborist/test/arborist/reify.js
index ea7c3f0c66e52..257fcb4cbcf7b 100644
--- a/workspaces/arborist/test/arborist/reify.js
+++ b/workspaces/arborist/test/arborist/reify.js
@@ -1770,7 +1770,6 @@ console.log('ok 1 - this is fine')
     event: 'test',
     path,
     pkg,
-    stdioString: true,
     stdio: 'pipe',
   }), 'test result')
 })
diff --git a/workspaces/libnpmexec/lib/run-script.js b/workspaces/libnpmexec/lib/run-script.js
index cee8ba45ae8e9..b34895c824e6d 100644
--- a/workspaces/libnpmexec/lib/run-script.js
+++ b/workspaces/libnpmexec/lib/run-script.js
@@ -68,7 +68,6 @@ const run = async ({
       banner: false,
       // we always run in cwd, not --prefix
       path: runPath,
-      stdioString: true,
       binPaths,
       event: 'npx',
       args,
diff --git a/workspaces/libnpmexec/package.json b/workspaces/libnpmexec/package.json
index 77f393c12c8d1..d3c8a4bb4c61a 100644
--- a/workspaces/libnpmexec/package.json
+++ b/workspaces/libnpmexec/package.json
@@ -60,7 +60,7 @@
   "dependencies": {
     "@npmcli/arborist": "^6.1.0",
     "@npmcli/ci-detect": "^3.0.0",
-    "@npmcli/run-script": "^5.0.0",
+    "@npmcli/run-script": "^6.0.0",
     "chalk": "^4.1.0",
     "npm-package-arg": "^10.0.0",
     "npmlog": "^7.0.1",
diff --git a/workspaces/libnpmpack/package.json b/workspaces/libnpmpack/package.json
index 0b9ab373d0bb7..3d054653ea2a1 100644
--- a/workspaces/libnpmpack/package.json
+++ b/workspaces/libnpmpack/package.json
@@ -37,7 +37,7 @@
   "homepage": "https://npmjs.com/package/libnpmpack",
   "dependencies": {
     "@npmcli/arborist": "^6.1.0",
-    "@npmcli/run-script": "^5.0.0",
+    "@npmcli/run-script": "^6.0.0",
     "npm-package-arg": "^10.0.0",
     "pacote": "^15.0.2"
   },
diff --git a/workspaces/libnpmpack/test/index.js b/workspaces/libnpmpack/test/index.js
index aa4f955fac0b0..ee34cd2c94c10 100644
--- a/workspaces/libnpmpack/test/index.js
+++ b/workspaces/libnpmpack/test/index.js
@@ -16,11 +16,6 @@ const OPTS = {
 
 const REG = OPTS.registry
 
-// TODO this ... smells.  npm "script-shell" config mentions defaults but those
-// are handled by run-script, not npm.  So for now we have to tie tests to some
-// pretty specific internals of runScript
-const makeSpawnArgs = require('@npmcli/run-script/lib/make-spawn-args.js')
-
 t.test('packs from local directory', async t => {
   const testDir = t.testdir({
     'package.json': JSON.stringify({
@@ -152,13 +147,15 @@ t.test('runs scripts in foreground when foregroundScripts === true', async t =>
   const cwd = process.cwd()
   process.chdir(testDir)
 
-  const [scriptShell, scriptArgs] = makeSpawnArgs({
-    event: 'prepack',
-    path: testDir,
-    cmd: 'touch prepack',
-  })
+  const shell = process.platform === 'win32'
+    ? process.env.COMSPEC
+    : 'sh'
+
+  const args = process.platform === 'win32'
+    ? ['/d', '/s', '/c', 'touch prepack']
+    : ['-c', 'touch prepack']
 
-  const prepack = spawk.spawn(scriptShell, scriptArgs)
+  const prepack = spawk.spawn(shell, args)
 
   await pack('file:.', {
     packDestination: testDir,
@@ -186,13 +183,7 @@ t.test('doesn\'t run scripts when ignoreScripts === true', async t => {
   const cwd = process.cwd()
   process.chdir(testDir)
 
-  const [scriptShell, scriptArgs] = makeSpawnArgs({
-    event: 'prepack',
-    path: testDir,
-    cmd: 'touch prepack',
-  })
-
-  const prepack = spawk.spawn(scriptShell, scriptArgs)
+  const prepack = spawk.spawn('sh', ['-c', 'touch prepack'])
 
   await pack('file:.', {
     packDestination: testDir,
diff --git a/workspaces/libnpmversion/package.json b/workspaces/libnpmversion/package.json
index 2b6d4d42d3959..9291629a47454 100644
--- a/workspaces/libnpmversion/package.json
+++ b/workspaces/libnpmversion/package.json
@@ -38,7 +38,7 @@
   },
   "dependencies": {
     "@npmcli/git": "^4.0.1",
-    "@npmcli/run-script": "^5.0.0",
+    "@npmcli/run-script": "^6.0.0",
     "json-parse-even-better-errors": "^3.0.0",
     "proc-log": "^3.0.0",
     "semver": "^7.3.7"