cherry-pick: Fix corrupt gzip from withNodeAdapter middleware on Node 26.11+ (#3108 → v5.3) - #3393

…return install_node_modules' npm report as an object on every npm (#3108)

* Keep piped chunks on a patched write() under Node 26.11, and parse npm's report behind its dry-run diff

Node 26.11.0's Readable.pipe fast path (nodejs/node#66182) calls _write() directly
for a byte-mode Writable destination, skipping write() overrides. withNodeAdapter's
response is a real PassThrough, so compression's res.write patch was skipped for
send(...).pipe(res): corrupt gzip on the wire, or a stalled body. On runtimes with
the fast path the response gives each pipe source a second, inert 'data' listener,
which keeps pipe on dest.write(), and removes it on unpipe.

npm before 11.20 prints the human dry-run diff ahead of its --json report, so
install_node_modules returned that output as an unparsed string; npm 11.20 dropped
the diff and the dry_run tests' match on it. Parse the report after any prefix and
assert on its added count.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013r4w8GFxG9nBkMVeRf7bbR
Dispatch-Task: main-red-kriszyp_harper_26a914501_38e57eff

* Release the pipe guard before pipe's own unpipe cleanup, so a stalled source stays paused

pipe's cleanup resumes a source awaiting 'drain' while any 'data' listener
remains, so with the guard's listener still attached an unpipe or a destroyed
response left the source flowing into nothing and its buffered data was lost.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013r4w8GFxG9nBkMVeRf7bbR
Dispatch-Task: main-red-kriszyp_harper_26a914501_38e57eff

* Guard only core Readable sources, which legacy pipe() never releases

Legacy Stream.prototype.pipe emits 'pipe' but never 'unpipe', and neither it nor a
userland pipe() takes Node's fast path, so the inert listener is skipped for them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013r4w8GFxG9nBkMVeRf7bbR
Dispatch-Task: main-red-kriszyp_harper_26a914501_38e57eff

* Skip the pipe guard for sources the fast path never takes, and release it from one constructor listener

Object-mode and decoded sources cannot take Node 26.11's pipe fast path, so the
inert listener only cost them a call per chunk. One 'unpipe' listener prepended in
the constructor replaces the per-pipe release closure and still runs ahead of each
pipe's own cleanup.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013r4w8GFxG9nBkMVeRf7bbR
Dispatch-Task: main-red-kriszyp_harper_26a914501_38e57eff

* Tolerate an 'unpipe' emitted without a source

Core and readable-stream always pass the source, but a bare res.emit('unpipe') from
third-party middleware must not throw out of the guard's release.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013r4w8GFxG9nBkMVeRf7bbR
Dispatch-Task: main-red-kriszyp_harper_26a914501_38e57eff

* Float the Node 26 unit-test leg to the newest 26.x, as integration tests do

Without check-latest, setup-node prefers a cached 26.x, on which the pipe
fast-path regression test passes with the guard removed.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013r4w8GFxG9nBkMVeRf7bbR
Dispatch-Task: main-red-kriszyp_harper_26a914501_38e57eff

* Check which package a dry run would add when npm reports it

npm 11's dry-run report names the packages in its add entries; npm 10's only counts
them, so the name is asserted when present.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013r4w8GFxG9nBkMVeRf7bbR
Dispatch-Task: main-red-kriszyp_harper_26a914501_38e57eff

* Release the pipe guard only from a Readable, matching where it attaches

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_013r4w8GFxG9nBkMVeRf7bbR
Dispatch-Task: main-red-kriszyp_harper_26a914501_38e57eff

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>
(cherry picked from commit b6b5edd)