@pnpm/releasing.exportable-manifest 1100.1.6 → 1100.1.7

package/lib/index.d.ts

@@ -8,7 +8,7 @@ export interface MakePublishManifestOptions {
     hooks?: Hooks;
     modulesDir?: string;
     skipManifestObfuscation?: boolean;
-    readmeFile?: string;
+    embedReadme?: boolean;
 }
 export declare function createExportableManifest(dir: string, originalManifest: ProjectManifest, opts: MakePublishManifestOptions): Promise<ExportedManifest>;
 export type PublishDependencyConverter = (depName: string, depSpec: string, dir: string, modulesDir?: string) => Promise<string> | string;

package/lib/index.js

@@ -1,3 +1,4 @@
+import fs from 'node:fs';
 import path from 'node:path';
 import { resolveFromCatalog } from '@pnpm/catalogs.resolver';
 import { PnpmError } from '@pnpm/error';
@@ -16,6 +17,15 @@ const PREPUBLISH_SCRIPTS = [
     'publish',
     'postpublish',
 ];
+async function readReadmeFile(projectDir) {
+    const entries = await fs.promises.readdir(projectDir, { withFileTypes: true });
+    // Only embed a regular README.md file. A symlink could point outside the
+    // project and leak its target's contents into the published manifest.
+    const readmeEntry = entries.find((entry) => entry.isFile() && /^readme\.md$/i.test(entry.name));
+    if (readmeEntry == null)
+        return undefined;
+    return fs.promises.readFile(path.join(projectDir, readmeEntry.name), 'utf8');
+}
 export async function createExportableManifest(dir, originalManifest, opts) {
     let publishManifest;
     if (opts.skipManifestObfuscation) {
@@ -48,8 +58,11 @@ export async function createExportableManifest(dir, originalManifest, opts) {
         });
     }
     overridePublishConfig(publishManifest);
-    if (opts?.readmeFile) {
-        publishManifest.readme ??= opts.readmeFile;
+    if (publishManifest.readme == null && opts?.embedReadme) {
+        const readme = await readReadmeFile(dir);
+        if (readme != null) {
+            publishManifest.readme = readme;
+        }
     }
     for (const hook of opts?.hooks?.beforePacking ?? []) {
         // eslint-disable-next-line no-await-in-loop

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/releasing.exportable-manifest",
-  "version": "1100.1.6",
+  "version": "1100.1.7",
   "description": "Creates an exportable manifest",
   "keywords": [
     "pnpm",
@@ -30,12 +30,12 @@
     "@npm/types": "^2.1.0",
     "p-map-values": "^0.1.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
-    "@pnpm/catalogs.resolver": "1100.0.0",
     "@pnpm/bins.resolver": "1100.0.8",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.13",
     "@pnpm/types": "1101.3.2",
+    "@pnpm/catalogs.resolver": "1100.0.0",
+    "@pnpm/error": "1100.0.0",
     "@pnpm/resolving.jsr-specifier-parser": "1100.0.0",
-    "@pnpm/error": "1100.0.0"
+    "@pnpm/workspace.project-manifest-reader": "1100.0.13"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
@@ -43,11 +43,11 @@
     "@types/ramda": "0.31.1",
     "cross-spawn": "^7.0.6",
     "write-yaml-file": "^6.0.0",
-    "@pnpm/catalogs.config": "1100.0.0",
+    "@pnpm/catalogs.config": "1100.0.1",
     "@pnpm/catalogs.types": "1100.0.0",
-    "@pnpm/releasing.exportable-manifest": "1100.1.6",
+    "@pnpm/hooks.pnpmfile": "1100.0.15",
     "@pnpm/prepare": "1100.0.16",
-    "@pnpm/hooks.pnpmfile": "1100.0.15"
+    "@pnpm/releasing.exportable-manifest": "1100.1.7"
   },
   "engines": {
     "node": ">=22.13"