npm-packlist 11.1.0 → 11.2.0

package/lib/index.js

@@ -305,6 +305,7 @@ class PackWalker extends IgnoreWalker {
       browser,
       files,
       main,
+      patchedDependencies,
     } = this.tree.package
 
     // rules in these arrays are inverted since they are patterns we want to _not_ ignore
@@ -394,6 +395,32 @@ class PackWalker extends IgnoreWalker {
       }
     }
 
+    // patch files declared in patchedDependencies are project-local fixes and must never ship.
+    // patchedDependencies is root-only state, so this applies only to the package being packed.
+    // each declared patch file is force-excluded even when it was added via "files".
+    // only the exact files are excluded, never their directory, so a shared dir keeps its other contents.
+    if (this.tree.isProjectRoot && patchedDependencies && typeof patchedDependencies === 'object') {
+      for (const patchPath of Object.values(patchedDependencies)) {
+        if (typeof patchPath !== 'string') {
+          continue
+        }
+        const rel = normalizePath(patchPath).replace(/^\.?\//, '').replace(/\/+$/, '')
+        // skip absolute paths or paths that escape the package root, which are never packed anyway
+        if (!rel || rel.startsWith('/') || rel === '..' || rel.startsWith('../') || rel.includes('/../')) {
+          continue
+        }
+        // warn when a "files" entry pulled the patch file in, either directly or via its directory
+        const parentGlob = `!/${normalizePath(dirname(rel))}/**`
+        if (files && (ignores.includes(`!/${rel}`) || ignores.includes(parentGlob))) {
+          log.warn(
+            'patched-dependencies',
+            `excluding "${rel}" from the package tarball: patch files in patchedDependencies must not be published`
+          )
+        }
+        strict.push(`/${rel}`)
+      }
+    }
+
     // and now we add all of the strict rules to our synthetic file
     this.injectRules(strictRules, strict, callback)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npm-packlist",
-  "version": "11.1.0",
+  "version": "11.2.0",
   "description": "Get a list of the files to add from a folder into an npm package",
   "directories": {
     "test": "test"