npm-packlist 11.1.0 → 11.3.0

package/lib/index.js

@@ -305,6 +305,7 @@ class PackWalker extends IgnoreWalker {
       browser,
       files,
       main,
+      patchedDependencies,
     } = this.tree.package
 
     // rules in these arrays are inverted since they are patterns we want to _not_ ignore
@@ -325,6 +326,8 @@ class PackWalker extends IgnoreWalker {
       '/pnpm-lock.yaml',
       '/bun.lockb',
       '/bun.lock',
+      '/.npm-extension.mjs',
+      '/.npm-extension.cjs',
     ]
 
     // if we have a files array in our package, we need to pull rules from it
@@ -394,6 +397,32 @@ class PackWalker extends IgnoreWalker {
       }
     }
 
+    // patch files declared in patchedDependencies are project-local fixes and must never ship.
+    // patchedDependencies is root-only state, so this applies only to the package being packed.
+    // each declared patch file is force-excluded even when it was added via "files".
+    // only the exact files are excluded, never their directory, so a shared dir keeps its other contents.
+    if (this.tree.isProjectRoot && patchedDependencies && typeof patchedDependencies === 'object') {
+      for (const patchPath of Object.values(patchedDependencies)) {
+        if (typeof patchPath !== 'string') {
+          continue
+        }
+        const rel = normalizePath(patchPath).replace(/^\.?\//, '').replace(/\/+$/, '')
+        // skip absolute paths or paths that escape the package root, which are never packed anyway
+        if (!rel || rel.startsWith('/') || rel === '..' || rel.startsWith('../') || rel.includes('/../')) {
+          continue
+        }
+        // warn when a "files" entry pulled the patch file in, either directly or via its directory
+        const parentGlob = `!/${normalizePath(dirname(rel))}/**`
+        if (files && (ignores.includes(`!/${rel}`) || ignores.includes(parentGlob))) {
+          log.warn(
+            'patched-dependencies',
+            `excluding "${rel}" from the package tarball: patch files in patchedDependencies must not be published`
+          )
+        }
+        strict.push(`/${rel}`)
+      }
+    }
+
     // and now we add all of the strict rules to our synthetic file
     this.injectRules(strictRules, strict, callback)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "npm-packlist",
-  "version": "11.1.0",
+  "version": "11.3.0",
   "description": "Get a list of the files to add from a folder into an npm package",
   "directories": {
     "test": "test"
@@ -20,7 +20,7 @@
   "devDependencies": {
     "@npmcli/arborist": "^9.0.0",
     "@npmcli/eslint-config": "^7.0.0",
-    "@npmcli/template-oss": "5.1.0",
+    "@npmcli/template-oss": "5.1.1",
     "mutate-fs": "^2.1.1",
     "tap": "^16.0.1"
   },
@@ -57,7 +57,7 @@
   },
   "templateOSS": {
     "//@npmcli/template-oss": "This file is partially managed by @npmcli/template-oss. Edits may be overwritten.",
-    "version": "5.1.0",
+    "version": "5.1.1",
     "publish": true,
     "updateNpm": false
   }