mirror of
https://github.com/electron/electron.git
synced 2026-05-02 03:00:22 -04:00
48401169d9
* build: restrict npm tarball contents to an explicit allowlist The npm publish flow runs `npm pack` in a staging temp dir, but `npm/package.json` had no `files` field — so any file that happened to land in that dir was packed into the published tarball. Recent releases (41.2.1+, 40.9.1+, 39.8.8+) shipped a self-referential `.npm-cache/_logs/*-debug-0.log` (npm's own debug log, written into the pack dir before pack finishes reading files) and a stray copy of `SHASUMS256.txt` that duplicates the info already in `checksums.json`. Add an explicit `files` allowlist so only the intended contents are packaged, regardless of staging-dir contamination. `package.json`, `README.md`, and `LICENSE` are auto-included by npm. Fixes #51290. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Keeley Hammond <vertedinde@electronjs.org> * build: include LICENSE and README.md in files allowlist These are auto-included by npm regardless, but listing them makes the intended contents of the tarball self-documenting alongside the other entries. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> Co-authored-by: Keeley Hammond <vertedinde@electronjs.org> --------- Co-authored-by: trop[bot] <37223003+trop[bot]@users.noreply.github.com> Co-authored-by: Keeley Hammond <vertedinde@electronjs.org>
29 lines
470 B
JSON
29 lines
470 B
JSON
{
|
|
"main": "index.js",
|
|
"types": "electron.d.ts",
|
|
"bin": {
|
|
"electron": "cli.js"
|
|
},
|
|
"scripts": {
|
|
"postinstall": "node install.js"
|
|
},
|
|
"files": [
|
|
"LICENSE",
|
|
"README.md",
|
|
"abi_version",
|
|
"checksums.json",
|
|
"cli.js",
|
|
"electron.d.ts",
|
|
"index.js",
|
|
"install.js"
|
|
],
|
|
"dependencies": {
|
|
"@electron/get": "^2.0.0",
|
|
"@types/node": "^24.9.0",
|
|
"extract-zip": "^2.0.1"
|
|
},
|
|
"engines": {
|
|
"node": ">= 12.20.55"
|
|
}
|
|
}
|