Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add files field to limit files installed when installed as a package #34

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

openam
Copy link

@openam openam commented Mar 15, 2024

Since the utils is included when I install this package I'm getting some vulnerabilities showing up in some scans. I know they are not used via the NPM package so it would be nice to just exclude them from the installed package.

$ npm pack --dry-run                                                            
npm notice 
npm notice 📦  [email protected]
npm notice === Tarball Contents === 
npm notice 1.1kB   LICENSE                  
npm notice 6.2kB   README.md                
npm notice 43.9kB  data/ca-cities.json      
npm notice 314B    data/ca-states.json      
npm notice 384.7kB data/cities.json         
npm notice 1.1kB   data/states.json         
npm notice 340.8kB data/us-cities.json      
npm notice 1.2kB   data/us-states.json      
npm notice 14.5kB  data/us-street-types.json
npm notice 13.9kB  index.js                 
npm notice 889B    package.json             
npm notice === Tarball Details === 
npm notice name:          addresser                               
npm notice version:       1.1.19                                  
npm notice filename:      addresser-1.1.19.tgz                    
npm notice package size:  292.0 kB                                
npm notice unpacked size: 808.6 kB                                
npm notice shasum:        cae204a2d17f8d881d181318f3bd15bcdae1ad10
npm notice integrity:     sha512-zuzIV/VDji+DS[...]lpdGCE6JvpkFQ==
npm notice total files:   11                                      
npm notice 
addresser-1.1.19.tgz

Vulnerability scan findings:

image image image image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant