Closed mvayngrib closed 1 year ago
@ljharb thanks for the quick response! Could u elaborate on why that's necessary? I imagine this can bloat node_modules quite a bit for other projects (maybe not json-stable-stringify/jsonify specifically). Can't the consumers who want to check tests clone the github repo and check out the tag (and compare files to npm contents if they really need to)?
I don't particularly care about bloated node_modules; disk space is infinite and free.
Cloning the repo requires an internet connection, and, since repos are mutable (like this package's original repo), not guaranteed to exist at all.
haha understood. What brought me here was actually a different reason. We audit all lines of code that make it to build machines, so this made audit pretty painful. Your module your choice of course
That seems like a really impractical policy, given that tons of code will exist in node_modules that doesn't end up in production, and is thus irrelevant.
currently this package includes many files that aren't needed at runtime. This PR npmignores them
Test Plan
run
npm pack
. You should see only these files packed