jqueuniet/dm2-tools

Fork 0

fix(wasm): list the licenses in the npm package's files array #324

Merged

jqueuniet merged 1 commit from fix/npm-license-files into main

2026-09-05 07:49:30 +02:00

jqueuniet commented

2026-09-05 07:44:30 +02:00

Owner

dm2-tools@0.2.0 is live on npm without either license text, despite
declaring "license": "MIT OR Apache-2.0". The published tarball has six
entries and neither is a license.

Why the earlier fix wasn't enough

Copying LICENSE-MIT / LICENSE-APACHE next to Cargo.toml gets wasm-pack to
place them in the package directory — which is as far as I verified it. But
packing is governed by files, and wasm-pack always writes that array without
them.

npm's always-included rule doesn't close the gap. From npm-packlist:

'!/license{,.*[^~$]}',
'!/licence{,.*[^~$]}',

The separator is a dot. LICENSE and LICENSE.md survive an explicit files
array; the hyphenated names a dual-licensed crate needs do not.

The fix

build-npm.sh appends both to files, and throws if either is missing from the
package directory rather than quietly publishing without them.

Verified with npm pack --dry-run in node:lts-trixie — eight entries
including both licenses, against six in what's published:

npm notice 11.4kB LICENSE-APACHE
npm notice 1.1kB  LICENSE-MIT
npm notice 9B     README.md
npm notice 1B     dm2_wasm_bg.js
...

The published 0.2.0 stays as it is

npm will not let it be corrected in place: a version number cannot be reused
after an unpublish, and unpublishing the only version of a package blocks the
name for 24 hours. Bumping npm alone would also desync it from the workspace
version that build-npm.sh reads out of Cargo.toml. So the fix ships with
the next release, and the docs record why 0.2.0 lacks the texts. The license is
still declared in the package metadata and the repository link resolves, so the
terms are discoverable meanwhile.

`dm2-tools@0.2.0` is live on npm without either license text, despite declaring `"license": "MIT OR Apache-2.0"`. The published tarball has six entries and neither is a license. ## Why the earlier fix wasn't enough Copying `LICENSE-MIT` / `LICENSE-APACHE` next to `Cargo.toml` gets wasm-pack to place them in the package directory — which is as far as I verified it. But packing is governed by `files`, and wasm-pack always writes that array without them. npm's always-included rule doesn't close the gap. From `npm-packlist`: ``` '!/license{,.*[^~$]}', '!/licence{,.*[^~$]}', ``` The separator is a dot. `LICENSE` and `LICENSE.md` survive an explicit `files` array; the hyphenated names a dual-licensed crate needs do not. ## The fix `build-npm.sh` appends both to `files`, and throws if either is missing from the package directory rather than quietly publishing without them. Verified with `npm pack --dry-run` in `node:lts-trixie` — eight entries including both licenses, against six in what's published: ``` npm notice 11.4kB LICENSE-APACHE npm notice 1.1kB LICENSE-MIT npm notice 9B README.md npm notice 1B dm2_wasm_bg.js ... ``` ## The published 0.2.0 stays as it is npm will not let it be corrected in place: a version number cannot be reused after an unpublish, and unpublishing the only version of a package blocks the name for 24 hours. Bumping npm alone would also desync it from the workspace version that `build-npm.sh` reads out of `Cargo.toml`. So the fix ships with the next release, and the docs record why 0.2.0 lacks the texts. The license is still declared in the package metadata and the repository link resolves, so the terms are discoverable meanwhile.

jqueuniet added 1 commit

2026-09-05 07:44:30 +02:00

fix(wasm): list the licenses in the npm package's files array

CI / msrv (1.90) (pull_request) Successful in 41s

Details

CI / audit (pull_request) Successful in 19s

Details

CI / msrv (1.90) (push) Successful in 41s

Details

CI / stable (push) Successful in 1m41s

Details

CI / python bindings (3.11) (push) Successful in 43s

Details

CI / stable (pull_request) Successful in 1m44s

Details

CI / python bindings (3.11) (pull_request) Successful in 45s

Details

CI / audit (push) Successful in 20s

Details

90c5b47387

`dm2-tools@0.2.0` shipped to npm without either license text, despite
declaring `"license": "MIT OR Apache-2.0"`. Copying the files next to
Cargo.toml gets wasm-pack to place them in the package directory, which is as
far as this was verified, but packing is governed by `files` — and wasm-pack
always writes that array without them.

npm's always-included rule does not cover the gap. From npm-packlist:

    '!/license{,.*[^~$]}',
    '!/licence{,.*[^~$]}',

The separator is a dot, so `LICENSE` and `LICENSE.md` survive an explicit
`files` array while the hyphenated `LICENSE-MIT` and `LICENSE-APACHE` of a
dual-licensed crate do not.

`build-npm.sh` now appends both to `files`, and fails loudly if either is
missing from the package directory rather than quietly publishing without
them. Verified with `npm pack --dry-run`: eight entries including both
licenses, against the six in the published tarball.

The published 0.2.0 cannot be corrected in place — npm refuses to reuse a
version number after an unpublish, and unpublishing the only version blocks
the package name for 24 hours — so the fix lands with the next release.

jqueuniet merged commit 90c5b47387 into main

2026-09-05 07:49:30 +02:00

jqueuniet deleted branch fix/npm-license-files

2026-09-05 07:49:30 +02:00

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

jqueuniet/dm2-tools!324

No description provided.

Rows
Columns