chore(deps): upgrade npm-packlist to 11 in @uppy

npm-packlist v7+ replaced the `{ path }` argument with an @npmcli/arborist
tree, so upload-to-cdn.js now loads an Arborist tree and passes it to
packlist(). Adds @npmcli/arborist as a devDependency.

Pinned arborist to ^9.6.0 (not the newer 9.7.0) to satisfy the repo's
npmMinimalAgeGate (48h) supply-chain policy.

Verified: getLocalDistFiles still returns the expected dist/ files; build
green; biome clean. (Release-only script, not covered by the test suite.)
This commit is contained in:
Prakash 2026-05-29 21:27:46 +05:30
parent cc9591a043
commit dfe44c6ef7
3 changed files with 236 additions and 61 deletions

View file

@ -80,13 +80,14 @@
},
"devDependencies": {
"@aws-sdk/client-s3": "^3.338.0",
"@npmcli/arborist": "^9.6.0",
"adm-zip": "^0.5.5",
"chalk": "^5.0.0",
"concat-stream": "^2.0.0",
"cssnano": "^8.0.1",
"esbuild": "^0.27.0",
"mime-types": "^3.0.2",
"npm-packlist": "^5.0.0",
"npm-packlist": "^11.1.0",
"pacote": "^21.5.0",
"postcss": "^8.5.15",
"postcss-cli": "^11.0.1",

View file

@ -32,6 +32,7 @@ import {
PutObjectCommand,
S3Client,
} from '@aws-sdk/client-s3'
import Arborist from '@npmcli/arborist'
import AdmZip from 'adm-zip'
import concat from 'concat-stream'
import mime from 'mime-types'
@ -102,7 +103,11 @@ async function getLocalDistFiles(packageName) {
const prefix = 'dist'
const files = (await packlist({ path: packagePath })).flatMap((f) => {
// npm-packlist v7+ takes an Arborist tree (loaded from the package path)
// instead of a `{ path }` option.
const tree = await new Arborist({ path: packagePath }).loadActual()
const files = (await packlist(tree)).flatMap((f) => {
const prefixSlash = `${prefix}/`
if (f.startsWith(prefixSlash)) {

287
yarn.lock
View file

@ -4765,6 +4765,13 @@ __metadata:
languageName: node
linkType: hard
"@isaacs/string-locale-compare@npm:^1.1.0":
version: 1.1.0
resolution: "@isaacs/string-locale-compare@npm:1.1.0"
checksum: 10/85682b14602f32023e487f62bc4076fe13cd3e887df9cca36acc0d41ea99b403100d586acb9367331526f3ee737d802ecaa582f59020998d75991e62a7ef0db5
languageName: node
linkType: hard
"@istanbuljs/schema@npm:^0.1.2, @istanbuljs/schema@npm:^0.1.3":
version: 0.1.3
resolution: "@istanbuljs/schema@npm:0.1.3"
@ -5403,6 +5410,50 @@ __metadata:
languageName: node
linkType: hard
"@npmcli/arborist@npm:^9.6.0":
version: 9.6.0
resolution: "@npmcli/arborist@npm:9.6.0"
dependencies:
"@gar/promise-retry": "npm:^1.0.0"
"@isaacs/string-locale-compare": "npm:^1.1.0"
"@npmcli/fs": "npm:^5.0.0"
"@npmcli/installed-package-contents": "npm:^4.0.0"
"@npmcli/map-workspaces": "npm:^5.0.0"
"@npmcli/metavuln-calculator": "npm:^9.0.2"
"@npmcli/name-from-folder": "npm:^4.0.0"
"@npmcli/node-gyp": "npm:^5.0.0"
"@npmcli/package-json": "npm:^7.0.0"
"@npmcli/query": "npm:^5.0.0"
"@npmcli/redact": "npm:^4.0.0"
"@npmcli/run-script": "npm:^10.0.0"
bin-links: "npm:^6.0.0"
cacache: "npm:^20.0.1"
common-ancestor-path: "npm:^2.0.0"
hosted-git-info: "npm:^9.0.0"
json-stringify-nice: "npm:^1.1.4"
lru-cache: "npm:^11.2.1"
minimatch: "npm:^10.0.3"
nopt: "npm:^9.0.0"
npm-install-checks: "npm:^8.0.0"
npm-package-arg: "npm:^13.0.0"
npm-pick-manifest: "npm:^11.0.1"
npm-registry-fetch: "npm:^19.0.0"
pacote: "npm:^21.0.2"
parse-conflict-json: "npm:^5.0.1"
proc-log: "npm:^6.0.0"
proggy: "npm:^4.0.0"
promise-all-reject-late: "npm:^1.0.0"
promise-call-limit: "npm:^3.0.1"
semver: "npm:^7.3.7"
ssri: "npm:^13.0.0"
treeverse: "npm:^3.0.0"
walk-up-path: "npm:^4.0.0"
bin:
arborist: bin/index.js
checksum: 10/612faad61f967eab3bda4c3f16c268c15aa636c7795d2387cff8f27e8c71c068d13cff6b018e44b431c5ef0a90e1aac29d272f09ab436722f75624dad0ff22ac
languageName: node
linkType: hard
"@npmcli/fs@npm:^3.1.0":
version: 3.1.1
resolution: "@npmcli/fs@npm:3.1.1"
@ -5486,6 +5537,38 @@ __metadata:
languageName: node
linkType: hard
"@npmcli/map-workspaces@npm:^5.0.0":
version: 5.0.3
resolution: "@npmcli/map-workspaces@npm:5.0.3"
dependencies:
"@npmcli/name-from-folder": "npm:^4.0.0"
"@npmcli/package-json": "npm:^7.0.0"
glob: "npm:^13.0.0"
minimatch: "npm:^10.0.3"
checksum: 10/72c5db2c555d64ff1300b912d1c3e738818658a90b7121a1f5ac98f48db53072ce38f1856b37677fcfefbce168d0db16d1e563452bd99f56d1ba38f83201c072
languageName: node
linkType: hard
"@npmcli/metavuln-calculator@npm:^9.0.2":
version: 9.0.3
resolution: "@npmcli/metavuln-calculator@npm:9.0.3"
dependencies:
cacache: "npm:^20.0.0"
json-parse-even-better-errors: "npm:^5.0.0"
pacote: "npm:^21.0.0"
proc-log: "npm:^6.0.0"
semver: "npm:^7.3.5"
checksum: 10/562f7fd373809c7d7d3b3526998f7ed295fa80636279deaddbb7416c8251c620127a0029349e962dfb788bdbf30e2721bac063ca1a75a867d5fb62689a607bbf
languageName: node
linkType: hard
"@npmcli/name-from-folder@npm:^4.0.0":
version: 4.0.0
resolution: "@npmcli/name-from-folder@npm:4.0.0"
checksum: 10/9aa8598f59866decbf4a877def4143b165964ea270056371782e459aa0c6623f020d218783651afbcc522dbf8dff4c63a316518600991f2cecfc488d23bd8aab
languageName: node
linkType: hard
"@npmcli/node-gyp@npm:^4.0.0":
version: 4.0.0
resolution: "@npmcli/node-gyp@npm:4.0.0"
@ -5548,6 +5631,15 @@ __metadata:
languageName: node
linkType: hard
"@npmcli/query@npm:^5.0.0":
version: 5.0.0
resolution: "@npmcli/query@npm:5.0.0"
dependencies:
postcss-selector-parser: "npm:^7.0.0"
checksum: 10/259375bfa34649f4c75a0908c8ec7e1c1a521436d3c3ab8a809bed369070e2f98363493bc75d3ea9955c13bdd13955f3666f8b5ed2334ab6131e0c3d4c3248a2
languageName: node
linkType: hard
"@npmcli/redact@npm:^3.0.0":
version: 3.1.1
resolution: "@npmcli/redact@npm:3.1.1"
@ -10605,6 +10697,19 @@ __metadata:
languageName: node
linkType: hard
"bin-links@npm:^6.0.0":
version: 6.0.2
resolution: "bin-links@npm:6.0.2"
dependencies:
cmd-shim: "npm:^8.0.0"
npm-normalize-package-bin: "npm:^5.0.0"
proc-log: "npm:^6.0.0"
read-cmd-shim: "npm:^6.0.0"
write-file-atomic: "npm:^7.0.0"
checksum: 10/8d28e74cb68a9ceeed83c4b039874e2754bd483cac410f2e3540fb4551009d4fcbe3528fa0ebfb8641db4afe3d7613dec715a3594984d3b722731015f2b5064c
languageName: node
linkType: hard
"binary-extensions@npm:^2.0.0":
version: 2.3.0
resolution: "binary-extensions@npm:2.3.0"
@ -11254,6 +11359,13 @@ __metadata:
languageName: node
linkType: hard
"cmd-shim@npm:^8.0.0":
version: 8.0.0
resolution: "cmd-shim@npm:8.0.0"
checksum: 10/79b533fccf8265a47596fd0804b9a8596e43e0ac8d3f7b9cc3a1492a90d5e230091dc14797588c36c370328b5ce0acd706d8c3d0dd6a2a6c9ce77220df1b4aa1
languageName: node
linkType: hard
"color-convert@npm:^1.9.0":
version: 1.9.3
resolution: "color-convert@npm:1.9.3"
@ -11347,6 +11459,13 @@ __metadata:
languageName: node
linkType: hard
"common-ancestor-path@npm:^2.0.0":
version: 2.0.0
resolution: "common-ancestor-path@npm:2.0.0"
checksum: 10/d15b61e109f993840bed09b893e2f533902f77c873004f0be7400b9147e6dc99c54f6eacec8c222bfe3d438697f757065c7747d4d9b2ae2c4f25ae523a85d828
languageName: node
linkType: hard
"common-path-prefix@npm:^3.0.0":
version: 3.0.0
resolution: "common-path-prefix@npm:3.0.0"
@ -14372,19 +14491,6 @@ __metadata:
languageName: node
linkType: hard
"glob@npm:^8.0.1":
version: 8.1.0
resolution: "glob@npm:8.1.0"
dependencies:
fs.realpath: "npm:^1.0.0"
inflight: "npm:^1.0.4"
inherits: "npm:2"
minimatch: "npm:^5.0.1"
once: "npm:^1.3.0"
checksum: 10/9aab1c75eb087c35dbc41d1f742e51d0507aa2b14c910d96fb8287107a10a22f4bbdce26fc0a3da4c69a20f7b26d62f1640b346a4f6e6becfff47f335bb1dc5e
languageName: node
linkType: hard
"glob@npm:~7.1.1":
version: 7.1.7
resolution: "glob@npm:7.1.7"
@ -14922,15 +15028,6 @@ __metadata:
languageName: node
linkType: hard
"ignore-walk@npm:^5.0.1":
version: 5.0.1
resolution: "ignore-walk@npm:5.0.1"
dependencies:
minimatch: "npm:^5.0.1"
checksum: 10/a88b3fbda155496363fb3db66c7c7b85cf04d614fb51146f0aa5fc6b35c65370c57f9e6c550cd6048651fc378985b7a2bb9015c9fcb3e0dc798fc0728746703c
languageName: node
linkType: hard
"ignore-walk@npm:^7.0.0":
version: 7.0.0
resolution: "ignore-walk@npm:7.0.0"
@ -14949,6 +15046,15 @@ __metadata:
languageName: node
linkType: hard
"ignore-walk@npm:^9.0.0":
version: 9.0.0
resolution: "ignore-walk@npm:9.0.0"
dependencies:
minimatch: "npm:^10.0.3"
checksum: 10/bc5e60a82194ecc986e55326d08cd80f8b8efa599b469d9c54defd6672250899fc539ab53996a95d804095757d5cc1f255898f3f39b11dbae626b8d2463800a6
languageName: node
linkType: hard
"ignore@npm:^5.2.0":
version: 5.3.1
resolution: "ignore@npm:5.3.1"
@ -15847,6 +15953,13 @@ __metadata:
languageName: node
linkType: hard
"json-stringify-nice@npm:^1.1.4":
version: 1.1.4
resolution: "json-stringify-nice@npm:1.1.4"
checksum: 10/0e02cae900a1f24df64613dd10a54b354e4ba2b17822f0d7f0d2708182e71a8bbbfac107d54d3ae8fa3d8bab3556e20cef84f193ace92c9df7bc30872ec2926e
languageName: node
linkType: hard
"json-stringify-safe@npm:^5.0.1":
version: 5.0.1
resolution: "json-stringify-safe@npm:5.0.1"
@ -15920,6 +16033,20 @@ __metadata:
languageName: node
linkType: hard
"just-diff-apply@npm:^5.2.0":
version: 5.5.0
resolution: "just-diff-apply@npm:5.5.0"
checksum: 10/5515c436c89e9ef934f1ea2aac447588c38dd017247ed85254537b005706e64321ca7a9c246fe7106338da1ef3a693f8550ebf11759c854713e9ccffb788a43b
languageName: node
linkType: hard
"just-diff@npm:^6.0.0":
version: 6.0.2
resolution: "just-diff@npm:6.0.2"
checksum: 10/4c6b14d6be2a3391b020ea2b3d1a0acf2f4c60fcb16681c7f6f76d4c0f1841fae5b00c1a2e719980992e46320e4b6c55a4713683cb1873dd41a2621f08c9f8e8
languageName: node
linkType: hard
"jwa@npm:^2.0.0":
version: 2.0.0
resolution: "jwa@npm:2.0.0"
@ -17297,15 +17424,6 @@ __metadata:
languageName: node
linkType: hard
"minimatch@npm:^5.0.1":
version: 5.1.6
resolution: "minimatch@npm:5.1.6"
dependencies:
brace-expansion: "npm:^2.0.1"
checksum: 10/126b36485b821daf96d33b5c821dac600cc1ab36c87e7a532594f9b1652b1fa89a1eebcaad4dff17c764dce1a7ac1531327f190fed5f97d8f6e5f889c116c429
languageName: node
linkType: hard
"minimatch@npm:^9.0.0, minimatch@npm:^9.0.4, minimatch@npm:^9.0.5":
version: 9.0.5
resolution: "minimatch@npm:9.0.5"
@ -18125,15 +18243,6 @@ __metadata:
languageName: node
linkType: hard
"npm-bundled@npm:^2.0.0":
version: 2.0.1
resolution: "npm-bundled@npm:2.0.1"
dependencies:
npm-normalize-package-bin: "npm:^2.0.0"
checksum: 10/adf5d727915cbd61603e2171ba67e39319efa343ceb72868348232a36ad774a8365d5af5e1aad29acc41c3caeda4ebd80e5b7a3da319985509aeedf79e352c0d
languageName: node
linkType: hard
"npm-bundled@npm:^4.0.0":
version: 4.0.0
resolution: "npm-bundled@npm:4.0.0"
@ -18170,13 +18279,6 @@ __metadata:
languageName: node
linkType: hard
"npm-normalize-package-bin@npm:^2.0.0":
version: 2.0.0
resolution: "npm-normalize-package-bin@npm:2.0.0"
checksum: 10/7c5379f9b188b564c4332c97bdd9a5d6b7b15f02b5823b00989d6a0e6fb31eb0280f02b0a924f930e1fcaf00e60fae333aec8923d2a4c7747613c7d629d8aa25
languageName: node
linkType: hard
"npm-normalize-package-bin@npm:^4.0.0":
version: 4.0.0
resolution: "npm-normalize-package-bin@npm:4.0.0"
@ -18225,17 +18327,14 @@ __metadata:
languageName: node
linkType: hard
"npm-packlist@npm:^5.0.0":
version: 5.1.3
resolution: "npm-packlist@npm:5.1.3"
"npm-packlist@npm:^11.1.0":
version: 11.1.0
resolution: "npm-packlist@npm:11.1.0"
dependencies:
glob: "npm:^8.0.1"
ignore-walk: "npm:^5.0.1"
npm-bundled: "npm:^2.0.0"
npm-normalize-package-bin: "npm:^2.0.0"
bin:
npm-packlist: bin/index.js
checksum: 10/78aa1c69a349c40cf7ba556581bff2dd5cbc1455614a44bd673e076f7f402096ac7c01660c45ec17cbd51bf0db3a4df7e9bc3a0a8e8e497ebf6d53848f33dfad
glob: "npm:^13.0.6"
ignore-walk: "npm:^9.0.0"
proc-log: "npm:^7.0.0"
checksum: 10/6e53dcbbc51713793000b331c1124d1557ccf5af10dc90dab38cdb5c14f5432bd611fb7d0edb01b5c886346bddc3b2de1063a0398b7b4a9290f39ad468c7f931
languageName: node
linkType: hard
@ -18690,7 +18789,7 @@ __metadata:
languageName: node
linkType: hard
"pacote@npm:^21.5.0":
"pacote@npm:^21.0.0, pacote@npm:^21.0.2, pacote@npm:^21.5.0":
version: 21.5.0
resolution: "pacote@npm:21.5.0"
dependencies:
@ -18726,6 +18825,17 @@ __metadata:
languageName: node
linkType: hard
"parse-conflict-json@npm:^5.0.1":
version: 5.0.1
resolution: "parse-conflict-json@npm:5.0.1"
dependencies:
json-parse-even-better-errors: "npm:^5.0.0"
just-diff: "npm:^6.0.0"
just-diff-apply: "npm:^5.2.0"
checksum: 10/c8290bd710ef3d2309e580b2951364e01f9a5b2fafcc441a91e1fa706fb6e4e04165f934ed349651284cffa1ce10d13376e8f17980874871f41e33ba803326da
languageName: node
linkType: hard
"parse-json@npm:^4.0.0":
version: 4.0.0
resolution: "parse-json@npm:4.0.0"
@ -19720,6 +19830,13 @@ __metadata:
languageName: node
linkType: hard
"proc-log@npm:^7.0.0":
version: 7.0.0
resolution: "proc-log@npm:7.0.0"
checksum: 10/97cd9f4a8a0d84e42ee91e106e5ba5edcb954521e8dbe26ee6ad31396e5c12cc2be5e5b6be7b53fa5a69959afbacd32719106e2d6f45802e34b31d9a3a01ec20
languageName: node
linkType: hard
"process-nextick-args@npm:~2.0.0":
version: 2.0.1
resolution: "process-nextick-args@npm:2.0.1"
@ -19727,6 +19844,13 @@ __metadata:
languageName: node
linkType: hard
"proggy@npm:^4.0.0":
version: 4.0.0
resolution: "proggy@npm:4.0.0"
checksum: 10/9230771ef89867721b555520ebb2fb0b329edeb7e31294387aa1fac42137f7bc256b2ba0b0bfed2af6483313c3aa5f3ef88c950d7356bf42ffeea2c6c816914d
languageName: node
linkType: hard
"prom-client@npm:15.1.3":
version: 15.1.3
resolution: "prom-client@npm:15.1.3"
@ -19737,6 +19861,20 @@ __metadata:
languageName: node
linkType: hard
"promise-all-reject-late@npm:^1.0.0":
version: 1.0.1
resolution: "promise-all-reject-late@npm:1.0.1"
checksum: 10/f5e5c1bfed975c26b6dec007393e1026c437716d87c9c688cfa026bb904c190155211d23fe795c03c4394f88563471aec56b3ad263bff5ed68dad734513c2912
languageName: node
linkType: hard
"promise-call-limit@npm:^3.0.1":
version: 3.0.2
resolution: "promise-call-limit@npm:3.0.2"
checksum: 10/e1e2d57658bd57574959bd89733958f4e6940a6a5788d2f380a81f62f5660f88f93a7dd9f9eb3d09dc7c4927387e25c00ca941a3bdfce8fb050987d2d0ffe59a
languageName: node
linkType: hard
"promise-queue@npm:^2.2.5":
version: 2.2.5
resolution: "promise-queue@npm:2.2.5"
@ -20027,6 +20165,13 @@ __metadata:
languageName: node
linkType: hard
"read-cmd-shim@npm:^6.0.0":
version: 6.0.0
resolution: "read-cmd-shim@npm:6.0.0"
checksum: 10/cba2285ef31ac21e038a1525094defce597c68fdcba0e8b355d4402000ac893dfc2a3d0a44e50471df6096c7b0218af159d7524ff94ca72c21c95d44de476fbc
languageName: node
linkType: hard
"read-pkg@npm:^3.0.0":
version: 3.0.0
resolution: "read-pkg@npm:3.0.0"
@ -22413,6 +22558,13 @@ __metadata:
languageName: node
linkType: hard
"treeverse@npm:^3.0.0":
version: 3.0.0
resolution: "treeverse@npm:3.0.0"
checksum: 10/a053ad73f800c64c53ecf0effe7ea12e16eae1cf03f0901ac6b61390b6440d05d0aa8c942b6e77d2e9237d247b36fd405284942419f3817c9c3ef43bc5236218
languageName: node
linkType: hard
"tslib@npm:2.8.1, tslib@npm:^2.0.0, tslib@npm:^2.0.3, tslib@npm:^2.1.0, tslib@npm:^2.3.0, tslib@npm:^2.4.0, tslib@npm:^2.6.2, tslib@npm:^2.8.0, tslib@npm:^2.8.1":
version: 2.8.1
resolution: "tslib@npm:2.8.1"
@ -22918,6 +23070,7 @@ __metadata:
resolution: "uppy@workspace:packages/uppy"
dependencies:
"@aws-sdk/client-s3": "npm:^3.338.0"
"@npmcli/arborist": "npm:^9.6.0"
"@uppy/audio": "workspace:*"
"@uppy/aws-s3": "workspace:*"
"@uppy/box": "workspace:*"
@ -22958,7 +23111,7 @@ __metadata:
cssnano: "npm:^8.0.1"
esbuild: "npm:^0.27.0"
mime-types: "npm:^3.0.2"
npm-packlist: "npm:^5.0.0"
npm-packlist: "npm:^11.1.0"
pacote: "npm:^21.5.0"
postcss: "npm:^8.5.15"
postcss-cli: "npm:^11.0.1"
@ -23483,6 +23636,13 @@ __metadata:
languageName: node
linkType: hard
"walk-up-path@npm:^4.0.0":
version: 4.0.0
resolution: "walk-up-path@npm:4.0.0"
checksum: 10/6a230b20e5de296895116dc12b09dafaec1f72b8060c089533d296e241aff059dfaebe0d015c77467f857e4b40c78e08f7481add76f340233a1f34fa8af9ed63
languageName: node
linkType: hard
"watchpack@npm:2.4.2, watchpack@npm:^2.4.1":
version: 2.4.2
resolution: "watchpack@npm:2.4.2"
@ -23920,6 +24080,15 @@ __metadata:
languageName: node
linkType: hard
"write-file-atomic@npm:^7.0.0":
version: 7.0.1
resolution: "write-file-atomic@npm:7.0.1"
dependencies:
signal-exit: "npm:^4.0.1"
checksum: 10/99c9fdf6fb282fc798102bc8763430fbf0f9b26030b510bf085e25c13ac9a36b0a0c8198e52eddcdb6ffcac68f0959a3db7b9b025f40df48374fd699db559f55
languageName: node
linkType: hard
"ws@npm:8.20.1, ws@npm:^8.19.0":
version: 8.20.1
resolution: "ws@npm:8.20.1"