Skip to content

Do not include licenseText field in npm metadata

Radamanthus Batnag requested to merge 345759-npm-disallow-field-licenseText into master

Context

Publishing an npm package with yarn fails when the package includes a license text that exceeds 20kb. (ZD link, internal only)

We have a check constraint that limits the package json metadata size to less than 20k.

We don't really need to include the license text in the metadata, so we can skip this field when storing the package metadata.

What does this MR do and why?

Ignore the licenseText field when creating the npm package metadata.

How to set up and validate locally

Scenario 1: Publish an npm package that has a LICENSE file smaller than 20kb

  1. Create an npm package that includes a LICENSE file smaller than 20kb.
  2. Publish the package using yarn.
  3. Expected results
  • master: The package was published. The contents of the LICENSE file is in the licenseText field in the packages_json column of the packages_npm_metadata table.
  • MR: The package was published. The contents of the LICENSE file should not be stored in the packages_npm_metadata record in the database.

Scenario 2: Publish an npm package that has a LICENSE file larger than 20kb

  1. Create an npm package that includes a LICENSE file larger than 20kb.
  2. Publish the package using yarn.
  3. Expected results
  • master: There is no error with the yarn publish operation, but the package was not published.
  • MR: The package was published. The contents of the LICENSE file should not be stored in the packages_npm_metadata record in the database.

MR acceptance checklist

This checklist encourages us to confirm any changes have been analyzed to reduce risks in quality, performance, reliability, security, and maintainability.

Related to #345759 (closed)

Edited by Radamanthus Batnag

Merge request reports