fix: publish explicit plugin bundled dependencies · openclaw/openclaw@976da39
steipete
·
2026-05-22
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -59,8 +59,8 @@ OpenClaw source checkouts use `pnpm-lock.yaml`. The published `openclaw` npm
|
59 | 59 | package and OpenClaw-owned npm plugin packages include `npm-shrinkwrap.json`, |
60 | 60 | npm's publishable dependency lockfile, so package installs use the reviewed |
61 | 61 | transitive dependency graph from the release instead of resolving a fresh graph |
62 | | -at install time. OpenClaw-owned npm plugin packages also publish with |
63 | | -`bundleDependencies`, so their runtime dependency files are carried in the |
| 62 | +at install time. OpenClaw-owned npm plugin packages also publish with explicit |
| 63 | +`bundledDependencies`, so their runtime dependency files are carried in the |
64 | 64 | plugin tarball instead of depending only on install-time resolution. |
65 | 65 | |
66 | 66 | This is a supply-chain hardening measure: |
|
| Original file line number | Diff line number | Diff line change |
|---|
@@ -74,12 +74,13 @@ policy, and writes `extensions/<id>/npm-shrinkwrap.json` for each
|
74 | 74 | OpenClaw does not require it for community packages, but npm will respect it |
75 | 75 | when present. |
76 | 76 | |
77 | | -OpenClaw-owned npm plugin packages also publish with `bundleDependencies`. The |
78 | | -npm publish path overlays `bundleDependencies: true`, removes dev-only |
79 | | -workspace metadata from the published package manifest, runs a script-free npm |
80 | | -install for package-local runtime dependencies, then packs or publishes the |
81 | | -plugin tarball with those dependency files included. The root `openclaw` |
82 | | -package does not bundle its full dependency tree. |
| 77 | +OpenClaw-owned npm plugin packages also publish with explicit |
| 78 | +`bundledDependencies`. The npm publish path overlays the runtime dependency |
| 79 | +name list, removes dev-only workspace metadata from the published package |
| 80 | +manifest, runs a script-free npm install for package-local runtime |
| 81 | +dependencies, then packs or publishes the plugin tarball with those dependency |
| 82 | +files included. The root `openclaw` package does not bundle its full dependency |
| 83 | +tree. |
83 | 84 | |
84 | 85 | Plugins that import `openclaw/plugin-sdk/*` declare `openclaw` as a peer |
85 | 86 | dependency. OpenClaw does not let npm install a separate registry copy of the |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。
