What happened?
After upgrading from aspect_rules_js 2.9.2 to 3.x, the generated npm package directory for marked no longer contains LICENSE.md and README.md.
This appears to be a regression introduced in rules_js 3.x.
Version
3.0.0, 3.0.1, 3.0.2 and 3.0.3 are affected.
How to reproduce
MODULE.bazel:
bazel_dep(name = "aspect_bazel_lib", version = "2.22.5")
bazel_dep(name = "aspect_rules_js", version = "3.0.3")
#bazel_dep(name = "aspect_rules_js", version = "2.9.2")
bazel_dep(name = "rules_nodejs", version = "6.7.4")
npm = use_extension("@aspect_rules_js//npm:extensions.bzl", "npm")
npm.npm_translate_lock(
name = "npm",
pnpm_lock = "//:pnpm-lock.yaml",
)
use_repo(npm, "npm")BUILD.bazel
load("@npm//:defs.bzl", "npm_link_all_packages")
npm_link_all_packages(name = "node_modules")
filegroup(
name = "marked_dir",
srcs = [":node_modules/marked/dir"],
)
genrule(
name = "list_marked_files",
srcs = [":marked_dir"],
outs = ["marked-files.txt"],
cmd = "find -L $(locations :marked_dir) -type f | sort > $@",
)package.json:
{
"name": "repro",
"private": true,
"packageManager": "pnpm@10.33.0",
"dependencies": {
"marked": "17.0.6"
}
}pnpm-workspace.yaml
onlyBuiltDependencies: []
ppm-lock.yaml:
lockfileVersion: '9.0'
settings:
autoInstallPeers: true
excludeLinksFromLockfile: false
importers:
.:
dependencies:
marked:
specifier: 17.0.1
version: 17.0.1
packages:
marked@17.0.1:
resolution: {integrity: sha512-boeBdiS0ghpWcSwoNm/jJBwdpFaMnZWRzjA6SkUMYb40SVaN1x7mmfGKp0jvexGcx+7y2La5zRZsYFZI6Qpypg==}
engines: {node: '>= 20'}
hasBin: true
snapshots:
marked@17.0.1: {}On rules_js 3.0.3:
$ bazelisk build :list_marked_files
INFO: Analyzed target //:list_marked_files (0 packages loaded, 0 targets configured).
INFO: Found 1 target...
Target //:list_marked_files up-to-date:
bazel-bin/marked-files.txt
INFO: Elapsed time: 0.120s, Critical Path: 0.00s
INFO: 1 process: 1 internal.
INFO: Build completed successfully, 1 total action
✔ ~/projects/marked_missing_files_reproduces
15:51 $ cat bazel-bin/marked-files.txt | grep LICENSE
# no match
On rules_js 2.9.2:
$ bazelisk build :list_marked_files
INFO: Analyzed target //:list_marked_files (67 packages loaded, 483 targets configured).
INFO: Found 1 target...
Target //:list_marked_files up-to-date:
bazel-bin/marked-files.txt
INFO: Elapsed time: 5.691s, Critical Path: 0.10s
INFO: 3 processes: 1 internal, 2 darwin-sandbox.
INFO: Build completed successfully, 3 total actions
✔ ~/projects/marked_missing_files_reproduces
15:52 $ cat bazel-bin/marked-files.txt | grep LICENSE
bazel-out/darwin_x86_64-fastbuild/bin/node_modules/.aspect_rules_js/marked@17.0.1/node_modules/marked/LICENSE.md
Expected behaviour:
are included.
Any other information?
This breaks license aggregation and compliance tooling that relies on scanning node_modules, e.g.: license collectors.
Bazel-based license pipelines (e.g. Gerrit’s node_modules_licenses).
See this change upstream for more details.
What happened?
After upgrading from aspect_rules_js 2.9.2 to 3.x, the generated npm package directory for marked no longer contains LICENSE.md and README.md.
This appears to be a regression introduced in rules_js 3.x.
Version
3.0.0, 3.0.1, 3.0.2 and 3.0.3 are affected.
How to reproduce
MODULE.bazel:
BUILD.bazel
package.json:
{ "name": "repro", "private": true, "packageManager": "pnpm@10.33.0", "dependencies": { "marked": "17.0.6" } }pnpm-workspace.yaml
ppm-lock.yaml:
On rules_js 3.0.3:
On rules_js 2.9.2:
Expected behaviour:
are included.
Any other information?
This breaks license aggregation and compliance tooling that relies on scanning node_modules, e.g.: license collectors.
Bazel-based license pipelines (e.g. Gerrit’s node_modules_licenses).
See this change upstream for more details.