bun publish command included the CHANGELOG.md file in the content

[fir4tozden]

Hi. bun publish command included the CHANGELOG.md file in the content even though it was specified in the .npmignore file and pushed it to npm. Related repos:

https://github.com/keift/uuniq
https://npmjs.com/package/uuniq

[RiskyMH]

Can confirm that bun doesn't do files exactly what npm does

C:\bun-repos\18691\uuniq>npm pack
npm notice
npm notice package: uuniq@1.1.1
npm notice === Tarball Contents ===
npm notice 1.1kB LICENSE.md
npm notice 6.5kB README.md
npm notice 2.3kB lib/Snowflake.js
npm notice 1.0kB lib/Symbolic.js
npm notice 170B  main.js
npm notice 829B  package.json
npm notice === Tarball Details ===
npm notice name:          uuniq
npm notice version:       1.1.1
npm notice filename:      uuniq-1.1.1.tgz
npm notice package size:  3.6 kB
npm notice unpacked size: 12.0 kB
npm notice shasum:        e24c8aeb356569c33c0abb82789cfd5794739ddb
npm notice integrity:     sha512-hKPuX6F7F3KtY[...]5/H/kWc0H7Oeg==
npm notice total files:   6
npm notice
uuniq-1.1.1.tgz

C:\bun-repos\18691\uuniq>bun pm pack
bun pack v1.2.9-canary.1 (323d78df)

packed 0.71KB package.json
packed 0KB CHANGELOG.md
packed 1.1KB LICENSE.md
packed 6.54KB README.md
packed 2.31KB lib/Snowflake.js
packed 1.0KB lib/Symbolic.js
packed 170B main.js

uuniq-1.1.1.tgz

Total files: 7
Shasum: 13e6d062242c9c31781f4cb9393609393e0525fc
Integrity: sha512-FXU//rpxIMYuX[...]pn2NXGQHMDLJg==
Unpacked size: 11.84KB
Packed size: 3.67KB

As such this test must be wrong (cc @dylan-conway)

bun/test/cli/install/bun-pack.test.ts

Lines 934 to 956 in a199b85

	test(".npmignore cannot exclude CHANGELOG", async () => {
	await Promise.all([
	write(
	join(packageDir, "package.json"),
	JSON.stringify({
	name: "pack-files-changelog",
	version: "1.1.2",
	}),
	),
	write(join(packageDir, ".npmignore"), "CHANGELOG\nCHANGELOG.*"),
	write(join(packageDir, "CHANGELOG"), "hello"),
	write(join(packageDir, "CHANGELOG.md"), "hello"),
	write(join(packageDir, "CHANGELOG.txt"), "hello"),
	]);
	await pack(packageDir, bunEnv);
	const tarball = readTarball(join(packageDir, "pack-files-changelog-1.1.2.tgz"));
	expect(tarball.entries).toMatchObject([
	{ "pathname": "package/package.json" },
	{ "pathname": "package/CHANGELOG" },
	{ "pathname": "package/CHANGELOG.md" },
	{ "pathname": "package/CHANGELOG.txt" },
	]);
	});

[Necrelox]

I've just come across this issue, I have the same problem, it's rather annoying because my CHANGELOG.md is heavy, is there a workaround?

[DonIsaac]

This is intended behavior. Per npm's docs, changelogs cannot be excluded via .npmignore. If you really want to exclude it, you may do so via the files field in package.json, which follows different inclusion/exclusion rules than .npmignore

{
  "files": [
    "!CHANGELOG",
    "!CHANGELOG.*",
  ]
}

[RiskyMH]

Even though the docs say that, we should follow the actual behavior of NPM (see my earlier message)

Edit: I think the docs for that section are outdated as another similar page removed it (npm/cli#3621) and I cant find any references to blocking CHANGELOG in the code.

[Electroid]

@claude Please fix this behavior. The logic and test we have is wrong. The changelog should not have special status, if it's ignored it should be ignored.

[claude]

Claude finished @Electroid's task —— View job • claude/issue-18691-20250519_191448 • Create PR ➔

---

I've fixed the issue with CHANGELOG files not respecting the .npmignore directives. Here's what I found and fixed:

• Analyze the issue
• Find the source of the bug in the codebase
• Fix the bug and update the test

The bug was in src/cli/pack_command.zig where CHANGELOG files were being given special treatment. In the isExcluded function at line 1069, there was a condition that specifically checked for CHANGELOG files and unconditionally included them regardless of what was in .npmignore:

if (isUnconditionallyIncludedFile(entry_name) or isSpecialFileOrVariant(entry_name, "CHANGELOG")) {
    return null;
}

I removed the special handling for CHANGELOG files so they can now be properly excluded by .npmignore. I also updated the test to verify the corrected behavior.