Reduce package size

[scotttrinh]

Avoids bundling large files like the changelog into the distributed package.

Unpacked size: 45.5 kB -> 12.3 kB
Packaged size: 15.7 kB -> 5 kB

Before:

npm pack --dry-run
npm notice
npm notice 📦  shell-quote@1.8.1
npm notice === Tarball Contents ===
npm notice 493B   .eslintrc
npm notice 582B   .github/FUNDING.yml
npm notice 229B   .nycrc
npm notice 21.7kB CHANGELOG.md
npm notice 1.1kB  LICENSE
npm notice 3.6kB  README.md
npm notice 128B   example/env.js
npm notice 106B   example/op.js
npm notice 118B   example/parse.js
npm notice 109B   example/quote.js
npm notice 87B    index.js
npm notice 1.8kB  package.json
npm notice 5.2kB  parse.js
npm notice 457B   quote.js
npm notice 295B   security.md
npm notice 642B   test/comment.js
npm notice 483B   test/env_fn.js
npm notice 1.9kB  test/env.js
npm notice 3.1kB  test/op.js
npm notice 1.4kB  test/parse.js
npm notice 1.4kB  test/quote.js
npm notice 565B   test/set.js
npm notice === Tarball Details ===
npm notice name:          shell-quote
npm notice version:       1.8.1
npm notice filename:      shell-quote-1.8.1.tgz
npm notice package size:  15.7 kB
npm notice unpacked size: 45.4 kB
npm notice shasum:        1e24f9b8fdc41b7c006d3efa6a94a0fa37f84a71
npm notice integrity:     sha512-ahgRvFkK1QU7C[...]k7EfVOHB4N27g==
npm notice total files:   22
npm notice
shell-quote-1.8.1.tgz

After:

npm pack --dry-run
npm notice
npm notice 📦  shell-quote@1.8.1
npm notice === Tarball Contents ===
npm notice 1.1kB LICENSE
npm notice 3.6kB README.md
npm notice 87B   index.js
npm notice 1.8kB package.json
npm notice 5.2kB parse.js
npm notice 457B  quote.js
npm notice === Tarball Details ===
npm notice name:          shell-quote
npm notice version:       1.8.1
npm notice filename:      shell-quote-1.8.1.tgz
npm notice package size:  5.0 kB
npm notice unpacked size: 12.3 kB
npm notice shasum:        452f8420a04b0105f9ac07200a8a35270ce13802
npm notice integrity:     sha512-5OlDuabL6IX/F[...]MoW/nSy7BNO7g==
npm notice total files:   6
npm notice
shell-quote-1.8.1.tgz

After including tests back in the package contents:

npm notice
npm notice 📦  shell-quote@1.8.1
npm notice === Tarball Contents ===
npm notice 582B  .github/FUNDING.yml
npm notice 1.1kB LICENSE
npm notice 3.6kB README.md
npm notice 87B   index.js
npm notice 1.8kB package.json
npm notice 5.2kB parse.js
npm notice 457B  quote.js
npm notice 295B  security.md
npm notice 642B  test/comment.js
npm notice 483B  test/env_fn.js
npm notice 1.9kB test/env.js
npm notice 3.1kB test/op.js
npm notice 1.4kB test/parse.js
npm notice 1.4kB test/quote.js
npm notice 565B  test/set.js
npm notice === Tarball Details ===
npm notice name:          shell-quote                        
npm notice version:       1.8.1                              
npm notice filename:      shell-quote-1.8.1.tgz              
npm notice package size:  7.7 kB                             
npm notice unpacked size: 22.6 kB                            
npm notice shasum:        10ffd15b781fa40af0826200d9114e63962db220
npm notice integrity:     sha512-9patS5xjm4tgs[...]ZK2kBuKah+e7g==
npm notice total files:   15                                 
npm notice
shell-quote-1.8.1.tgz

[ljharb]

As written, this excludes way more than just the changelog - tests must always be included in the published package.

[scotttrinh]

tests must always be included in the published package.

While this is a perfectly fine stance to hold (your package after all!), I'm not sure I understand why a published package should include tests since consumers wouldn't be running tests for packages (most test dependencies would be dev dependencies, no?).

If you want files ignored, add them to the publishConfig.ignore list below.

Yeah, I considered that, but I thought it was better to allow-list than deny-list certain files. This package is used by a lot of other packages, so reducing the package size of this one package down will reduce packaging size and distribution bandwidth of the overall npm ecosystem a lot, so seems worth having the smallest reasonable package size.

I'll update to liberally use .npmignore and let me know your feedback on which files you absolutely think need to be included in the 14 million weekly downloads this package has 😅

[scotttrinh]

Including the tests in the package contents makes the change less dramatic, but still an overall win at 50% savings:

Unpacked size: 45.5 kB -> 12.3 kB -> 22.6 kB
Packaged size: 15.7 kB -> 5 kB -> 7.7 kB

[ljharb]

Also, it’s not package authors’ responsibility to manage package size and distribution bandwidth, it’s npm’s, and npm has chosen not to consider this a priority (by implementing separate “full” vs “minimal” tarballs for a single package)

[scotttrinh]

Also, it’s not package authors’ responsibility to manage package size and distribution bandwidth, it’s npm’s, and npm has chosen not to consider this a priority (by implementing separate “full” vs “minimal” tarballs for a single package)

Man, I'm learning so much here: I can't find any reference about this anywhere either (my Google-fu is weak tonight...) and when I install shell-quote in my own environment, I get all of the included files.

Maybe the minimal change that we can both agree to here is excluding the changelog? But then again, if it's not the package author's responsibility, we can also just close this PR as won't fix, no hard feelings. 🤝

[scotttrinh]

Latest changes:

Unpacked size: 45.5 kB -> 12.3 kB -> 22.6 kB -> 23.3 kB
Packaged size: 15.7 kB -> 5 kB -> 7.7 kB -> 8.0 kB

[ljharb]

I’m fine with this change, thanks.