[UP] ⬆️ Bump npm-build-zip from 1.0.4 to 2.0.1

[dependabot]

Bumps npm-build-zip from 1.0.4 to 2.0.1.

Changelog

Sourced from npm-build-zip's changelog.

[2.0.1] - 2026-07-05

Fixed

• Default Source Directory Bug: Fixed an issue where running npm-build-zip without the --source option failed with [npm-build-zip] Source directory does not exist: .
• Long-form Alias Support: Resolved mapping of long-form aliases (like --src and --dst) so they work reliably even when parameters are omitted or defaulted.
• Short-form Alias mapping -x: Added the missing mapping for the -x alias to --exclude in the parser.
• Write Stream Stability: Added error handling to the archive output write stream to reject the package Promise gracefully rather than causing Node to hang or crash on write failures.

[2.0.0] - 2026-06-24

⚠️ BREAKING CHANGES

• Minimum Node.js is now 22.0.0 (was 18). The --exclude flag uses fs.promises.glob, which is stable in Node 22+. If you can't upgrade, stay on 1.2.x.
• Package is now ESM-first ("type": "module"). CJS consumers can still use it via the index.cjs shim, but with one constraint: pack is async-only. Sync require('npm-build-zip').pack(...) is no longer supported — use the returned Promise (.then() / await).
• Runtime dependencies dropped from 4 to 2: removed archiver-promise, sanitize-filename, yargs. The CLI parser is hand-rolled, sanitize() is inlined, and archiver is used directly. Only archiver and npm-packlist remain.
• --include_hidden and --all semantics unchanged. The bundled option to npm-packlist still uses the v1 API (pinned to ^1.4.4).
• Pinned npm-packlist to ^1.4.4 to keep the simple { path, bundled } API. v3+ switched to a Tree-based API that would have required adding @npmcli/arborist.

Added

• --exclude / -x flag for glob-based file exclusion. Comma-separated patterns, evaluated with fs.promises.glob(pattern, { cwd: source }). Example: npm-build-zip --exclude="*.map,**/*.test.js". Works in both default mode and --include_hidden mode.
• Hand-rolled CLI parser (no yargs). Supports all the previous flags and aliases (-s, -d, -i, -n, -no, -v, --all, --src, --dst, --in) plus the new -x short alias for --exclude. Adds --version short alias -V.
• Dual ESM/CJS distribution via package.json#exports: { "import": "./index.js", "require": "./index.cjs" }.
• loadPackageJson(cwd?) now accepts an optional cwd argument for testability. Default is process.cwd().
• sanitize(name) is now exported and reused internally. Inlined from sanitize-filename (MIT) — covers unsafe chars, whitespace, and trim.
• CJS shim tests verify require('npm-build-zip').pack(...) works for legacy consumers.
• fs.promises.glob integration for --exclude (Node 22+ stable).

Changed

• archiver-promise → archiver direct (more control over global options like forceUTC and comment).
• yargs removed; CLI parser is ~60 lines, no deps.
• sanitize-filename removed; sanitize inlined.
• ESLint config updated for ESM (sourceType: "module").
• Test split: unit.test.mjs (ESM, imports index.js directly) and cli.test.cjs / integration.test.cjs / cjs-shim.test.cjs (CJS, invoke the bin via child_process).
• CI matrix is now Node 22 only (was 18/20/22). The package's engines.node is >=22, so testing below that is meaningless and breaks on fs.promises.glob (** glob) and --test directory walking introduced after 18.

[1.2.0] - 2026-06-24

Added

• --no-timestamp flag for reproducible builds. When set, every entry in the zip gets mtime 1980-01-01 00:00, the archive uses forceUTC: true and comment: '', and entries are sorted alphabetically for byte-level determinism.
• --help output now includes describe text for every flag.
• .check() in the CLI rejects --name_only without --name with a clear, actionable error.
• Error messages are prefixed with [npm-build-zip] for log-grep friendliness.
• Tests via node:test (built-in, no new dependency): 23 tests across unit, cli, and integration suites. CI runs on Node 18, 20, and 22.
• GitHub Actions: .github/workflows/ci.yml (test matrix) and .github/workflows/publish.yml (tag-triggered npm publish --provenance).
• Internal helpers (loadPackageJson, walkAllFiles, resolveFilename) are exposed under _internal for unit testing.
• files whitelist in package.json so the published tarball is small.

... (truncated)

Commits

• 52fdc0a chore: bump version to 2.0.1 and update CHANGELOG
• af8833e feat: add CLI interface for npm-build-zip and include comprehensive test cove...
• 52f3b4a Merge pull request #21 from roberto-slopez/fix/test-glob
• e1b2e11 fix(ci): drop Node 18/20 from CI matrix; list test files explicitly
• d398e4a fix(test): use two separate globs to avoid shell brace-expansion
• 86d3dc6 Merge pull request #20 from roberto-slopez/release/v2.0.0
• 441068d fix: long-form aliases (--src, --dst) now work like the short forms
• 53dd2c4 2.0.0: ESM-first + drop 2 deps + --exclude
• dfebfd6 1.2.0: hardening release
• 0bd3f5b Merge pull request #13 from roberto-slopez/dependabot/npm_and_yarn/minimatch-...
• Additional commits viewable in compare view