From 0f8c4a91e66e3709eab6fcc9e3e1de69463697f8 Mon Sep 17 00:00:00 2001 From: Joao Henrique Machado Silva Date: Mon, 1 Jun 2026 08:39:31 +0200 Subject: [PATCH] fix(release): scope published crate with include allowlist (fixes crates.io 413) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The `sqlrite-engine` crate publish for v0.11.0 was rejected by crates.io: status 413 Payload Too Large: max upload size is: 10485760 The package root is the workspace root and the engine [package] had no `include`/`exclude`, so `cargo publish` swept the ENTIRE repo tree — every sibling member plus `web/`, `images/`, and the journal example's demo media. After SQLR-42 (web/public/playground/pkg/*.wasm, 2.1 MiB) and SQLR-43 (examples/desktop-journal/docs/demo.gif 9 MiB + demo.mp4 8.7 MiB + screenshots) landed since v0.10.2, the uncompressed tarball hit ~25 MiB and blew the 10 MiB cap. Patch releases before that stayed under the limit, which is why this is the first time it broke. Fix: add an `include` allowlist so only the library/REPL sources, the three declared `[[example]]` targets (their .rs files must be in the tarball or `cargo publish`'s verify step can't parse the manifest), and the readme/license ship. An allowlist beats `exclude` here because new large files anywhere in the repo can't silently re-bloat the crate. Verified locally: `cargo package -p sqlrite-engine` produces a 376 KiB .crate (down from ~25 MiB uncompressed) and the packaged crate compiles clean against the already-published sqlrite-ask 0.11.0. Co-Authored-By: Claude Opus 4.8 (1M context) --- Cargo.toml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/Cargo.toml b/Cargo.toml index 5d6a673..6a9648f 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -35,6 +35,28 @@ description = "Light version of SQLite developed with Rust. Published as `sqlrit repository = "https://github.com/joaoh82/rust_sqlite" license = "MIT" +# Allowlist of files that ship in the published crate. The package root +# IS the workspace root, so without this `cargo publish` sweeps the +# ENTIRE repo tree — every sibling member, plus `web/`, `images/`, and +# the `examples/desktop-journal/docs/` demo media. That ballooned the +# v0.11.0 tarball to ~25 MiB and crates.io rejected it (HTTP 413, 10 MiB +# cap) after SQLR-42/43 landed the playground wasm + the journal +# demo.gif/.mp4. An allowlist (vs. a fragile `exclude`) keeps the crate +# small no matter what large files land elsewhere in the repo later. +# +# What's listed: the library + REPL bin sources (`src/**`), the three +# `[[example]]` targets declared below (their `.rs` files must be in the +# tarball or `cargo publish`'s verify step fails to parse the manifest), +# and the readme/license. `Cargo.toml` is always included implicitly. +include = [ + "src/**/*", + "examples/rust/quickstart.rs", + "examples/hybrid-retrieval/hybrid_retrieval.rs", + "examples/rust/concurrent_writers.rs", + "README.md", + "LICENSE", +] + # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html