[revopushbot]

Step 2 of 4 of the dependency cleanup (REV-133). Removes four runtime dependencies without changing behaviour.

Changes

Removed	Replacement
rimraf@2	fs.promises.rm with recursive, force and maxRetries: 3. rimraf also retried busy errors 3 times, waiting 100 ms × the attempt number, and Node's retry works the same way.
rimraf's ${tmpdir}/react-* glob	deleteReactTempFolders() deletes every temp entry whose name starts with react-. As before, a temp folder that can't be read means nothing is deleted.
temp	fs.mkdtempSync(path.join(os.tmpdir(), "code-push")). The old code also deleted and recreated the new empty folder, which had no effect, so that step is gone.
recursive-fs	listFiles() in file-utils.ts. It keeps the same breadth-first order and /-joined paths, and lists symlinks as files.
slash@1	The existing normalizePath. yazl converts backslashes in entry names itself, so zip contents are unchanged.

Related fixes:

• generatePackageManifestFromDirectory and packageFileFromPath chain on listFiles instead of wrapping it in a Q deferred. An exception thrown while building the manifest or zip now rejects the promise instead of leaving it pending.
• sign.ts now returns the rejection when copying a single-file release to the temp folder fails. Before, the error was dropped and signing failed later with a misleading error.
• hash-utils imports yauzl directly instead of through an optional require, which no longer did anything.

Verification

• Build and lint: tsc and npm run lint are clean.
• Tests: npm test passes all 155 tests on macOS and on Linux (Docker, Node 20.19.0). That includes new tests in test/file-utils.ts for listFiles and copyFileToTmpDir.
• Same output as main: on a sample release folder (nested folders, a dotfile, a non-ASCII file name, a symlinked folder), the code-signing hashes and the order of files in the uploaded zip match main exactly. A symlinked folder fails the same way in both.

🤖 Generated with Claude Code