netlify-cli 26.2.0 installs local-functions-proxy binary with --omit=optional

netlify-cli@26.2.0 still installs the @netlify/local-functions-proxy-linux-x64@1.1.1 platform binary when npm is invoked with --omit=optional.

Reproduction on Node 24.18.0 / npm 11.16.0:

npm i -g --omit=optional netlify-cli@26.2.0
find /usr/local/lib/node_modules/netlify-cli -path '*local-functions-proxy*' -print

The result includes:

/usr/local/lib/node_modules/netlify-cli/node_modules/@netlify/local-functions-proxy-linux-x64/bin/local-functions-proxy

The dependency chain is netlify-cli -> @netlify/local-functions-proxy@2.0.3 -> @netlify/local-functions-proxy-linux-x64@1.1.1. Security scanners flag the bundled Go binary, including fixable critical findings such as CVE-2023-24538, CVE-2023-24540, CVE-2024-24790, and CVE-2025-68121.

Removing the platform package after installation leaves netlify --version, netlify build --help, and netlify deploy --help working, but intentionally disables local functions and netlify dev.

Could the platform binaries be rebuilt against supported Go dependencies, and could --omit=optional be made to omit them as expected? HolyCode is temporarily removing every local-functions-proxy-* package from its image and documenting remote build/deploy support only.

Start by reproducing the npm install and find commands against netlify-cli@26.2.0, then inspect the dependency chain from netlify-cli through @netlify/local-functions-proxy to the platform package. Done means --omit=optional no longer installs the platform binary, the bundled Go dependencies are supported, and the documented CLI commands still work while local functions remain available when optional dependencies are installed.