3307561f85npm 12 (July 2026) stops running dependency install scripts unless they are approved via allowScripts, and npm 11.16 already warns. Studio has no git or remote URL deps anywhere, so script gating is the only exposure: - commit the allowScripts policy that npm approve-scripts writes for @biomejs/biome and msw, plus a manual fsevents entry: the tooling cannot match a darwin-only optional dep from Linux, but the strict check walks the platform independent ideal tree and flags it anyway - drop the minimum-release-age npmrc alias; npm >=11.16 flags it as an unknown project config that stops working in npm 12 - approve bun's postinstall in the setup.sh / setup.ps1 bun bootstrap; under npm 12 defaults npm install -g bun otherwise leaves a broken stub and setup falls back to the slower npm install path - fix the stale esbuild comment in studio-frontend-ci.yml: the vite 8 chain ships napi binaries with no install scripts
25 lines
1.3 KiB
Text
25 lines
1.3 KiB
Text
# Studio frontend npm configuration.
|
|
#
|
|
# Mini Shai-Hulud / Axios-style supply chain defense.
|
|
# Requires npm >=11.10.0. Refuses tarballs published less than 7 days ago,
|
|
# closing the typical 4-72h attack window between malicious publish and
|
|
# upstream removal. npm interprets the bare integer as DAYS; do not
|
|
# append `d`, npm 11.x will parse `7d` as a Date string and abort.
|
|
min-release-age=7
|
|
# Do not re-add the old `minimum-release-age` alias: npm >=11.16 warns on
|
|
# unknown project configs and npm 12 stops accepting them.
|
|
# Belt-and-braces: refuse to write back loose `^x.y.z` ranges into
|
|
# package.json when a maintainer runs `npm install <pkg>` locally. This
|
|
# does NOT rewrite already-present ranges (those need an explicit
|
|
# `npm install <name>@<version> --save-exact` pass) but it stops new
|
|
# carets from creeping into the manifest as patch-version footguns.
|
|
save-exact=true
|
|
# Lock the registry. A user-set PIP_INDEX_URL-style override (here:
|
|
# NPM_CONFIG_REGISTRY env var or a stale ~/.npmrc) shouldn't redirect
|
|
# our installs to an attacker registry.
|
|
registry=https://registry.npmjs.org/
|
|
audit-level=high
|
|
fund=false
|
|
# Maintainer note: use `npm ci` (never `npm install`) in CI and locally
|
|
# when reproducing a build. The 7-day cooldown above is enforced by npm
|
|
# itself; downgrading or removing it bypasses the supply-chain gate.
|