55e4d90d9e
Three findings against the install-script allowlist landed by the HTML/SVG preview PR: 1. Allowlist matched on package name alone, so adding 'esbuild' silently approved every future esbuild postinstall version. Pin each entry to name@version and reject bare names. 2. The script defaulted the allowlist path to the head checkout's .install-script-allowlist, so the same PR that introduced a new postinstall dep could allowlist it in the same diff. Source the allowlist from the BASE ref instead; any head-only entry fails the gate. 3. The security-audit workflow only extracted the BASE package-lock, leaving the allowlist defaulted to the PR checkout. Update the workflow to also extract the BASE allowlist and pass it through --base-allowlist. The existing esbuild entry is now pinned to esbuild@0.21.5 so the gate refuses any future esbuild version that has not been re-eyeballed.
17 lines
894 B
Text
17 lines
894 B
Text
# Packages whose npm install-script (postinstall) we have eyeballed and
|
|
# accepted. The new-install-script gate (scripts/check_new_install_scripts.py)
|
|
# refuses any newly-added install-script dep by default; entries listed here
|
|
# are explicitly skipped.
|
|
#
|
|
# Pin EACH entry to an exact "name@version" so a maintainer compromise that
|
|
# ships a new malicious version is not silently swept under the same line.
|
|
# Lines starting with "#" are comments; blank lines are ignored.
|
|
#
|
|
# DO NOT add packages here without reading the actual install script body.
|
|
# Allowlist entries MUST land on main first; the gate rejects head-only
|
|
# additions so a PR cannot allowlist its own new postinstall dep.
|
|
|
|
# evanw/esbuild downloads the platform-specific native binary
|
|
# (esbuild-linux-x64, etc.) in its postinstall. Used transitively by
|
|
# vitest for dev-only test transforms; no runtime exposure.
|
|
esbuild@0.21.5
|