fb6a6703cb
The frontend test stack (added in this PR for SVG sanitization coverage) pulls vitest, which transitively depends on esbuild. esbuild's postinstall downloads the platform-specific native binary (esbuild-linux-x64, etc.); it has no runtime exposure for Studio and is a top-tier maintained package. Add a file-based allowlist mechanism to scripts/check_new_install_scripts.py so well-known, eyeballed install-script deps can be triaged without weakening the gate for the long tail. Defaults to studio/frontend/.install-script-allowlist; the new file lists esbuild with a comment explaining the safety review. The gate otherwise behaves as before -- any other newly-added install-script dep still hard-fails. |
||
|---|---|---|
| .. | ||
| public | ||
| src | ||
| .gitignore | ||
| .gitkeep | ||
| .install-script-allowlist | ||
| .npmrc | ||
| biome.json | ||
| components.json | ||
| data-designer.openapi (1).yaml | ||
| eslint.config.js | ||
| index.html | ||
| package-lock.json | ||
| package.json | ||
| tsconfig.app.json | ||
| tsconfig.json | ||
| tsconfig.node.json | ||
| vite.config.ts | ||
| vitest.config.ts | ||