fix(libnpmteam): update README - #8291
Merged
Merged
Conversation
mbtools
commented
May 13, 2025
Contributor
- Move "Example" to proper place
- Remove "Publishing" (probably copy pasta)
- Move "Example" to proper place - Remove "Publish" (probably copy pasta)
wraithgar
approved these changes
May 13, 2025
Contributor
|
Publishing was not copypasta, that used to be in a lot of the readmes we just missed removing that one. |
Merged
4 tasks
HikaruEgashira
added a commit
to HikaruEgashira/pmsec
that referenced
this pull request
Jul 30, 2026
…sly-allow-all-builds, mise gpg_verify) * feat: add allow-scripts-pin, dangerously-allow-all-builds, and mise per-language gpg_verify New security settings added across all four ports (node, python, bash, powershell): npm ~/.npmrc: - allow-scripts-pin=true — pins script approvals to exact versions so `npm install-scripts approve` cannot be satisfied by a newer, potentially tampered release (npm >= 11.15.0) npm/cli#8291 pnpm ~/.config/pnpm/rc: - dangerously-allow-all-builds=false — closes the all-builds escape hatch so that strict-dep-builds=true cannot be silently bypassed at the user level (pnpm >= 10.9.0) https://github.com/pnpm/pnpm/releases/tag/v10.9.0 mise ~/.config/mise/config.toml [settings]: - node.gpg_verify=true — in-process GPG verification for Node.js tarballs using pure-Rust rPGP; no external gpg binary required (mise >= 2026.7.12) - swift.gpg_verify=true — same for Swift tarballs (mise >= 2026.7.12) https://github.com/jdx/mise/releases/tag/v2026.7.12 Threat model: these four settings collectively close windows where an approved install-script could drift to a tampered version (allow-scripts-pin), where a build-script allowlist could be bypassed wholesale (dangerously-allow-all-builds), and where tarball authenticity checks could be skipped when no system GPG binary is present (gpg_verify). All four test suites updated; README policy table extended with 4 new rows. * fix: update conformance fixtures and ps test for allow-scripts-pin The conformance cases had hardcoded expected JSON with 7 npm extras that didn't include the new allow-scripts-pin entry. The PowerShell test had a hardcoded count of 5 pnpm extras (now 6 with dangerously-allow-all-builds). --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.