From abab9415ff10274c0d0fd2342c0e91abda046434 Mon Sep 17 00:00:00 2001 From: Vaclav Vancura Date: Sun, 17 May 2026 08:30:14 +0200 Subject: [PATCH 1/2] chore(ci): add pnpm 10 supply-chain hardening Set minimum-release-age to 10080 minutes (7 days) so newly published packages cannot be installed before they age out of common exploit windows. Enable block-exotic-subdeps and strict-dep-builds for additional supply-chain protection. Silence esbuild's post-install build script via ignoredBuiltDependencies to keep the lockfile clean. Signed-off-by: Vaclav Vancura --- .npmrc | 5 +++++ package.json | 5 ++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.npmrc b/.npmrc index 135f7a0..68cb41e 100644 --- a/.npmrc +++ b/.npmrc @@ -1 +1,6 @@ shared-workspace-lockfile=false + +# Supply-chain hardening for pnpm 10. +minimum-release-age=10080 +block-exotic-subdeps=true +strict-dep-builds=true diff --git a/package.json b/package.json index 427b8f1..f9d1e85 100644 --- a/package.json +++ b/package.json @@ -84,7 +84,10 @@ "overrides": { "vite-node": "^5.2.0", "esbuild": "^0.25.0" - } + }, + "ignoredBuiltDependencies": [ + "esbuild" + ] }, "devDependencies": { "@biomejs/biome": "^2.4.15", -- 2.51.2 From ae4afaf1b8ed27b96350014b27055685731595cb Mon Sep 17 00:00:00 2001 From: Vaclav Vancura Date: Sun, 17 May 2026 12:19:19 +0200 Subject: [PATCH 2/2] fix(ci): replace ignoredBuiltDependencies with allowBuilds for esbuild pnpm 10 uses allowBuilds (object keyed by package name) to whitelist build scripts rather than the older ignoredBuiltDependencies array. Signed-off-by: Vaclav Vancura --- package.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/package.json b/package.json index f9d1e85..38e31c9 100644 --- a/package.json +++ b/package.json @@ -85,9 +85,9 @@ "vite-node": "^5.2.0", "esbuild": "^0.25.0" }, - "ignoredBuiltDependencies": [ - "esbuild" - ] + "allowBuilds": { + "esbuild": true + } }, "devDependencies": { "@biomejs/biome": "^2.4.15", -- 2.51.2