4 ms·
Both pnpm and yarn implemented npmMinimalAgeGate: 1440 enableScripts: false These mostly solve the issue of adding postinstall scripts and packages being comp
by Chyzwar 7mo ago
Both pnpm and yarn implemented
npmMinimalAgeGate: 1440
enableScripts: false
These mostly solve the issue of adding postinstall scripts and packages being compromised.
- silverstream 7mo agoenableScripts: false is a great default, but in a pnpm workspace monorepo it needs some tuning — a few packages legitimately rely on postinstall (esbuild, sharp, etc. downloading platform binaries). What worked for us was whitelisting just those in onlyBuiltDependencies. Everything else stays locked down. The age gate is a nice extra layer. I do wonder how well it holds up for fast-moving deps where you actually want the latest patch though.