From 8384f1f1b6e4b03f6fa6d7cd654182b78d28c877 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Sat, 22 Aug 2026 13:02:08 -0400 Subject: [PATCH] chore: deny esbuild and fsevents install scripts MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm 11.19 gates dependency lifecycle install scripts behind an allowScripts allowlist and warns about any package not yet reviewed. Three were pending: esbuild's postinstall and two copies of fsevents. None of them is needed. esbuild resolves its platform binary through optionalDependencies (@esbuild/darwin-*), so install.js is only a validation/fallback-download step, and both fsevents copies ship a prebuilt fsevents.node — their install script is just a node-gyp rebuild fallback. Verified: builds and tests pass with the scripts skipped. Denying rather than approving keeps the warning quiet without granting a standing "run this package's arbitrary install script" permission. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH --- package.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package.json b/package.json index 72dd9254f..ce18005cf 100644 --- a/package.json +++ b/package.json @@ -103,5 +103,9 @@ "**/*.{js,ts,jsx,tsx,json,md}": [ "prettier --write" ] + }, + "allowScripts": { + "esbuild": false, + "fsevents": false } }