From dd454a605688b94ab39e01b8bf55f8ba4a5b9a7b Mon Sep 17 00:00:00 2001 From: Claas Augner Date: Tue, 8 Sep 2026 14:45:04 +0200 Subject: [PATCH 1/2] build(npm): allowlist dependency install scripts npm 12 no longer runs `preinstall`/`install`/`postinstall` from dependencies unless the root `package.json` lists them in `allowScripts`. `npm ci` still succeeds, so a missing entry only surfaces later as a missing binary. Generated with `npm approve-scripts --all --no-allow-scripts-pin`, so the entries are name-only and keep matching after a dependency bump. --- package.json | 3 +++ 1 file changed, 3 insertions(+) diff --git a/package.json b/package.json index 5d44d28..6678c48 100644 --- a/package.json +++ b/package.json @@ -30,5 +30,8 @@ "plotly.js-dist-min": "^3.7.0", "react": "^19.2.8", "react-dom": "^19.2.8" + }, + "allowScripts": { + "fsevents": true } } From 6cc5654d43b464b13efbe9e492a56a6730e03842 Mon Sep 17 00:00:00 2001 From: Claas Augner Date: Tue, 8 Sep 2026 15:52:57 +0200 Subject: [PATCH 2/2] build(npm): deny `fsevents` install script The published fsevents 2.3.3 tarball ships a prebuilt `fsevents.node` and has no `install` script; only the registry manifest marks it as having one, so approving it grants nothing useful. --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 6678c48..a32a740 100644 --- a/package.json +++ b/package.json @@ -32,6 +32,6 @@ "react-dom": "^19.2.8" }, "allowScripts": { - "fsevents": true + "fsevents": false } }