chore: deny esbuild and fsevents install scripts - #2077
Merged
Conversation
cliffhall
added
v1
chore
cliffhall
force-pushed
the
chore/v1-allowscripts
branch
from
August 22, 2026 17:07
2ce797d to
d15279e
Compare
There was a problem hiding this comment.
Pull request overview
Adds npm install-script denials for esbuild and fsevents. However, this non-security chore conflicts with the v1 branch policy.
Changes:
- Adds
allowScriptsentries denying both packages’ lifecycle scripts.
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
olaservo
force-pushed
the
chore/v1-allowscripts
branch
from
August 24, 2026 00:14
d15279e to
ee62fd2
Compare
olaservo
previously approved these changes
Aug 24, 2026
npm 11.19 gates dependency lifecycle install scripts behind an allowScripts allowlist and warns about any package not yet reviewed. Three were pending: esbuild's postinstall and two copies of fsevents. None of them is needed. esbuild resolves its platform binary through optionalDependencies (@esbuild/darwin-*), so install.js is only a validation/fallback-download step, and both fsevents copies ship a prebuilt fsevents.node — their install script is just a node-gyp rebuild fallback. Verified: builds and tests pass with the scripts skipped. Denying rather than approving keeps the warning quiet without granting a standing "run this package's arbitrary install script" permission. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH
olaservo
force-pushed
the
chore/v1-allowscripts
branch
from
August 24, 2026 02:51
ee62fd2 to
8384f1f
Compare
olaservo
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #2079
Problem
npm 11.19 gates dependency lifecycle install scripts behind an
allowScriptsallowlist and warns on every install about packages not yet reviewed:Why deny rather than approve
Neither package needs its install script:
optionalDependencies(@esbuild/darwin-*etc.);install.jsis only a validation / fallback-download step.node_modules/.bin/esbuild --versionreports correctly with the script skipped.playwright/) ships a prebuiltfsevents.nodein the tarball. Its install script is a node-gyp rebuild fallback.Denying silences the warning without granting a standing "run this package's arbitrary install script" permission that would also apply to future versions.
Verification
Everything in this repo has been built and tested with these scripts skipped (
npm ci --ignore-scripts) throughout:npm run buildandnpm run lintpass, and all suites pass (539 client + 37 server + 85 CLI). Vite/esbuild bundling works, and the app starts and serves normally. After the change,npm install-scripts lsreportsNo packages with unreviewed install scripts.Scope note
AGENTS.mdscopesv1/mainto security fixes only. This is build-config hygiene rather than a security fix, so it does not have that justification — it is proposed because the warning only affects people building v1, and v1 is where it appears. Opened at the explicit direction of a maintainer (@cliffhall); close it if you would rather v1 not take chores.Stacked on #2075 (base is
fix/v1-audit-clear; GitHub retargets this tov1/mainautomatically as the stack merges). Merge order: #2073 -> #2075 -> #2077.The change itself is independent of the other two — they touch
overridesand the lockfile, this touches only a new top-levelallowScriptskey — so it can also be cherry-picked out and landed on its own if the stack is rejected or reordered.🤖 Generated with Claude Code
https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH