From 0681500e8f8ae941491c4030fd5ab466fe6c9e0a Mon Sep 17 00:00:00 2001 From: Cliff Hall Date: Sun, 23 Aug 2026 23:13:42 -0400 Subject: [PATCH] chore: deny esbuild and fsevents install scripts (#2077) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit npm 11.19 gates dependency lifecycle install scripts behind an allowScripts allowlist and warns about any package not yet reviewed. Three were pending: esbuild's postinstall and two copies of fsevents. None of them is needed. esbuild resolves its platform binary through optionalDependencies (@esbuild/darwin-*), so install.js is only a validation/fallback-download step, and both fsevents copies ship a prebuilt fsevents.node — their install script is just a node-gyp rebuild fallback. Verified: builds and tests pass with the scripts skipped. Denying rather than approving keeps the warning quiet without granting a standing "run this package's arbitrary install script" permission. Claude-Session: https://claude.ai/code/session_01Gq5jMmxRUphrVbfNbYVmQH Co-authored-by: Claude Opus 5 (1M context) --- package.json | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/package.json b/package.json index 72dd9254..ce18005c 100644 --- a/package.json +++ b/package.json @@ -103,5 +103,9 @@ "**/*.{js,ts,jsx,tsx,json,md}": [ "prettier --write" ] + }, + "allowScripts": { + "esbuild": false, + "fsevents": false } }