@casomoltd/tooling 0.24.1 → 0.24.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +9 -4
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -403,7 +403,12 @@ only and on explicit request; the agents never do it.
|
|
|
403
403
|
(`@casomoltd/paye-calc`, `@casomoltd/nhs-pay`), publishes to the public
|
|
404
404
|
npm registry via OIDC trusted publishing — install with no auth or
|
|
405
405
|
`.npmrc`. A version-tag push (`npm version patch` → `git push
|
|
406
|
-
--follow-tags`) triggers `publish.yml`. That workflow
|
|
407
|
-
|
|
408
|
-
|
|
409
|
-
|
|
406
|
+
--follow-tags`) triggers `publish.yml`. That workflow carries **no npm
|
|
407
|
+
pin**: it builds on Node 24, whose bundled npm 11.x is already the range
|
|
408
|
+
we want — at or above the `npm >= 11.5.1` trusted publishing needs, and
|
|
409
|
+
short of npm 12, which still refuses non-registry fetches by default
|
|
410
|
+
(`EALLOWREMOTE`) and so cannot regenerate a lockfile that resolves a
|
|
411
|
+
transitive remote tarball. The other two npm 12.0.0 regressions this
|
|
412
|
+
once guarded against are fixed: `npm ci` strictness (12.0.2 installs
|
|
413
|
+
Linux-generated locks cleanly) and the provenance/sigstore crash
|
|
414
|
+
(12.0.1). Re-test the fetch block before moving to npm 12.
|
package/package.json
CHANGED