@gkiely/safe-install 0.1.9 → 0.1.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +9 -3
  2. package/package.json +4 -1
package/README.md CHANGED
@@ -23,8 +23,14 @@ behind a reviewed allowlist in `package.json`.
23
23
 
24
24
  ```txt
25
25
  ignore-scripts=true
26
+ allow-git=root
27
+ allow-remote=root
26
28
  ```
27
29
 
30
+ `allow-git=root` and `allow-remote=root` let your project use direct Git or
31
+ remote tarball dependencies when you intentionally declare them, while blocking
32
+ transitive packages from pulling in those sources.
33
+
28
34
  2. Add script to `package.json`:
29
35
 
30
36
  ```json
@@ -42,9 +48,9 @@ npm run safe-install -- review-deps
42
48
  ```
43
49
 
44
50
  5. Review the output, then add trusted packages to `package.json`. You can also
45
- enable `blockExoticSubDeps` to fail installs when transitive dependencies point
46
- outside the npm registry with `git:`, `file:`, `link:`, or remote tarball URL
47
- specifiers.
51
+ enable `blockExoticSubDeps` as a lockfile-level backstop for transitive
52
+ dependencies that point outside the npm registry with `git:`, `file:`, `link:`,
53
+ or remote tarball URL specifiers.
48
54
 
49
55
  ```json
50
56
  {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@gkiely/safe-install",
3
- "version": "0.1.9",
3
+ "version": "0.1.11",
4
4
  "description": "Run npm installs with lifecycle scripts disabled, then rebuild explicitly trusted dependencies.",
5
5
  "author": "Grant Kiely <grant@youneedawiki.com>",
6
6
  "license": "MIT",
@@ -53,5 +53,8 @@
53
53
  "devDependencies": {
54
54
  "@types/node": "^25.7.0",
55
55
  "typescript": "latest"
56
+ },
57
+ "volta": {
58
+ "node": "24.14.0"
56
59
  }
57
60
  }