@gkiely/safe-install 0.1.9 → 0.1.12

package/README.md

@@ -25,6 +25,17 @@ behind a reviewed allowlist in `package.json`.
 ignore-scripts=true
 ```
 
+Optionally enable:
+
+```txt
+allow-git=root # npm 11.10.0+
+allow-remote=root # npm 11.14.0+ 
+```
+
+`allow-git=root` and `allow-remote=root` let your project use direct Git or
+remote tarball dependencies when you intentionally declare them, while blocking
+transitive packages from pulling in those sources.
+
 2. Add script to `package.json`:
 
 ```json
@@ -42,9 +53,9 @@ npm run safe-install -- review-deps
 ```
 
 5. Review the output, then add trusted packages to `package.json`. You can also
-enable `blockExoticSubDeps` to fail installs when transitive dependencies point
-outside the npm registry with `git:`, `file:`, `link:`, or remote tarball URL
-specifiers.
+enable `blockExoticSubDeps` as a lockfile-level backstop for transitive
+dependencies that point outside the npm registry with `git:`, `file:`, `link:`,
+or remote tarball URL specifiers.
 
 ```json
 {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gkiely/safe-install",
-  "version": "0.1.9",
+  "version": "0.1.12",
   "description": "Run npm installs with lifecycle scripts disabled, then rebuild explicitly trusted dependencies.",
   "author": "Grant Kiely <grant@youneedawiki.com>",
   "license": "MIT",
@@ -53,5 +53,9 @@
   "devDependencies": {
     "@types/node": "^25.7.0",
     "typescript": "latest"
+  },
+  "volta": {
+    "node": "24.14.1",
+    "npm": "11.14.1"
   }
 }