@grafana/create-plugin 7.4.0 → 7.5.0-canary.2630.25781735426.0

package/dist/commands/generate.command.js

@@ -93,7 +93,7 @@ function getActionsForTemplateFolder({
   templateData
 }) {
   let files = glob.sync(`${folderPath}/**`, { dot: true });
-  if (templateData.packageManagerName !== "pnpm") {
+  if (templateData.packageManagerName === "yarn") {
     files = files.filter((file) => path.basename(file) !== "npmrc");
   }
   files = files.filter((file) => {

package/dist/utils/utils.packageManager.js

@@ -17,9 +17,17 @@ async function configureYarn(cwd, packageManagerVersion) {
         shell: true,
         cwd
       });
-      return "Configured Yarn Berry to use node_modules (PnP is not supported)";
+      spawnSync("yarn", ["config", "set", "enableScripts", "false"], {
+        shell: true,
+        cwd
+      });
+      return "Configured Yarn Berry to use node_modules and disabled script execution during installation.";
     }
-    return "";
+    spawnSync("yarn", ["config", "set", "ignore-scripts", "true"], {
+      shell: true,
+      cwd
+    });
+    return "Configured Yarn to ignore scripts during installation.";
   } catch (error) {
     throw new Error(
       "There was an error configuring Yarn. Please run `yarn set version stable && yarn config set nodeLinker node-modules` in your plugin directory."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@grafana/create-plugin",
-  "version": "7.4.0",
+  "version": "7.5.0-canary.2630.25781735426.0",
   "repository": {
     "directory": "packages/create-plugin",
     "url": "https://github.com/grafana/plugin-tools"
@@ -55,5 +55,5 @@
   "engines": {
     "node": ">=20"
   },
-  "gitHead": "d9190314df0893842f12e33bbdfb7d39c3a704cc"
+  "gitHead": "b92e8671ea11d60bf79cc2c03cb7c5a6afe75b58"
 }

package/src/commands/generate.command.ts

@@ -135,8 +135,8 @@ function getActionsForTemplateFolder({
 }) {
   let files = glob.sync(`${folderPath}/**`, { dot: true });
 
-  // The npmrc file is only useful for `pnpm` settings. We can remove it for other package managers.
-  if (templateData.packageManagerName !== 'pnpm') {
+  // If the user selected yarn as their package manager, filter out npmrc file from templates since it's only needed for npm/pnpm.
+  if (templateData.packageManagerName === 'yarn') {
     files = files.filter((file) => path.basename(file) !== 'npmrc');
   }
 

package/src/utils/utils.packageManager.ts

@@ -24,9 +24,18 @@ export async function configureYarn(cwd: string, packageManagerVersion: string)
         shell: true,
         cwd,
       });
-      return 'Configured Yarn Berry to use node_modules (PnP is not supported)';
+      spawnSync('yarn', ['config', 'set', 'enableScripts', 'false'], {
+        shell: true,
+        cwd,
+      });
+      return 'Configured Yarn Berry to use node_modules and disabled script execution during installation.';
     }
-    return '';
+    spawnSync('yarn', ['config', 'set', 'ignore-scripts', 'true'], {
+      shell: true,
+      cwd,
+    });
+
+    return 'Configured Yarn to ignore scripts during installation.';
   } catch (error) {
     throw new Error(
       'There was an error configuring Yarn. Please run `yarn set version stable && yarn config set nodeLinker node-modules` in your plugin directory.'

package/templates/common/npmrc

@@ -1,12 +1,5 @@
-# This file is required for PNPM
-
-# PNPM 8 changed the default resolution mode to "lowest-direct" which is not how we expect resolutions to work
-resolution-mode="highest"
-
-# Make sure the default patterns are still included (https://pnpm.io/npmrc#public-hoist-pattern)
-public-hoist-pattern[]="*eslint*"
-public-hoist-pattern[]="*prettier*"
-
-# Hoist all types packages to the root for better TS support
-public-hoist-pattern[]="@types/*"
-public-hoist-pattern[]="*terser-webpack-plugin*"
+# Disable post install scripts to prevent execution of arbitrary code during package installation.
+# This secures both local development and CI from common supply chain attacks.
+# If you experience problems with legitimate lifecycle scripts rather than
+# disable this please use https://www.npmjs.com/package/@lavamoat/allow-scripts
+ignore-scripts=true