James Griffin 668397104a Adopt @lavamoat/allow-scripts to gate npm install scripts ...

Disables dependency lifecycle scripts by default via .npmrc
(ignore-scripts=true) so arbitrary packages cannot execute code at
install time. An explicit allowlist in web/package.json opts specific
packages back in, and CI/Docker/Taskfile now run allow-scripts after
npm install to apply it.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-17 11:29:08 -03:00

..

ci.yml

Adopt @lavamoat/allow-scripts to gate npm install scripts

2026-04-17 11:29:08 -03:00