James Griffin
668397104a
Disables dependency lifecycle scripts by default via .npmrc (ignore-scripts=true) so arbitrary packages cannot execute code at install time. An explicit allowlist in web/package.json opts specific packages back in, and CI/Docker/Taskfile now run allow-scripts after npm install to apply it. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
40 lines
996 B
JSON
40 lines
996 B
JSON
{
|
|
"name": "web",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"type": "module",
|
|
"dependencies": {
|
|
"@lavamoat/preinstall-always-fail": "^3.0.0",
|
|
"react": "^19.2.4",
|
|
"react-dom": "^19.2.4",
|
|
"react-router-dom": "^7.13.1"
|
|
},
|
|
"scripts": {
|
|
"dev": "vite",
|
|
"build": "tsc -b tsconfig.app.json && vite build",
|
|
"preview": "vite preview",
|
|
"test": "vitest run"
|
|
},
|
|
"devDependencies": {
|
|
"@lavamoat/allow-scripts": "^5.0.1",
|
|
"@testing-library/dom": "^10.4.1",
|
|
"@testing-library/jest-dom": "^6.9.1",
|
|
"@testing-library/react": "^16.3.2",
|
|
"@testing-library/user-event": "^14.6.1",
|
|
"@types/node": "^25.5.2",
|
|
"@types/react": "^19.2.14",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@vitejs/plugin-react": "^6.0.1",
|
|
"@vitest/coverage-v8": "^4.1.4",
|
|
"jsdom": "^29.0.2",
|
|
"typescript": "^6.0.2",
|
|
"vite": "^8.0.8",
|
|
"vitest": "^4.1.4"
|
|
},
|
|
"lavamoat": {
|
|
"allowScripts": {
|
|
"@lavamoat/preinstall-always-fail": false
|
|
}
|
|
}
|
|
}
|