sillsdev / sillsdev/languageforge-lexbox
Update to PNPM 10
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 9
- Forks
- 8
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 49
Description
PNPM 10 is now in RC. One of its major features is that "Lifecycle scripts of dependencies are not executed during installation by default! This is a breaking change aimed at increasing security."
I've read of several supply-chain attacks in NPM recently, many of which were aimed at installing bitcoin miners on target computers, so this strikes me as a good idea in general. But we'll need to edit package.json to include a pnpm.onlyBuiltDependencies field listing the packages that should be allowed to run their lifecycle scripts (e.g. playwright wants to download updated browser versions).
This is probably low priority since PNPM 9 is working just fine so far, but in the long run I think the extra security that will come with PNPM 10 means we'll want to upgrade once we've checked which packages should be allowed to run scripts.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing package.json and the current package-manager configuration, then identify which dependencies require lifecycle scripts, including the mentioned Playwright case. Update the project to PNPM 10 and add the allowed dependency list; confirm installation succeeds without unintended lifecycle scripts running.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- build-system
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100