Skip to content

Disable npm lifecycle scripts and security hardening improvements#10176

Merged
tobias-jarvelov merged 5 commits intomainfrom
disable-npm-lifecycle-scripts-des-2809
Apr 23, 2026
Merged

Disable npm lifecycle scripts and security hardening improvements#10176
tobias-jarvelov merged 5 commits intomainfrom
disable-npm-lifecycle-scripts-des-2809

Conversation

@tobias-jarvelov
Copy link
Copy Markdown
Contributor

@tobias-jarvelov tobias-jarvelov commented Apr 10, 2026

This PR will:

  • Upgrade npm to 11.12.1
  • Add .npmrc to:
    • Disable npm lifecycle scripts, i.e. preinstall, postinstall et al. (ignore-scripts)
    • Set a dependency version's minimum age to 1 day (min-release-age)
    • Security hardening dependency installations to not allow git dependencies. (allow-git)
      • The main reason for excluding git dependencies is that the repository could contain a .npmrc file which could override the path to the git binary, which would allow for execution of arbitrary binaries.
  • Add shell scripts to replace the pre/postinstall operations required.
    • Add ci and install npm scripts to desktop/package.json to replace their counterparts.
    • Update usage of npm ci and npm install to npm run ci and npm run install respectively.

Edit:
Pushed a tag for a test build: test-disable-npm-lifecycle-scripts


This change is Reviewable

@linear
Copy link
Copy Markdown

linear Bot commented Apr 10, 2026

@tobias-jarvelov tobias-jarvelov force-pushed the disable-npm-lifecycle-scripts-des-2809 branch from 894c433 to 2faf3b2 Compare April 10, 2026 15:14
@tobias-jarvelov tobias-jarvelov changed the base branch from main to npm-update-electron April 10, 2026 15:17
@tobias-jarvelov tobias-jarvelov force-pushed the disable-npm-lifecycle-scripts-des-2809 branch 2 times, most recently from 9fc5dc0 to dcb8a1b Compare April 10, 2026 15:21
@tobias-jarvelov tobias-jarvelov marked this pull request as ready for review April 13, 2026 11:52
@tobias-jarvelov tobias-jarvelov requested a review from olmoh April 13, 2026 11:52
@tobias-jarvelov tobias-jarvelov force-pushed the npm-update-electron branch 3 times, most recently from 65ef8f4 to 6f1139a Compare April 13, 2026 13:33
Base automatically changed from npm-update-electron to main April 13, 2026 13:35
@tobias-jarvelov tobias-jarvelov force-pushed the disable-npm-lifecycle-scripts-des-2809 branch from dcb8a1b to fc82d0c Compare April 14, 2026 08:45
olmoh
olmoh previously approved these changes Apr 21, 2026
Copy link
Copy Markdown
Collaborator

@olmoh olmoh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Comment thread desktop/scripts/install-scripts.sh Outdated
@tobias-jarvelov tobias-jarvelov changed the title Disable npm lifecycle scripts Disable npm lifecycle scripts and security hardening improvements Apr 21, 2026
@tobias-jarvelov tobias-jarvelov requested a review from olmoh April 21, 2026 13:20
@tobias-jarvelov tobias-jarvelov force-pushed the disable-npm-lifecycle-scripts-des-2809 branch from a287deb to 318a85c Compare April 21, 2026 14:21
@tobias-jarvelov tobias-jarvelov force-pushed the disable-npm-lifecycle-scripts-des-2809 branch 2 times, most recently from 455abff to e6f3c9c Compare April 22, 2026 07:34
@tobias-jarvelov tobias-jarvelov force-pushed the disable-npm-lifecycle-scripts-des-2809 branch from e6f3c9c to 765cf12 Compare April 23, 2026 07:36
@tobias-jarvelov tobias-jarvelov merged commit a94a89a into main Apr 23, 2026
16 of 20 checks passed
@tobias-jarvelov tobias-jarvelov deleted the disable-npm-lifecycle-scripts-des-2809 branch April 23, 2026 07:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants