simon/semantic-release
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

test(lockfile): added lockfile lint to prevent attacks that download deps from malicious registries

Browse Source 
i thought we'd already taken the step of adding this protection, but it looks like i failed to
follow up with getting applied across all repos
This commit is contained in:
Matt Travi 2023-09-17 09:37:52 -05:00
parent de413899fe
commit a8d863834a
No known key found for this signature in database
GPG Key ID: 8C173646C24FED70
2 changed files with 3919 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3979
package-lock.json generated
View File

File diff suppressed because it is too large Load Diff

10
package.json
View File

@ -67,6 +67,7 @@
"fs-extra": "11.1.1", "fs-extra": "11.1.1",
"got": "13.0.0", "got": "13.0.0",
"js-yaml": "4.1.0", "js-yaml": "4.1.0",
"lockfile-lint": "4.12.1",
"mockserver-client": "5.15.0", "mockserver-client": "5.15.0",
"nock": "13.3.3", "nock": "13.3.3",
"npm-run-all2": "6.0.6", "npm-run-all2": "6.0.6",
@ -116,6 +117,14 @@
], ],
"all": true "all": true
}, },
"lockfile-lint": {
"path": "package-lock.json",
"type": "npm",
"validate-https": true,
"allowed-hosts": [
"npm"
]
},
"prettier": { "prettier": {
"printWidth": 120, "printWidth": 120,
"trailingComma": "es5" "trailingComma": "es5"
@ -132,6 +141,7 @@
"codecov": "codecov -f coverage/coverage-final.json", "codecov": "codecov -f coverage/coverage-final.json",
"lint:js": "prettier --check \"*.{js,json,md}\" \".github/**/*.{md,yml}\" \"docs/**/*.md\" \"{bin,lib,test}/**/*.js\"", "lint:js": "prettier --check \"*.{js,json,md}\" \".github/**/*.{md,yml}\" \"docs/**/*.md\" \"{bin,lib,test}/**/*.js\"",
"lint:js:fix": "prettier --write \"*.{js,json,md}\" \".github/**/*.{md,yml}\" \"docs/**/*.md\" \"{bin,lib,test}/**/*.js\"", "lint:js:fix": "prettier --write \"*.{js,json,md}\" \".github/**/*.{md,yml}\" \"docs/**/*.md\" \"{bin,lib,test}/**/*.js\"",
"lint:lockfile": "lockfile-lint",
"semantic-release": "./bin/semantic-release.js", "semantic-release": "./bin/semantic-release.js",
"test": "npm-run-all --print-label --parallel lint:* --parallel test:*", "test": "npm-run-all --print-label --parallel lint:* --parallel test:*",
"test:unit": "c8 ava --verbose", "test:unit": "c8 ava --verbose",