Skip to content

Npm security#1543

Open
d10n wants to merge 2 commits intolemonade-sdk:mainfrom
d10n:npm-security
Open

Npm security#1543
d10n wants to merge 2 commits intolemonade-sdk:mainfrom
d10n:npm-security

Conversation

@d10n
Copy link
Copy Markdown

@d10n d10n commented Apr 5, 2026

  • Avoid axios different-version and lifecycle-script surprises
  • npm ci --ignore-scripts should always be used instead of npm install or npm ci
  • npm ci requires package-lock.json to exist
  • Maintainer please verify or recreate package-lock.json before merging
  • Maybe developer docs should have a note about updating package-lock.json for releases

@Geramy Geramy self-requested a review April 6, 2026 18:13
@Geramy
Copy link
Copy Markdown
Member

Geramy commented Apr 6, 2026

@claude Can you double check the packages-lock.json please and verify these are correct and have the same main inclusions from packages.json and that none of the versions selected are at risk or infected?

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 6, 2026

Claude Code is working…

I'll analyze this and get back to you.

View job run

@d10n
Copy link
Copy Markdown
Author

d10n commented Apr 7, 2026

@Geramy I checked the "Allow edits by maintainers" box, so you can make commits in my branch - it's probably easiest to just delete the lock file and manually recreate it yourself with cd src/web-app; npm install --ignore-scripts, then push the commit to my branch. I might not trust AI to verify lock files anyway 😄

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Apr 8, 2026

Claude Code is working…

I'll analyze this and get back to you.

View job run

@d10n
Copy link
Copy Markdown
Author

d10n commented Apr 8, 2026

It seems like Claude is failing because it's unable to check out branches from forks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants