From 6b24d81aa668658698d5879dd047f3540dfe689d Mon Sep 17 00:00:00 2001 From: Giles Cope Date: Wed, 5 Aug 2026 11:05:59 +0100 Subject: [PATCH] security: bump npm to version with stronger defaults and be explicit about version number. Signed-off-by: Giles Cope --- .github/workflows/playwright-visual-regression.yml | 3 +++ .github/workflows/pr.yml | 3 +++ .github/workflows/prod.yml | 3 +++ .github/workflows/vale.yml | 3 +++ .npmrc | 5 +++++ 5 files changed, 17 insertions(+) create mode 100644 .npmrc diff --git a/.github/workflows/playwright-visual-regression.yml b/.github/workflows/playwright-visual-regression.yml index 57b9ad7b..c64b11e5 100644 --- a/.github/workflows/playwright-visual-regression.yml +++ b/.github/workflows/playwright-visual-regression.yml @@ -32,6 +32,9 @@ jobs: with: node-version: 22 + - name: Update NPM + run: npm install -g npm@12.0.2 + - name: Enable Corepack run: | corepack enable diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 45c8f3bb..d94d0516 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -33,6 +33,9 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # 7.0.0 with: node-version: 22 + - name: Update NPM + run: npm install -g npm@12.0.2 + - name: Enable Corepack run: | corepack enable diff --git a/.github/workflows/prod.yml b/.github/workflows/prod.yml index 614c12c1..92983720 100644 --- a/.github/workflows/prod.yml +++ b/.github/workflows/prod.yml @@ -32,6 +32,9 @@ jobs: uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # 7.0.0 with: node-version: 22 + - name: Update NPM + run: npm install -g npm@12.0.2 + - name: Enable Corepack run: | corepack enable diff --git a/.github/workflows/vale.yml b/.github/workflows/vale.yml index 2f9ffdf1..a45de289 100644 --- a/.github/workflows/vale.yml +++ b/.github/workflows/vale.yml @@ -22,6 +22,9 @@ jobs: with: node-version: 22 + - name: Update NPM + run: npm install -g npm@12.0.2 + - run: npm install -g mdx2vast - name: Run Vale diff --git a/.npmrc b/.npmrc new file mode 100644 index 00000000..ee38c917 --- /dev/null +++ b/.npmrc @@ -0,0 +1,5 @@ +# Supply-chain cooldown: refuse dependency versions published <7 days ago (npm 12+). +# Own packages are exempt so same-day @midnight-ntwrk releases stay installable. +min-release-age=7 +min-release-age-exclude[]=@midnight-ntwrk/* +min-release-age-exclude[]=@midnightntwrk/*