chore: upgrade to NPM v12 - #1121
Conversation
Require npm >=12.0.2 <13, enforced via check-node-version on npm install and npm ci. CI installs the version from engines.npm via the new .github/actions/install-npm composite action. The motivation is that npm v12 turns three code-execution paths off by default, most notably the unauthorized execution of install scripts: - allowScripts now defaults to off, so npm install no longer executes preinstall, install or postinstall scripts from dependencies unless they are explicitly allowed in package.json. This also covers prepare scripts from git, file and link dependencies. - --allow-git now defaults to none, which closes a code-execution path where a git dependency's .npmrc could override the git executable, even with --ignore-scripts. - --allow-remote now defaults to none, blocking dependencies from remote URLs such as HTTPS tarballs. See https://github.blog/changelog/2026-06-09-upcoming-breaking-changes-for-npm-v12/ The check is skipped during npm publish and npm pack, because semantic-release bundles its own npm (@semantic-release/npm depends on npm@^11.6.2) and runs the publish with that version rather than the one installed in CI. The Node.js requirement is left unchanged.
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
1 participant
Require npm
>=12.0.2 <13for this project (Node.js stays at>=22.2.0). It is enforced viacheck-node-versiononnpm installandnpm ci.Why
npm v12 turns three code-execution paths off by default — most notably the
unauthorized execution of install scripts, which is the primary vector for
supply-chain attacks via compromised dependencies
(GitHub changelog):
allowScriptsnow defaults to off, sonpm installno longer executespreinstall,installorpostinstallscripts from dependencies unless theyare explicitly allowed in
package.json. This also coverspreparescriptsfrom
git,fileandlinkdependencies.--allow-gitnow defaults tonone, which closes a code-execution pathwhere a git dependency's
.npmrccould override the git executable, even with--ignore-scripts.--allow-remotenow defaults tonone, blocking dependencies from remoteURLs such as HTTPS tarballs.
Pinning
engines.npmto>=12.0.2 <13and failing the install when it is notmet means these protections cannot be silently bypassed by running an older npm
locally or in CI.
How
engines.npmis set to>=12.0.2 <13.engines.nodeis left untouched.check-node-version --packageruns from thepreparescript, which npmexecutes on
npm installandnpm ci.engines.npmthrough the new.github/actions/install-npmcomposite action, added after eachactions/setup-nodestep.The check is skipped during
npm publishandnpm pack, becausesemantic-releasebundles its own npm (@semantic-release/npmdepends onnpm@^11.6.2) and runs the publish with that version rather than the one installed in CI.