Skip to content

v1.2.0 — allow-git / allow-remote coverage

Choose a tag to compare

View all tags
@Booyaka101 Booyaka101 released this 27 Jul 05:03
v1.2.0
bc0f8a9

npm v12 flips three defaults, not one. npm-script-lens has covered allowScripts since day one — this release covers the other two: allow-git and allow-remote, under which git and remote-tarball dependencies stop resolving entirely unless you opt in. Both are the strict enum all | none | root, defaulting to none, and there is no migration tooling upstream — the official discussion's best offer is grep -r 'git+' package.json.

New: sources

npx npm-script-lens sources                # report + the minimal correct .npmrc
npx npm-script-lens sources --check        # CI: exit 1 on insufficient / over-permissive / invalid
npx npm-script-lens sources --write        # merge the minimal values into .npmrc (comment-preserving)
npx npm-script-lens sources --json         # { git, remote, npmrc }
git dependencies (2)
  ROOT        left-pad @ github:left-pad/left-pad
  TRANSITIVE  some-pkg @ git+ssh://git@github.com/a/b.git   via my-lib -> some-pkg
remote dependencies (0)

minimal correct .npmrc:
  allow-git=all

allow-git=all is required because 1 git dependency is transitive; allow-git=root would otherwise suffice.
Re-point or drop `some-pkg` (via my-lib) to tighten this to allow-git=root.

It reads all four lockfile dialects (package-lock v1/v2/v3, yarn classic + berry, pnpm, bun.lock) with zero network calls, classifies each dependency as ROOT (declared in the root package.json, so allow-git=root suffices) or TRANSITIVE (forces all, with the via-chain that drags it in), and tells you exactly which dependency to re-point to tighten back to least privilege.

--check fails in three distinct ways

  • insufficient — npm v12 will refuse the install (no .npmrc, or root committed while a transitive git dep exists)
  • over-permissive — all committed where root or nothing suffices: the least-privilege ratchet
  • invalid — allow-git=true or a bare --allow-git, which several published migration guides recommend, is not in the enum; npm treats it as unset and your install still breaks. The check names the valid three.

Also in this release

  • allow --ci-check now also fails when git/remote deps exist and the committed config is insufficient or invalid — the same silent-CI-break shape as a missing allowScripts block, in the same fast no-scan gate.
  • doctor reports git/remote dependency counts, minimal values vs the committed .npmrc, whether your npm has the keys at all (they appeared in 11.10.0 / 11.15.0, checked at full-version precision), and warns that allow-git=root is unreliable on npm 11 (npm/cli#9189, closed via PR #9206 — root-level git deps were wrongly rejected): prefer all there.
  • GitHub Action sources-check input (default 'false', opt-in): fails the job with an ::error annotation and a job-summary line when the committed .npmrc doesn't match the lockfile's git/remote reality.

Compatibility

The audit / analyzer / risk engine is untouched — non-registry dependencies were and are skipped there, so existing reports are byte-identical. The .npmrc emitter is npm-only; for yarn/pnpm/bun lockfiles the dependency report still works and the write is skipped with a note. 174 tests, green on ubuntu + windows × node 20/22.

The VS Code extension is unchanged in this release — the .vsix on the v1.0.1 release still applies.

Full changelog: CHANGELOG.md · Diff: v1.1.0...v1.2.0

Assets 2
Loading