Allow required install scripts

[admdly]

Summary by cubic

Allow required install scripts via the new allowScripts field to unblock CI/local installs, adding entries for esbuild@0.18.20, esbuild@0.25.12, esbuild@0.28.1, fsevents@2.3.3, and workerd@1.20260730.1. Also refreshes the lockfile with minor/patch bumps, including vite@8.2.0 and rolldown@1.2.1.

^{Written for commit 2a41f79. Summary will update on new commits.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	api	2a41f79	Commit Preview URL Branch Preview URL	Aug 03 2026, 05:45 AM

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="package.json">

<violation number="1" location="package.json:60">
P2: This new `allowScripts` block is inert as committed: npm doesn't read a top-level `allowScripts` field — it's consumed by the `@lavamoat/allow-scripts` tool (which also needs `ignore-scripts=true` in `.npmrc` to actually block/enable scripts). Neither that devDependency, nor a `.npmrc`, nor any workflow that runs `allow-scripts` exists in this repo, and per the LavaMoat docs the config is expected nested under `lavamoat.allowScripts` rather than top-level. As it stands the field has no effect, so required install scripts (esbuild binary download, workerd, fsevents) will not actually be allowed. Consider either wiring up the tooling and placing the config where it's read (e.g. `"lavamoat": { "allowScripts": { ... } }`), or dropping the dead config until the enabling setup lands. Note also that pinning exact versions of these transitive deps (esbuild/workerd/fsevents) means any future dependency bump will silently leave the new version's script disallowed.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>