Skip to content

Safer autoinstall#1348

Merged
josephjclark merged 6 commits intomainfrom
safer-install
Apr 2, 2026
Merged

Safer autoinstall#1348
josephjclark merged 6 commits intomainfrom
safer-install

Conversation

@josephjclark
Copy link
Copy Markdown
Collaborator

@josephjclark josephjclark commented Apr 1, 2026

In CLI and Worker, run npm install --min-release-age=1, which reduces the vector for hijacked npm packages being installed when running workflows.

Fixes #1345

AI Usage

Please disclose whether you've used AI anywhere in this PR (it's cool, we just
want to know!):

  • I have used Claude Code
  • I have used another model
  • I have not used AI

You can read more details in our
Responsible AI Policy

@josephjclark josephjclark marked this pull request as ready for review April 1, 2026 14:47
@github-project-automation github-project-automation bot moved this to New Issues in Core Apr 1, 2026
@josephjclark josephjclark merged commit 4945b0a into main Apr 2, 2026
6 checks passed
@github-project-automation github-project-automation bot moved this from New Issues to Done in Core Apr 2, 2026
@josephjclark josephjclark deleted the safer-install branch April 2, 2026 08:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

Autoinstall adaptor with minReleaseAge

2 participants