Skip to content

ui : don't use npx inside package.json script - #28270

Merged
allozaur merged 1 commit into
ggml-org:masterfrom
eapache:ehuus/more-supply-chain-hardening
Sep 4, 2026
Merged

ui : don't use npx inside package.json script#28270
allozaur merged 1 commit into
ggml-org:masterfrom
eapache:ehuus/more-supply-chain-hardening

Conversation

@eapache

@eapache eapache commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Overview

Don't use npx inside of a package.json script. It's not necessary, and can potentially install an unexpected version of the package if npm ci hasn't already been run.

Requirements

  • I have read and agree with the contributing guidelines
  • AI usage disclosure: YES - Sol found this and wrote the (extremely trivial) diff, as part of an old supply-chain-security audit, although it's more of a cleanup at than any real risk.

@eapache
eapache requested a review from a team as a code owner September 2, 2026 21:10

@nikwen nikwen left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch!

@nikwen nikwen changed the title Don't use npx inside a package.json script ui : don't use npx inside package.json script Sep 3, 2026
@allozaur
allozaur merged commit d509cb1 into ggml-org:master Sep 4, 2026
6 checks passed
@eapache
eapache deleted the ehuus/more-supply-chain-hardening branch September 4, 2026 10:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants