Skip to content

fix: skip disconnected orphans in install script checks - #10068

Open
JamieMagee wants to merge 2 commits into
npm:latestfrom
JamieMagee:fix/strict-allow-scripts-orphans
Open

JamieMagee wants to merge 2 commits into
npm:latestfrom
JamieMagee:fix/strict-allow-scripts-orphans

Conversation

@JamieMagee

Copy link
Copy Markdown
Contributor

Skip disconnected lockfile entries in strict install checks and post-install reporting. Keep policy checks for installed packages and retained local links.

References

Fixes #9680

@JamieMagee
JamieMagee requested a review from a team as a code owner October 3, 2026 04:08
@JamieMagee
JamieMagee force-pushed the fix/strict-allow-scripts-orphans branch from 3762311 to 8e1623f Compare October 3, 2026 04:26
Comment thread lib/utils/strict-allow-scripts-preflight.js Outdated
Comment thread workspaces/config/lib/definitions/definitions.js Outdated
Comment thread workspaces/arborist/lib/unreviewed-scripts.js

@manzoorwanijk manzoorwanijk left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the fixes. This is ready to land.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] strict-allow-scripts false-positives on extraneous (edgeless) registry nodes

3 participants