Skip to content

Guard benchmark tooling dependency installs - #1

Closed
sgirones wants to merge 1 commit into
masterfrom
salvador/pnpm-security-guards
Closed

sgirones wants to merge 1 commit into
masterfrom
salvador/pnpm-security-guards

Conversation

@sgirones

@sgirones sgirones commented Oct 9, 2026

Copy link
Copy Markdown

Owned Node registry installs use pnpm 11.28.5 with a strict release delay of at least 24 hours, required timestamps, frozen-lock policy checks and disabled automatic lifecycle hooks. Longer existing delays are preserved.

Disable automatic install hooks, pin pnpm/Node and freeze CI installs. Draft until the two typecheck errors are resolved or verified against the baseline. No paid benchmarks executed.

Validation:

  • Frozen workspace install and all workspace package builds passed
  • Typecheck failed on two ModalConfig scalableSandboxes properties
  • git diff --check

@sgirones sgirones closed this Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant