Skip to content

Guard maintainer dependency installs - #2

Closed
sgirones wants to merge 1 commit into
mainfrom
salvador/pnpm-security-guards
Closed

sgirones wants to merge 1 commit into
mainfrom
salvador/pnpm-security-guards

Conversation

@sgirones

@sgirones sgirones commented Oct 9, 2026

Copy link
Copy Markdown

Owned Node registry installs use pnpm 11.28.5 with a strict release delay of at least 24 hours, required timestamps, frozen-lock policy checks and disabled automatic lifecycle hooks. Longer existing delays are preserved.

Disable automatic Husky setup and make Git hooks explicit. npm publication/consumer examples are retained. Existing dependencies are preserved.

Validation:

  • Frozen workspace install and package build passed
  • git diff --check

@sgirones sgirones closed this Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant