github-starred/awesome-compose
2
0
Fork 0
mirror of https://github.com/docker/awesome-compose.git synced 2026-07-16 04:43:53 -05:00
Code Issues 9.3k Packages Projects Releases Wiki Activity

[PR #748] [MERGED] ci: add ignore-scripts to Node package manager config (20260526-184008) #13536

New Issue
Closed
opened 2026-06-14 08:49:00 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-06-14 08:49:00 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/docker/awesome-compose/pull/748
Author: @securityeng-bot[bot]
Created: 5/26/2026
Status: ✅ Merged
Merged: 6/5/2026
Merged by: @vallieres

Base: master ← Head: sec-cli/ignore-scripts-fix-20260526-184008

📝 Commits (10+)

  • 50c308c ci: enforce ignore-scripts policy for Node package managers
  • 87bbccd ci: enforce ignore-scripts policy for Node package managers
  • 04dd5d5 ci: enforce ignore-scripts policy for Node package managers
  • c427ea6 ci: enforce ignore-scripts policy for Node package managers
  • fed96cb ci: enforce ignore-scripts policy for Node package managers
  • 4453cdd ci: enforce ignore-scripts policy for Node package managers
  • c39b75b ci: enforce ignore-scripts policy for Node package managers
  • 23ff117 ci: enforce ignore-scripts policy for Node package managers
  • 079e77c ci: enforce ignore-scripts policy for Node package managers
  • 9f2bf62 ci: enforce ignore-scripts policy for Node package managers

📊 Changes

12 files changed (+22 additions, -0 deletions)

View changed files

➕ .npmrc (+1 -0)
➕ .yarnrc.yml (+1 -0)
📝 angular/angular/Dockerfile (+2 -0)
📝 nginx-nodejs-redis/web/Dockerfile (+2 -0)
📝 react-express-mongodb/backend/Dockerfile (+2 -0)
📝 react-express-mongodb/frontend/Dockerfile (+2 -0)
📝 react-express-mysql/backend/Dockerfile (+2 -0)
📝 react-express-mysql/frontend/Dockerfile (+2 -0)
📝 react-java-mysql/frontend/Dockerfile (+2 -0)
📝 react-nginx/Dockerfile (+2 -0)
📝 react-rust-postgres/frontend/Dockerfile (+2 -0)
📝 vuejs/vuejs/Dockerfile (+2 -0)

📄 Description

This PR was generated by sec-cli github repositories ignore-scripts update.

What changed

Package managers detected: npm, yarn

Created config files:

  • .npmrc
  • .yarnrc.yml

Dockerfiles updated (COPY added before install step):

  • angular/angular/Dockerfile
  • nginx-nodejs-redis/web/Dockerfile
  • react-express-mongodb/backend/Dockerfile
  • react-express-mongodb/frontend/Dockerfile
  • react-express-mysql/backend/Dockerfile
  • react-express-mysql/frontend/Dockerfile
  • react-java-mysql/frontend/Dockerfile
  • react-nginx/Dockerfile
  • react-rust-postgres/frontend/Dockerfile
  • vuejs/vuejs/Dockerfile

Why

Running npm install (or yarn, pnpm, bun, npx) without restricting
postinstall scripts allows dependency lifecycle hooks to execute arbitrary code
during installation. Setting ignore-scripts=true (or the equivalent for your
package manager) mitigates this risk.

References:

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/docker/awesome-compose/pull/748 **Author:** [@securityeng-bot[bot]](https://github.com/apps/securityeng-bot) **Created:** 5/26/2026 **Status:** ✅ Merged **Merged:** 6/5/2026 **Merged by:** [@vallieres](https://github.com/vallieres) **Base:** `master` ← **Head:** `sec-cli/ignore-scripts-fix-20260526-184008` --- ### 📝 Commits (10+) - [`50c308c`](https://github.com/docker/awesome-compose/commit/50c308cc7c5477c9079bdfcb4b0112b660e508b5) ci: enforce ignore-scripts policy for Node package managers - [`87bbccd`](https://github.com/docker/awesome-compose/commit/87bbccd5e1ff5b99d11e27de31c44cd9b4741610) ci: enforce ignore-scripts policy for Node package managers - [`04dd5d5`](https://github.com/docker/awesome-compose/commit/04dd5d532300a89dab2e2df95183f74c73eee5c5) ci: enforce ignore-scripts policy for Node package managers - [`c427ea6`](https://github.com/docker/awesome-compose/commit/c427ea68c5a541dbe7c6077ad471ba12b79430e2) ci: enforce ignore-scripts policy for Node package managers - [`fed96cb`](https://github.com/docker/awesome-compose/commit/fed96cbbed4b71a833568e38d1ab9a9e35574c20) ci: enforce ignore-scripts policy for Node package managers - [`4453cdd`](https://github.com/docker/awesome-compose/commit/4453cddd0c920e7d8fdc9ca7bab5c9aa526769ef) ci: enforce ignore-scripts policy for Node package managers - [`c39b75b`](https://github.com/docker/awesome-compose/commit/c39b75bd39a243f2314514335f7b8268ba619f4a) ci: enforce ignore-scripts policy for Node package managers - [`23ff117`](https://github.com/docker/awesome-compose/commit/23ff117f0e88401ca462be814c1690af45d751af) ci: enforce ignore-scripts policy for Node package managers - [`079e77c`](https://github.com/docker/awesome-compose/commit/079e77c5feb7ec63d04371438e4ad1f2292ec6aa) ci: enforce ignore-scripts policy for Node package managers - [`9f2bf62`](https://github.com/docker/awesome-compose/commit/9f2bf62def61ac9895ef7b6e05a731477cc0653b) ci: enforce ignore-scripts policy for Node package managers ### 📊 Changes **12 files changed** (+22 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `.npmrc` (+1 -0) ➕ `.yarnrc.yml` (+1 -0) 📝 `angular/angular/Dockerfile` (+2 -0) 📝 `nginx-nodejs-redis/web/Dockerfile` (+2 -0) 📝 `react-express-mongodb/backend/Dockerfile` (+2 -0) 📝 `react-express-mongodb/frontend/Dockerfile` (+2 -0) 📝 `react-express-mysql/backend/Dockerfile` (+2 -0) 📝 `react-express-mysql/frontend/Dockerfile` (+2 -0) 📝 `react-java-mysql/frontend/Dockerfile` (+2 -0) 📝 `react-nginx/Dockerfile` (+2 -0) 📝 `react-rust-postgres/frontend/Dockerfile` (+2 -0) 📝 `vuejs/vuejs/Dockerfile` (+2 -0) </details> ### 📄 Description This PR was generated by `sec-cli github repositories ignore-scripts update`. ## What changed **Package managers detected:** npm, yarn **Created config files:** - .npmrc - .yarnrc.yml **Dockerfiles updated** (COPY added before install step): - angular/angular/Dockerfile - nginx-nodejs-redis/web/Dockerfile - react-express-mongodb/backend/Dockerfile - react-express-mongodb/frontend/Dockerfile - react-express-mysql/backend/Dockerfile - react-express-mysql/frontend/Dockerfile - react-java-mysql/frontend/Dockerfile - react-nginx/Dockerfile - react-rust-postgres/frontend/Dockerfile - vuejs/vuejs/Dockerfile ## Why Running `npm install` (or `yarn`, `pnpm`, `bun`, `npx`) without restricting postinstall scripts allows dependency lifecycle hooks to execute arbitrary code during installation. Setting `ignore-scripts=true` (or the equivalent for your package manager) mitigates this risk. References: - npm: https://docs.npmjs.com/cli/v10/using-npm/config#ignore-scripts - yarn classic: https://classic.yarnpkg.com/lang/en/docs/configuration - yarn berry: https://yarnpkg.com/configuration/yarnrc#enableScripts - bun: https://bun.sh/docs/install/lifecycle --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-06-14 08:49:00 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
good first issue
proposal
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/awesome-compose#13536
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?