github-starred/awesome-compose
2
0
Fork 0
mirror of https://github.com/docker/awesome-compose.git synced 2026-07-16 21:23:00 -05:00
Code Issues 9.3k Packages Projects Releases Wiki Activity

[PR #750] [MERGED] ci: add ignore-scripts to Node package manager config (20260527-153132) #14624

New Issue
Closed
opened 2026-06-17 23:15:03 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-06-17 23:15:03 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/docker/awesome-compose/pull/750
Author: @securityeng-bot[bot]
Created: 5/27/2026
Status: ✅ Merged
Merged: 6/5/2026
Merged by: @vallieres

Base: master ← Head: sec-cli/ignore-scripts-fix-20260527-153132

📝 Commits (10+)

  • b82468c ci: enforce ignore-scripts policy for Node package managers
  • c490eef ci: enforce ignore-scripts policy for Node package managers
  • 5706d92 ci: enforce ignore-scripts policy for Node package managers
  • e162a02 ci: enforce ignore-scripts policy for Node package managers
  • a1a2593 ci: enforce ignore-scripts policy for Node package managers
  • c8337c8 ci: enforce ignore-scripts policy for Node package managers
  • 78a65a2 ci: enforce ignore-scripts policy for Node package managers
  • f9bd36d ci: enforce ignore-scripts policy for Node package managers
  • 83b18fa ci: enforce ignore-scripts policy for Node package managers
  • d54fc79 ci: enforce ignore-scripts policy for Node package managers

📊 Changes

30 files changed (+40 additions, -0 deletions)

View changed files

➕ angular/angular/.npmrc (+1 -0)
➕ angular/angular/.yarnrc.yml (+1 -0)
📝 angular/angular/Dockerfile (+2 -0)
➕ nginx-nodejs-redis/web/.npmrc (+1 -0)
➕ nginx-nodejs-redis/web/.yarnrc.yml (+1 -0)
📝 nginx-nodejs-redis/web/Dockerfile (+2 -0)
➕ react-express-mongodb/backend/.npmrc (+1 -0)
➕ react-express-mongodb/backend/.yarnrc.yml (+1 -0)
📝 react-express-mongodb/backend/Dockerfile (+2 -0)
➕ react-express-mongodb/frontend/.npmrc (+1 -0)
➕ react-express-mongodb/frontend/.yarnrc.yml (+1 -0)
📝 react-express-mongodb/frontend/Dockerfile (+2 -0)
➕ react-express-mysql/backend/.npmrc (+1 -0)
➕ react-express-mysql/backend/.yarnrc.yml (+1 -0)
📝 react-express-mysql/backend/Dockerfile (+2 -0)
➕ react-express-mysql/frontend/.npmrc (+1 -0)
➕ react-express-mysql/frontend/.yarnrc.yml (+1 -0)
📝 react-express-mysql/frontend/Dockerfile (+2 -0)
➕ react-java-mysql/frontend/.npmrc (+1 -0)
➕ react-java-mysql/frontend/.yarnrc.yml (+1 -0)

...and 10 more files

📄 Description

This PR was generated by sec-cli github repositories ignore-scripts update.

What changed

Package managers detected: npm, yarn

Created config files:

  • .npmrc
  • .yarnrc.yml

Dockerfiles updated (COPY added before install step):

  • angular/angular/Dockerfile
  • nginx-nodejs-redis/web/Dockerfile
  • react-express-mongodb/backend/Dockerfile
  • react-express-mongodb/frontend/Dockerfile
  • react-express-mysql/backend/Dockerfile
  • react-express-mysql/frontend/Dockerfile
  • react-java-mysql/frontend/Dockerfile
  • react-nginx/Dockerfile
  • react-rust-postgres/frontend/Dockerfile
  • vuejs/vuejs/Dockerfile

Why

Running npm install (or yarn, pnpm, bun, npx) without restricting
postinstall scripts allows dependency lifecycle hooks to execute arbitrary code
during installation. Setting ignore-scripts=true (or the equivalent for your
package manager) mitigates this risk.

References:

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/docker/awesome-compose/pull/750 **Author:** [@securityeng-bot[bot]](https://github.com/apps/securityeng-bot) **Created:** 5/27/2026 **Status:** ✅ Merged **Merged:** 6/5/2026 **Merged by:** [@vallieres](https://github.com/vallieres) **Base:** `master` ← **Head:** `sec-cli/ignore-scripts-fix-20260527-153132` --- ### 📝 Commits (10+) - [`b82468c`](https://github.com/docker/awesome-compose/commit/b82468c1e335e0d38ae521a8163eb5dc07126a29) ci: enforce ignore-scripts policy for Node package managers - [`c490eef`](https://github.com/docker/awesome-compose/commit/c490eef6a8a6c3b9b4ad9dcc2ac5e7fad1cfa070) ci: enforce ignore-scripts policy for Node package managers - [`5706d92`](https://github.com/docker/awesome-compose/commit/5706d92959332a1b44d18f00f239807849d17268) ci: enforce ignore-scripts policy for Node package managers - [`e162a02`](https://github.com/docker/awesome-compose/commit/e162a02ac07f3b1ab4a9b17cdf60315983c1a9cb) ci: enforce ignore-scripts policy for Node package managers - [`a1a2593`](https://github.com/docker/awesome-compose/commit/a1a259356a30a4508e755d6ca31a9ae6f040214e) ci: enforce ignore-scripts policy for Node package managers - [`c8337c8`](https://github.com/docker/awesome-compose/commit/c8337c81b0449bed8df54dff4819b8ff23a1dc7e) ci: enforce ignore-scripts policy for Node package managers - [`78a65a2`](https://github.com/docker/awesome-compose/commit/78a65a2e0373656cab42aeeaec0e51f05df86b76) ci: enforce ignore-scripts policy for Node package managers - [`f9bd36d`](https://github.com/docker/awesome-compose/commit/f9bd36d5881d40de4ea7b61d8624a692092bc04a) ci: enforce ignore-scripts policy for Node package managers - [`83b18fa`](https://github.com/docker/awesome-compose/commit/83b18fa91dd8eb1fe6c60e47e927f48fbe65ed42) ci: enforce ignore-scripts policy for Node package managers - [`d54fc79`](https://github.com/docker/awesome-compose/commit/d54fc795b713033e54c6f7c7d483eadebdcc197c) ci: enforce ignore-scripts policy for Node package managers ### 📊 Changes **30 files changed** (+40 additions, -0 deletions) <details> <summary>View changed files</summary> ➕ `angular/angular/.npmrc` (+1 -0) ➕ `angular/angular/.yarnrc.yml` (+1 -0) 📝 `angular/angular/Dockerfile` (+2 -0) ➕ `nginx-nodejs-redis/web/.npmrc` (+1 -0) ➕ `nginx-nodejs-redis/web/.yarnrc.yml` (+1 -0) 📝 `nginx-nodejs-redis/web/Dockerfile` (+2 -0) ➕ `react-express-mongodb/backend/.npmrc` (+1 -0) ➕ `react-express-mongodb/backend/.yarnrc.yml` (+1 -0) 📝 `react-express-mongodb/backend/Dockerfile` (+2 -0) ➕ `react-express-mongodb/frontend/.npmrc` (+1 -0) ➕ `react-express-mongodb/frontend/.yarnrc.yml` (+1 -0) 📝 `react-express-mongodb/frontend/Dockerfile` (+2 -0) ➕ `react-express-mysql/backend/.npmrc` (+1 -0) ➕ `react-express-mysql/backend/.yarnrc.yml` (+1 -0) 📝 `react-express-mysql/backend/Dockerfile` (+2 -0) ➕ `react-express-mysql/frontend/.npmrc` (+1 -0) ➕ `react-express-mysql/frontend/.yarnrc.yml` (+1 -0) 📝 `react-express-mysql/frontend/Dockerfile` (+2 -0) ➕ `react-java-mysql/frontend/.npmrc` (+1 -0) ➕ `react-java-mysql/frontend/.yarnrc.yml` (+1 -0) _...and 10 more files_ </details> ### 📄 Description This PR was generated by `sec-cli github repositories ignore-scripts update`. ## What changed **Package managers detected:** npm, yarn **Created config files:** - .npmrc - .yarnrc.yml **Dockerfiles updated** (COPY added before install step): - angular/angular/Dockerfile - nginx-nodejs-redis/web/Dockerfile - react-express-mongodb/backend/Dockerfile - react-express-mongodb/frontend/Dockerfile - react-express-mysql/backend/Dockerfile - react-express-mysql/frontend/Dockerfile - react-java-mysql/frontend/Dockerfile - react-nginx/Dockerfile - react-rust-postgres/frontend/Dockerfile - vuejs/vuejs/Dockerfile ## Why Running `npm install` (or `yarn`, `pnpm`, `bun`, `npx`) without restricting postinstall scripts allows dependency lifecycle hooks to execute arbitrary code during installation. Setting `ignore-scripts=true` (or the equivalent for your package manager) mitigates this risk. References: - npm: https://docs.npmjs.com/cli/v10/using-npm/config#ignore-scripts - yarn classic: https://classic.yarnpkg.com/lang/en/docs/configuration - yarn berry: https://yarnpkg.com/configuration/yarnrc#enableScripts - bun: https://bun.sh/docs/install/lifecycle --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-06-17 23:15:03 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
good first issue
proposal
pull-request
Mirrored from GitHub Pull Request
 question
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/awesome-compose#14624
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?