Skip to content

Use npm ci --ignore-scripts instead of npm install#1722

Merged
woodruffw merged 1 commit intomainfrom
ww/npm
Dec 2, 2025
Merged

Use npm ci --ignore-scripts instead of npm install#1722
woodruffw merged 1 commit intomainfrom
ww/npm

Conversation

@woodruffw
Copy link
Member

Summary

This uses npm ci --ignore-scripts instead of npm install, which is more hermetic/reproducible and also forbids build-time script execution (which none of the deps in SchemaStore should need).

See astral-sh/ruff#21742 and astral-sh/uv#16915 for equivalent changes.

Test Plan

Identical to the uv change, which I tested locally 🙂

Signed-off-by: William Woodruff <william@astral.sh>
@woodruffw woodruffw self-assigned this Dec 2, 2025
@woodruffw woodruffw merged commit a362ad2 into main Dec 2, 2025
12 checks passed
@woodruffw woodruffw deleted the ww/npm branch December 2, 2025 15:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants