Replies: 1 comment
-
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
🏷️ Discussion Type
Product Feedback
Body
It'd be helpful if the npm cli provided an equivalent to
allow-gitfor tarball URLs (as described here in the docs), with the same options ("all", "none", or "root").The intent being that setting e.g.
allow-git=none, allow-tarball-url=nonewould then only allow installing from the configured registry or a local folder, which should help defend against cases like 'PhantomRaven' (Koi).Something similar was previously suggested by @boramalper in a comment on the v11.10.0+ release announcement, but I'm raising it here too for visibility.
As they pointed out, pnpm provide a similar mechanism via blockExoticSubdeps.
Thank you for your consideration.
Beta Was this translation helpful? Give feedback.
All reactions