From 78bbb464384f6a407b0d4c207c8ef9481fc7ef6d Mon Sep 17 00:00:00 2001
From: Grace <grace@microbit.org>
Date: Mon, 27 Jul 2026 13:54:17 +0100
Subject: [PATCH] Improve npm package installation security

---
 .github/workflows/build-docs.yml |  8 +++++++-
 .github/workflows/build.yml      |  9 +++++----
 .npmrc                           | 12 ++++++++++++
 package.json                     |  4 ++++
 4 files changed, 28 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml
index ed0ea74..6a57ede 100644
--- a/.github/workflows/build-docs.yml
+++ b/.github/workflows/build-docs.yml
@@ -12,9 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
+      - name: Setup Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24.x'
+          cache: npm
       - name: Setup Pages
         uses: actions/configure-pages@v5
+      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
       - run: npm ci
       - name: Build docs
         run: npm run docs
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 43a3c46..8f3e38e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -11,15 +11,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
         with:
-          node-version: '20.x'
+          node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
           cache: npm
+      - run: npm install -g npm@11 --registry=https://registry.npmjs.org
       - run: npm ci
       - run: npm run ci
-      - run: npm publish
+      - run: npm publish --allow-directory=all
         if: github.event_name == 'release' && github.event.action == 'created'
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.npmrc b/.npmrc
index 94a06c2..538a088 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,13 @@
 access=public
+
+min-release-age=7
+min-release-age-exclude[]=@microbit/*
+min-release-age-exclude[]=@microbit-foundation/*
+
+# root here means this project's package.json
+allow-git=root
+allow-remote=root
+allow-file=root
+allow-directory=root
+
+strict-allow-scripts=true
diff --git a/package.json b/package.json
index 4d5d230..799530c 100644
--- a/package.json
+++ b/package.json
@@ -36,6 +36,10 @@
     "npm": ">=9.0",
     "yarn": "^1.0"
   },
+  "allowScripts": {
+    "esbuild": true,
+    "fsevents": true
+  },
   "scripts": {
     "build:esm": "tsc -p tsconfig.json && echo '{\"type\": \"module\"}' > dist/esm/package.json",
     "build:cjs": "tsc -p tsconfig.cjs.json && echo '{\"type\": \"commonjs\"}' > dist/cjs/package.json",