Found by a nested-workspace-root audit in udibo/udibo#1030.
This repo is its own Deno workspace root with its own deno.lock, and Deno does not inherit minimumDependencyAge or allowScripts from an outer root. udibo consumes this package as the submodule packages/esbuild-plugin-postcss, excluded from udibo's root workspace, so udibo's settings never apply here. Both are missing on the pinned commit and on main.
What that means today
- No install-script gate: the lock records four packages with
"scripts": true (parcel, esbuild ×2, fsevents). With no allowScripts, whichever of Deno's defaults applies is doing the deciding, not a recorded decision.
- No dependency-age floor: a freshly published third-party version can be installed the day it appears. The floor exists so a compromised release cannot be pulled in during its first days.
Suggested fix, matching what udibo and udibo/oauth2#12 do:
"minimumDependencyAge": { "age": "P3D", "exclude": ["jsr:@udibo/*"] },
"allowScripts": { "allow": [], "deny": ["npm:<each package in the lock with scripts: true>"] }Verify each script-bearing package actually works with its install script blocked before denying it. For esbuild that holds, because the binary ships in a separate platform package. Prove it with rm -rf node_modules && deno install --frozen plus the test suite.
Related: udibo/juniper#128 tracks the same class of drift in that repo, and udibo/oauth2#12 fixes the oauth2 root.
🤖 Generated with Claude Code
Found by a nested-workspace-root audit in udibo/udibo#1030.
This repo is its own Deno workspace root with its own
deno.lock, and Deno does not inheritminimumDependencyAgeorallowScriptsfrom an outer root. udibo consumes this package as the submodulepackages/esbuild-plugin-postcss, excluded from udibo's root workspace, so udibo's settings never apply here. Both are missing on the pinned commit and onmain.What that means today
"scripts": true(parcel, esbuild ×2, fsevents). With noallowScripts, whichever of Deno's defaults applies is doing the deciding, not a recorded decision.Suggested fix, matching what udibo and udibo/oauth2#12 do:
Verify each script-bearing package actually works with its install script blocked before denying it. For esbuild that holds, because the binary ships in a separate platform package. Prove it with
rm -rf node_modules && deno install --frozenplus the test suite.Related: udibo/juniper#128 tracks the same class of drift in that repo, and udibo/oauth2#12 fixes the oauth2 root.
🤖 Generated with Claude Code