← Back to context

Comment by punkbit

1 month ago

> The resulting allowlist is written to package.json

Couldn’t this effectively result in the same process we get in pre-12 defaults?

2 comments

punkbit

Reply
CGamesPlay  1 month ago

It's unstated, but I'm willing to assume that only the root package.json is consulted to decide if these scripts are allowed. Otherwise, yes, this would not actually change anything.

  • punkbit  1 month ago

    Thanks for the sanity check!

    Had a quick read on my mobile, and that was my first impression.

    Guess its more of a way to make the maintainers accountable instead of making npm reputation the main focus.