blob: 43c5f3b41c0ae6f9e1fe95207ce71e241ff4a212 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
|
{ pkgs, lib, ... }:
let
# Most registry compromises are caught and unpublished within days, so a
# week-old version has had time to be noticed. Lifecycle scripts are
# already blocked by pnpm unless a project allows them.
pnpmConfig = ''
minimumReleaseAge: 10080
trustPolicy: no-downgrade
blockExoticSubdeps: true
'';
in
{
# pnpm reads $XDG_CONFIG_HOME/pnpm/config.yaml, and on macOS falls back to
# ~/Library/Preferences/pnpm when XDG_CONFIG_HOME is unset (GUI apps, editors).
xdg.configFile."pnpm/config.yaml".text = pnpmConfig;
home.file."Library/Preferences/pnpm/config.yaml" = lib.mkIf pkgs.stdenv.isDarwin {
text = pnpmConfig;
};
# An env var rather than ~/.npmrc, which `npm login` must be able to write.
# pnpm ignores it. Explicit `npm run <script>` still runs.
home.sessionVariables.npm_config_ignore_scripts = "true";
home.packages = [ pkgs.osv-scanner ];
}
|
