From 680a71d16b245ece4f95febe6123129f314b54dc Mon Sep 17 00:00:00 2001 From: Grace Date: Wed, 15 Jul 2026 14:41:22 +0100 Subject: [PATCH 1/4] Improve npm package installation security MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit .npmrc: min-release-age=7 (cooldown; @microbit/* and @microbit-foundation/* exempt) allow-git/remote/file/directory=root (block transitive non-registry deps) strict-allow-scripts=true + engine-strict=true package.json: targetted allowScripts policy (esbuild, fsevents — the only deps with install scripts in our tree) engines: node >=24.0.0, npm >=11.18.0 CI workflows: grab latest v11 npm directly after setup-node so engine-strict is satisfied give build-docs its own node 24 setup (it had none and ran npm ci bare) bump GitHub-provided actions (checkout, Pages family to v5) --- .github/workflows/build-docs.yml | 11 ++++++++--- .github/workflows/build.yml | 1 + .npmrc | 14 ++++++++++++++ package-lock.json | 8 ++++---- package.json | 8 ++++++-- 5 files changed, 33 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml index ed0ea74..88f820b 100644 --- a/.github/workflows/build-docs.yml +++ b/.github/workflows/build-docs.yml @@ -12,14 +12,19 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 + - uses: actions/setup-node@v6 + with: + node-version: '24.x' + cache: npm + - run: npm install -g npm@11 --registry=https://registry.npmjs.org - name: Setup Pages uses: actions/configure-pages@v5 - run: npm ci - name: Build docs run: npm run docs - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@v5 with: path: ./docs/build @@ -36,4 +41,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 046466a..e803482 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -18,6 +18,7 @@ jobs: node-version: '24.x' registry-url: 'https://registry.npmjs.org' cache: npm + - run: npm install -g npm@11 --registry=https://registry.npmjs.org - uses: microbit-foundation/npm-package-versioner-action@v3 - run: npm ci env: diff --git a/.npmrc b/.npmrc index 94a06c2..ad165a7 100644 --- a/.npmrc +++ b/.npmrc @@ -1 +1,15 @@ access=public + +min-release-age=7 +min-release-age-exclude[]=@microbit/* +min-release-age-exclude[]=@microbit-foundation/* + +# root here means this project's package.json +allow-git=root +allow-remote=root +allow-file=root +allow-directory=root + +strict-allow-scripts=true + +engine-strict=true diff --git a/package-lock.json b/package-lock.json index acf7f6d..4826c76 100644 --- a/package-lock.json +++ b/package-lock.json @@ -35,12 +35,12 @@ "typescript": "^5.2.2" }, "engines": { - "node": ">=20", - "npm": ">=10" + "node": ">=24.0.0", + "npm": ">=11.18.0" }, "peerDependencies": { - "react": ">=18.0.0", - "react-dom": ">=18.0.0" + "react": ">=17.0.2", + "react-dom": ">=17.0.2" } }, "node_modules/@aashutoshrathi/word-wrap": { diff --git a/package.json b/package.json index 1aad227..0ba635c 100644 --- a/package.json +++ b/package.json @@ -11,9 +11,13 @@ "type": "git", "url": "https://github.com/microbit-foundation/makecode-embed" }, + "allowScripts": { + "esbuild": true, + "fsevents": true + }, "engines": { - "node": ">=20", - "npm": ">=10" + "node": ">=24.0.0", + "npm": ">=11.18.0" }, "main": "./dist/cjs/index.js", "module": "./dist/esm/index.js", From 3f4ed618a8af54c044b500e098353d3efc461b5a Mon Sep 17 00:00:00 2001 From: Grace Date: Wed, 15 Jul 2026 15:15:26 +0100 Subject: [PATCH 2/4] Add .node-version --- .node-version | 1 + 1 file changed, 1 insertion(+) create mode 100644 .node-version diff --git a/.node-version b/.node-version new file mode 100644 index 0000000..1e4f392 --- /dev/null +++ b/.node-version @@ -0,0 +1 @@ +24.12.0 \ No newline at end of file From 0618c5ebe76dc77f737a1ddc42ee15abf048e5b5 Mon Sep 17 00:00:00 2001 From: Grace Date: Wed, 15 Jul 2026 15:17:24 +0100 Subject: [PATCH 3/4] Upgrade .node-version to 24.18.0 --- .node-version | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.node-version b/.node-version index 1e4f392..7329493 100644 --- a/.node-version +++ b/.node-version @@ -1 +1 @@ -24.12.0 \ No newline at end of file +24.18.0 \ No newline at end of file From 9971ee8fb269453d49f00df0603184b1f4ecba20 Mon Sep 17 00:00:00 2001 From: Grace Date: Wed, 15 Jul 2026 16:44:02 +0100 Subject: [PATCH 4/4] Configure corepack npm version to 11.18.0 CloudFlare pages uses Corepack to manage package managers including npm. This hopefully will allow CloudFlare deployments to use a later version of npm than the corresponding node version defined in .node-version. --- package.json | 1 + 1 file changed, 1 insertion(+) diff --git a/package.json b/package.json index 0ba635c..24a11fb 100644 --- a/package.json +++ b/package.json @@ -15,6 +15,7 @@ "esbuild": true, "fsevents": true }, + "packageManager": "npm@11.18.0", "engines": { "node": ">=24.0.0", "npm": ">=11.18.0"