From 8edc0f8d8d3566e5dbf9840bab99766ab3020df6 Mon Sep 17 00:00:00 2001 From: Grace Date: Fri, 17 Jul 2026 09:29:36 +0100 Subject: [PATCH 1/5] Improve npm installation security --- .github/workflows/build-docs.yml | 11 ++++++++--- .github/workflows/build.yml | 9 +++++---- .node-version | 1 + .npmrc | 14 ++++++++++++++ package-lock.json | 4 ++-- package.json | 9 +++++++-- 6 files changed, 37 insertions(+), 11 deletions(-) create mode 100644 .node-version diff --git a/.github/workflows/build-docs.yml b/.github/workflows/build-docs.yml index ed0ea74..88f820b 100644 --- a/.github/workflows/build-docs.yml +++ b/.github/workflows/build-docs.yml @@ -12,14 +12,19 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@v6 + - uses: actions/setup-node@v6 + with: + node-version: '24.x' + cache: npm + - run: npm install -g npm@11 --registry=https://registry.npmjs.org - name: Setup Pages uses: actions/configure-pages@v5 - run: npm ci - name: Build docs run: npm run docs - name: Upload artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@v5 with: path: ./docs/build @@ -36,4 +41,4 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5 diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 0ba283b..d159b1d 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -12,13 +12,14 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@v3 - - uses: actions/setup-node@v3 + - uses: actions/checkout@v7 + - uses: actions/setup-node@v6 with: - node-version: '20.x' + node-version: '24.x' registry-url: 'https://registry.npmjs.org' cache: npm - - uses: microbit-foundation/npm-package-versioner-action@v1 + - run: npm install -g npm@11 --registry=https://registry.npmjs.org + - uses: microbit-foundation/npm-package-versioner-action@v3 - run: npm ci env: NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.node-version b/.node-version new file mode 100644 index 0000000..7329493 --- /dev/null +++ b/.node-version @@ -0,0 +1 @@ +24.18.0 \ No newline at end of file diff --git a/.npmrc b/.npmrc index 94a06c2..e114aba 100644 --- a/.npmrc +++ b/.npmrc @@ -1 +1,15 @@ access=public + +min-release-age=7 +min-release-age-exclude[]=@microbit/* +min-release-age-exclude[]=@microbit-foundation/* + +# root here means this project's package.json +allow-git=root +allow-remote=root +allow-file=root +allow-directory=root + +strict-allow-scripts=true + +engine-strict=true \ No newline at end of file diff --git a/package-lock.json b/package-lock.json index f00d4b2..e915cc9 100644 --- a/package-lock.json +++ b/package-lock.json @@ -37,8 +37,8 @@ "typescript": "^5.2.2" }, "engines": { - "node": ">=20", - "npm": ">=10" + "node": ">=24.0.0", + "npm": ">=11.18.0" }, "peerDependencies": { "react": ">=18.0.0", diff --git a/package.json b/package.json index 082bddc..8b828dc 100644 --- a/package.json +++ b/package.json @@ -11,9 +11,14 @@ "type": "git", "url": "https://github.com/microbit-foundation/python-editor-embed" }, + "allowScripts": { + "fsevents": true, + "esbuild": true + }, + "packageManager": "npm@11.18.0", "engines": { - "node": ">=20", - "npm": ">=10" + "node": ">=24.0.0", + "npm": ">=11.18.0" }, "main": "./dist/cjs/index.js", "module": "./dist/esm/index.js", From 6f05eef8d28bcc2d3fa381307e577299f0894e99 Mon Sep 17 00:00:00 2001 From: Grace Date: Fri, 17 Jul 2026 15:23:24 +0100 Subject: [PATCH 2/5] Cludge around npm publish --- .github/workflows/build.yml | 2 +- .storybook/main.ts | 1 + public/_headers | 11 +++++++++++ 3 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 public/_headers diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index d159b1d..2d63dad 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,7 +24,7 @@ jobs: env: NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: npm run ci - - run: npm publish + - run: npm publish --allow-directory=all if: github.event_name == 'release' && github.event.action == 'created' env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} diff --git a/.storybook/main.ts b/.storybook/main.ts index f90e437..f2b17d1 100644 --- a/.storybook/main.ts +++ b/.storybook/main.ts @@ -2,6 +2,7 @@ import type { StorybookConfig } from '@storybook/react-vite'; const config: StorybookConfig = { stories: ['../src/**/*.stories.tsx'], + staticDirs: ['../public'], addons: [ '@storybook/addon-links', '@storybook/addon-essentials', diff --git a/public/_headers b/public/_headers new file mode 100644 index 0000000..5f909cb --- /dev/null +++ b/public/_headers @@ -0,0 +1,11 @@ +# Never serve a stale HTML entry point: it references content-hashed assets +# that are purged on redeploy, which otherwise 404 -> SPA fallback -> a +# text/html response the browser rejects as a module script. +/index.html + Cache-Control: no-cache +/iframe.html + Cache-Control: no-cache + +# Content-hashed assets are immutable and safe to cache forever. +/assets/* + Cache-Control: public, max-age=31536000, immutable From fdc47897e7cca688dfc8125ebb969bddacafd0b9 Mon Sep 17 00:00:00 2001 From: Grace Date: Fri, 17 Jul 2026 15:24:23 +0100 Subject: [PATCH 3/5] Remove engine restrictions for consuming apps --- package-lock.json | 4 ---- package.json | 4 ---- 2 files changed, 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index e915cc9..18474f2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -36,10 +36,6 @@ "tslib": "^2.6.2", "typescript": "^5.2.2" }, - "engines": { - "node": ">=24.0.0", - "npm": ">=11.18.0" - }, "peerDependencies": { "react": ">=18.0.0", "react-dom": ">=18.0.0" diff --git a/package.json b/package.json index 8b828dc..8a312d3 100644 --- a/package.json +++ b/package.json @@ -16,10 +16,6 @@ "esbuild": true }, "packageManager": "npm@11.18.0", - "engines": { - "node": ">=24.0.0", - "npm": ">=11.18.0" - }, "main": "./dist/cjs/index.js", "module": "./dist/esm/index.js", "typings": "./dist/esm/index.d.ts", From 893dec9e3594098ad60cdaefdd4d6f817ccab7e4 Mon Sep 17 00:00:00 2001 From: Grace Date: Fri, 24 Jul 2026 15:47:17 +0100 Subject: [PATCH 4/5] Revert unintended changes --- .storybook/main.ts | 1 - public/_headers | 11 ----------- 2 files changed, 12 deletions(-) delete mode 100644 public/_headers diff --git a/.storybook/main.ts b/.storybook/main.ts index f2b17d1..f90e437 100644 --- a/.storybook/main.ts +++ b/.storybook/main.ts @@ -2,7 +2,6 @@ import type { StorybookConfig } from '@storybook/react-vite'; const config: StorybookConfig = { stories: ['../src/**/*.stories.tsx'], - staticDirs: ['../public'], addons: [ '@storybook/addon-links', '@storybook/addon-essentials', diff --git a/public/_headers b/public/_headers deleted file mode 100644 index 5f909cb..0000000 --- a/public/_headers +++ /dev/null @@ -1,11 +0,0 @@ -# Never serve a stale HTML entry point: it references content-hashed assets -# that are purged on redeploy, which otherwise 404 -> SPA fallback -> a -# text/html response the browser rejects as a module script. -/index.html - Cache-Control: no-cache -/iframe.html - Cache-Control: no-cache - -# Content-hashed assets are immutable and safe to cache forever. -/assets/* - Cache-Control: public, max-age=31536000, immutable From 5a418f45ead74e49a17cfecdf2856757e7bcf9ba Mon Sep 17 00:00:00 2001 From: Grace Date: Fri, 24 Jul 2026 15:51:33 +0100 Subject: [PATCH 5/5] Re-apply engines and remove engine-strict --- .npmrc | 2 -- package-lock.json | 4 ++++ package.json | 4 ++++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.npmrc b/.npmrc index e114aba..538a088 100644 --- a/.npmrc +++ b/.npmrc @@ -11,5 +11,3 @@ allow-file=root allow-directory=root strict-allow-scripts=true - -engine-strict=true \ No newline at end of file diff --git a/package-lock.json b/package-lock.json index 18474f2..f00d4b2 100644 --- a/package-lock.json +++ b/package-lock.json @@ -36,6 +36,10 @@ "tslib": "^2.6.2", "typescript": "^5.2.2" }, + "engines": { + "node": ">=20", + "npm": ">=10" + }, "peerDependencies": { "react": ">=18.0.0", "react-dom": ">=18.0.0" diff --git a/package.json b/package.json index 8a312d3..8b51d97 100644 --- a/package.json +++ b/package.json @@ -11,6 +11,10 @@ "type": "git", "url": "https://github.com/microbit-foundation/python-editor-embed" }, + "engines": { + "node": ">=20", + "npm": ">=10" + }, "allowScripts": { "fsevents": true, "esbuild": true