doc: add minutes for meeting 28 January#140
Conversation
|
Missed the call due to an epic 🤦♂️, but I can see a related discussion - coincidentally last week I implemented this: https://www.npmjs.com/package/allow-scripts tl;dr:
fwiw, I hope I can deprecate that package soon, as Not sure how much in scope this is for |
|
@dominykas you'd have to pursue that change in both npm and yarn. |
|
Yarn already has an RFC PR for that, npm has the thread that was mentioned in the call - this can serve as a userland ref/PoC impl to get the standards rolling (it does solve a need at work for me). I agree security wg doesn't have levers to pull this off, but advocacy and awareness is still useful? And --ignore-scripts as a best practice (at least in CI) is also recommendable? (Are we going borderline offtopic?) |
No description provided.