acetheking987/bsky-social-app
1
0
Fork 0
Code Issues Actions Packages Projects Releases 1 Wiki Activity

drop lockfile-lint

Browse Source 
lockfile-lint doesn't support pnpm-lock.yaml. pnpm enforces tarball
integrity hashes on install, covering the core supply-chain concern.
The explicit allowlists (hosts, schemes, git URLs) are gone with it;
acceptable tradeoff for now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Samuel Newman
2026-05-12 16:08:42 +03:00
parent 9b4c888195
commit ee1488f322
5 changed files with 0 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/bundle-deploy-eas-update.yml
-3
View File
@@ -74,9 +74,6 @@ jobs:
- name: Lint check
run: pnpm lint
- name: Lint lockfile
run: pnpm lockfile-lint
- name: Prettier check
run: pnpm prettier --check .
.github/workflows/lint.yml
-2
View File
@@ -55,8 +55,6 @@ jobs:
attempt_delay: 2000
- name: Lint check
run: pnpm lint
- name: Lint lockfile
run: pnpm lockfile-lint
- name: Prettier check
run: pnpm prettier --check .
- name: Check & compile i18n
.github/workflows/pull-request-comment.yml
-3
View File
@@ -131,9 +131,6 @@ jobs:
- name: Lint check
run: pnpm lint
- name: Lint lockfile
run: pnpm lockfile-lint
- name: 🔤 Compile translations
run: pnpm intl:build 2>&1 | tee i18n.log
package.json
-25
View File
@@ -287,7 +287,6 @@
"jest-expo": "~54.0.17",
"jest-junit": "^16.0.0",
"lint-staged": "^13.2.3",
"lockfile-lint": "^4.14.0",
"prettier": "^3.6.0",
"react-native-dotenv": "^3.4.11",
"react-refresh": "^0.14.0",
@@ -381,29 +380,5 @@
"assets/icons/*.svg": [
"svgo"
]
},
"lockfile-lint": {
"path": "pnpm-lock.yaml",
"allowedHosts": [
"npm",
"yarn"
],
"allowedSchemes": [
"https:"
],
"allowedPackageNameAliases": [
"@babel/traverse--for-generate-function-map:@babel/traverse",
"string-width-cjs:string-width",
"strip-ansi-cjs:strip-ansi",
"wrap-ansi-cjs:wrap-ansi"
],
"allowedUrls": [
"https://codeload.github.com/bluesky-social/react-native-bottom-sheet/tar.gz/28a87d1bb55e10fc355fa1455545a30734995908",
"https://codeload.github.com/bluesky-social/react-native-progress/tar.gz/5a372f4f2ce5feb26f4f47b6a4d187ab9b923ab4",
"https://codeload.github.com/mattermost/react-native-paste-input/tar.gz/f260447edc645a817ab1ba7b46d8341d84dba8e9"
],
"emptyHostname": false,
"validatePackageNames": true,
"validateIntegrity": true
}
}
pnpm-lock.yaml
Generated
-70
View File
@@ -638,9 +638,6 @@ importers:
lint-staged:
specifier: ^13.2.3
version: 13.3.0
lockfile-lint:
specifier: ^4.14.0
version: 4.14.1(typescript@6.0.3)
prettier:
specifier: ^3.6.0
version: 3.8.3
@@ -3773,10 +3770,6 @@ packages:
'@yarnpkg/lockfile@1.1.0':
resolution: {integrity: sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==}
'@yarnpkg/parsers@3.0.3':
resolution: {integrity: sha512-mQZgUSgFurUtA07ceMjxrWkYz8QtDuYkvPlu0ZqncgjopQ0t6CNEo/OSealkmnagSUx8ZD5ewvezUwUuMqutQg==}
engines: {node: '>=18.12.0'}
abab@2.0.6:
resolution: {integrity: sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==}
deprecated: Use your platform's native atob() and btoa() methods instead
@@ -4470,15 +4463,6 @@ packages:
typescript:
optional: true
cosmiconfig@9.0.1:
resolution: {integrity: sha512-hr4ihw+DBqcvrsEDioRO31Z17x71pUYoNe/4h6Z0wB72p7MU7/9gH8Q3s12NFhHPfYBBOV3qyfUxmr/Yn3shnQ==}
engines: {node: '>=14'}
peerDependencies:
typescript: '>=4.9.5'
peerDependenciesMeta:
typescript:
optional: true
create-jest@29.7.0:
resolution: {integrity: sha512-Adz2bdH0Vq3F53KEMJOoftQFutWCukm6J24wbPWRO4k1kMY7gS7ds/uoJkNuV8wDCtWWnuwGcJwpWcih+zEW1Q==}
engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
@@ -4893,10 +4877,6 @@ packages:
resolution: {integrity: sha512-ObFo8v4rQJAE59M69QzwloxPZtd33TpYEIjtKD1rrFDcM1Gd7IkDxEBU+HriziN6HSHQnBJi8Dmy+JWkav5HKA==}
engines: {node: '>=8'}
env-paths@2.2.1:
resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==}
engines: {node: '>=6'}
error-ex@1.3.4:
resolution: {integrity: sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==}
@@ -6635,15 +6615,6 @@ packages:
resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==}
engines: {node: '>=10'}
lockfile-lint-api@5.9.2:
resolution: {integrity: sha512-3QhxWxl3jT9GcMxuCnTsU8Tz5U6U1lKBlKBu2zOYOz/x3ONUoojEtky3uzoaaDgExcLqIX0Aqv2I7TZXE383CQ==}
engines: {node: '>=16.0.0'}
lockfile-lint@4.14.1:
resolution: {integrity: sha512-NW0Tk1qfldhbhJWQENYQWANdmlanXKxvTJYRYKn56INYjaP2M07Ua2SJYkUMS+ZbYwxDzul/C6pDsV/NEXrl+A==}
engines: {node: '>=16.0.0'}
hasBin: true
lodash.chunk@4.2.0:
resolution: {integrity: sha512-ZzydJKfUHJwHa+hF5X66zLFCBrWn5GeF28OHEr4WVWtNDXlQ/IjWKPBiikqKo2ne0+v6JgCgJ0GzJp8k8bHC7w==}
@@ -7045,10 +7016,6 @@ packages:
resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==}
engines: {node: '>=0.10.0'}
object-hash@3.0.0:
resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==}
engines: {node: '>= 6'}
object-inspect@1.13.4:
resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==}
engines: {node: '>= 0.4'}
@@ -13061,11 +13028,6 @@ snapshots:
'@yarnpkg/lockfile@1.1.0': {}
'@yarnpkg/parsers@3.0.3':
dependencies:
js-yaml: 3.14.2
tslib: 2.8.1
abab@2.0.6: {}
abort-controller@3.0.0:
@@ -13840,15 +13802,6 @@ snapshots:
optionalDependencies:
typescript: 6.0.3
cosmiconfig@9.0.1(typescript@6.0.3):
dependencies:
env-paths: 2.2.1
import-fresh: 3.3.1
js-yaml: 4.1.1
parse-json: 5.2.0
optionalDependencies:
typescript: 6.0.3
create-jest@29.7.0(@types/node@24.12.4):
dependencies:
'@jest/types': 29.6.3
@@ -14244,8 +14197,6 @@ snapshots:
env-editor@0.4.2: {}
env-paths@2.2.1: {}
error-ex@1.3.4:
dependencies:
is-arrayish: 0.2.1
@@ -16469,25 +16420,6 @@ snapshots:
dependencies:
p-locate: 5.0.0
lockfile-lint-api@5.9.2:
dependencies:
'@yarnpkg/parsers': 3.0.3
debug: 4.4.3
object-hash: 3.0.0
transitivePeerDependencies:
- supports-color
lockfile-lint@4.14.1(typescript@6.0.3):
dependencies:
cosmiconfig: 9.0.1(typescript@6.0.3)
debug: 4.4.3
fast-glob: 3.3.3
lockfile-lint-api: 5.9.2
yargs: 17.7.2
transitivePeerDependencies:
- supports-color
- typescript
lodash.chunk@4.2.0: {}
lodash.debounce@4.0.8: {}
@@ -16944,8 +16876,6 @@ snapshots:
object-assign@4.1.1: {}
object-hash@3.0.0: {}
object-inspect@1.13.4: {}
object-is@1.1.6: