From ee1488f32244d58c973ebc7c145568bbe6c42b38 Mon Sep 17 00:00:00 2001 From: Samuel Newman Date: Tue, 12 May 2026 16:08:42 +0300 Subject: [PATCH] drop lockfile-lint lockfile-lint doesn't support pnpm-lock.yaml. pnpm enforces tarball integrity hashes on install, covering the core supply-chain concern. The explicit allowlists (hosts, schemes, git URLs) are gone with it; acceptable tradeoff for now. Co-Authored-By: Claude Opus 4.7 (1M context) --- .../workflows/bundle-deploy-eas-update.yml | 3 - .github/workflows/lint.yml | 2 - .github/workflows/pull-request-comment.yml | 3 - package.json | 25 ------- pnpm-lock.yaml | 70 ------------------- 5 files changed, 103 deletions(-) diff --git a/.github/workflows/bundle-deploy-eas-update.yml b/.github/workflows/bundle-deploy-eas-update.yml index ea84911952..217c87520a 100644 --- a/.github/workflows/bundle-deploy-eas-update.yml +++ b/.github/workflows/bundle-deploy-eas-update.yml @@ -74,9 +74,6 @@ jobs: - name: Lint check run: pnpm lint - - name: Lint lockfile - run: pnpm lockfile-lint - - name: Prettier check run: pnpm prettier --check . diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 01b1055087..e8d9f9abba 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -55,8 +55,6 @@ jobs: attempt_delay: 2000 - name: Lint check run: pnpm lint - - name: Lint lockfile - run: pnpm lockfile-lint - name: Prettier check run: pnpm prettier --check . - name: Check & compile i18n diff --git a/.github/workflows/pull-request-comment.yml b/.github/workflows/pull-request-comment.yml index 48a203186d..0f6c27a3d5 100644 --- a/.github/workflows/pull-request-comment.yml +++ b/.github/workflows/pull-request-comment.yml @@ -131,9 +131,6 @@ jobs: - name: Lint check run: pnpm lint - - name: Lint lockfile - run: pnpm lockfile-lint - - name: 🔤 Compile translations run: pnpm intl:build 2>&1 | tee i18n.log diff --git a/package.json b/package.json index 30638a87ae..279eb6838c 100644 --- a/package.json +++ b/package.json @@ -287,7 +287,6 @@ "jest-expo": "~54.0.17", "jest-junit": "^16.0.0", "lint-staged": "^13.2.3", - "lockfile-lint": "^4.14.0", "prettier": "^3.6.0", "react-native-dotenv": "^3.4.11", "react-refresh": "^0.14.0", @@ -381,29 +380,5 @@ "assets/icons/*.svg": [ "svgo" ] - }, - "lockfile-lint": { - "path": "pnpm-lock.yaml", - "allowedHosts": [ - "npm", - "yarn" - ], - "allowedSchemes": [ - "https:" - ], - "allowedPackageNameAliases": [ - "@babel/traverse--for-generate-function-map:@babel/traverse", - "string-width-cjs:string-width", - "strip-ansi-cjs:strip-ansi", - "wrap-ansi-cjs:wrap-ansi" - ], - "allowedUrls": [ - "https://codeload.github.com/bluesky-social/react-native-bottom-sheet/tar.gz/28a87d1bb55e10fc355fa1455545a30734995908", - "https://codeload.github.com/bluesky-social/react-native-progress/tar.gz/5a372f4f2ce5feb26f4f47b6a4d187ab9b923ab4", - "https://codeload.github.com/mattermost/react-native-paste-input/tar.gz/f260447edc645a817ab1ba7b46d8341d84dba8e9" - ], - "emptyHostname": false, - "validatePackageNames": true, - "validateIntegrity": true } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 31d138fccc..59acfcebe3 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -638,9 +638,6 @@ importers: lint-staged: specifier: ^13.2.3 version: 13.3.0 - lockfile-lint: - specifier: ^4.14.0 - version: 4.14.1(typescript@6.0.3) prettier: specifier: ^3.6.0 version: 3.8.3 @@ -3773,10 +3770,6 @@ packages: '@yarnpkg/lockfile@1.1.0': resolution: {integrity: sha512-GpSwvyXOcOOlV70vbnzjj4fW5xW/FdUF6nQEt1ENy7m4ZCczi1+/buVUPAqmGfqznsORNFzUMjctTIp8a9tuCQ==} - '@yarnpkg/parsers@3.0.3': - resolution: {integrity: sha512-mQZgUSgFurUtA07ceMjxrWkYz8QtDuYkvPlu0ZqncgjopQ0t6CNEo/OSealkmnagSUx8ZD5ewvezUwUuMqutQg==} - engines: {node: '>=18.12.0'} - abab@2.0.6: resolution: {integrity: sha512-j2afSsaIENvHZN2B8GOpF566vZ5WVk5opAiMTvWgaQT8DkbOqsTfvNAvHoRGU2zzP8cPoqys+xHTRDWW8L+/BA==} deprecated: Use your platform's native atob() and btoa() methods instead @@ -4470,15 +4463,6 @@ packages: typescript: optional: true - cosmiconfig@9.0.1: - resolution: {integrity: sha512-hr4ihw+DBqcvrsEDioRO31Z17x71pUYoNe/4h6Z0wB72p7MU7/9gH8Q3s12NFhHPfYBBOV3qyfUxmr/Yn3shnQ==} - engines: {node: '>=14'} - peerDependencies: - typescript: '>=4.9.5' - peerDependenciesMeta: - typescript: - optional: true - create-jest@29.7.0: resolution: {integrity: sha512-Adz2bdH0Vq3F53KEMJOoftQFutWCukm6J24wbPWRO4k1kMY7gS7ds/uoJkNuV8wDCtWWnuwGcJwpWcih+zEW1Q==} engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0} @@ -4893,10 +4877,6 @@ packages: resolution: {integrity: sha512-ObFo8v4rQJAE59M69QzwloxPZtd33TpYEIjtKD1rrFDcM1Gd7IkDxEBU+HriziN6HSHQnBJi8Dmy+JWkav5HKA==} engines: {node: '>=8'} - env-paths@2.2.1: - resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==} - engines: {node: '>=6'} - error-ex@1.3.4: resolution: {integrity: sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==} @@ -6635,15 +6615,6 @@ packages: resolution: {integrity: sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==} engines: {node: '>=10'} - lockfile-lint-api@5.9.2: - resolution: {integrity: sha512-3QhxWxl3jT9GcMxuCnTsU8Tz5U6U1lKBlKBu2zOYOz/x3ONUoojEtky3uzoaaDgExcLqIX0Aqv2I7TZXE383CQ==} - engines: {node: '>=16.0.0'} - - lockfile-lint@4.14.1: - resolution: {integrity: sha512-NW0Tk1qfldhbhJWQENYQWANdmlanXKxvTJYRYKn56INYjaP2M07Ua2SJYkUMS+ZbYwxDzul/C6pDsV/NEXrl+A==} - engines: {node: '>=16.0.0'} - hasBin: true - lodash.chunk@4.2.0: resolution: {integrity: sha512-ZzydJKfUHJwHa+hF5X66zLFCBrWn5GeF28OHEr4WVWtNDXlQ/IjWKPBiikqKo2ne0+v6JgCgJ0GzJp8k8bHC7w==} @@ -7045,10 +7016,6 @@ packages: resolution: {integrity: sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==} engines: {node: '>=0.10.0'} - object-hash@3.0.0: - resolution: {integrity: sha512-RSn9F68PjH9HqtltsSnqYC1XXoWe9Bju5+213R98cNGttag9q9yAOTzdbsqvIa7aNm5WffBZFpWYr2aWrklWAw==} - engines: {node: '>= 6'} - object-inspect@1.13.4: resolution: {integrity: sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==} engines: {node: '>= 0.4'} @@ -13061,11 +13028,6 @@ snapshots: '@yarnpkg/lockfile@1.1.0': {} - '@yarnpkg/parsers@3.0.3': - dependencies: - js-yaml: 3.14.2 - tslib: 2.8.1 - abab@2.0.6: {} abort-controller@3.0.0: @@ -13840,15 +13802,6 @@ snapshots: optionalDependencies: typescript: 6.0.3 - cosmiconfig@9.0.1(typescript@6.0.3): - dependencies: - env-paths: 2.2.1 - import-fresh: 3.3.1 - js-yaml: 4.1.1 - parse-json: 5.2.0 - optionalDependencies: - typescript: 6.0.3 - create-jest@29.7.0(@types/node@24.12.4): dependencies: '@jest/types': 29.6.3 @@ -14244,8 +14197,6 @@ snapshots: env-editor@0.4.2: {} - env-paths@2.2.1: {} - error-ex@1.3.4: dependencies: is-arrayish: 0.2.1 @@ -16469,25 +16420,6 @@ snapshots: dependencies: p-locate: 5.0.0 - lockfile-lint-api@5.9.2: - dependencies: - '@yarnpkg/parsers': 3.0.3 - debug: 4.4.3 - object-hash: 3.0.0 - transitivePeerDependencies: - - supports-color - - lockfile-lint@4.14.1(typescript@6.0.3): - dependencies: - cosmiconfig: 9.0.1(typescript@6.0.3) - debug: 4.4.3 - fast-glob: 3.3.3 - lockfile-lint-api: 5.9.2 - yargs: 17.7.2 - transitivePeerDependencies: - - supports-color - - typescript - lodash.chunk@4.2.0: {} lodash.debounce@4.0.8: {} @@ -16944,8 +16876,6 @@ snapshots: object-assign@4.1.1: {} - object-hash@3.0.0: {} - object-inspect@1.13.4: {} object-is@1.1.6: