NPM security related fixes#24
Open
IanMadd wants to merge 1 commit into
Open
Conversation
Signed-off-by: Ian Maddaus <ian.maddaus@progress.com>
✅ Deploy Preview for chef-workstation-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
There was a problem hiding this comment.
Pull request overview
This PR tightens Node.js dependency installation and update behavior to address npm/security concerns in the Chef Workstation docs build tooling (Netlify deploy scripts + local Make targets), and introduces dependency update policy configuration.
Changes:
- Switches multiple build/deploy entrypoints from
npm installto deterministicnpm ci. - Updates Netlify’s Node runtime from
19to22. - Adds npm hardening config (
.npmrc) and expands Dependabot configuration to include npm (plus new cooldown settings).
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| scripts/netlify-deploy-production.sh | Uses npm ci for deterministic production installs during Netlify builds. |
| scripts/netlify-deploy-preview.sh | Uses npm ci for deterministic deploy-preview installs. |
| scripts/netlify-branch-deploy.sh | Uses npm ci for deterministic branch-deploy installs. |
| scripts/local-server.sh | Uses npm ci for deterministic local Netlify CLI dev installs. |
| netlify.toml | Sets Netlify build Node version to 22. |
| Makefile | Changes bundle target to use npm ci. |
| .npmrc | Adds npm install hardening settings (release age gate, disable scripts, block git deps). |
| .github/dependabot.yml | Adds npm updates configuration and cooldown settings. |
lbarry316
approved these changes
Jun 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Version
These are changes for Chef Workstation versions:
Definition of done
Issues resolved
Related PRs
Checklist