From e46822ea6f4a954c0522541322c1a64c26ee8414 Mon Sep 17 00:00:00 2001 From: Nat Dean-Lewis Date: Wed, 5 Aug 2026 10:37:45 +0100 Subject: [PATCH] feat: disable yarn lifecycle scripts by default for security --- .yarnrc | 1 + CLAUDE.md | 2 ++ 2 files changed, 3 insertions(+) create mode 100644 .yarnrc diff --git a/.yarnrc b/.yarnrc new file mode 100644 index 000000000..5455c6c5d --- /dev/null +++ b/.yarnrc @@ -0,0 +1 @@ +ignore-scripts true diff --git a/CLAUDE.md b/CLAUDE.md index 841257b42..0b9b87e5d 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -44,6 +44,8 @@ yarn prettier . --check # --write to autocorrect Database: `bundle exec rake db:create db:migrate db:seed`. Seeded users use the password from `REVIEW_APP_USER_PASSWORD` in `.env` (default `password`). +`.yarnrc` sets `ignore-scripts true` — a supply-chain safeguard disallowing `preinstall`/`postinstall`/etc. lifecycle scripts for any yarn-installed package. Don't remove it, and avoid adding dependencies that require install-time scripts to function. + ## Architecture ### The form system (core abstraction)