CI installs with npm 10, so the allowScripts denials from #2712 do not apply there
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 48/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- github-actions, node.js, typescript
调研方向
Start with .github/workflows/main.yml and inspect the build, coverage, and package jobs that run npm install; compare their setup with the publish job’s pinned npm step. Check AGENTS.md for the exact pin rules and confirm the chosen npm version supports Node 22. Done when every dependency-installing job uses npm 11.19 or later and the affected CI jobs pass without lockfile or peer resolution issues.
由索引模型根据 Issue 内容生成。
描述
Problem
#2712 denies the esbuild and fsevents install scripts through allowScripts in each v2 install. npm reads that policy only from 11.19 on. The build, coverage and package jobs in .github/workflows/main.yml use Node 22's bundled npm (10.x) and run npm install with it, so CI still runs both scripts. Copilot raised this on PR #2714.
The verify:install-scripts guard from #2712 reads lockfiles, so it enforces the review decision in CI regardless of npm version. What CI doesn't get is the blocking itself.
Proposed change
Before dependency installation, run npm >= 11.19 in every job that installs dependencies. For example, an exact-pinned npm install -g --ignore-scripts npm@<x.y.z> step, as the publish job already does for OIDC (#2483). Things to check:
- Whether an exact pin should follow the credentialed-job rules in AGENTS.md (#2484). The
packagejob builds an artifact that a credentialed job downloads. - Node 22's floor against the chosen npm version.
- Whether CI on npm 11 then fails on anything else (lockfile format, peer resolution).
Scoring
Severity 2 (CI behaves as it does today; the scripts are not malicious, only unneeded) + urgency 2 + milestone 1 = 5 → Low.
- 主要语言
- TypeScript
- 星标
- 11.1k
- 派生
- 1.5k
- 平均合并
- 4 小时 14 分钟
- 30 天内合并 PR
- 162
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
modelcontextprotocol/inspector 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 72/100
modelcontextprotocol/inspector#2723 ·
维护者通常 1 天内回复
-
Modern subscriptions: a subscriptions/listen refused with HTTP 403 is retried eight times in silence未关闭bug v2
难度 4/5 3-5 天 新手友好度 30/100
modelcontextprotocol/inspector#2722 · 1 条评论 ·
维护者通常 1 天内回复
-
bug v2
难度 3/5 1-2 天 新手友好度 50/100
modelcontextprotocol/inspector#2721 · 2 条评论 ·
维护者通常 1 天内回复
-
bug v2
难度 3/5 半天 新手友好度 62/100
modelcontextprotocol/inspector#2719 ·
维护者通常 1 天内回复
-
enhancement v2
难度 5/5 一周以上 新手友好度 35/100
modelcontextprotocol/inspector#2705 ·
维护者通常 1 天内回复
查看 modelcontextprotocol/inspector 的全部 Issue
相似的 Issue
-
afk-ok area:data-quality importer size:S
难度 2/5 1-3 小时 新手友好度 74/100
enorm-labs/event-junkie#3301 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
one-zero-eight/apply-bot#39 ·
-
难度 2/5 1-3 小时 新手友好度 72/100
bigbluebutton/bbb-ui-components-react#108 ·
维护者通常 2 天内回复
-
area: app type: bug
难度 2/5 1-3 小时 新手友好度 70/100
ExpidetGames/code-reviewer#308 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复