Skip to content

Conversation

@jdmarshall
Copy link
Collaborator

While npmjs.org is trying to take important steps to reduce supply chain attacks, working with, or indeed on, other people's OSS projects is still a bit fraught at the moment.

While dev containers are really meant for more elaborate workflows, a barebones implementation seems to be pretty okay for isolating npm install from having access to things it should not have access to.

@jdmarshall jdmarshall force-pushed the devcontainer branch 3 times, most recently from d65a553 to 1f6f8c4 Compare January 22, 2026 03:13
@@ -0,0 +1,3 @@
FROM node:24.6-trixie-slim
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we avoid fixing a semver-minor version? What about node:24-alpine only?

Copy link
Collaborator Author

@jdmarshall jdmarshall Jan 28, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not with the outstanding issue with commandline flags and tests.

Copy link
Owner

@RafaelGSS RafaelGSS left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should rebase and keep only the devcontainer.json changes. Feel free to land it once you remove the two unrelated commit.

Also 24.6 is the last node version that honors the nodejs CLI flags.
@jdmarshall
Copy link
Collaborator Author

I could have sworn you merged that other commit. Weird.

@jdmarshall jdmarshall merged commit 96575ff into RafaelGSS:main Feb 2, 2026
6 of 7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants