Merge pull request #148 from sillsdev/supplyChainHardening

chore(deps): enforce dependency-safety policy via .npmrc

Author: hatton

.npmrc

@@ -0,0 +1,25 @@
+# Dependency-safety policy (requires npm >= 11.17.0; see volta/engines in package.json)
+
+# 0. Refuse to run on an npm too old to honor the keys below (engines.npm in
+#    package.json requires >=11.17.0). Without this, an old npm silently
+#    ignores the entire policy.
+engine-strict=true
+
+# 1. Pin: write exact versions, never ^ or ~ ranges, on `npm install <pkg>`.
+save-exact=true
+
+# 2. Age: only install versions that have been published for more than 7 days.
+#    Guards against compromised/yanked brand-new releases.
+min-release-age=7
+
+# 3. Install scripts: deny by default; hard-fail on any non-allowlisted script.
+#    The allowlist itself lives in the "allowScripts" field of package.json
+#    (npm rejects allow-scripts in .npmrc for project-scoped installs).
+strict-allow-scripts=true
+
+# 4. Sources: only allow registry installs. No git/url/tarball deps; directory
+#    (workspace) deps permitted only from the repo root.
+allow-git=none
+allow-remote=none
+allow-file=root
+allow-directory=root

components/language-chooser/common/find-language/package.json

@@ -25,13 +25,13 @@
     "lint": "eslint ."
   },
   "dependencies": {
-    "fuse.js": "^7.0.0",
-    "iso-15924": "^3.2.0",
-    "iso-3166": "^4.3.0"
+    "fuse.js": "7.1.0",
+    "iso-15924": "3.2.0",
+    "iso-3166": "4.3.0"
   },
   "devDependencies": {
-    "@types/node": "^20.16.11",
-    "tsx": "^4.19.2"
+    "@types/node": "20.19.37",
+    "tsx": "4.20.5"
   },
   "volta": {
     "extends": "../../../../package.json"

components/language-chooser/common/language-chooser-controller/package.json

@@ -23,8 +23,8 @@
     "@ethnolib/state-management-core": "0.2.2"
   },
   "devDependencies": {
-    "@types/node": "^20.16.11",
-    "tsx": "^4.19.2"
+    "@types/node": "20.19.37",
+    "tsx": "4.20.5"
   },
   "volta": {
     "extends": "../../../../package.json"

components/language-chooser/react/common/language-chooser-react-hook/package.json

@@ -24,16 +24,16 @@
   },
   "dependencies": {
     "@ethnolib/find-language": "0.3.2",
-    "fuse.js": "^7.0.0",
-    "iso-15924": "^3.2.0",
-    "iso-3166": "^4.3.0"
+    "fuse.js": "7.1.0",
+    "iso-15924": "3.2.0",
+    "iso-3166": "4.3.0"
   },
   "devDependencies": {
-    "@types/lodash": "^4.17.7",
-    "@types/react": "^17",
-    "@types/react-dom": "^17",
-    "@vitejs/plugin-react-swc": "^3.8.0",
-    "vite-plugin-dts": "^4.2.1"
+    "@types/lodash": "4.17.20",
+    "@types/react": "17.0.88",
+    "@types/react-dom": "17.0.26",
+    "@vitejs/plugin-react-swc": "3.11.0",
+    "vite-plugin-dts": "4.5.4"
   },
   "volta": {
     "extends": "../../../../../package.json"

components/language-chooser/react/language-chooser-react-mui/package.json

@@ -30,26 +30,26 @@
   "dependencies": {
     "@ethnolib/find-language": "0.3.2",
     "@ethnolib/language-chooser-react-hook": "0.3.2",
-    "lodash": "^4.17.21",
-    "react-lazyload": "^3.2.1",
-    "@mui/icons-material": "^5.15.19"
+    "lodash": "4.17.21",
+    "react-lazyload": "3.2.1",
+    "@mui/icons-material": "5.18.0"
   },
   "devDependencies": {
-    "@emotion/react": "^11.11.4",
-    "@emotion/styled": "^11.11.5",
-    "@mui/material": "^5.15.19",
-    "@storybook/addon-essentials": "^8.2.8",
-    "@storybook/core-server": "^8.2.8",
-    "@storybook/react-vite": "^8.2.8",
-    "@storybook/test-runner": "^0.19.1",
-    "@types/lodash": "^4.17.7",
-    "@types/react": "^17",
-    "@types/react-dom": "^17",
-    "@types/react-lazyload": "^3.2.3",
-    "react": "^17.0.2",
-    "react-dom": "^17.0.2",
-    "storybook": "^8.2.8",
-    "vite-plugin-dts": "^4.2.1"
+    "@emotion/react": "11.14.0",
+    "@emotion/styled": "11.14.1",
+    "@mui/material": "5.18.0",
+    "@storybook/addon-essentials": "8.6.18",
+    "@storybook/core-server": "8.6.18",
+    "@storybook/react-vite": "8.6.18",
+    "@storybook/test-runner": "0.19.1",
+    "@types/lodash": "4.17.20",
+    "@types/react": "17.0.88",
+    "@types/react-dom": "17.0.26",
+    "@types/react-lazyload": "3.2.3",
+    "react": "17.0.2",
+    "react-dom": "17.0.2",
+    "storybook": "8.6.18",
+    "vite-plugin-dts": "4.5.4"
   },
   "peerDependencies": {
     "@emotion/react": "^11.11.4",

components/language-chooser/svelte/language-chooser-svelte-daisyui/package.json

@@ -27,21 +27,21 @@
     "@ethnolib/state-management-svelte": "0.2.2"
   },
   "devDependencies": {
-    "@storybook/addon-essentials": "^8.2.8",
-    "@storybook/svelte-vite": "^8.2.8",
-    "@sveltejs/vite-plugin-svelte": "^4.0.0",
-    "@tailwindcss/postcss": "^4.1.13",
-    "@tailwindcss/typography": "^0.5.16",
-    "@tsconfig/svelte": "^5.0.0",
-    "autoprefixer": "^10.4.21",
-    "daisyui": "^5.1.12",
-    "eslint-plugin-svelte": "^2.44.0",
-    "postcss": "^8.5.6",
-    "storybook": "^8.2.8",
-    "svelte": "^5.38.6",
-    "svelte-check": "^4.0.5",
-    "svelte-preprocess": "^6.0.0",
-    "tailwindcss": "^3.4.17"
+    "@storybook/addon-essentials": "8.6.18",
+    "@storybook/svelte-vite": "8.6.18",
+    "@sveltejs/vite-plugin-svelte": "4.0.4",
+    "@tailwindcss/postcss": "4.1.13",
+    "@tailwindcss/typography": "0.5.16",
+    "@tsconfig/svelte": "5.0.5",
+    "autoprefixer": "10.4.21",
+    "daisyui": "5.1.12",
+    "eslint-plugin-svelte": "2.46.1",
+    "postcss": "8.5.6",
+    "storybook": "8.6.18",
+    "svelte": "5.53.11",
+    "svelte-check": "4.3.1",
+    "svelte-preprocess": "6.0.3",
+    "tailwindcss": "3.4.19"
   },
   "engines": {
     "node": ">=18.18"

components/state-management/state-management-core/package.json

@@ -19,9 +19,9 @@
     "lint": "eslint ."
   },
   "devDependencies": {
-    "@types/node": "^20.16.11",
-    "tsx": "^4.19.2",
-    "typescript": "^5.2.2"
+    "@types/node": "20.19.37",
+    "tsx": "4.20.5",
+    "typescript": "5.7.3"
   },
   "volta": {
     "extends": "../../../package.json"

components/state-management/state-management-react/package.json

@@ -26,14 +26,14 @@
     "react-dom": "^17.0.2"
   },
   "devDependencies": {
-    "@types/react": "^17",
-    "@types/react-dom": "^17",
-    "@types/node": "^20.16.11",
-    "react": "^17.0.2",
-    "react-dom": "^17.0.2",
-    "jsdom": "^26.0.0",
-    "tsx": "^4.19.2",
-    "typescript": "^5.2.2"
+    "@types/react": "17.0.88",
+    "@types/react-dom": "17.0.26",
+    "@types/node": "20.19.37",
+    "react": "17.0.2",
+    "react-dom": "17.0.2",
+    "jsdom": "26.1.0",
+    "tsx": "4.20.5",
+    "typescript": "5.7.3"
   },
   "volta": {
     "extends": "../../../package.json"

components/state-management/state-management-svelte/package.json

@@ -22,11 +22,11 @@
     "@ethnolib/state-management-core": "0.2.2"
   },
   "devDependencies": {
-    "@types/node": "^20.16.11",
-    "svelte": "^5.38.6",
-    "svelte-check": "^4.0.0",
-    "@sveltejs/vite-plugin-svelte": "^4.0.0",
-    "tsx": "^4.19.2"
+    "@types/node": "20.19.37",
+    "svelte": "5.53.11",
+    "svelte-check": "4.3.1",
+    "@sveltejs/vite-plugin-svelte": "4.0.4",
+    "tsx": "4.20.5"
   },
   "volta": {
     "extends": "../../../package.json"