diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 51aa7cc7..add5fa88 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -178,12 +178,16 @@ yarn upgrade-interactive ``` Install scripts are disabled by default (`enableScripts: false` in `.yarnrc.yml`), so a -compromised dependency cannot run code just by being installed. Packages that genuinely need -to build something at install time are opted in individually under `dependenciesMeta` in -`package.json`. +compromised dependency cannot run code just by being installed. No package currently needs an +exception. -If an install prints `YN0004: lists build scripts, but all build scripts have been -disabled`, decide whether that package really needs to build. If it does, add it: +Installs print `YN0004: lists build scripts, but all build scripts have been +disabled` for packages whose scripts were skipped. That warning is not by itself a problem — +most install scripts in modern packages are no-ops that only matter when a prebuilt native +binary is missing, and some are explicitly skipped under Yarn anyway. Before granting an +exception, read the script and check whether the package actually works without it. + +If it genuinely needs to build, opt that one package in: ```json "dependenciesMeta": { @@ -191,8 +195,9 @@ disabled`, decide whether that package really needs to build. If it does, add it } ``` -Ignoring the warning leaves the package unbuilt, which usually surfaces later as a confusing -runtime failure rather than an install error. +Prefer verifying over granting: a package that silently fails to build usually surfaces as a +confusing runtime error, but a blanket `enableScripts: true` gives every dependency in the +tree the right to execute code at install time. ### i18n strings / Weblate diff --git a/package.json b/package.json index 9c87e810..93037d19 100644 --- a/package.json +++ b/package.json @@ -161,17 +161,6 @@ "yargs-parser": "^22.0.0", "zod": "^4.4.3" }, - "dependenciesMeta": { - "@parcel/watcher": { - "built": true - }, - "@swc/core": { - "built": true - }, - "esbuild": { - "built": true - } - }, "build": { "toolsets": { "appimage": "1.0.3" diff --git a/yarn.lock b/yarn.lock index 0ca38453..92eca2f7 100644 --- a/yarn.lock +++ b/yarn.lock @@ -9957,13 +9957,6 @@ __metadata: yargs: "npm:^18.0.0" yargs-parser: "npm:^22.0.0" zod: "npm:^4.4.3" - dependenciesMeta: - "@parcel/watcher": - built: true - "@swc/core": - built: true - esbuild: - built: true languageName: unknown linkType: soft