chore: Avoid running postinstall scripts #13830
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
These are a security risk, let's not run them if not needed This might not work because yarn 1 doesn't let us choose what dependencies are allowed to run postinstall scripts. We'll need to migrate to pnpm if we fail to build the app with these changes.
yarn is very hard to make it safe after today's supply chain attack, let's use pnpm - same as our main repo
This worked when using yarn because a dependency installed this, but this stopped working when using pnpm because it installs files in different places
We were previously using yarn and on yarn you can require transitive dependencies because files are installed like this ``` node_modules | node | posthog-js | posthog-js-dependency-i-can-require ``` on pnpm, on the other hand, they're nested, which means we cannot require dependencies we didn't install - which is much saner This meant we had to install more packages than before to get this to work
rafaeelaudibert
force-pushed
the
harden-posthog-com-no-postscript-installs
branch
from
8314cff to
3d72208
Compare
smallbrownbike
approved these changes
Nov 25, 2025
rafaeelaudibert
deleted the
harden-posthog-com-no-postscript-installs
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Let's migrate to pnpm to allow us to choose what scripts are run on
pre/postinstalland also add our newminimumReleaseAgeto avoid installing very recent packages