Merge pull request #411 from NodeSecure/security-maintenance

Security maintenance

Author: fraxken

.github/dependabot.yml

@@ -5,6 +5,8 @@ updates:
     versioning-strategy: widen
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 5
     groups:
       dependencies:
         dependency-type: "production"
@@ -14,6 +16,8 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 5
     groups:
       github-actions:
         patterns:

.github/workflows/changesets.yml

@@ -22,7 +22,7 @@ jobs:
           node-version: 22
 
       - name: Install dependencies
-        run: npm install
+        run: npm install --ignore-scripts
 
       - name: Build monorepo
         run: npm run build --if-present

.github/workflows/node.js.yml

@@ -27,7 +27,7 @@ jobs:
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
-        run: npm install
+        run: npm install --ignore-scripts
       - name: Build typescript sources
         run: npm run build
       - name: Run tests

.npmrc

@@ -1 +1,3 @@
 package-lock=false
+save-exact=true
+ignore-scripts=true