Merge pull request #91 from privilegedescalation/fix/npm-audit-missing-lockfile

fix(ci): generate npm lockfile before running npm audit
2026-04-15 01:35:08 +00:00
parent aadb9e483c 3b7d582d5e
commit 521506cf1d
1 changed files with 3 additions and 2 deletions
@@ -169,6 +169,7 @@ jobs:

      - name: Security audit
        run: |
-          # npm retired the audit endpoint pnpm uses. Use npm's audit for both
-          # package managers to avoid 410 errors.
+          # npm retired the pnpm audit endpoint (410). Use npm audit instead.
+          # pnpm projects don't have package-lock.json, so generate one first.
+          npm install --package-lock-only --ignore-scripts --quiet
          npm audit --omit=dev