fix(security): prepare for npm v12 breaking changes (#1072)

* chore(ci): bump e2e workflow Node to 24.12.0 and track NODE_VERSION via Renovate

Node 20 is EOL and will be unsupported by npm 12. Adds a Renovate custom
manager so all workflow NODE_VERSION pins receive update PRs.

* fix(security): disable dependency install scripts for all npm installs

Adopts npm v12's secure default today: every npm ci/install call site
(CI workflows, Dockerfile, Makefile, scripts, package.json pre-hooks)
now passes --ignore-scripts, and unrs-resolver's postinstall is
explicitly denied via allowScripts (it ships prebuilt binaries; the
script is only a fallback build). Verified: clean installs, frontend
build, type-check, and full unit suite all pass with scripts disabled.

---------

Co-authored-by: GitHub Actions <actions@github.com>

Author: Wikid82

.github/renovate.json

@@ -225,6 +225,19 @@
       "datasourceTemplate": "golang-version",
       "versioningTemplate": "semver"
     },
+    {
+      "customType": "regex",
+      "description": "Track NODE_VERSION in Actions workflows",
+      "managerFilePatterns": [
+        "/^\\.github/workflows/.*\\.yml$/"
+      ],
+      "matchStrings": [
+        "NODE_VERSION: ['\"]?(?<currentValue>[\\d\\.]+)['\"]?"
+      ],
+      "depNameTemplate": "node",
+      "datasourceTemplate": "node-version",
+      "versioningTemplate": "node"
+    },
     {
       "customType": "regex",
       "description": "Track GO_VERSION in Actions workflows",

.github/skills/test-e2e-playwright-coverage-scripts/run.sh

@@ -158,7 +158,7 @@ start_vite() {
     # Ensure dependencies are installed
     if [[ ! -d "node_modules" ]]; then
         log_info "Installing frontend dependencies..."
-        npm ci --silent
+        npm ci --silent --ignore-scripts
     fi
 
     # Start Vite in background with explicit port

.github/workflows/codecov-upload.yml

@@ -174,7 +174,7 @@ jobs:
 
       - name: Install dependencies
         working-directory: frontend
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Run frontend tests and coverage
         working-directory: ${{ github.workspace }}

.github/workflows/e2e-tests-split.yml

@@ -82,7 +82,7 @@ on:
   pull_request:
 
 env:
-  NODE_VERSION: '20'
+  NODE_VERSION: '24.12.0'
   GO_VERSION: '1.26.4'
   GOTOOLCHAIN: local
   DOCKERHUB_REGISTRY: docker.io
@@ -166,7 +166,7 @@ jobs:
 
       - name: Install dependencies
         if: steps.resolve-image.outputs.image_source == 'build'
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Set up Docker Buildx
         if: steps.resolve-image.outputs.image_source == 'build'
@@ -304,7 +304,7 @@ jobs:
           exit 1
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Install Playwright Chromium
         run: |
@@ -506,7 +506,7 @@ jobs:
           exit 1
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Install Playwright Chromium (required by security-tests dependency)
         run: |
@@ -716,7 +716,7 @@ jobs:
           exit 1
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Install Playwright Chromium (required by security-tests dependency)
         run: |
@@ -953,7 +953,7 @@ jobs:
           exit 1
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Install Playwright Chromium
         run: |
@@ -1191,7 +1191,7 @@ jobs:
           exit 1
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Install Playwright Chromium (required by security-tests dependency)
         run: |
@@ -1437,7 +1437,7 @@ jobs:
           exit 1
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Install Playwright Chromium (required by security-tests dependency)
         run: |

.github/workflows/quality-checks.yml

@@ -310,7 +310,7 @@ jobs:
 
       - name: Install dependencies
         working-directory: frontend
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Run frontend tests and coverage
         id: frontend-tests

.github/workflows/release-goreleaser.yml

@@ -62,7 +62,7 @@ jobs:
           # Inject version into frontend build from tag (if present)
           VERSION=${GITHUB_REF#refs/tags/}
           echo "VITE_APP_VERSION=${VERSION}" >> "$GITHUB_ENV"
-          npm ci
+          npm ci --ignore-scripts
           npm run build
 
       - name: Install Cross-Compilation Tools (Zig)

Dockerfile

@@ -118,7 +118,7 @@ RUN apk upgrade --no-cache && \
 # hadolint ignore=DL3059
 RUN npm install -g picomatch@4.0.4 --no-fund --no-audit
 
-RUN npm ci
+RUN npm ci --ignore-scripts
 
 # Copy frontend source and build
 COPY frontend/ ./

Makefile

@@ -31,7 +31,7 @@ install:
 	@echo "Installing backend dependencies..."
 	cd backend && go mod download
 	@echo "Installing frontend dependencies..."
-	cd frontend && npm install
+	cd frontend && npm install --ignore-scripts
 
 # Install Go development tools
 install-tools:

frontend/package.json

@@ -10,15 +10,15 @@
   "scripts": {
     "dev": "vite",
     "build": "tsc -p tsconfig.build.json && vite build",
-    "pretype-check": "npm ci --silent",
+    "pretype-check": "npm ci --silent --ignore-scripts",
     "type-check": "tsc --noEmit",
     "lint": "eslint . --report-unused-disable-directives",
     "preview": "vite preview",
     "test": "NODE_OPTIONS=--max-old-space-size=4096 vitest run",
     "test:ci": "NODE_OPTIONS=--max-old-space-size=4096 vitest run",
     "test:ui": "vitest --ui",
     "check-coverage": "bash ../scripts/frontend-test-coverage.sh",
-    "pretest:coverage": "npm ci --silent && node -e \"require('fs').mkdirSync('coverage/.tmp', { recursive: true })\"",
+    "pretest:coverage": "npm ci --silent --ignore-scripts && node -e \"require('fs').mkdirSync('coverage/.tmp', { recursive: true })\"",
     "test:coverage": "NODE_OPTIONS=--max-old-space-size=4096 vitest run --coverage",
     "e2e:install": "npx playwright install --with-deps",
     "e2e:test": "playwright test",
@@ -114,5 +114,8 @@
     "@vitejs/plugin-react": {
       "vite": "^8.0.16"
     }
+  },
+  "allowScripts": {
+    "unrs-resolver": false
   }
 }

scripts/frontend-test-coverage.sh

@@ -19,7 +19,7 @@ RUN_COVERAGE_DIR="coverage/.run-${PPID}-$$-$(date +%s)"
 cd "$FRONTEND_DIR"
 
 # Ensure dependencies are installed for CI runs
-npm ci --silent
+npm ci --silent --ignore-scripts
 
 # Ensure coverage output directories exist
 mkdir -p "$CANONICAL_COVERAGE_DIR"