Pin dependency policy exceptions to versions

2026-08-27 12:51:53 +01:00
parent f28b9ee87d
commit 8098495abf
10 changed files with 125 additions and 27 deletions
@@ -36,7 +36,9 @@ export async function verifyDirectPackage(item, document, policy, dependencies)
  }

  const lifecycle = ["preinstall", "install", "postinstall"].filter((name) => versionData.scripts?.[name]);
-  if (lifecycle.length && !policy.allowDirectLifecycleScripts.includes(item.name)) {
+  const lifecycleException = policy.allowDirectLifecycleScripts[item.name];
+  const lifecycleAllowed = lifecycleException?.versions.includes(item.version) && Date.parse(lifecycleException.expiresAt) > dependencies.now();
+  if (lifecycle.length && !lifecycleAllowed) {
    failures.push(`direct package declares lifecycle hook(s): ${lifecycle.join(", ")}`);
  }