[theofidry]

The following settings are quite standard to provide a bit of a better security when working on node projects. Nonetheless, they may not be known by everyone so the following description is a Codex explanation for more details of the why for each settings.

Description

The website builds in CI with Node 24, but local installs currently accept other Node and npm versions and can resolve conflicting peer dependencies with a warning. Contributors can therefore commit a dependency tree that behaves differently in CI. The project now requires Node 24 and npm ^11.10.0 || ^12.0, rejects peer dependency conflicts, and provides an .nvmrc so contributors can select the matching Node version with nvm use.

Dependency updates also expose contributors and the build environment to code from newly published packages. Even established packages have been compromised: an unauthorised eslint-scope 3.7.2 release stole npm authentication tokens, and three compromised ua-parser-js releases contained malware. The 21-day minimum release age gives maintainers and security researchers time to detect and remove malicious releases before dependency updates select them. This reduces exposure to newly published malware, but doesn't establish that an older release is safe. Urgent fixes may need an explicit exception to the delay.

Git dependencies allow packages to be installed directly from repositories, outside published registry releases. For example, a dependency can point to a GitHub branch. Before packaging it, npm can install the repository's dependencies and dev dependencies and run its prepare script (npm install documentation). A malicious prepare script could read credentials from the build environment. allow-git=none blocks direct and transitive Git dependencies, removing this installation path from the website.

Contributors can run nvm use && npm ci to install with the declared Node version. The project previously had no engine requirement to reject an install under Node 22. It now fails with EBADENGINE because Node 22 doesn't meet the declared requirement.

Changes

• engine-strict=true enforces the Node ^24.0.0 and npm ^11.10.0 || ^12.0 requirements. npm 11.10.0 is the earliest release supporting all four settings: npm's changelog records the addition of allow-git in 11.9.0 and min-release-age in 11.10.0. npm is declared as the package manager, and the lockfile records the same engine ranges.
• strict-peer-deps=true turns peer dependency conflicts into installation failures instead of allowing npm to guess a resolution.
• min-release-age=21 delays selection of new dependency releases, while allow-git=none prevents dependencies from being fetched and installed from Git references (npm configuration reference).