Preparing for release 13.20.0 (automated).

[36degrees]

New features

When you install plugins using the 'Manage prototype' page or install other dependencies using the npm command:

• npm scripts will no longer be run for the installed plugins or dependencies
• you will not be able to install plugins or dependencies using Git references if you're using npm v11.10.0 or later
  This only applies to new prototypes created using npx govuk-prototype-kit@latest create.
  To protect existing prototypes, add the following lines to the .npmrc file in your prototype:

ignore-scripts=true
allow-git=none

We've made these changes to help protect Prototype Kit users against supply chain attacks, where malicious code is included in a dependency.
It's still possible for dependencies to execute malicious code. Make sure you only install dependencies from trusted sources.
#2519: Disable npm scripts and installing from git dependencies by default for new prototypes

Fixes

• #2516: Update immutable
• #2518: Only fetch plugin package info from NPM when needed – thanks to @RichardBradley for reporting this issue and contributing a fix
• #2524: Update brace-expansion, path-to-regexp, picomatch, socket.io-parser, lodash and other dev dependencies