SK-2839: harden against npm supply chain attacks — pin deps and add --ignore-scripts to CI

.github/workflows/CI.yml

@@ -29,7 +29,7 @@ jobs:
           node-version: 14.21.3
 
       - name: install node_modules
-        run: npm install
+        run: npm install --ignore-scripts
 
       - name: Run spellcheck
         run: npm run spellcheck

.github/workflows/beta-release.yml

@@ -19,7 +19,7 @@ jobs:
         with:
           node-version: 14.21.3
           registry-url: 'https://registry.npmjs.org'
-      - run: npm install
+      - run: npm install --ignore-scripts
 
       - name: Build
         run: npm run build

.github/workflows/internal-release.yml

@@ -24,7 +24,7 @@ jobs:
         with:
           node-version: 14.21.3
 
-      - run: npm install
+      - run: npm install --ignore-scripts
 
       - name: Get Previous tag
         id: previoustag

.github/workflows/main.yml

@@ -15,7 +15,7 @@ jobs:
           node-version: 14.21.3
 
       - name: install node_modules
-        run: npm install
+        run: npm install --ignore-scripts
 
       - name: Run tests
         run: npm run test

.github/workflows/release.yml

@@ -23,7 +23,7 @@ jobs:
 
 
       - name: install modules
-        run: npm install
+        run: npm install --ignore-scripts
 
       - name: Get Previous tag
         id: previoustag

package.json

@@ -42,28 +42,28 @@
   "author": "Skyflow",
   "license": "MIT",
   "devDependencies": {
-    "@arkweid/lefthook": "^0.7.7",
-    "@babel/eslint-parser": "^7.18.2",
-    "@commitlint/config-conventional": "^17.0.2",
-    "@react-native-community/eslint-config": "^3.0.2",
-    "@testing-library/react-native": "^11.3.0",
-    "@types/jest": "^28.1.2",
-    "@types/lodash": "^4.14.185",
-    "@types/react": "~17.0.21",
+    "@arkweid/lefthook": "0.7.7",
+    "@babel/eslint-parser": "7.25.9",
+    "@commitlint/config-conventional": "17.8.1",
+    "@react-native-community/eslint-config": "3.2.0",
+    "@testing-library/react-native": "11.5.4",
+    "@types/jest": "28.1.8",
+    "@types/lodash": "4.17.13",
+    "@types/react": "17.0.21",
     "@types/react-native": "0.68.0",
-    "commitlint": "^17.0.2",
+    "commitlint": "17.8.1",
     "cspell": "4.2.8",
-    "eslint": "^8.4.1",
-    "eslint-config-prettier": "^8.5.0",
-    "eslint-plugin-prettier": "^4.0.0",
-    "jest": "^28.1.1",
-    "pod-install": "^0.1.0",
-    "prettier": "^2.0.5",
+    "eslint": "8.57.1",
+    "eslint-config-prettier": "8.10.0",
+    "eslint-plugin-prettier": "4.2.1",
+    "jest": "28.1.3",
+    "pod-install": "0.1.39",
+    "prettier": "2.8.8",
     "react": "18.0.0",
-    "react-native": "^0.71.19",
-    "react-native-builder-bob": "^0.18.3",
-    "react-test-renderer": "^18.2.0",
-    "typescript": "^4.5.2"
+    "react-native": "0.71.19",
+    "react-native-builder-bob": "0.18.3",
+    "react-test-renderer": "18.3.1",
+    "typescript": "4.9.5"
   },
   "resolutions": {
     "@types/react": "17.0.21",
@@ -133,9 +133,9 @@
     ]
   },
   "dependencies": {
-    "jwt-decode": "^3.1.2",
-    "lodash": "^4.17.21",
-    "react-native-uuid": "^2.0.1",
-    "set-value": "^4.1.0"
+    "jwt-decode": "3.1.2",
+    "lodash": "4.17.21",
+    "react-native-uuid": "2.0.3",
+    "set-value": "4.1.0"
   }
 }