From 0645ad6b3c19b14066cc266af449fb441dd82399 Mon Sep 17 00:00:00 2001
From: "securityeng-bot[bot]"
 <219863240+securityeng-bot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 15:52:23 +0000
Subject: [PATCH 1/2] ci: enforce ignore-scripts policy for Node package
 managers

---
 .npmrc | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .npmrc

diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..97b895e
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+ignore-scripts=true

From 75c75b4852924d1f61b57a7dd8264c5f6cc6324d Mon Sep 17 00:00:00 2001
From: "securityeng-bot[bot]"
 <219863240+securityeng-bot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 15:52:24 +0000
Subject: [PATCH 2/2] ci: enforce ignore-scripts policy for Node package
 managers

---
 Dockerfile | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/Dockerfile b/Dockerfile
index 40a2f39..a424b6b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -22,6 +22,7 @@ COPY tsconfig.json .
 
 # Refresh the lock file to be sure we include Linux-only packages that might not
 # be in the existing package-lock.json.
+COPY .npmrc .
 RUN npm install --package-lock-only \
     && npm ci
 
@@ -41,6 +42,7 @@ COPY --from=builder /app/package*.json ./
 COPY --from=builder /app/dist/ ./dist/
 
 # Install production dependencies only
+COPY .npmrc .
 RUN npm ci --omit=dev && npm cache clean --force
 
 # Set proper permissions