Skip to content

fix(external): use safe npm install for dws#1033

Merged
jackwener merged 1 commit intomainfrom
issue-1026-dws-install
Apr 15, 2026
Merged

fix(external): use safe npm install for dws#1033
jackwener merged 1 commit intomainfrom
issue-1026-dws-install

Conversation

@jackwener
Copy link
Copy Markdown
Owner

Summary

  • change built-in dws auto-install from curl | sh to the official npm package
  • add a registry regression test so built-in install commands must remain shell-safe

Validation

  • node node_modules/vitest/vitest.mjs run src/external.test.ts
  • npm run typecheck

Context

Fixes #1026.

@jackwener jackwener force-pushed the issue-1026-dws-install branch from b3196db to 9776166 Compare April 15, 2026 04:11
@jackwener jackwener merged commit 9bcdaaa into main Apr 15, 2026
9 checks passed
@jackwener jackwener deleted the issue-1026-dws-install branch April 15, 2026 04:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: Failed to install 'dws': Install command contains unsafe shell operators and cannot be executed securely

1 participant