Chore/pin npm exactly - #10

Merged

Radiergummi merged 3 commits into

mainfrom

chore/pin-npm-exactly

Jul 30, 2026

Commits on Jul 30, 2026

feat(security): make npm's bootstrap publish single-use by construction

Radiergummi
and
claude
committed
3d604b4
fix(release): pin the publish registry and derive the npm dist-tag

Radiergummi
and
claude
committed
06290ce
docs(security): document the placeholder bootstrap instead of a CI token

Radiergummi
and
claude
committed
d57cc54