Skip to content

Remove NPM and use git submodules #86

Open
brickpop wants to merge 8 commits intomainfrom
f/wipe-npm
Open

Remove NPM and use git submodules #86
brickpop wants to merge 8 commits intomainfrom
f/wipe-npm

Conversation

@brickpop
Copy link
Copy Markdown
Contributor

@brickpop brickpop commented Mar 31, 2026

  • NPM is not a solidity package manager
  • NPM/Yarn allow for arbitrary code execution on packages with postInstall scripts, only skipped by a flag that is trivial to forget
  • Some testing scripts were using FFI (for some reason)

This PR:

  • Eliminates NPM everywhere possible
    • npm-artifacts is kept for obvious reasons
  • Adds just-foundry as the task+environment runner

Other:

  • Avoids FFI completely
  • Removing unrestricted write permission of solidity files to the project root
  • Pins versions to an explicit, specific commit ID
  • Removes unnecessary and convoluted multi-layer dependencies
  • Removes scripts that are unusable, by design

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants