Refuse a node_modules at the plugins/ root, where it outranks the host's

2026-08-18 08:14:21 +02:00
parent 3f9787df48
commit 7d1f7750d3
5 changed files with 18 additions and 17 deletions
@@ -6,8 +6,7 @@ npm-debug.log
 *.log
 .DS_Store

-# A plugin author's pin setting, per README → Plugin dependencies. Nothing reads it at runtime, and
-# an .npmrc is where a private-registry token would sit — never bake one into a shipped image.
+# A plugin's .npmrc is where a private-registry token would sit — never in a shipped image.
 plugins/**/.npmrc

 e2e-tests/artifacts