Refuse a node_modules at the plugins/ root, where it outranks the host's

2026-08-18 08:14:21 +02:00
parent 82af77356f
commit cb59eee76d
5 changed files with 18 additions and 17 deletions
@@ -6,8 +6,7 @@ npm-debug.log
 *.log
 .DS_Store

-# A plugin author's pin setting, per README → Plugin dependencies. Nothing reads it at runtime, and
-# an .npmrc is where a private-registry token would sit — never bake one into a shipped image.
+# A plugin's .npmrc is where a private-registry token would sit — never in a shipped image.
 plugins/**/.npmrc

 e2e-tests/artifacts