Skip to content

Remove NPM and use git submodules #86

Merged
brickpop merged 10 commits intomainfrom
f/wipe-npm
Apr 10, 2026
Merged

Remove NPM and use git submodules #86
brickpop merged 10 commits intomainfrom
f/wipe-npm

Conversation

@brickpop
Copy link
Copy Markdown
Contributor

@brickpop brickpop commented Mar 31, 2026

  • NPM is not a solidity package manager
  • NPM/Yarn allow for arbitrary code execution on packages with postInstall scripts, only skipped by a flag that is trivial to forget
  • Some testing scripts were using FFI (for some reason)

This PR:

  • Eliminates NPM everywhere possible
    • npm-artifacts is kept for obvious reasons
  • Adds just-foundry as the task+environment runner

Other:

  • Avoids FFI completely
  • Removing unrestricted write permission of solidity files to the project root
  • Pins versions to an explicit, specific commit ID
  • Removes unnecessary and convoluted multi-layer dependencies
  • Removes scripts that are unusable, by design

cristianizzo
cristianizzo previously approved these changes Apr 7, 2026
@brickpop brickpop merged commit 6d56b9e into main Apr 10, 2026
5 checks passed
@brickpop brickpop deleted the f/wipe-npm branch April 10, 2026 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants