SK-2839: Pin dependency versions and add --ignore-scripts to harden against supply chain attacks

.github/workflows/common-ci.yml

@@ -17,7 +17,7 @@ jobs:
           node-version: '20.x'
 
       - name: Install Packages
-        run: npm install
+        run: npm install --ignore-scripts
 
       - name: Run ESLint
         run: npm run eslint

.github/workflows/common-release.yml

@@ -22,7 +22,7 @@ jobs:
           registry-url: "https://registry.npmjs.org"
 
       - name: Install Packages
-        run: npm install
+        run: npm install --ignore-scripts
 
       - name: Build
         run: npm run build

.github/workflows/contract-tests.yml

@@ -22,7 +22,7 @@ jobs:
           cache: 'npm'
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Verify API surface snapshot
         run: npm run contract-snapshot-verify

.npmrc

@@ -0,0 +1 @@
+ignore-scripts=true

package.json

@@ -35,44 +35,44 @@
     "tokenization"
   ],
   "dependencies": {
-    "@babel/runtime": "^7.27.1",
-    "dotenv": "^16.4.5",
-    "form-data": "^4.0.0",
-    "form-data-encoder": "^4.0.2",
-    "formdata-node": "^6.0.3",
+    "@babel/runtime": "7.29.2",
+    "dotenv": "16.6.1",
+    "form-data": "4.0.5",
+    "form-data-encoder": "4.1.0",
+    "formdata-node": "6.0.3",
     "js-base64": "3.7.7",
-    "jsonwebtoken": "^9.0.3",
-    "jwt-decode": "^3.1.2",
-    "node-fetch": "^2.7.0",
-    "qs": "^6.14.1",
-    "readable-stream": "^4.5.2",
+    "jsonwebtoken": "9.0.3",
+    "jwt-decode": "3.1.2",
+    "node-fetch": "2.7.0",
+    "qs": "6.15.1",
+    "readable-stream": "4.7.0",
     "url-join": "4.0.1"
   },
   "devDependencies": {
-    "@microsoft/api-extractor": "^7.58.5",
-    "@babel/plugin-proposal-decorators": "^7.25.7",
-    "@babel/plugin-transform-object-assign": "^7.25.7",
-    "@babel/plugin-transform-runtime": "^7.25.7",
-    "@babel/preset-env": "^7.25.8",
-    "@babel/preset-typescript": "^7.25.7",
-    "@eslint/js": "^9.39.2",
-    "@types/jest": "^29.5.14",
-    "@types/jsonwebtoken": "^9.0.6",
-    "@types/node": "^18.19.70",
-    "@types/node-fetch": "^2.6.12",
-    "@types/qs": "^6.9.17",
-    "@types/readable-stream": "^4.0.18",
+    "@microsoft/api-extractor": "7.58.7",
+    "@babel/plugin-proposal-decorators": "7.29.0",
+    "@babel/plugin-transform-object-assign": "7.27.1",
+    "@babel/plugin-transform-runtime": "7.29.0",
+    "@babel/preset-env": "7.29.5",
+    "@babel/preset-typescript": "7.28.5",
+    "@eslint/js": "9.39.4",
+    "@types/jest": "29.5.14",
+    "@types/jsonwebtoken": "9.0.10",
+    "@types/node": "18.19.130",
+    "@types/node-fetch": "2.6.13",
+    "@types/qs": "6.15.1",
+    "@types/readable-stream": "4.0.23",
     "@types/url-join": "4.0.1",
-    "cspell": "^9.3.1",
-    "eslint": "^9.39.2",
-    "globals": "^16.5.0",
-    "jest": "^29.7.0",
-    "jest-environment-jsdom": "^29.7.0",
+    "cspell": "9.8.0",
+    "eslint": "9.39.4",
+    "globals": "16.5.0",
+    "jest": "29.7.0",
+    "jest-environment-jsdom": "29.7.0",
     "prettier": "3.6.2",
-    "ts-jest": "^29.1.1",
-    "ts-loader": "^9.5.1",
-    "typescript": "~5.7.2",
-    "typescript-eslint": "^8.50.0",
-    "webpack": "^5.97.1"
+    "ts-jest": "29.4.9",
+    "ts-loader": "9.5.7",
+    "typescript": "5.7.3",
+    "typescript-eslint": "8.59.3",
+    "webpack": "5.106.2"
   }
 }