You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Sep 17, 2023. It is now read-only.
This commit removes hard-coded use of `lerna bootstrap`'s
`--force-local`[^1] command, so that monorepos that don't want to
opt in to this behavior are not forced to.
For projects that wish to include the `--force-local` flag on every
invocation to `lerna bootstrap`, perhaps to prevent dependency
confusion attacks, we recommend specifying this in the lerna
manifest. For example, your lerna.json could look like
```
{
"packages": [
"packages/*"
],
"command": {
"bootstrap": {
"forceLocal": true
}
}
}
```
To prevent the case where a project was expecting `--force-local`
to be applied, but not specifying this in the configuration file,
we consider this a breaking change.
[^1]: https://github.com/lerna/lerna/blob/main/commands/bootstrap/README.md#--force-local
BREAKING CHANGE: do not specify `--force-local` in makefiles generated by `make-depend`
0 commit comments