Bjørn Erik Pedersen a54c398b93 Harden Node tool execution with --permission flag ...

Add security.node.permissions config to run Node tools (PostCSS, Babel,
TailwindCSS) under Node's permission model, restricting file system access
to the working directory by default.

The binary resolution is simplified to node_modules/.bin → PATH (npx removed).
For both locations, the actual JS entry point is resolved via symlinks (macOS/Linux)
or by parsing npm wrapper scripts (Windows .cmd), then executed as
"node --permission --allow-fs-read=<path> --allow-fs-write=<path> <script>".

Users can opt out by removing "node" from security.exec.allow.

Closes #7287

2026-04-22 15:47:34 +02:00

..

deps_test.go

Create a struct with all of Hugo's config options

2023-05-16 18:01:29 +02:00

deps.go

Harden Node tool execution with --permission flag

2026-04-22 15:47:34 +02:00