refactor: simplify plugin dependency handling

Simplify plugin installation and runtime loading around package-manager-owned dependencies, with Jiti reserved for local/TS fallback paths.

Also scans npm plugin install roots so hoisted transitive dependencies are covered by dependency denylist and node_modules symlink checks.
This commit is contained in:
Peter Steinberger
2026-05-01 21:32:22 +01:00
committed by GitHub
parent 2e8e9cd6ca
commit ed8f50f240
294 changed files with 2562 additions and 25454 deletions

View File

@@ -142,6 +142,11 @@
"class": "default-runtime-initially",
"risk": ["provider-sdk", "network"]
},
"playwright-core": {
"owner": "core:browser",
"class": "core-runtime",
"risk": ["browser-automation", "cdp"]
},
"pdfjs-dist": {
"owner": "plugin:document-extract",
"class": "plugin-runtime",
@@ -158,11 +163,6 @@
"class": "default-runtime-initially",
"risk": ["terminal-rendering", "png-encoding"]
},
"semver": {
"owner": "core:package-versioning",
"class": "core-runtime",
"risk": ["version-parser"]
},
"sharp": {
"owner": "plugin:media-understanding-core",
"class": "plugin-runtime",