fix: Expressly forbid deep imports through captp, far, lockdown, marshal

endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES

Apache License 2.0

804 stars 71 forks source link

fix: Expressly forbid deep imports through captp, far, lockdown, marshal #1907

Closed kriskowal closed 9 months ago

kriskowal commented 9 months ago

To limit exposure to Hyrum’s Law, this change introduces an "exports" property to the four packages in Endo that currently lack one. Node.js 16+ and Endo’s bundler forbid deep imports to modules not expressly mentioned in "exports".