fix: Expressly forbid deep imports through captp, far, lockdown, marshal

endojs / endo

Endo is a distributed secure JavaScript sandbox, based on SES

Apache License 2.0

828 stars 72 forks source link

fix: Expressly forbid deep imports through captp, far, lockdown, marshal #1907

Closed kriskowal closed 10 months ago

kriskowal commented 10 months ago

To limit exposure to Hyrum’s Law, this change introduces an "exports" property to the four packages in Endo that currently lack one. Node.js 16+ and Endo’s bundler forbid deep imports to modules not expressly mentioned in "exports".