# Supply chain hardening (axios/litellm incidents, March 2026)
# Block postinstall scripts by default — allowlist exceptions below
ignore-scripts=true

# Pin exact versions on install (no ^ or ~ drift)
save-exact=true