René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Manage npm packages used in workflows","articleBody":"## What would you like?\n\nAdd an npm [private](https://docs.npmjs.com/cli/v11/configuring-npm/package-json#private) (non-publishable) [package.json](https://docs.npmjs.com/cli/v11/configuring-npm/package-json) to allow managing and pinning npm dependencies used in GitHub Actions workflows.\n\n## Why is this needed?\n\nBest practices for GitHub repos have evolved in the face of supply-chain attacks, and favor pinning dependencies instead of allowing `latest` or SemVer ranges.\n\n[Code-scanning alerts](https://github.com/nodejs/docker-node/security/code-scanning) for the repo, report \"Pinned-Dependencies\" for three GitHub Actions [.github/workflows](https://github.com/nodejs/docker-node/tree/main/.github/workflows):\n\n| Workflow                                                                                                             | npm Package                                                         |\n| -------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------- |\n| [doctoc.yml](https://github.com/nodejs/docker-node/blob/main/.github/workflows/doctoc.yml)                           | [doctoc](https://www.npmjs.com/package/doctoc)                      |\n| [eclint.yml](https://github.com/nodejs/docker-node/blob/main/.github/workflows/eclint.yml)                           | [eclint](https://www.npmjs.com/package/eclint)                      |\n| [markdown-link-check.yml](https://github.com/nodejs/docker-node/blob/main/.github/workflows/markdown-link-check.yml) | [markdown-link-check@3.14.2](npmjs.com/package/markdown-link-check) |\n\n## Other\n\nPR https://github.com/nodejs/docker-node/pull/2570 proposes to replace `eclint` with `prettier`. In this case, `prettier` would be added to the `package.json` instead of `eclint`.","author":{"url":"https://github.com/MikeMcC399","@type":"Person","name":"MikeMcC399"},"datePublished":"2026-07-20T17:15:32.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":3},"url":"https://github.com/2571/docker-node/issues/2571"}