Ruben FiszelandClaude Opus 5.5 6646c86351 fix: run bun and npm installs under nsjail sandboxing (#11845) ...

* fix: pass --save-text-lockfile only to bun installs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: run bun and npm installs under nsjail sandboxing

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: mount npmrc cafile paths given with ${VAR} or ~ in the install jail

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* perf: keep bun's cache hardlinks for jailed installs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: harden the bun install staging dir and npm-mode jail mounts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: reach the bun staging dir only through no-follow descriptors

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: create bun staging files new and check outputs after the move

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: add DISABLE_BUN_INSTALL_SANDBOX to run bun installs unjailed

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-17 09:59:33 +00:00

..

examples

fix: enrich OTEL log records with per-request LogContext (#8812)

2026-04-13 21:50:50 +00:00

src

fix: run bun and npm installs under nsjail sandboxing (#11845)

2026-10-17 09:59:33 +00:00

tests

feat: let operators compose full-code apps when the workspace grants it (#11229)

2026-10-09 19:31:36 +02:00

Cargo.toml

fix: let ALLOW_PRIVATE_AI_BASE_URLS name the private hosts it allows (#11841)

2026-10-17 08:36:22 +00:00