By prudloff on
Change record status:
Published (View all published change records)
Project:
Introduced in branch:
11.5.x
Introduced in version:
11.5.0
Issue links:
Description:
Drupal's .htaccess now blocks HTTP access to package-lock.json, alongside the existing protection for package.json and yarn.lock.
Core uses Yarn and does not produce a package-lock.json itself. Contributed or custom themes and modules that use npm can have one.
Sites with a customized .htaccess (including scaffold-managed sites that override the scaffolded file) need to apply the same change: replace package\.json with package(-lock)?\.json in the FilesMatch rule.
Impacts:
Site builders, administrators, editors
