feat: securing npm package installation

Author: Jörn Franke

CHANGELOG.md

@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * Backend: Update to [Spring Boot 4.0.2](https://spring.io/blog/2026/01/22/spring-boot-4-0-2-available-now), Hibernate 7.2.4.Final, Spring Modulith 2.0.2, BouncyCastle 1.83, OWASP HTML Sanitizer: 20260102.1, Gradle Plugin: CycloneDX 3.1.0, Spotless 8.2.1
 * Frontend: Add [linter based on eslint](https://angular.dev/cli/lint)
 * Frontend: Use [inject() instead of constructor injector](https://angular.dev/reference/migrations/inject-function)
+* Frontend: Build tool: Set for npm [allow-git](https://docs.npmjs.com/cli/v11/commands/npm-install#allow-git) to None and [min-release-age](min-release-age) to 2 days. Both settings aim at avoiding supply chain attacks
 * Frontend: Update to Angular 21.1.3
 
 ## [0.0.11] - 2025-11-21

backend/build.gradle

@@ -121,7 +121,7 @@ task installFrontEndDependencies(type:Exec) {
      workingDir "$webappDir"
      inputs.dir "$webappDir"
      group = BasePlugin.BUILD_GROUP
-     commandLine "npm", "ci"
+     commandLine "npm", "ci", "--allow-git=none", "--min-release-age=2"
 }
 
 task buildAngular(type:Exec, dependsOn: installFrontEndDependencies) {

frontend/docs/BUILD.md

@@ -9,13 +9,14 @@ You need to have at least NodeJs 20 installed. We recommend to always use the la
 You can install all the dependencies using the following command:
 
 ```
-npm install
+npm install --allow-git=none --min-release-age=2
 ```
 
 If you want to have an exactly reproducible build then you should use instead:
 
 ```
-npm ci
+npm ci --allow-git=none --min-release-age=2
+
 ```
 
 # Run the frontend locally for development purposes