From 26df12bde7f3666d49dab1b8e828feb3d85688a8 Mon Sep 17 00:00:00 2001
From: "B. Watson" <urchlay@slackware.uk>
Date: Mon, 14 Sep 2026 23:57:55 -0400
Subject: sbolint: do not allow "npm audit fix" in SlackBuild.

---
 NEWS    | 1 +
 sbolint | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/NEWS b/NEWS
index 8a87c76..a339608 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,7 @@ sbolint:
 - Having multiple *.SlackBuild files is now an error.
 - doinst.sh must not use chmod.
 - doinst.sh must not refer to $PKG (it won't be set when it runs).
+- SlackBuild scripts must not call 'npm audit fix'.
 
 sbopkglint:
 - Package which bundle their own glibc in /opt no longer trigger
diff --git a/sbolint b/sbolint
index f96f365..93c2fe0 100755
--- a/sbolint
+++ b/sbolint
@@ -1617,6 +1617,8 @@ sub check_script {
 			}
 		} elsif(/^[^#]*(SLCKFLAGS|PRGMAN|PGK)/) {
 			log_warning("$file:$lineno: $1 looks like a typo");
+		} elsif(/^[^#]*npm\s+audit\s+fix/) {
+			log_error("$file:$lineno: scripts must not call 'npm audit fix'");
 		}
 
 		if(/^[^#]*<documentation>/) {
-- 
cgit v1.2.3