ehoandClaude Sonnet 5
526da76617
Local semgrep run found 25 findings (not the WP's remembered 27 — already-stale by the time this ran): dependabot cooldown, npm min-release-age, every GitHub Action pinned to a full commit SHA (dependabot's existing github-actions ecosystem entry keeps these current), and 2 detect-non-literal-regexp findings in e2e/create-ssp.mjs suppressed as false positives (non-attacker-controlled input: a test's own captured version number, a local generator's CLI arg). `semgrep scan` now runs with `--error`, a real blocking gate instead of report-only. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
8 lines
378 B
Plaintext
8 lines
378 B
Plaintext
# @storybook/angular's peer range lags Angular 22; the builder works fine at runtime.
|
|
# ponytail: one flag beats pinning the whole app back to Angular 21.
|
|
legacy-peer-deps=true
|
|
|
|
# WP-30: wait 7 days before resolving newly-published package versions (semgrep
|
|
# npm-missing-minimum-release-age) — guards against a freshly-published malicious/unstable release.
|
|
min-release-age=7
|