From ed961276e0be0f6fe3fb7083ef501398eb487131 Mon Sep 17 00:00:00 2001 From: Nicolas Bonet Date: Wed, 16 Sep 2026 12:45:04 -0500 Subject: [PATCH 1/2] Add npm min-release-age cooldown for supply chain protection Only resolve package versions published at least 7 days ago. npm ci and lockfile-clean installs are unaffected. See https://github.com/Expensify/Expensify/issues/636594 --- .gitignore | 1 - .npmrc | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 .npmrc diff --git a/.gitignore b/.gitignore index 595b823..09beb5f 100644 --- a/.gitignore +++ b/.gitignore @@ -7,7 +7,6 @@ npm-debug.log dist/ # NPM file created by GitHub actions -.npmrc # IDEs .idea diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..4d82617 --- /dev/null +++ b/.npmrc @@ -0,0 +1,2 @@ +# Supply chain protection: only resolve package versions published at least 7 days ago. +min-release-age=7 From 34c6c064dc5f347932d9796ecd50e473dbd08194 Mon Sep 17 00:00:00 2001 From: Nicolas Bonet Date: Wed, 16 Sep 2026 12:47:30 -0500 Subject: [PATCH 2/2] Remove orphaned .gitignore comment --- .gitignore | 2 -- 1 file changed, 2 deletions(-) diff --git a/.gitignore b/.gitignore index 09beb5f..7a14a0b 100644 --- a/.gitignore +++ b/.gitignore @@ -6,7 +6,5 @@ node_modules/ npm-debug.log dist/ -# NPM file created by GitHub actions - # IDEs .idea