From d3bab5125af839b3c64c627f8e702cc97b7d25f7 Mon Sep 17 00:00:00 2001 From: Nicolas Bonet Date: Wed, 16 Sep 2026 12:44:46 -0500 Subject: [PATCH 1/2] Add npm min-release-age cooldown for supply chain protection Only resolve package versions published at least 7 days ago. npm ci and lockfile-clean installs are unaffected. See https://github.com/Expensify/Expensify/issues/636594 --- .gitignore | 1 - .npmrc | 2 ++ 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 .npmrc diff --git a/.gitignore b/.gitignore index f5af0e6..bd6efbc 100644 --- a/.gitignore +++ b/.gitignore @@ -7,5 +7,4 @@ npm-debug.log dist/ # NPM file created by GitHub actions -.npmrc .idea/ diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000..4d82617 --- /dev/null +++ b/.npmrc @@ -0,0 +1,2 @@ +# Supply chain protection: only resolve package versions published at least 7 days ago. +min-release-age=7 From efd5ed784557bcc27882d3ba6eb0366ca2551cf1 Mon Sep 17 00:00:00 2001 From: Nicolas Bonet Date: Wed, 16 Sep 2026 12:47:24 -0500 Subject: [PATCH 2/2] Remove orphaned .gitignore comment --- .gitignore | 1 - 1 file changed, 1 deletion(-) diff --git a/.gitignore b/.gitignore index bd6efbc..40e3b5f 100644 --- a/.gitignore +++ b/.gitignore @@ -6,5 +6,4 @@ node_modules/ npm-debug.log dist/ -# NPM file created by GitHub actions .idea/