From e06e4def1125039b3b36f38daf87e958850c6fd6 Mon Sep 17 00:00:00 2001 From: Nicolas Bonet Date: Wed, 16 Sep 2026 12:43:57 -0500 Subject: [PATCH 1/2] Add npm min-release-age cooldown for supply chain protection Only resolve package versions published at least 7 days ago. npm ci and lockfile-clean installs are unaffected. See https://github.com/Expensify/Expensify/issues/636594 --- .gitignore | 1 - .npmrc | 4 ++++ 2 files changed, 4 insertions(+), 1 deletion(-) create mode 100644 .npmrc diff --git a/.gitignore b/.gitignore index b0b314aae..8b3ddd111 100644 --- a/.gitignore +++ b/.gitignore @@ -9,7 +9,6 @@ jsconfig.json # NPM file created by GitHub actions -.npmrc # Xcode build/ diff --git a/.npmrc b/.npmrc new file mode 100644 index 000000000..d21f7a7b9 --- /dev/null +++ b/.npmrc @@ -0,0 +1,4 @@ +# Supply chain protection: only resolve package versions published at least 7 days ago. +min-release-age=7 +min-release-age-exclude[]=expensify-common +min-release-age-exclude[]=eslint-config-expensify From 3484ba4e59b918e6f722d0bc6b21f56605815b1d Mon Sep 17 00:00:00 2001 From: Nicolas Bonet Date: Wed, 16 Sep 2026 12:47:17 -0500 Subject: [PATCH 2/2] Remove orphaned .gitignore comment --- .gitignore | 2 -- 1 file changed, 2 deletions(-) diff --git a/.gitignore b/.gitignore index 8b3ddd111..1a17b2b6a 100644 --- a/.gitignore +++ b/.gitignore @@ -8,8 +8,6 @@ .vscode/ jsconfig.json -# NPM file created by GitHub actions - # Xcode build/ *.pbxuser