maziggy 7c0eeed8d5 Both workflows now parse package-lock.json directly instead of trusting npm ls. The lockfile correctly marks minimatch as dev: true and doesn't contain npm/tar at all — ...

so all three npm-internal packages will be filtered out regardless of which npm version CI uses.

2026-02-20 19:32:07 +01:00

..

ci.yml

Both workflows now parse package-lock.json directly instead of trusting npm ls. The lockfile correctly marks minimatch as dev: true and doesn't contain npm/tar at all —

2026-02-20 19:32:07 +01:00

codeql.yml

…

issue-closed.yml

…

security.yml

Both workflows now parse package-lock.json directly instead of trusting npm ls. The lockfile correctly marks minimatch as dev: true and doesn't contain npm/tar at all —

2026-02-20 19:32:07 +01:00

stale.yml

…