maziggy 7c0eeed8d5 Both workflows now parse package-lock.json directly instead of trusting npm ls. The lockfile correctly marks minimatch as dev: true and doesn't contain npm/tar at all — ...

so all three npm-internal packages will be filtered out regardless of which npm version CI uses.

2026-02-20 19:32:07 +01:00

..

ci.yml

Both workflows now parse package-lock.json directly instead of trusting npm ls. The lockfile correctly marks minimatch as dev: true and doesn't contain npm/tar at all —

2026-02-20 19:32:07 +01:00

codeql.yml

Add CodeQL advanced setup workflow with accepted-risk exclusions

2026-02-06 13:25:23 +01:00

issue-closed.yml

Updated CI

2026-01-29 13:31:07 +01:00

security.yml

Both workflows now parse package-lock.json directly instead of trusting npm ls. The lockfile correctly marks minimatch as dev: true and doesn't contain npm/tar at all —

2026-02-20 19:32:07 +01:00

stale.yml

The only-labels: 'feedback' parameter tells the stale bot to only process issues that have the feedback label. All other issues (feature requests with future, bug

2026-02-16 08:35:43 +01:00