Supply Chain

How do you set a minimum package age in Yarn with npmMinimalAgeGate?

Yarn's npmMinimalAgeGate skips package versions newer than a set age. How to configure it, what npmPreapprovedPackages exempts, and what to watch for.

Does Yarn Modern read my .npmrc after migrating from Yarn Classic?

No. Yarn Modern ignores .npmrc and uses .yarnrc.yml, so registry and token settings must be converted or installs may hit the wrong registry.

How do you allowlist git dependencies in Yarn?

Yarn's approvedGitRepositories blocks any git dependency whose repository URL does not match a glob you approved. How it works and how to roll it out.

How do I write a not affected VEX statement for my library?

A worked example of an OpenVEX not affected statement for a library maintainer: required fields, the five justification labels, and when to use each.

Worked example: scoring a hypothetical library with a maintainer rubric

The maintainer vetting rubric applied step by step to an invented npm library, with evidence for each score and a final adopt-with-conditions call.

What is the WordPress.org plugin release cooldown and automated review?

WordPress.org now holds each plugin and theme release for a cooldown while an automated review scores it. What that covers and what it cannot catch.

Why should a WordPress plugin never load updates from its own server?

WordPress.org guideline 8 bars plugins from sending executable code through third-party systems. See what it blocks, why, and how to spot a breach of it.

Will scanners still flag vulnerabilities in a renamed fork?

Often not. Scanners match on package name and version, so a renamed fork can look clean while carrying the original flaw. How to close the gap.

Why did Unity install a different package version than I requested?

Unity installs one version per package, so another package's dependency can raise yours. How the graph and lock file decide, and what to review.

Why does the same library show up in five versions after a split?

After a monolith is split, one library often appears in many versions across services. Here is why it happens and how to converge on one safe version.

Why does SLSA Build L3 want a fresh environment for every build?

SLSA Build L3 requires an ephemeral, isolated environment per build so one build cannot persist or influence the next. Here is the attack that rules out.

Why should PyPI releases use separate build and publish jobs?

Build in one CI job, store the artifacts, and publish from a second job with only the permission it needs. Why that split limits a build compromise.