jethac opened a new issue, #42983: URL: https://github.com/apache/superset/issues/42983
### Problem There is no `.npmrc` at the repository root or in `superset-frontend/`, so npm installs have no `minimumReleaseAge` cooldown. Every `npm install`/`npm ci` will happily resolve a version published seconds ago. Dependabot's own cooldown settings only govern what Dependabot proposes. They do nothing for a developer's local install, a Docker build, or a CI job — and `docker/docker-frontend.sh` currently runs a bare `npm install` (apache/superset#42979), which discards the lockfile as well. The npm ecosystem has had several self-propagating worm incidents where the window between a malicious publish and its takedown was measured in hours. A cooldown is the cheapest control that closes that window. ### Proposed change Add an `.npmrc` setting a minimum release age (7 days matches the Dependabot cooldown already in use), so every install path inherits it rather than relying on each one being configured correctly. Verified against `master` at `3539c41dab`. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
