Repository navigation

Reject out-of-policy npm transitive updates - #16496

Open

myevolve wants to merge 9 commits into

dependabot:mainfrom

myevolve:fix/npm-transitive-version-policy

Commits on Oct 7, 2026
- Reject out-of-policy npm transitive updates
  Daryoush Rahseparian
  committed
  cc7bcec
- Assert rejection in npm updater contract tests
  Daryoush Rahseparian
  committed
  b7e0158
Commits on Oct 8, 2026
- Merge commit '328836263e30e52540e77f0595a6b87b319271ce' into fix/npm-transitive-version-policy
  Daryoush Rahseparian
  committed
  f6afa86
- Merge upstream main 89a9e44 into npm transitive version policy
  Daryoush Rahseparian
  committed
  7fda226
- Merge upstream main 0286aa0 into PR 16496
  Daryoush Rahseparian
  committed
  260f77e
- Isolate npm version selectors between specs
  Daryoush Rahseparian
  committed
  de4a7cb
Commits on Oct 9, 2026
- fix(npm): validate legacy and rebound transitive installations
  Daryoush Rahseparian
  committed
  683673c
- test(npm): enforce policy across legacy lockfile occurrences
  Daryoush Rahseparian
  committed
  0bc4729
- test(npm): expect the highest allowed legacy occurrence
  Daryoush Rahseparian
  committed
  17d417e