Merge branch 'master' into APS-22106-replace-decompress-with-adm-zip

Author: karanshah-browserstack

.coderabbit.yaml

@@ -0,0 +1,15 @@
+inheritance: true
+reviews:
+  review_details: true
+  request_changes_workflow: true
+  auto_review:
+    enabled: true
+knowledge_base:
+  code_guidelines:
+    filePatterns:
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/rules/**/*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/agents/*review*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/skills/*review*/**/*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/knowledge/*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/knowledge/automate/**/*.md"
+      - "browserstack/browserstack-ai-harness:stacks/stack-domain-browserstack-cypress-cli/knowledge/docs/**/*.md"

.github/workflows/Semgrep.yml

@@ -27,7 +27,10 @@ jobs:
 
     container:
       # A Docker image with Semgrep installed. Do not change this.
-      image: returntocorp/semgrep:1.166.0
+      # Pinned to a digest for supply-chain integrity (APS-19017 / INF-007).                                                                                                                                                                                                                                                
+      # returntocorp/semgrep:1.166.0 resolved 2026-09-16.                                                                                                                                                                                                                                                                 
+      image: returntocorp/semgrep:1.166.0@sha256:c180f0c93a17b420c0af5006214a29d3c747c5459c732b740191adf657dd0068
+
     # Skip any PR created by dependabot to avoid permission issues:
     if: (github.actor != 'dependabot[bot]')
 

.npmrc

@@ -1,2 +1,5 @@
+min-release-age=7
 package-lock=true
 lockfile-version=1
+strict-ssl=true
+save-exact=true