v1.5.0 — Observability, Dashboard Customization & Hardening

.github/codeql/codeql-config.yml

@@ -1,18 +1,21 @@
+---
 name: drydock CodeQL config
 
+paths-ignore:
+  # MSW service worker — generated by `npx msw init`, not our code
+  - apps/demo/public/mockServiceWorker.js
+
 queries:
   - uses: security-and-quality
   - uses: ./.github/codeql/custom-queries
 
 query-filters:
-  - exclude:
-      id: js/clear-text-logging
-  # Exclude the built-in log-injection query; our custom-queries pack provides
-  # a replacement that recognises sanitizeLogParam() as a taint barrier.
+  # Replaced by .github/codeql/custom-queries/LogInjection.ql
+  # (same upstream flow module with an added sanitizeLogParam() barrier).
   - exclude:
       id: js/log-injection
-  # Exclude the built-in http-to-file-access query; our custom-queries pack
-  # provides a replacement that recognises validateFetchedIconPayload() as a
-  # taint barrier after payload validation.
+  # Replaced by .github/codeql/custom-queries/HttpToFileAccess.ql
+  # (same upstream flow module with an added
+  # validateFetchedIconPayload() barrier).
   - exclude:
       id: js/http-to-file-access