Socket.dev false positives: suppress them in .socket.yml with package, issue, reason, expiry

TL;DR

Per the Socket.dev case study: suppress false positives in.socket.yml with a reason and an expiry - never ignore silently. Suppress these in.socket.yml under an ignore list: each entry names the package, the issue type, a human reason, and an expires date so the ignore is revisited.

Steps

1. Per the Socket.dev case study: suppress false positives in.socket.yml with a reason and an expiry - never ignore silently.
2. Suppress these in.socket.yml under an ignore list: each entry names the package, the issue type, a human reason, and an expires date so the ignore is revisited.

When to use

You are seeing this: Per the Socket.dev case study: suppress false positives in.socket.yml with a reason and an expiry - never ignore silently. Use this skill when you run into "Socket.dev false positives: suppress them in .socket.yml with package, issue, reason, expiry".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Problem: Socket flags legitimate packages - unstableOwnership on workbox- (Google packages churn ownership internally) and @biomejs/ (fast-moving legitimate project), obfuscatedFile on safer-buffer (ships minified tests). Suppress these in .socket.yml under an ignore list: each entry names the package, the issue type, a human reason, and an expires date so the ignore is revisited. Documenting the reason keeps future-you (and auditors) from wondering why an alert was silenced.

Verified resolution: Per the Socket.dev case study: suppress false positives in .socket.yml with a reason and an expiry - never ignore silently.

Source URL: https://github.com/miccy/dont-be-shy-hulud/blob/HEAD/packages/docs-content/reference/case-study-socket.md