@@ -8,6 +8,7 @@ All notable changes will be documented in this file.
 - `swallowed_error` (medium): a `catch` block whose only statements are `console` calls. The error is logged and the code carries on as if the operation succeeded. A comment in the block explaining why that is safe, a rethrow, or any other statement (such as `setError(e)`) means it is not reported, and so does a fallback after the `try`, as for `empty_catch`.
 
 ### Changed
+- `fresh_package_version` skips packages the scanned workspace publishes itself (any `name` in a scanned package.json) and lockfile entries that link a workspace folder. TanStack Query got 184 warnings for `@tanstack/*` versions it had just released.
 - Folders named `build`, `out` or `temp` are skipped only at the scan root or next to a package.json, where they hold build output. Deeper ones are often source: Next.js keeps its build pipeline in `packages/next/src/build/`, which was never scanned.
 - A run whose paths are all missing, ignored or unsupported ends with a one-line error instead of a stack trace.
 - An unknown command-line option stops the run with exit 1 and names the option. `--stirct` used to run without strict mode. A `severityOverrides` key that is not a rule id or custom pattern id prints a warning: `type_asertion: "off"` used to do nothing, silently.
 
@@ -249,6 +249,15 @@ export function uniqueRealFiles(files: readonly string[]): string[] {
   return [...byRealPath.values()];
 }
 
+function readPackageName(manifestPath: string): string | undefined {
+  try {
+    const name = asRecord(JSON.parse(fs.readFileSync(manifestPath, 'utf-8')))?.name;
+    return typeof name === 'string' && name !== '' ? name : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function isCliPath(filePath: string, content: string): boolean {
   if (content.startsWith('#!')) return true;
   const normalized = filePath.replace(/\\/g, '/');
@@ -292,6 +301,8 @@ class AISlopDetector {
   private registryWarningLogged = false;
   private registryUnavailable = false;
   private reportedFreshPackageKeys = new Set<string>();
+  /** Names of the packages the scanned workspace itself publishes; their fresh versions are its own releases. */
+  private workspacePackages = new Set<string>();
   private targetPaths: string[] = [];
   private summary: ScanSummary = { filesScanned: 0, linesScanned: 0, applicationLinesScanned: 0 };
   private lineCounts = new Map<string, number>();
@@ -484,6 +495,10 @@ class AISlopDetector {
     }
 
     const codeFiles = filesToAnalyze.filter(file => !this.manifestFilenames.includes(path.basename(file)));
+    this.workspacePackages = new Set(filesToAnalyze
+      .filter(file => path.basename(file) === 'package.json')
+      .map(file => readPackageName(file))
+      .filter(name => name !== undefined));
     for (const file of filesToAnalyze) {
       await this.analyzeFile(file, quiet);
     }
@@ -755,7 +770,8 @@ class AISlopDetector {
           // for package freshness.
           if (!isRegistryBackedLockfileEntry(pkgPath)) continue;
           const info = asRecord(pkgInfo);
-          if (info === undefined || typeof info.version !== 'string') continue;
+          // `"link": true` points node_modules at a workspace folder.
+          if (info === undefined || info.link === true || typeof info.version !== 'string') continue;
           const pkgName = typeof info.name === 'string' && info.name
             ? info.name
             : pkgPath.split('node_modules/').pop() || pkgPath;
@@ -780,7 +796,8 @@ class AISlopDetector {
       // Keep the rule narrow on purpose: only caret/tilde ranges are treated
       // as "fresh package" candidates in package.json. package-lock.json is
       // always checked because it contains the resolved version.
-      .filter(({ isRange }) => isRange || filePath.endsWith('package-lock.json'));
+      .filter(({ isRange }) => isRange || filePath.endsWith('package-lock.json'))
+      .filter(({ pkgName }) => !this.workspacePackages.has(pkgName));
 
     // Bound concurrency: npm registry rate-limits unauthenticated callers at
     // ~600 req/min, and a typical package-lock.json has 200-1000 deps.
 
@@ -777,6 +777,31 @@ test('npm registry requests send a karpeslop User-Agent', async (t) => {
   assert.deepEqual(userAgents, [`karpeslop/${version}`, `karpeslop/${version}`]);
 });
 
+test('fresh_package_version skips packages the scanned workspace publishes itself', async t => {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'karpeslop-workspace-'));
+  try {
+    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ name: 'repo', private: true }));
+    fs.mkdirSync(path.join(dir, 'packages', 'core'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'packages', 'core', 'package.json'), JSON.stringify({ name: '@acme/core', version: '5.1.0' }));
+    fs.mkdirSync(path.join(dir, 'examples', 'basic'), { recursive: true });
+    fs.writeFileSync(path.join(dir, 'examples', 'basic', 'package.json'),
+      JSON.stringify({ name: 'basic-example', dependencies: { '@acme/core': '^5.1.0', 'left-pad': '^1.3.0' } }));
+    const now = new Date().toISOString();
+    t.mock.method(globalThis, 'fetch', async () => new Response(JSON.stringify({ time: { '5.1.0': now, '1.3.0': now } }), { status: 200 }));
+    t.mock.method(console, 'log', () => {});
+    const savedOffline = process.env.KARPESLOP_OFFLINE;
+    delete process.env.KARPESLOP_OFFLINE;
+    try {
+      const issues = await new AISlopDetector(dir, undefined, async () => 'exists').detect();
+      assert.deepEqual(issues.filter(issue => issue.type === 'fresh_package_version').map(issue => issue.code), ['"left-pad": "1.3.0"']);
+    } finally {
+      if (savedOffline !== undefined) process.env.KARPESLOP_OFFLINE = savedOffline;
+    }
+  } finally {
+    fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 test('finding density counts application code only', async t => {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'karpeslop-density-'));
   try {