feat: update LFS core to 6.19.4 and apply warning severity threshold

[RubenHalman]

Hey @VinceFINET 👋

Following up on the previous discussion — this sets a default severity threshold.

Version 6.19.2 of lfs core ships filterByThreshold natively.

What changed:

• Updated lfscore.js to 6.19.2
• After scanning, filterByThreshold(ruleResults, 'warning') is called per flow — notes are silently dropped
• lfsViolations now stores { name, severity } objects instead of plain strings, so the severity is visible in the table if needed
• Score rule formulas updated accordingly (.some(v => v.name === 'X') instead of .includes('X'))

No UI changes, no new options for users.

[VinceFINET]

Hi @RubenHalman

Thank you for this!!
Do you have an official URL for the lfscore.js library with version 6.19.2 please?

[RubenHalman]

Hi @VinceFINET,

The official link for LFS Core 6.19.2 is:

https://github.com/Flow-Scanner/lightning-flow-scanner/releases/tag/core-v6.19.2

This is the canonical tag for both the npm package and the UMD build.

I didn’t create a full GitHub release with notes because it was primarily security patches (6.19.2).

Let me know if you need the built UMD file.

[RubenHalman]

Hi @VinceFINET, refreshed this to Core 6.19.4, released today: https://github.com/Flow-Scanner/lightning-flow-scanner/releases/tag/core-v6.19.4

That release resolves a ReDoS (CWE-1333) in the UnusedVariable rule; Flow variable names are no longer compiled into regular expressions. Worth noting for Org Check's threat model: it is a hardening fix rather than an exploitable path here, since the variable names Org Check scans come from org metadata rather than untrusted input.

On your question about an official URL for lfscore.js: the core package publishes ESM only, so the UMD in this PR is bundled from the published npm package. The release tag, the npm version and the exact build command are now recorded in install.readme next to the file, so the bundle can be reproduced and checked byte for byte.