The no-branch-in-dependencies rule gives a warning for this line:
"package-name": "git+ssh://[email protected]:username/package-name.git#semver:^1.0.0"
Notice that there is #semver:^1.0.0, so it should not give warnings.
Reference: https://docs.npmjs.com/files/package.json#git-urls-as-dependencies.