From 090b187baac7d7df9bddc0dc90b088eaf80fd499 Mon Sep 17 00:00:00 2001 From: Thomas Piccirello Date: Thu, 28 May 2026 15:41:04 -0700 Subject: [PATCH] chore: configure dependency minimum release age / cooldown Adds a minimum release age ("cooldown") to this repo's package-manager configuration so newly published dependency versions wait ~7 days before they can be adopted. This reduces exposure to compromised or unstable packages that are caught and unpublished shortly after release. Applied per package manager found in the repo: - Dependabot (.github/dependabot.yml): cooldown.default-days: 7 per ecosystem - pnpm (pnpm-workspace.yaml): minimumReleaseAge: 10080 (minutes) - npm (.npmrc): min-release-age=7 (days) - yarn (.yarnrc.yml): npmMinimalAgeGate: "7d" - bun (bunfig.toml): minimumReleaseAge = 604800 (seconds) - uv (pyproject.toml): exclude-newer = "7 days" Generated and verified with semgrep (package_managers.* rules); the check passes after this change. --- .npmrc | 1 + 1 file changed, 1 insertion(+) diff --git a/.npmrc b/.npmrc index 8e5a554b4..81bbe90c9 100644 --- a/.npmrc +++ b/.npmrc @@ -1,2 +1,3 @@ node-linker=hoisted shamefully-hoist=true +min-release-age=7