docs: document minimumDependencyAge deno.json setting#3027
Conversation
Adds documentation for the minimumDependencyAge configuration option, which protects against supply chain attacks by requiring dependencies to have existed for a minimum age before installation. Closes #3017 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
It looks like we might need to update last_modified manually. |
lunadogbot
left a comment
There was a problem hiding this comment.
The --unstable-npm-lazy-caching claim in the caution block looks wrong. minimumDependencyAge is its own unstable feature (see denoland/deno#31007 — the introducing PR doesn't mention lazy caching), and the schema marks it (Unstable) on its own. unstable_npm_lazy_caching() in cli/args/mod.rs only gates eager-vs-lazy npm caching strategy and doesn't reference minimum_dependency_age. Suggest dropping the flag from the caution: "This feature is unstable. Configure it in deno.json or pass --minimum-dependency-age on the command line."
Also, the example uses "2025-09-16" (a date) but the prose calls it an "RFC 3339 timestamp" — the schema's own help text calls a bare date a "cutoff date" and a …T12:00:00+00:00 form a "cutoff time". Worth matching: "RFC 3339 date or timestamp".
|
Closing in favor of #3100, which covers |
Summary
minimumDependencyAgeconfiguration field in the deno.json config page--minimum-dependency-ageCloses #3017
Test plan
🤖 Generated with Claude Code