v1.2.0

Dependencies can now install once they are 3 days old, down from 14, and an urgent security fix has a documented way through on its release day. Packages build with tsup 9, which removes the TypeScript 6 workaround from every package config.

Changed

• 3-day dependency age rule. pnpm refuses any version published in the last 3 days, including transitive ones, and Renovate waits the same 3 days before proposing an update. The two values must stay equal, or Renovate opens PRs that pnpm refuses.
• Urgent security fixes. One exact version may be added to minimumReleaseAgeExclude, with its advisory linked, and is removed once it is 3 days old. A person approves each exception, and AGENTS.md tells agents never to add one. The README's "Dependency Updates" section has the steps.
• Security-fix PRs. Renovate labels vulnerability fixes security and opens them outside its weekly schedule. This needs Dependabot alerts turned on for the repository.
• tsup 9.0.0. JavaScript output is byte-identical to tsup 8.5.1. Declaration files now put type-only exports in a separate export type { … } statement, which is equivalent.

Changes for existing projects

A project created from v1.1.0 would change the following to match:

1. Dependency age. In pnpm-workspace.yaml, set minimumReleaseAge: 4320. In renovate.json, set "minimumReleaseAge": "3 days" and add "vulnerabilityAlerts": { "labels": ["security"] }.
2. tsup 9. Pin tsup to 9.0.0 in every package.json that lists it. In each tsup.config.ts, replace dts: { compilerOptions: { ignoreDeprecations: '6.0' } } with dts: true, keeping any other dts options such as entry. tsup 9 requires Node 22.18 or later; the template already requires Node 24.