[security] Add minimum release age (hardening against supply chain vulns)

[bencmbrook]

Sets minimumReleaseAge to 24 hours, meaning we do not upgrade to package versions that were published in the last 24 hours. This gives the security community time to detect vulnerabilities (this is usually within hours with AI!) and publish CVE. For example, the massive axios critical vulnerability was only on npm for 3 hours.

See related Slack thread (Transcend-internal link)

Other nit(s):

• Improvement to the tests that drive standardized tsconfig.json files. This is now more granular, detecting non-standard / overridden compilerOption in each package. Note this rule is intentionally skipped since we do override tsconfig.json in some packages, and it will require a project to incrementally remove overrides.

[pkg-pr-new]

Open in StackBlitz

@transcend-io/cli

pnpm add https://pkg.pr.new/@transcend-io/cli@72

yarn add https://pkg.pr.new/@transcend-io/cli@72.tgz

@transcend-io/privacy-types

pnpm add https://pkg.pr.new/@transcend-io/privacy-types@72

yarn add https://pkg.pr.new/@transcend-io/privacy-types@72.tgz

@transcend-io/sdk

pnpm add https://pkg.pr.new/@transcend-io/sdk@72

yarn add https://pkg.pr.new/@transcend-io/sdk@72.tgz

@transcend-io/utils

pnpm add https://pkg.pr.new/@transcend-io/utils@72

yarn add https://pkg.pr.new/@transcend-io/utils@72.tgz

commit: 9af59a6