Fahreddin Özcan
c918e80e84
Configures pnpm's minimumReleaseAge to 10080 minutes (7 days) so newly published package versions can't be installed until they've existed on the registry long enough for short-lived supply-chain compromises (e.g. hijacked publish tokens, typosquats) to be detected and yanked. 7 days is the post-Shai-Hulud/tj-actions community baseline. Critical hotfixes can still be installed by adding entries to minimumReleaseAgeExclude. Ref: https://pnpm.io/blog/2025/12/05/newsroom-npm-supply-chain-security
8 lines
83 B
YAML
8 lines
83 B
YAML
packages:
|
|
- "packages/*"
|
|
|
|
allowBuilds:
|
|
esbuild: true
|
|
|
|
minimumReleaseAge: 10080
|