From 750b9dc16c50e3dc707d98df60ef5f8854e7c45a Mon Sep 17 00:00:00 2001 From: Kai Schwarz Date: Sat, 29 Aug 2026 16:01:38 +0200 Subject: [PATCH] chore(deps): require a 24-hour minimum release age --- pnpm-workspace.yaml | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 pnpm-workspace.yaml diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml new file mode 100644 index 0000000..6931e1e --- /dev/null +++ b/pnpm-workspace.yaml @@ -0,0 +1,14 @@ +# pnpm settings live here, not in .npmrc and not in the `pnpm` field of package.json — +# pnpm 10 stopped reading that field and only warned about it. + +# Nothing here is installed until it is at least a day old. This is a supply-chain +# control, not a tidiness rule: the npm attacks that actually hurt people publish a +# compromised version of a real package and rely on automation to pull it into a build +# within minutes. Setting this to 0 to make a red build go green removes the protection +# at exactly the moment it is worth the most — wait instead. +# +# 1440 minutes is pnpm's default, declared explicitly so that it is a decision which can +# be reported as drift rather than one inherited silently. One value across every +# rtldev-middleware repository, enforced by node-policy.sh in the workspace repository. +# (RSRMID-3018) +minimumReleaseAge: 1440