镜像站点 · 本页由第三方 GitHub 只读镜像提供,非 GitHub 官方站点,不接受任何登录或凭据输入。前往 github.com
Skip to content

build: Add 7 day dependency cooldown via pnpm minimumReleaseAge - #302

Merged
pavelzw merged 1 commit into
mainfrom
ci/pnpm-minimum-release-age
Nov 1, 2026
Merged

pavelzw merged 1 commit into
mainfrom
ci/pnpm-minimum-release-age

Conversation

@pavelzw

@pavelzw pavelzw commented Nov 1, 2026

Copy link
Copy Markdown
Collaborator

Sets pnpm's minimumReleaseAge (pnpm's equivalent of exclude-newer) to 7 days (10080 minutes) in pnpm-workspace.yaml.

pnpm will refuse to resolve any package version, including transitive dependencies, that was published less than 7 days ago. This complements the existing 7 day dependabot cooldown, which only applies to dependabot's own update PRs and not to manual pnpm add / pnpm update or transitive resolution.

  • Requires pnpm >= 10.16; CI uses pnpm/action-setup with version: 10 (currently 10.x latest).
  • The current lockfile is unaffected (pnpm install leaves it unchanged).
  • Verified locally: with the setting, pnpm add oxfmt@0.75.0 (published 5 days ago) fails, and pnpm add oxfmt falls back to 0.74.0.
  • If a fresh release is ever urgently needed (e.g. a security fix), the package can be added to minimumReleaseAgeExclude.

@pavelzw
pavelzw merged commit 784aed4 into main Nov 1, 2026
204 checks passed
@pavelzw
pavelzw deleted the ci/pnpm-minimum-release-age branch November 1, 2026 14:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant