Skip to content

Commit 8aea95a

Browse files
authored
chore: configure dependency minimum release age / cooldown (#216)
Adds a minimum release age ("cooldown") to this repo's package-manager configuration so newly published dependency versions wait ~7 days before they can be adopted. This reduces exposure to compromised or unstable packages that are caught and unpublished shortly after release. Applied per package manager found in the repo: - Dependabot (.github/dependabot.yml): cooldown.default-days: 7 per ecosystem - pnpm (pnpm-workspace.yaml): minimumReleaseAge: 10080 (minutes) - npm (.npmrc): min-release-age=7 (days) - yarn (.yarnrc.yml): npmMinimalAgeGate: "7d" - bun (bunfig.toml): minimumReleaseAge = 604800 (seconds) - uv (pyproject.toml): exclude-newer = "7 days" Generated and verified with semgrep (package_managers.* rules); the check passes after this change.
1 parent f0b7308 commit 8aea95a

1 file changed

Lines changed: 2 additions & 0 deletions

File tree

pnpm-workspace.yaml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,5 @@ packages:
22
- 'src/PostHog'
33
- 'src/PostHog.AspNetCore'
44
- 'src/PostHog.AI'
5+
6+
minimumReleaseAge: 10080

0 commit comments

Comments
 (0)