From 146705cd84bc70a94d9fc6fdcb5592dd68461690 Mon Sep 17 00:00:00 2001 From: Thomas Piccirello Date: Thu, 28 May 2026 15:40:13 -0700 Subject: [PATCH] chore: configure dependency minimum release age / cooldown Adds a minimum release age ("cooldown") to this repo's package-manager configuration so newly published dependency versions wait ~7 days before they can be adopted. This reduces exposure to compromised or unstable packages that are caught and unpublished shortly after release. Applied per package manager found in the repo: - Dependabot (.github/dependabot.yml): cooldown.default-days: 7 per ecosystem - pnpm (pnpm-workspace.yaml): minimumReleaseAge: 10080 (minutes) - npm (.npmrc): min-release-age=7 (days) - yarn (.yarnrc.yml): npmMinimalAgeGate: "7d" - bun (bunfig.toml): minimumReleaseAge = 604800 (seconds) - uv (pyproject.toml): exclude-newer = "7 days" Generated and verified with semgrep (package_managers.* rules); the check passes after this change. --- pnpm-workspace.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 5ee3f084..23246e34 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -2,3 +2,5 @@ packages: - 'src/PostHog' - 'src/PostHog.AspNetCore' - 'src/PostHog.AI' + +minimumReleaseAge: 10080