fix(deps): Resetting the age filter.

[RobinTail]

Summary by CodeRabbit

• Chores
  • Simplified workspace configuration by removing obsolete settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f2125d1f-fb18-458e-8418-e08ffc72824d

📥 Commits

Reviewing files that changed from the base of the PR and between ab89ebc and 66179a8.

📒 Files selected for processing (1)

• pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

• pnpm-workspace.yaml

---

📝 Walkthrough

Walkthrough

The PR removes the minimumReleaseAge setting and its minimumReleaseAgeExclude allowlist from pnpm-workspace.yaml, allowing publicHoistPattern to follow directly after the remaining workspace settings like engineStrict, autoInstallPeers, and dedupePeers.

Changes

Workspace configuration cleanup

Layer / File(s)	Summary
Minimum release age setting removal pnpm-workspace.yaml	Deleted the minimumReleaseAge configuration and its associated minimumReleaseAgeExclude list; the workspace configuration now flows directly from core settings to publicHoistPattern and the catalogs/overrides sections.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• RobinTail/express-zod-api#2943: Adds the minimumReleaseAge and minimumReleaseAgeExclude settings to pnpm workspace configuration, making this a direct inverse change.

Poem

🐰 A config so tidy, so lean and so clean,
We swept up the settings that no longer mean,
Release ages gone with a minimalist's care,
The workspace breathes lighter, refreshed by the air! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(deps): Resetting the age filter.' directly and specifically describes the main change—removal of the minimumReleaseAge setting from pnpm-workspace.yaml configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch reset-age-filter

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coveralls-official]

coverage: 100.0%. remained the same — reset-age-filter into master

[pullfrog]

Note

Sound revert. After removal, pnpm 11's built-in default of minimumReleaseAge: 1440 (1 day, non-strict) still applies, so the supply-chain delay is reduced from 2 days strict → 1 day soft fallback rather than eliminated. Verified clean against the rest of the repo.

TL;DR — Drops the explicit minimumReleaseAge: 2880 and its 24-entry minimumReleaseAgeExclude allowlist from pnpm-workspace.yaml, almost certainly to dodge the pnpm 11.0.4 regression where minimumReleaseAgeStrict started defaulting to true when minimumReleaseAge is set explicitly, breaking installs whenever no version in a requested range was sufficiently mature.

Key changes

• Remove explicit age filter from pnpm-workspace.yaml — deletes minimumReleaseAge: 2880 plus the entire minimumReleaseAgeExclude list, falling back to pnpm 11's built-in 1-day default in non-strict mode.

_{Summary ｜ 1 file ｜ 1 commit ｜ base: master ← reset-age-filter}

Why removal is sound on pnpm@11.0.9

Before: explicit minimumReleaseAge: 2880 with a curated 24-package bypass list, enforced strictly under pnpm 11.0.4+ (would fail installs when no satisfying mature version exists).
After: no explicit setting; pnpm 11's built-in minimumReleaseAge: 1440 still applies in non-strict (silent-fallback) mode.

The repo pins pnpm@11.0.9, which includes pnpm/pnpm#11436 (shipped in 11.0.4): when minimumReleaseAge is explicitly set, minimumReleaseAgeStrict now defaults to true. That flip caused real install breakage for users with renovate-style update churn (see pnpm/pnpm#11433 and the closely-timed pnpm/pnpm#11543). Reverting to defaults is a reasonable workaround.

Is there a more surgical alternative?

Yes — keeping minimumReleaseAge: 2880 and adding minimumReleaseAgeStrict: false would preserve the 2-day soft window and keep the carefully-tuned minimumReleaseAgeExclude allowlist meaningful, while still avoiding the 11.0.4 strict-mode install failures. The full revert is simpler; the surgical version is documented as a defensive option for when upstream pnpm offers a non-breaking fix. No action needed unless the team wants to lock in the 2-day window again later.

pnpm-workspace.yaml

Impact audit

Before: the explicit filter and its allowlist could in principle be referenced from docs, workflows, or Renovate config.
After: repo-wide grep for minimumReleaseAge, minimumReleaseAgeExclude, 2880, "2 days", age filter, release age, and cooldown returns zero hits outside .git/.

No workflows pass --config.minimumReleaseAge, renovate.json has no age/merge-confidence gating, CHANGELOG.md has no prior entry for the addition (so no symmetric removal entry is required by the project's policy), and AGENTS.md does not reference the filter. The removal is fully self-contained.

renovate.json · .github/workflows/dependencies.yml · CHANGELOG.md

Minor — PR-body context for future maintainers

Before: a future reader of git log sees "fix(deps): Resetting the age filter." with no link to the upstream pnpm regression.
After: linking pnpm/pnpm#11433 and noting "revisit when upstream provides a non-breaking fix" would make this revert auditable and reversible.

The deleted allowlist took non-trivial curation (e.g. an individual tracked removal of undici); even though git log -p -- pnpm-workspace.yaml recovers it, a one-line PR description note would lower future friction. Optional.

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}