From 65a37e52e224b2d208d9fe6e0be448c5816d385c Mon Sep 17 00:00:00 2001
From: Robin Tail <robin_tail@me.com>
Date: Wed, 13 May 2026 15:27:07 +0200
Subject: [PATCH 1/5] min release age 7 days.

---
 pnpm-workspace.yaml | 1 +
 renovate.json       | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 77f445e53e..716840915c 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -11,6 +11,7 @@ gitChecks: false
 engineStrict: true
 autoInstallPeers: false
 dedupePeers: true
+minimumReleaseAge: 10080
 publicHoistPattern:
   - "@typescript-eslint/*" # used as an assumed transitive in migration
   - "@vitest/*" # used by vitest.setup.ts and vitest.config.ts
diff --git a/renovate.json b/renovate.json
index 9e01e95458..b859d079e8 100644
--- a/renovate.json
+++ b/renovate.json
@@ -4,7 +4,7 @@
   "dependencyDashboard": false,
   "postUpdateOptions": ["pnpmDedupe"],
   "ignorePaths": ["**/compat-test/**"],
-  "minimumReleaseAge": "1 day",
+  "minimumReleaseAge": "7 days",
   "packageRules": [
     {
       "groupName": "TypeScript-ESLint and its rule tester",

From 3595b61d24641278c77acd99893b086447f50bdf Mon Sep 17 00:00:00 2001
From: Robin Tail <robin_tail@me.com>
Date: Wed, 13 May 2026 15:38:42 +0200
Subject: [PATCH 2/5] fix(CI): disabling OIDC token where not needed.

---
 .github/workflows/bump.yml            | 1 +
 .github/workflows/codeql-analysis.yml | 1 +
 .github/workflows/headers.yml         | 1 +
 .github/workflows/node.js.yml         | 3 +++
 4 files changed, 6 insertions(+)

diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index 3958600b2c..2c08c4d78c 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -27,6 +27,7 @@ on:
           - prerelease
 
 permissions:
+  id-token: none
   contents: write
 
 jobs:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index fb84f17a4a..00d19b767f 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -25,6 +25,7 @@ jobs:
     name: Analyze
     runs-on: ubuntu-latest
     permissions:
+      id-token: none
       actions: read
       contents: read
       security-events: write
diff --git a/.github/workflows/headers.yml b/.github/workflows/headers.yml
index b6ae879c1a..7cc750b472 100644
--- a/.github/workflows/headers.yml
+++ b/.github/workflows/headers.yml
@@ -6,6 +6,7 @@ on:
     - cron: "0 0 * * 0" # Runs every Sunday at midnight UTC
 
 permissions:
+  id-token: none
   contents: write # Grants write access to push changes
   pull-requests: write # and create PRs
 
diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index a5f88fc2ba..e813dd0c06 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -9,6 +9,9 @@ on:
   pull_request:
     branches: [ master, v25, v26, v27 ]
 
+permissions:
+  id-token: none
+
 jobs:
   build:
     runs-on: ubuntu-latest

From b46937bd6c3a7e8be803bbaa732893e21fce2af3 Mon Sep 17 00:00:00 2001
From: Anna Bocharova <robin_tail@me.com>
Date: Wed, 13 May 2026 16:07:18 +0200
Subject: [PATCH 3/5] fix(CI): Add contents:read permission

Co-authored-by: pullfrog[bot] <226033991+pullfrog[bot]@users.noreply.github.com>
---
 .github/workflows/node.js.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index e813dd0c06..bdbe502cec 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -11,7 +11,9 @@ on:
 
 permissions:
   id-token: none
-
+permissions:
+  id-token: none
+  contents: read
 jobs:
   build:
     runs-on: ubuntu-latest

From 9945b51271fecaf54ba9faadbe853b665482c7b4 Mon Sep 17 00:00:00 2001
From: Anna Bocharova <robin_tail@me.com>
Date: Wed, 13 May 2026 16:07:59 +0200
Subject: [PATCH 4/5] Apply suggestion from @RobinTail

---
 .github/workflows/node.js.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index bdbe502cec..049818a999 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -9,11 +9,10 @@ on:
   pull_request:
     branches: [ master, v25, v26, v27 ]
 
-permissions:
-  id-token: none
 permissions:
   id-token: none
   contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest

From bf74000928c86176ebcf3f5f4c64d39d48446a34 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 13 May 2026 17:07:15 +0000
Subject: [PATCH 5/5] express-zod-api version 28.0.1-beta.1

---
 express-zod-api/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/express-zod-api/package.json b/express-zod-api/package.json
index 24d1fb02fc..3cf7c0294f 100644
--- a/express-zod-api/package.json
+++ b/express-zod-api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "express-zod-api",
-  "version": "28.0.1-beta.0",
+  "version": "28.0.1-beta.1",
   "description": "A Typescript framework to help you get an API server up and running with I/O schema validation and custom middlewares in minutes.",
   "license": "MIT",
   "repository": {