fix: move minimum-release-age to pnpm-workspace.yaml, fix Socket package downgrades

- Move pnpm's minimum-release-age from .npmrc to pnpm-workspace.yaml
  to avoid npm v11+ warning about unknown config key
- Keep min-release-age=7 in .npmrc for npm
- Fix update script: bypass age gate for @socketsecurity/* and
  @socketregistry/* via env override (prevents downgrades)

Author: jdalton

.npmrc

@@ -2,9 +2,8 @@ ignore-scripts=true
 link-workspace-packages=false
 loglevel=error
 prefer-workspace-packages=false
-# Minimum release age - wait 7 days before installing newly published packages
-# pnpm uses minimum-release-age (minutes), npm v11+ uses min-release-age (days)
-minimum-release-age=10080
+# Minimum release age for npm v11+ (days).
+# pnpm equivalent is in pnpm-workspace.yaml (minimumReleaseAge).
 min-release-age=7
 
 trust-policy=no-downgrade

pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+settings:
+  # Wait 7 days (10080 minutes) before installing newly published packages.
+  minimumReleaseAge: 10080

scripts/update.mjs

@@ -44,7 +44,8 @@ async function main() {
       process.stdout.write('\r\x1b[K')
     }
 
-    // Always update Socket packages (bypass taze maturity period).
+    // Update Socket packages — bypass minimum-release-age since these are
+    // our own packages and we trust them immediately.
     if (!quiet) {
       logger.progress('Updating Socket packages...')
     }
@@ -60,12 +61,12 @@ async function main() {
         '-r',
       ],
       {
+        env: { ...process.env, npm_config_minimum_release_age: '0' },
         shell: WIN32,
         stdio: quiet ? 'pipe' : 'inherit',
       },
     )
 
-    // Clear progress line.
     if (!quiet) {
       process.stdout.write('\r\x1b[K')
     }