Skip to content

Increase min release age to 48h#27

Merged
yosriady merged 1 commit into
mainfrom
chore/sec
May 12, 2026
Merged

Increase min release age to 48h#27
yosriady merged 1 commit into
mainfrom
chore/sec

Conversation

@yosriady
Copy link
Copy Markdown
Contributor

@yosriady yosriady commented May 12, 2026


View in Codesmith
Need help on this PR? Tag @codesmith with what you need.

  • Let Codesmith autofix CI failures and bot reviews

@yosriady yosriady merged commit 7603c56 into main May 12, 2026
8 checks passed
@yosriady yosriady deleted the chore/sec branch May 12, 2026 07:42
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the .npmrc configuration to increase the minimum-release-age from 25 to 48 hours. Feedback indicates that while this change enhances security against dependency hijacking, it may negatively impact development velocity by delaying access to critical bug fixes, and suggests evaluating if a 24-hour window would provide a better balance.

Comment thread .npmrc
audit=true
block-exotic-subdeps=true
minimum-release-age=25h
minimum-release-age=48h
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Increasing the minimum-release-age to 48 hours is a strong security measure against dependency hijacking, but it may significantly impact development velocity. This setting blocks the installation of any package version released within the last 48 hours, which includes critical bug fixes or security patches from upstream dependencies. Consider if this two-day delay is acceptable for your workflow, or if a 24-hour window (e.g., 24h) would provide a better balance between security and operational agility.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant