fix: add minimum release age configuration to .npmrc and renovate.json#2740
Conversation
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. WalkthroughThis PR updates dependency management configurations to enforce a 3-day minimum release age for npm packages. The ChangesPackage Release Age Enforcement
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning Review ran into problems🔥 ProblemsGit: Failed to clone repository. Please run the Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.npmrc:
- Line 2: The .npmrc entry uses an invalid key and value format; replace the
incorrect key "min-release-age" with pnpm's correct key "minimum-release-age"
and change the duration string "3d" to numeric minutes (3 days = 4320), i.e.,
set minimum-release-age=4320 so pnpm enforces the minimum release age policy.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| @@ -1 +1,2 @@ | |||
| node-linker=hoisted No newline at end of file | |||
| node-linker=hoisted | |||
| min-release-age=3d No newline at end of file | |||
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
For the package manager configured with .npmrcandnode-linker=hoisted(pnpm context), what is the exact supported.npmrckey and value format for minimum package release age? Ismin-release-age=3dvalid, or should it be another key/value (e.g.,minimum-release-age, numeric minutes, etc.)?
💡 Result:
Valid key/value format in.npmrc (pnpm): - Key: minimum-release-age (kebab-case) - Value format: a number of minutes So min-release-age=3d is not valid for pnpm’s .npmrc setting. pnpm expects numeric minutes, e.g. for 3 days: - minimum-release-age=4320 Evidence: - pnpm documents minimumReleaseAge as “Type: number (minutes)” in settings, describing it as the minimum number of minutes after publication before pnpm installs the version [1]. - pnpm’s config reader accepts the kebab-case .npmrc key minimum-release-age (examples in pnpm issues show .npmrc usage like minimum-release-age = 14000) [2]. - The pnpm issue discussing .npmrc casing explicitly notes the correct kebab-case key (minimum-release-age=30240) after a test showed camelCase was not working there [3]. Note: pnpm’s CLI flag --min-release-age exists for npm (and other tools), but for pnpm the setting is described as config-file driven (minimumReleaseAge), and .npmrc uses minimum-release-age with minutes [4][1].
Citations:
- 1: https://pnpm.io/settings
- 2: minimumReleaseAge causes
pnpm outdatedto fail pnpm/pnpm#10605 - 3: minimumReleaseAge not respected when .npmrc has shared-workspace-lockfile = false pnpm/pnpm#10008
- 4: Add CLI flag
--min-release-age=...to set aminimumReleaseAgeper-invocation (without config file) pnpm/pnpm#11224
Correct .npmrc key and value format for pnpm.
min-release-age=3d is invalid for pnpm's .npmrc. The correct key is minimum-release-age (not min-release-age) and the value must be numeric minutes, not a duration string. For 3 days, use:
minimum-release-age=4320
Without this correction, the minimum release age policy will not be enforced.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.npmrc at line 2, The .npmrc entry uses an invalid key and value format;
replace the incorrect key "min-release-age" with pnpm's correct key
"minimum-release-age" and change the duration string "3d" to numeric minutes (3
days = 4320), i.e., set minimum-release-age=4320 so pnpm enforces the minimum
release age policy.
There was a problem hiding this comment.
@chiol
min-release age should be reflected as the following.
min-release-age=3
ref: https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age
There was a problem hiding this comment.
Seems like the humans are having a chat. I'll hop back into my burrow for now. If you need me again, just tag @coderabbitai in a new comment, and I'll come hopping out!
2 participants
Summary by CodeRabbit