chore(deps): pin dependencies to versions at least 7 days old#1598
Open
RaananW wants to merge 3 commits into
Open
chore(deps): pin dependencies to versions at least 7 days old#1598RaananW wants to merge 3 commits into
RaananW wants to merge 3 commits into
Conversation
Downgrade four transitive/direct deps whose locked versions were published less than 7 days ago to the newest versions published on or before the 7-day cutoff, per company policy: - baseline-browser-mapping 2.10.42 -> 2.10.41 - electron-to-chromium 1.5.387 -> 1.5.385 - tsx 4.23.0 -> 4.22.5 - webpack 5.108.4 -> 5.108.3 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Documentation snapshot uploaded. Snapshot: https://snapshots-cvgtc2eugrd3cgfd.z01.azurefd.net/DOCS/refs/pull/1598/merge |
Add an .npmrc with min-release-age=7 so npm only installs package versions published at least 7 days ago (npm 11.10.0+ feature), and engine-strict=true to enforce the engines requirement. Require npm >= 11.10.0 in package.json engines, since older npm silently ignores min-release-age. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
npm ci was failing with EBADENGINE because Node 22.x ships npm 10.x, below the engines requirement (npm >= 11.10.0) needed for the min-release-age dependency-cooldown policy. Node 24.x bundles npm 11.16+, satisfying the requirement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Documentation snapshot uploaded. Snapshot: https://snapshots-cvgtc2eugrd3cgfd.z01.azurefd.net/DOCS/refs/pull/1598/merge |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Enforces the new company-wide policy that npm dependencies must be at least 7 days old, and makes it automatic going forward.
1. Repin too-new locked versions
Four packages were resolved to versions published only 1–2 days ago; each is pinned back to the newest version published on or before the 7-day cutoff (2026-07-03), still satisfying its existing semver ranges.
baseline-browser-mappingelectron-to-chromiumtsxwebpack2. Enforce the policy going forward
.npmrc:min-release-age=7— npm will only install versions public for ≥ 7 days (npm 11.10.0+ feature; older npm silently ignores it)..npmrc:engine-strict=true— enforce theenginesrequirement below.package.jsonengines.npm:>=11.10.0, since older npm ignoresmin-release-age.How
name@versionentries inpackage-lock.jsonagainst npm registry publish times.npm install --package-lock-onlyto reconcile (no sub-dependency changes, 0 vulnerabilities).