From 773c46f68e77df16e344afc2ec2b7ed940e24b7e Mon Sep 17 00:00:00 2001 From: Matiss Janis Aboltins Date: Mon, 1 Jun 2026 10:25:44 +0100 Subject: [PATCH] [AI] Add npm minimal age gate for supply-chain defense (#8011) * [AI] Add npmMinimalAgeGate to block dependency versions newer than 3 days * [autofix.ci] apply automated fixes * [AI] Add release notes for npm minimal age gate --------- Co-authored-by: Claude Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> --- .yarnrc.yml | 5 +++++ upcoming-release-notes/8011.md | 6 ++++++ 2 files changed, 11 insertions(+) create mode 100644 upcoming-release-notes/8011.md diff --git a/.yarnrc.yml b/.yarnrc.yml index eae8da740d..597597bbc3 100644 --- a/.yarnrc.yml +++ b/.yarnrc.yml @@ -11,3 +11,8 @@ yarnPath: .yarn/releases/yarn-4.13.0.cjs # Secure default: don't run postinstall scripts. # If a new package requires them, add it to dependenciesMeta in package.json. enableScripts: false + +# Supply-chain defense: don't install package versions published less than 3 +# days ago, giving the community time to catch compromised releases. Trusted +# packages that need immediate updates can be listed in npmPreapprovedPackages. +npmMinimalAgeGate: '3d' diff --git a/upcoming-release-notes/8011.md b/upcoming-release-notes/8011.md new file mode 100644 index 0000000000..120a7e8c3e --- /dev/null +++ b/upcoming-release-notes/8011.md @@ -0,0 +1,6 @@ +--- +category: Maintenance +authors: [MatissJanis] +--- + +Add a 3-day minimum age gate for npm dependencies to harden against supply-chain attacks