Skip to content

chore: enforce 7-day supply-chain cooldown on dependencies #87

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
pofallon wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: enforce 7-day supply-chain cooldown on dependencies #87

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,13 @@ updates:
day: "monday"
time: "09:00"
open-pull-requests-limit: 10
# Supply-chain cooldown: hold newly published versions for 7 days so a
# compromised release can be detected/yanked before it's proposed. The
# first-party @get2knowio/* scope is exempt.
cooldown:
default-days: 7
exclude:
- "@get2knowio/*"
reviewers:
- "pofallon"
assignees:
Expand All @@ -27,6 +34,8 @@ updates:
day: "monday"
time: "09:00"
open-pull-requests-limit: 5
cooldown:
default-days: 7
reviewers:
- "pofallon"
assignees:
Expand Down
4 changes: 4 additions & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
# Supply-chain cooldown: refuse versions published less than 7 days ago so a
# malicious release has time to be detected/yanked before install. npm has no
# per-package exclusion, so this applies to all deps.
min-release-age=7

@coderabbitai coderabbitai Bot Jun 15, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

For npm CLI, does min-release-age apply uniformly to all installs/resolutions (including security patch versions), and is there any built-in exception mechanism for security updates?

💡 Result:

In the npm CLI (as of June 2026), the min-release-age configuration applies to all package installations and resolutions performed by commands that involve dependency resolution, such as npm install and npm update [1][2][3]. It does not natively distinguish between standard package updates and security patches, meaning it will block recently published security fixes if they fall within the configured "cooldown" period, resulting in an ETARGET error [4]. There are two primary ways to manage exceptions for this policy: 1. Explicit Bypass via Command-line Flag: You can override the configuration for specific commands by setting the flag to zero. For example, running npm install <package-name> --min-release-age=0 will bypass the cooldown period for that specific operation [5][4]. This is commonly used in automated workflows (such as Dependabot) to ensure critical security patches are installed immediately [4]. 2. Built-in Exclusion Mechanism: Recently, npm introduced the min-release-age-exclude configuration option [6]. This allows users to define a list of packages (supporting exact names or glob patterns, such as @myorg/*) that are exempt from the min-release-age policy [7][6]. This provides a structured way to allow trusted packages or internal libraries to bypass the age restriction consistently without needing to manually override the flag for every command [7]. Note that min-release-age does not affect npm ci, as that command installs packages verbatim from the lockfile without performing new resolution [3]. Additionally, due to how npm handles configuration flattening, min-release-age may appear as null when checked via npm config get if it has been converted into a before date for internal use [8][9].

Citations:

min-release-age=7 blocks security patches during npm install/npm update even when Dependabot overrides it per-PR.

min-release-age applies globally to resolution-based commands and does not distinguish between security patches and standard updates. This means npm install and npm update will reject recently published security fixes within the 7-day window, resulting in an ETARGET error—delaying critical patches. (npm ci itself is unaffected as it uses the lockfile without resolution.)

While Dependabot can override with --min-release-age=0 per-PR, consider using the min-release-age-exclude configuration option to exempt security-critical packages from the policy, or lower the window for packages with known vulnerability exposure.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.npmrc at line 4, The `min-release-age=7` setting in the .npmrc file
prevents npm from installing security patches published within the last 7 days,
blocking critical security updates during `npm install` and `npm update`
commands. To fix this, configure `min-release-age-exclude` in the .npmrc file to
exempt security-critical packages from the policy, allowing recently published
security patches to be installed immediately while maintaining the 7-day window
for other dependencies. Alternatively, lower the `min-release-age` value for
packages with known vulnerability exposure to reduce the delay in applying
security fixes.