The_Great_Archive/dokploy
1
0
Fork 0
mirror of https://github.com/Dokploy/dokploy.git synced 2026-09-12 19:51:00 +05:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

chore: enforce 3-day minimum release age for dependencies

Browse Source 
Supply-chain hardening. pnpm 10.16+ native minimumReleaseAge refuses to
resolve any dependency version published less than 3 days ago (4320 min),
so newly-published malicious versions get caught/yanked before we install.
Workspace-wide, so it covers root, apps/* and packages/server. Only gates
new resolutions; versions already pinned in the lockfile are unaffected.

Closes #4678

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
vikyw89 2026-06-22 14:54:10 +00:00
parent 24b02f5523
commit 57bb9f27bd
No known key found for this signature in database
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
pnpm-workspace.yaml
View File

@ -4,4 +4,8 @@ packages:
- "apps/schedules"
- "packages/server"
# Supply-chain hardening: refuse package versions younger than 3 days (4320 min),
# so newly-published malicious versions get caught/yanked before we install them.
minimumReleaseAge: 4320