fix: disable minimumReleaseAge (broke builds on unrelated AWS SDK deps)

@aws-sdk/client-secrets-manager (pre-existing, unrelated to any recent
PR) transitively pulled @smithy/fetch-http-handler + @smithy/core
versions published the same day, with no older compatible version to
fall back to. AWS SDK v3 is dozens of interdependent packages often
published together same-day, so a global minimumReleaseAge with no
per-scope threshold (pnpm only supports all-or-nothing exclude) was
going to keep breaking builds on any lockfile touch. Commented out
rather than deleted -- left for whoever wants to revisit it, see
discussion on #4679.

Also lets @aws-sdk/client-route-53 and @aws-sdk/client-secrets-manager
resolve to their actual latest versions now that nothing blocks it.
This commit is contained in:
Mauricio Siu 2026-08-12 04:26:27 -06:00
parent 7825537964
commit 9412b52172
4 changed files with 210 additions and 526 deletions

View File

@ -47,8 +47,8 @@
"@ai-sdk/mistral": "^3.0.20", "@ai-sdk/mistral": "^3.0.20",
"@ai-sdk/openai": "^3.0.29", "@ai-sdk/openai": "^3.0.29",
"@ai-sdk/openai-compatible": "^2.0.30", "@ai-sdk/openai-compatible": "^2.0.30",
"@aws-sdk/client-route-53": "^3.1097.0", "@aws-sdk/client-route-53": "^3.1108.0",
"@aws-sdk/client-secrets-manager": "^3.1097.0", "@aws-sdk/client-secrets-manager": "^3.1108.0",
"@better-auth/api-key": "1.6.23", "@better-auth/api-key": "1.6.23",
"@better-auth/passkey": "1.6.23", "@better-auth/passkey": "1.6.23",
"@better-auth/scim": "1.6.23", "@better-auth/scim": "1.6.23",

View File

@ -37,8 +37,8 @@
"@ai-sdk/mistral": "^3.0.20", "@ai-sdk/mistral": "^3.0.20",
"@ai-sdk/openai": "^3.0.29", "@ai-sdk/openai": "^3.0.29",
"@ai-sdk/openai-compatible": "^2.0.30", "@ai-sdk/openai-compatible": "^2.0.30",
"@aws-sdk/client-route-53": "^3.1097.0", "@aws-sdk/client-route-53": "^3.1108.0",
"@aws-sdk/client-secrets-manager": "^3.1097.0", "@aws-sdk/client-secrets-manager": "^3.1108.0",
"@better-auth/api-key": "1.6.23", "@better-auth/api-key": "1.6.23",
"@better-auth/passkey": "1.6.23", "@better-auth/passkey": "1.6.23",
"@better-auth/scim": "1.6.23", "@better-auth/scim": "1.6.23",

File diff suppressed because it is too large Load Diff

View File

@ -4,8 +4,10 @@ packages:
- "apps/schedules" - "apps/schedules"
- "packages/server" - "packages/server"
# Supply-chain hardening: refuse package versions younger than 3 days (4320 min), # Supply-chain hardening: refuse package versions younger than N days,
# so newly-published malicious versions get caught/yanked before we install them. # so newly-published malicious versions get caught/yanked before we install them.
minimumReleaseAge: 4320 # Disabled for now — kept breaking builds on unrelated fresh transitive deps
# (see PR #4679). Re-enable when there's a per-scope threshold or exclude list.
# minimumReleaseAge: 1440