mirror of
https://github.com/Dokploy/dokploy.git
synced 2026-09-12 11:40:27 +05:00
9412b52172
@aws-sdk/client-secrets-manager (pre-existing, unrelated to any recent PR) transitively pulled @smithy/fetch-http-handler + @smithy/core versions published the same day, with no older compatible version to fall back to. AWS SDK v3 is dozens of interdependent packages often published together same-day, so a global minimumReleaseAge with no per-scope threshold (pnpm only supports all-or-nothing exclude) was going to keep breaking builds on any lockfile touch. Commented out rather than deleted -- left for whoever wants to revisit it, see discussion on #4679. Also lets @aws-sdk/client-route-53 and @aws-sdk/client-secrets-manager resolve to their actual latest versions now that nothing blocks it.
14 lines
428 B
YAML
14 lines
428 B
YAML
packages:
|
|
- "apps/api"
|
|
- "apps/dokploy"
|
|
- "apps/schedules"
|
|
- "packages/server"
|
|
|
|
# Supply-chain hardening: refuse package versions younger than N days,
|
|
# so newly-published malicious versions get caught/yanked before we install them.
|
|
# Disabled for now — kept breaking builds on unrelated fresh transitive deps
|
|
# (see PR #4679). Re-enable when there's a per-scope threshold or exclude list.
|
|
# minimumReleaseAge: 1440
|
|
|
|
|