dokploy/pnpm-workspace.yaml at 3be9cdfe65ecbcdb68bbb57b80f33dcd86642bf7 - dokploy - zinch - Git

The_Great_Archive/dokploy

mirror of https://github.com/Dokploy/dokploy.git synced 2026-09-14 11:06:15 +05:00

vikyw89 57bb9f27bd

chore: enforce 3-day minimum release age for dependencies

Supply-chain hardening. pnpm 10.16+ native minimumReleaseAge refuses to
resolve any dependency version published less than 3 days ago (4320 min),
so newly-published malicious versions get caught/yanked before we install.
Workspace-wide, so it covers root, apps/* and packages/server. Only gates
new resolutions; versions already pinned in the lockfile are unaffected.

Closes #4678

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-22 14:54:10 +00:00

12 lines

278 B

YAML

Raw Blame History

 packages:
   - "apps/api"
   - "apps/dokploy"
   - "apps/schedules"
   - "packages/server"
 # Supply-chain hardening: refuse package versions younger than 3 days (4320 min),
 # so newly-published malicious versions get caught/yanked before we install them.
 minimumReleaseAge: 4320