Add npm dependency release age cooldown#1339
Conversation
✅ Deploy Preview for testcontainers-node ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
cristianrgreco
added
maintenance
ChatGPT Codex Connector
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0f8f7f7c13
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1 +1,2 @@ | |||
| engine-strict=true No newline at end of file | |||
| engine-strict=true | |||
| min-release-age=7 | |||
There was a problem hiding this comment.
min-release-age is currently ignored in environments where npm does not implement that config, so this line can create a false sense of protection while installs still resolve freshly published versions. In this repo, running npm commands already emits Unknown project config "min-release-age", which means the policy is not being enforced in those runtimes; given CI/workflows run across multiple Node versions, this should be gated by an npm-version check or accompanied by an explicit npm minimum to ensure the cooldown is actually active.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
this should be gated by an npm-version check or accompanied by an explicit npm minimum to ensure the cooldown is actually active.
Cooldown is dependabot specific right, not related to the min-release-age config setting?
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e36441baa8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1 +1,2 @@ | |||
| engine-strict=true No newline at end of file | |||
| engine-strict=true | |||
| min-release-age=7 | |||
There was a problem hiding this comment.
min-release-age project setting
This repository-level setting is currently not enforced by npm in this environment, so it creates a false security guarantee: running npm --version or npm config --help in the repo prints Unknown project config "min-release-age", which means installs proceed without the intended 7-day gate. Fresh evidence since prior comments: this warning is reproducible against the current tree at commit 5bdef7d5, so the cooldown policy is silently inactive unless you also require an npm version that supports this key.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2eb80d94e4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1 +1,2 @@ | |||
| engine-strict=true No newline at end of file | |||
| engine-strict=true | |||
| min-release-age=7 | |||
There was a problem hiding this comment.
min-release-age config
Fresh evidence on this commit: running npm config --help in the repo prints Unknown project config "min-release-age", which means npm ignores this key in the current toolchain and installs are not actually gated by package publish age. That creates a false safety guarantee (Dependabot cooldown only delays Dependabot PRs, not local/CI npm install resolution), so this setting should be removed or guarded by enforcing an npm version that supports it.
Useful? React with 👍 / 👎.
1 participant
Summary
Verification
npm cinpm run formatnpm run lintgit diff --checknpm run test -- packages/modules/oraclefree/src/oraclefree-container.test.ts -t "default configuration"min-release-ageconfig without error.Test Results
npm cipassed and installed dependencies from the lockfile.npm run formatpassed with no formatting changes.npm run lintpassed.git diff --checkpassed.ORA-27040: No space left on device).Semver Impact
Patch. This does not change any published package API or runtime behavior. The diff updates repository npm/Dependabot configuration and a test-only OracleFree timeout/cleanup path, so it is not a breaking change.