Skip to content

Add npm dependency release age cooldown #1339

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
cristianrgreco wants to merge 3 commits into
base: main
Choose a base branch
from
+6 −3
Open

Add npm dependency release age cooldown #1339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0f8f7f7
Add npm dependency release age cooldown
cristianrgreco May 26, 2026
e36441b
Stabilize OracleFree startup test
cristianrgreco May 26, 2026
2eb80d9
Merge branch 'main' into codex/npm-release-age-cooldown
cristianrgreco May 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ updates:
directory: "/"
schedule:
interval: "weekly"
cooldown:
default-days: 7
labels:
- "dependencies"
- "javascript"
Expand Down
3 changes: 2 additions & 1 deletion .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,2 @@
engine-strict=true
engine-strict=true
min-release-age=7
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Guard min-release-age with supported npm version

min-release-age is currently ignored in environments where npm does not implement that config, so this line can create a false sense of protection while installs still resolve freshly published versions. In this repo, running npm commands already emits Unknown project config "min-release-age", which means the policy is not being enforced in those runtimes; given CI/workflows run across multiple Node versions, this should be gated by an npm-version check or accompanied by an explicit npm minimum to ensure the cooldown is actually active.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Collaborator Author

@cristianrgreco cristianrgreco May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this should be gated by an npm-version check or accompanied by an explicit npm minimum to ensure the cooldown is actually active.

Cooldown is dependabot specific right, not related to the min-release-age config setting?

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove unsupported min-release-age project setting

This repository-level setting is currently not enforced by npm in this environment, so it creates a false security guarantee: running npm --version or npm config --help in the repo prints Unknown project config "min-release-age", which means installs proceed without the intended 7-day gate. Fresh evidence since prior comments: this warning is reproducible against the current tree at commit 5bdef7d5, so the cooldown policy is silently inactive unless you also require an npm version that supports this key.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector Bot May 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove unsupported min-release-age config

Fresh evidence on this commit: running npm config --help in the repo prints Unknown project config "min-release-age", which means npm ignores this key in the current toolchain and installs are not actually gated by package publish age. That creates a false safety guarantee (Dependabot cooldown only delays Dependabot PRs, not local/CI npm install resolution), so this setting should be removed or guarded by enforcing an npm version that supports it.

Useful? React with 👍 / 👎.

4 changes: 2 additions & 2 deletions packages/modules/oraclefree/src/oraclefree-container.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,10 @@ describe.sequential("OracleFreeContainer", { timeout: 240_000 }, () => {
// start one container for all tests in this block to save on resources
beforeAll(async () => {
container = await new OracleDbContainer(IMAGE).start();
}, 120_000);
}, 240_000);

afterAll(async () => {
await container.stop();
await container?.stop();
});

it("should connect and return a query result", async () => {
Expand Down
Loading