From: Jérôme Benoit <jerome.benoit@piment-noir.org>
Date: Tue, 26 May 2026 17:47:40 +0000 (+0200)
Subject: ci(renovate): enforce 3-day minimum release age for npm packages
X-Git-Url: https://git.piment-noir.org/?a=commitdiff_plain;h=2b68733e66e05a03725fc3491afc97ac37c7d6ae;p=poolifier.git

ci(renovate): enforce 3-day minimum release age for npm packages

Extend the Renovate config with the official 'security:minimumReleaseAgeNpm'
preset so that Renovate waits 3 days after publication before creating PRs
for any npm/pnpm dependency. This adds a buffer against unpublished or
freshly-broken releases (e.g. malicious packages, npm unpublish window,
transient registry/lockfile resolution issues).
---

diff --git a/renovate.json b/renovate.json
index 8346acb3c..4dd0f2557 100644
--- a/renovate.json
+++ b/renovate.json
@@ -6,7 +6,8 @@
     ":configMigration",
     "group:allNonMajor",
     "schedule:daily",
-    ":maintainLockFilesWeekly"
+    ":maintainLockFilesWeekly",
+    "security:minimumReleaseAgeNpm"
   ],
   "packageRules": [
     {