From 43f18cca81df109c7e8fa69e0c262288f9a0a7e3 Mon Sep 17 00:00:00 2001 From: ethernet Date: Thu, 30 Jul 2026 17:03:39 -0400 Subject: [PATCH] feat(sec): add min-release-age = 2 wks in .npmrc has some exclusions for packages with recent security fixes, which are to be removed in >= 2wks --- .npmrc | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .npmrc diff --git a/.npmrc b/.npmrc new file mode 100644 index 0000000000000..d95ac8986d9f0 --- /dev/null +++ b/.npmrc @@ -0,0 +1,32 @@ +min-release-age=14 +# allow assistant-ui packages & a couple specific deps since they update a LOT. +# remove this when we stabilize (or we haven't updated in 2 wks) +min-release-age-exclude[]=@assistant-ui/* +min-release-age-exclude[]=assistant-cloud +min-release-age-exclude[]=assistant-stream +min-release-age-exclude[]=@radix-ui/* +min-release-age-exclude[]=radix-ui +min-release-age-exclude[]=safe-content-frame + +# react-router 8.3.0 includes fixes for vulns. remove this when 8.3.0 is > 2wks old. +min-release-age-exclude[]=react-router + +# eslint 10.8.0 includes fixes for vulns. remove this when 10.8.0 is > 2wks old. +min-release-age-exclude[]=eslint +min-release-age-exclude[]=@eslint/* + +# tar 7.5.21 includes fixes for vulns. remove this when 7.5.21 is > 2wks old +min-release-age-exclude[]=tar + +# concurrently 10.0.4 includes fixes for vulns. remove this when 10.0.4 is > 2wks old +min-release-age-exclude[]=concurrently + +# fast-uri 3.1.4 includes fixes for vulns. remove this when 3.1.4 is > 2wks old +min-release-age-exclude[]=fast-uri + +# minimatch 10.2.6 includes fixes for vulns. remove this when 10.2.6 is > 2wks old +min-release-age-exclude[]=minimatch + + +# brace-expansion 5.0.8 includes fixes for vulns. remove this when 5.0.8 is > 2wks old +min-release-age-exclude[]=brace-expansion \ No newline at end of file