Merge pull request #5798 from bjester/min-release-age

Add minReleaseAge to pnpm settings to reduce likelihood of supply chain compromises

Author: rtibbles

.github/dependabot.yml

@@ -20,6 +20,12 @@ updates:
       time: "00:00"
     cooldown:
       default-days: 7
+      exclude:
+        - kolibri-constants
+        - kolibri-design-system
+        - kolibri-logging
+        - kolibri-format
+        - kolibri-tools
     groups:
       babel:
         patterns:

package.json

@@ -183,7 +183,7 @@
     "> 1%",
     "Firefox ESR"
   ],
-  "packageManager": "pnpm@10.12.4+sha512.5ea8b0deed94ed68691c9bad4c955492705c5eeb8a87ef86bc62c74a26b037b08ff9570f108b2e4dbd1dd1a9186fea925e527f141c648e85af45631074680184",
+  "packageManager": "pnpm@10.33.0+sha512.10568bb4a6afb58c9eb3630da90cc9516417abebd3fabbe6739f0ae795728da1491e9db5a544c76ad8eb7570f5c4bb3d6c637b2cb41bfdcdb47fa823c8649319",
   "volta": {
     "node": "20.19.3",
     "pnpm": "10.12.4"

pnpm-workspace.yaml

@@ -0,0 +1,8 @@
+# minimum number of minutes
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - kolibri-constants
+  - kolibri-design-system
+  - kolibri-logging
+  - kolibri-format
+  - kolibri-tools