From 82aa35cf87a49555211809cef9d57cc6332de5df Mon Sep 17 00:00:00 2001
From: Steven Chong <25894545+teamchong@users.noreply.github.com>
Date: Fri, 22 May 2026 23:45:55 -0400
Subject: [PATCH] chore(deps): enforce 3-day install quarantine + bump ws to
 patched 8.20.1+

- .npmrc: pin minimum-release-age=4320 (3 days) for supply-chain
  defence; new versions can't be installed until they've been
  on the registry long enough for typo-squat / compromise to be
  caught and yanked.
- minimum-release-age-exclude=@cloudflare/* so first-party
  packages don't block our own iteration.
- pnpm.overrides forces ws>=8.20.1 transitively via miniflare,
  closing GHSA-58qx-3vcg-4xpx (moderate, uninitialized memory
  disclosure in ws). Dev-only chain, no prod runtime impact, but
  worth keeping clean for dependabot.
---
 .npmrc         |  7 +++++++
 package.json   |  7 ++++++-
 pnpm-lock.yaml | 11 ++++++-----
 3 files changed, 19 insertions(+), 6 deletions(-)
 create mode 100644 .npmrc

diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..0cfe630
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,7 @@
+# Supply-chain hardening: wait 3 days after publish before installing a new
+# version. Catches typo-squat / compromise windows where the malicious version
+# is yanked before it propagates. See:
+# https://pnpm.io/settings#minimumreleaseage
+minimum-release-age=4320
+# First-party packages we publish ourselves should not block our own iteration.
+minimum-release-age-exclude=@cloudflare/*
diff --git a/package.json b/package.json
index 46e3a21..431cc21 100644
--- a/package.json
+++ b/package.json
@@ -85,5 +85,10 @@
     "vite": "8.0.13",
     "vitest": "^4.1.6",
     "wrangler": "^4.92.0"
+  },
+  "pnpm": {
+    "overrides": {
+      "ws@>=8.0.0 <8.20.1": "^8.20.1"
+    }
   }
-}
+}
\ No newline at end of file
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 783ee9a..cd58b9d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,7 +4,8 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
-pnpmfileChecksum: sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=
+overrides:
+  ws@>=8.0.0 <8.20.1: ^8.20.1
 
 importers:
 
@@ -1273,8 +1274,8 @@ packages:
       '@cloudflare/workers-types':
         optional: true
 
-  ws@8.18.0:
-    resolution: {integrity: sha512-8VbfWfHLbbwu3+N6OKsOMpBdT4kXPDDB9cJk2bJ6mh9ucxdlnNvH1e+roYkKmN9Nxw2yjz7VzeO9oOz2zJ04Pw==}
+  ws@8.21.0:
+    resolution: {integrity: sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -1983,7 +1984,7 @@ snapshots:
       sharp: 0.34.5
       undici: 7.24.8
       workerd: 1.20260515.1
-      ws: 8.18.0
+      ws: 8.21.0
       youch: 4.1.0-beta.10
     transitivePeerDependencies:
       - bufferutil
@@ -2199,7 +2200,7 @@ snapshots:
       - bufferutil
       - utf-8-validate
 
-  ws@8.18.0: {}
+  ws@8.21.0: {}
 
   youch-core@0.3.3:
     dependencies: