mirror of
https://github.com/teamchong/pxpipe.git
synced 2026-07-22 02:02:51 +02:00
teamchong
9288c99b5c
Refuses to install any package version published less than 3 days ago. Catches the typical malicious-package lifecycle (publish → discovered → unpublished within hours/days). Legitimate security patches also wait 3 days; deliberate trade-off for a manually-updated repo.
13 lines
499 B
YAML
13 lines
499 B
YAML
onlyBuiltDependencies:
|
|
- esbuild
|
|
- sharp
|
|
- workerd
|
|
|
|
# Supply-chain hardening: refuse to install any package version published
|
|
# less than 3 days ago. Catches the typical malicious-package lifecycle
|
|
# (publish → discovered → unpublished within hours/days). Legitimate
|
|
# security patches also wait 3 days; that's a deliberate trade-off for a
|
|
# repo we update manually.
|
|
minimumReleaseAge: 4320 # minutes (= 3 days)
|
|
# minimumReleaseAgeExclude: # add packages here if a fast follow is needed
|