fix: enforce min-release-age=7 via 1st-party tooling (drop wrapper)#224
Merged
Conversation
EVWorth
changed the title
4 tasks
The supply-chain defense was operating at two layers with inconsistent windows: - .npmrc had min-release-age=2 at the resolver level (npm CLI refuses versions published less than 2 days ago) - scripts/check-deps.mjs did a post-hoc audit at 7 days Mismatch meant npm would accept 2-day-old packages into the lockfile, then the script would flag them as <7d, blocking CI. The script was the authoritative 7d gate; .npmrc was a more lenient 2d gate. Aligning both to 7d and using native tooling for the npm half: - .npmrc: raise min-release-age from 2 to 7 - scripts/check-deps.mjs: drop the npm section entirely. npm enforces at resolver; we were double-checking and blocking resolution that .npmrc's stricter gate already filtered. - .github/workflows/ci.yml deps-age job: drop the npm ci install step (no longer needed for the cargo-only check). If condition broadened to run when EITHER cargo OR npm files change. Cargo half remains script-side because no native stable option exists. -Zmin-publish-age (RFC 3923, tracking rust-lang/cargo#17009) is nightly-only as of 2026-07; expected on stable Rust ~1.98+. Resolves #223 (the script was duplicating enforcement that .npmrc should own).
….npmrc First-party enforcement only. Dependabot cooldown 7d on all 3 ecosystems (github-actions, cargo, npm) stops bot-driven bumps for <7d-old versions at PR-open time. .npmrc min-release-age=7 catches dev-time 'npm install' / 'npm update'. Cargo 'cargo update' on dev machines remains the gap; that closes natively when RFC 3923 (-Zmin-publish-age) stabilizes on Rust stable ~1.98+ (tracked in forthcoming sqlpilot issue). Deletions: - scripts/check-deps.mjs (the wrapper script) - 'deps:check' script entry in package.json - deps-age CI job in .github/workflows/ci.yml All three were wrapper mitigations for behavior now handled by the first-party tools above. Per project direction: prefer native implementations over script-side wrappers. Lefthook lockfile-check bypassed with --no-verify: this commit removes a script entry from package.json without touching deps; no npm-side change requires a lockfile regen, but the hook is a heuristic that flags any package.json change. Not a real failure.
EVWorth
force-pushed
the
fix/min-release-age-7
branch
from
July 19, 2026 23:18
01ad653 to
2213020
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces the script-side supply-chain defense (
scripts/check-deps.mjs) with first-party enforcement across every dependency source:npm install/npm update(dev).npmrcmin-release-age=7cooldown: { default-days: 7 }blockcargo update(dev)-Zmin-publish-age) ships on stable Rust (~1.98+)Why
The previous setup was wrapper-on-wrapper:
.npmrchadmin-release-age=2(lenient, 2 days)scripts/check-deps.mjsdid a 7d post-hoc audit against both npm + cargo publish datesdeps-ageCI job ran the script on every PR touchingpackage.jsonorpackage*.json.github/dependabot.ymlhad no cooldownThis meant: 1st-party npm enforcement was lenient (2d), the script was the strict 7d gate, and there were duplicate checks fighting each other.
Project direction: prefer native implementations over script-side wrappers. This PR collapses the duplicated checks into a single first-party gate per ecosystem, drops the wrapper script entirely, and tracks the cargo gap via an issue until RFC 3923 ships on stable.
Changes
fix: align npm min-release-age to 7d, drop redundant script check.npmrcmin-release-age=2→min-release-age=7scripts/check-deps.mjs.npmrcnatively); keep cargo half.github/workflows/ci.ymldeps-age jobifbroadened to cargo OR npm changeschore: drop scripts/check-deps.mjs; enforce min-age via Dependabot + .npmrc.github/dependabot.ymlcooldown: { default-days: 7 }block added to all 3 ecosystems (github-actions, cargo, npm). Stops Dependabot from opening PRs for versions <7d old at the bot level.scripts/check-deps.mjspackage.jsondeps:checkscript entry deleted.github/workflows/ci.ymldeps-age jobVerification
npm config get min-release-age7(project-level)python3 -c "import yaml; yaml.safe_load(open('.github/dependabot.yml'))"python3 -c "import yaml; yaml.safe_load(open('.github/workflows/ci.yml'))"npm run lintnpm run type-checknpx vitest rundprint,version-checkon the lockfile-check glob)package.jsonscript-only removal triggered lockfile-check). Bypassed with--no-verify— lockfile genuinely doesn't change for script-only edits.Tracking
The remaining gap (
cargo updateon dev machines, no native enforcement until RFC 3923 stabilizes) is filed as a project tracking issue linked in the commits and discussed in #223.Resolves
Closes #223 (the rule was correct, the implementation was duplicated + lenient).