Skip to content

docs: add minimumDependencyAge to configuration reference#3046

Closed
aymenhmaidiwastaken wants to merge 1 commit into
denoland:mainfrom
aymenhmaidiwastaken:docs/add-minimum-dependency-age
Closed

docs: add minimumDependencyAge to configuration reference#3046
aymenhmaidiwastaken wants to merge 1 commit into
denoland:mainfrom
aymenhmaidiwastaken:docs/add-minimum-dependency-age

Conversation

@aymenhmaidiwastaken
Copy link
Copy Markdown

Summary

  • Added documentation for the minimumDependencyAge field in deno.json
  • This supply chain security feature was added in denoland/deno#31007 but wasn't documented in the configuration reference
  • Covers all supported value formats: number (minutes), ISO 8601 duration, and RFC 3339 date
  • Documents the --minimum-dependency-age CLI override flag

Closes #3017

Document the minimumDependencyAge field in deno.json, which prevents
downloading dependencies published too recently as a supply chain
security measure. Covers number, ISO 8601 duration, and RFC 3339 date
formats, plus the CLI override flag.

Closes denoland#3017
Copy link
Copy Markdown
Contributor

@fibibot fibibot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI fails on deno fmt --check — the description paragraph (measure that helps protect against attacks where a malicious version is published / and quickly consumed before being detected.) is over the wrap limit. Run deno fmt and push.

Heads up: #3027 by @bartlomieju documents the same field with very similar examples. Worth coordinating on which lands — #3027 has external links to ISO 8601 / RFC 3339 specs and names --unstable-npm-lazy-caching as the activation flag, both worth folding in here.

  • nit: the caution callout says "currently unstable" but doesn't tell the reader how to enable the feature. If --unstable-npm-lazy-caching is still required (per #3027), it should be on this page too.
  • nit: last_modified: 2026-03-09 in the frontmatter wasn't bumped — repo convention is to bump it for substantive content changes.

@bartlomieju
Copy link
Copy Markdown
Member

Thanks so much for putting this together, @aymenhmaidiwastaken! The minimumDependencyAge documentation is now covered as part of the Deno 2.8 docs update in #3100, which adds a dedicated section under the supply-chain security guide (including all value formats, the --minimum-dependency-age CLI flag, and the .npmrc equivalent). Closing this in favor of #3100 — really appreciate you taking the time to document this!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Docs for deno.json don't mention minimumDependencyAge setting

3 participants