docs: add minimumDependencyAge to configuration reference#3046
docs: add minimumDependencyAge to configuration reference#3046aymenhmaidiwastaken wants to merge 1 commit into
Conversation
Document the minimumDependencyAge field in deno.json, which prevents downloading dependencies published too recently as a supply chain security measure. Covers number, ISO 8601 duration, and RFC 3339 date formats, plus the CLI override flag. Closes denoland#3017
fibibot
left a comment
There was a problem hiding this comment.
CI fails on deno fmt --check — the description paragraph (measure that helps protect against attacks where a malicious version is published / and quickly consumed before being detected.) is over the wrap limit. Run deno fmt and push.
Heads up: #3027 by @bartlomieju documents the same field with very similar examples. Worth coordinating on which lands — #3027 has external links to ISO 8601 / RFC 3339 specs and names --unstable-npm-lazy-caching as the activation flag, both worth folding in here.
- nit: the caution callout says "currently unstable" but doesn't tell the reader how to enable the feature. If
--unstable-npm-lazy-cachingis still required (per #3027), it should be on this page too. - nit:
last_modified: 2026-03-09in the frontmatter wasn't bumped — repo convention is to bump it for substantive content changes.
|
Thanks so much for putting this together, @aymenhmaidiwastaken! The |
Summary
minimumDependencyAgefield indeno.json--minimum-dependency-ageCLI override flagCloses #3017