From 467b7a8b4ccb8f08f2db9df8e1407bf5da713732 Mon Sep 17 00:00:00 2001 From: Taylor Buchanan Date: Mon, 1 Jun 2026 21:48:35 -0500 Subject: [PATCH] Add 3-day minimum release age to pnpm and mise Match the shared Renovate preset's 3-day quarantine at the package manager and tool-manager layers for defense in depth. - pnpm: set minimumReleaseAge to 4320 (3 days, in minutes), extending pnpm 11's 1-day default. Covers the full transitive tree at install, not just direct-dep PRs. The existing minimumReleaseAgeExclude for @gtbuchanan/* mirrors the preset's own-package carve-out. - mise: set minimum_release_age to 3d. Only filters fuzzy/latest resolution (e.g. manual `mise up --bump`); exact pins install unaffected and Renovate already gates automated bumps at 3 days. Co-Authored-By: Claude Opus 4.8 (1M context) --- mise.toml | 4 ++++ pnpm-workspace.yaml | 2 ++ 2 files changed, 6 insertions(+) diff --git a/mise.toml b/mise.toml index bbea20b..38f9f6c 100644 --- a/mise.toml +++ b/mise.toml @@ -4,6 +4,10 @@ # Keeps the pnpm pin in one place instead of mirroring it in mise.toml. idiomatic_version_file_enable_tools = ["pnpm"] lockfile = true +# Matches the Renovate/pnpm 3-day quarantine. Only filters fuzzy/`latest` +# resolution (e.g. manual `mise up --bump`); install of the exact pins +# below bypasses it, and Renovate already gates automated bumps at 3 days. +minimum_release_age = "3d" [tools] node = "24.16.0" diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index b6b62b0..e53be3a 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -55,6 +55,8 @@ hoist: false lockfileIncludeTarballUrl: false +# 4320 minutes = 3 days, matching the shared Renovate preset's quarantine. +minimumReleaseAge: 4320 minimumReleaseAgeExclude: - '@gtbuchanan/*'