From 1384d3ed4b8dd0b2489adaac81c4d47aa4093204 Mon Sep 17 00:00:00 2001 From: Tim Haines Date: Thu, 23 Jul 2026 20:17:21 +1200 Subject: [PATCH] Add an npm resolution cooldown to match the Dependabot config MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The npm analog of the uv exclude-newer in #861. min-release-age=6 in an .npmrc under the frontend gates tree resolution (npm install/update, lockfile regen) so a version has to age a few days before it resolves — one day under the Dependabot cooldown so bumps still land here. min-release-age arrived in npm 11.10.0 and is a no-op on older npm, which would fail the cooldown open. engine-strict + engines.npm >= 11.10.0 make an older npm error instead. Does not affect npm ci (lockfile verbatim). Co-Authored-By: Claude Opus 4.8 (1M context) --- strix/viewer/frontend/.npmrc | 6 ++++++ strix/viewer/frontend/package.json | 3 +++ 2 files changed, 9 insertions(+) create mode 100644 strix/viewer/frontend/.npmrc diff --git a/strix/viewer/frontend/.npmrc b/strix/viewer/frontend/.npmrc new file mode 100644 index 000000000..69ef87aa0 --- /dev/null +++ b/strix/viewer/frontend/.npmrc @@ -0,0 +1,6 @@ +# Release-age cooldown: don't resolve a version until it's 6 days old, a guard +# against a freshly-compromised upstream. Gates npm install/update, not npm ci. +# Needs npm >= 11.10.0; engine-strict fails an older npm loudly rather than +# silently skipping the unrecognised key. +min-release-age=6 +engine-strict=true diff --git a/strix/viewer/frontend/package.json b/strix/viewer/frontend/package.json index e79db76fd..a42f65c79 100644 --- a/strix/viewer/frontend/package.json +++ b/strix/viewer/frontend/package.json @@ -3,6 +3,9 @@ "private": true, "version": "0.0.0", "type": "module", + "engines": { + "npm": ">=11.10.0" + }, "scripts": { "dev": "vite", "build": "vite build",