From 643e651ad71080f9c4b2dfde0f25a4b1835356fa Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Sun, 12 Jul 2026 12:50:54 -0700 Subject: [PATCH] chore(bunfig): restore minimumReleaseAge supply-chain gate with scoped excludes --- bunfig.toml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/bunfig.toml b/bunfig.toml index 27722f016f1..791be5f6eff 100644 --- a/bunfig.toml +++ b/bunfig.toml @@ -1,6 +1,17 @@ [install] exact = true -minimumReleaseAge = 0 +# Supply-chain gate: only install package versions published at least 7 days ago +# (blocks freshly published, potentially compromised releases). +minimumReleaseAge = 604800 +# @typescript/native-preview stays excluded permanently: it only publishes nightly +# dev builds, so every version is structurally younger than any age gate. +# typescript@7.0.2 and @typescript/typescript6@6.0.2 were vetted in #5521; they age +# out of the gate on 2026-07-15 and 2026-07-13 — drop those two entries after that. +minimumReleaseAgeExcludes = [ + "typescript", + "@typescript/typescript6", + "@typescript/native-preview", +] [run] env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }