From 873ce7860214ea80a0a2f6da290fbe7c38b0644f Mon Sep 17 00:00:00 2001 From: Tyler Ford Date: Fri, 31 Jul 2026 13:44:26 -0400 Subject: [PATCH 1/2] fix(supply chain): add minimumReleaseAgeStrict + minimumReleaseAgeIgnoreMissingTime --- pnpm-workspace.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index fe40c3be7..09245687e 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,6 +9,11 @@ minimumReleaseAgeExclude: - '@commercetools-backend/*' - '@commercetools-uikit/*' +# minimumReleaseAge set explicitly flips this to hard-fail; false restores pnpm's soft fall-back so clean CI/Vercel installs don't break. +minimumReleaseAgeStrict: false +# Skip the age gate for packages whose registry metadata lacks a publish time (pnpm/pnpm#11616). +minimumReleaseAgeIgnoreMissingTime: true + blockExoticSubdeps: true allowBuilds: From 76f3367edce44b29d7ae8742df98b89ae99496ef Mon Sep 17 00:00:00 2001 From: Tyler Ford Date: Mon, 3 Aug 2026 17:07:22 -0400 Subject: [PATCH 2/2] fix(supply-chain): adopt strict minimumReleaseAge posture --- pnpm-workspace.yaml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 09245687e..83f98222d 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -9,10 +9,10 @@ minimumReleaseAgeExclude: - '@commercetools-backend/*' - '@commercetools-uikit/*' -# minimumReleaseAge set explicitly flips this to hard-fail; false restores pnpm's soft fall-back so clean CI/Vercel installs don't break. -minimumReleaseAgeStrict: false -# Skip the age gate for packages whose registry metadata lacks a publish time (pnpm/pnpm#11616). -minimumReleaseAgeIgnoreMissingTime: true +# Explicit minimumReleaseAge already makes pnpm hard-fail on a no-mature-match; true keeps that (no silent fall-back or auto-exclude). +minimumReleaseAgeStrict: true +# Deliberate tightening: enforce the gate even when registry metadata omits a publish time, so a time-less mirror can't waive the cooldown. +minimumReleaseAgeIgnoreMissingTime: false blockExoticSubdeps: true