chore: configure 3-day release age gate for npm packages

[dev-hari-prasad]

Part of #10363.

Configures Yarn's npmMinimalAgeGate setting to 3d in both web/.yarnrc.yml and runtime/.yarnrc.yml.

This introduces a 3-day cooldown period for newly published package versions before they can be resolved, protecting the project against freshly published or compromised npm supply-chain packages while giving the community time to detect and revoke malicious versions.

Changes

• Added npmMinimalAgeGate: 3d to web/.yarnrc.yml
• Added npmMinimalAgeGate: 3d to runtime/.yarnrc.yml

Summary by CodeRabbit

• Chores
  • Package installation now applies a three-day minimum age requirement to npm packages.
  • This configuration is enabled consistently across runtime and web environments.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: e760bb64-0af1-4f3d-9ce7-15c21d895d86

📥 Commits

Reviewing files that changed from the base of the PR and between bd7cde5 and 2dbee48.

📒 Files selected for processing (2)

• runtime/.yarnrc.yml
• web/.yarnrc.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

Walkthrough

The runtime and web Yarn configurations now require npm packages to be at least three days old.

Changes

npm package age gate

Layer / File(s)	Summary
Configure npm package age gate runtime/.yarnrc.yml, web/.yarnrc.yml	Adds npmMinimalAgeGate: 3d to both Yarn configurations.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 2dbee

Package resolution in both runtime and web now requires npm releases to be at least three days old, reducing exposure to newly published compromised packages. The change is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: configuring a three-day npm package release age gate in Yarn.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}