Skip to content

chore: add npm supply-chain hardening #23

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kitze merged 3 commits into from
May 13, 2026
Merged

chore: add npm supply-chain hardening #23

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a1c2a04
chore: add npm supply-chain hardening: .npmrc
kitze May 13, 2026
fb93b02
chore: add npm supply-chain hardening: .yarnrc.yml
kitze May 13, 2026
167a7e3
chore: add npm supply-chain hardening: .github/dependabot.yml
kitze May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
version: 2
updates:
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
cooldown:
default-days: 7
semver-major-days: 7
semver-minor-days: 7
semver-patch-days: 7
2 changes: 2 additions & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
ignore-scripts=true
min-release-age=3
1 change: 1 addition & 0 deletions .yarnrc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
npmMinimalAgeGate: "3d"

@coderabbitai coderabbitai Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

What are the valid configuration options in Yarn .yarnrc.yml file for controlling npm package installation and release age?

💡 Result:

Valid Yarn.yarnrc.yml configuration keys for controlling npm package installation and “release age” (as of Yarn Berry / Yarn 2+): 1) Controlling npm package installation (npm-related install behavior) - npmAlwaysAuth: enables always sending auth when accessing npm registries. [1] - npmAuditRegistry: set the registry used for npm audit (npm security audit). [1] - npmPublishAccess: set publish access (e.g., public/restricted) for npm publishes. [1] - npmAuditExcludePackages: exclude packages from npm audit. [1] - npmPublishRegistry: registry used for npm publishes. [1] - npmRegistries: configure additional npm registries. [1] - npmRegistryServer: set the npm registry server. [1] - npmScopes: configure per-scope npm settings (including per-scope npmRegistryServer and auth). [1] - Example structure (scope-specific): npmScopes: my-scope: npmRegistryServer: "https://..." npmAuthToken: ${auth-token} npmAlwaysAuth: true (The key npmScopes itself is documented; the per-scope fields are covered under that section.) [1][2] 2) Controlling “release age” (minimum time since npm publish before Yarn will install) - npmMinimalAgeGate: numeric minimum age gate in minutes. When set > 0, Yarn blocks installation of versions that are younger than this threshold; 0 disables the gate. [3][4] - There was also work to set a default (e.g. 3 days = 4320 minutes) and allow opting out by setting npmMinimalAgeGate: 0. [5] - npmPreapprovedPackages: array of package descriptors and/or package name glob patterns to exclude from all package gates (i.e., allowlist/bypass for the gates, including the age gate). [1] Notes / limits: - The official Yarn config reference page lists many keys in.yarnrc.yml, including npm* and npmScopes as shown above. [1] - Yarn’s release-age gate is implemented under the npm resolver and is controlled by npmMinimalAgeGate plus the allowlist-style exclusions in npmPreapprovedPackages. [4] If you want, tell me your Yarn version (e.g., 4.10 vs 4.2) and whether you want the gate applied globally or only for certain npm scopes, and I can suggest a concrete.yarnrc.yml snippet using only supported keys.

Citations:

Fix npmMinimalAgeGate value format: use numeric minutes, not string "3d".

npmMinimalAgeGate is a valid Yarn configuration option that enforces a minimum age gate on npm packages. However, the value must be numeric (representing minutes), not a string. The intended 3-day gate should be set to 4320 (3 days × 24 hours × 60 minutes), not "3d". Without the correct numeric format, Yarn will fail to enforce this security control.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.yarnrc.yml at line 1, The npmMinimalAgeGate value is currently a string
("3d") but Yarn requires a numeric value in minutes; update the
npmMinimalAgeGate setting to the numeric minutes for 3 days (4320) without
quotes so the key npmMinimalAgeGate reads as a number (4320) instead of "3d".