Repository navigation
chore: add npm supply-chain hardening - #23
Conversation
📝 WalkthroughWalkthroughThis PR establishes dependency management policies by adding Dependabot automation and configuring npm/Yarn to enforce a 3-day minimum release age. The changes prevent unstable package versions while enabling automated, weekly dependency update checks. ChangesDependency Management and Security Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.yarnrc.yml:
- Line 1: The npmMinimalAgeGate value is currently a string ("3d") but Yarn
requires a numeric value in minutes; update the npmMinimalAgeGate setting to the
numeric minutes for 3 days (4320) without quotes so the key npmMinimalAgeGate
reads as a number (4320) instead of "3d".
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 3544587e-2ecc-49ed-8de8-48951c97b2cd
📒 Files selected for processing (3)
.github/dependabot.yml.npmrc.yarnrc.yml
| @@ -0,0 +1 @@ | |||
| npmMinimalAgeGate: "3d" | |||
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What are the valid configuration options in Yarn .yarnrc.yml file for controlling npm package installation and release age?
💡 Result:
Valid Yarn.yarnrc.yml configuration keys for controlling npm package installation and “release age” (as of Yarn Berry / Yarn 2+): 1) Controlling npm package installation (npm-related install behavior) - npmAlwaysAuth: enables always sending auth when accessing npm registries. [1] - npmAuditRegistry: set the registry used for npm audit (npm security audit). [1] - npmPublishAccess: set publish access (e.g., public/restricted) for npm publishes. [1] - npmAuditExcludePackages: exclude packages from npm audit. [1] - npmPublishRegistry: registry used for npm publishes. [1] - npmRegistries: configure additional npm registries. [1] - npmRegistryServer: set the npm registry server. [1] - npmScopes: configure per-scope npm settings (including per-scope npmRegistryServer and auth). [1] - Example structure (scope-specific): npmScopes: my-scope: npmRegistryServer: "https://..." npmAuthToken: ${auth-token} npmAlwaysAuth: true (The key npmScopes itself is documented; the per-scope fields are covered under that section.) [1][2] 2) Controlling “release age” (minimum time since npm publish before Yarn will install) - npmMinimalAgeGate: numeric minimum age gate in minutes. When set > 0, Yarn blocks installation of versions that are younger than this threshold; 0 disables the gate. [3][4] - There was also work to set a default (e.g. 3 days = 4320 minutes) and allow opting out by setting npmMinimalAgeGate: 0. [5] - npmPreapprovedPackages: array of package descriptors and/or package name glob patterns to exclude from all package gates (i.e., allowlist/bypass for the gates, including the age gate). [1] Notes / limits: - The official Yarn config reference page lists many keys in.yarnrc.yml, including npm* and npmScopes as shown above. [1] - Yarn’s release-age gate is implemented under the npm resolver and is controlled by npmMinimalAgeGate plus the allowlist-style exclusions in npmPreapprovedPackages. [4] If you want, tell me your Yarn version (e.g., 4.10 vs 4.2) and whether you want the gate applied globally or only for certain npm scopes, and I can suggest a concrete.yarnrc.yml snippet using only supported keys.
Citations:
- 1: https://yarnpkg.com/configuration/yarnrc
- 2: https://stackoverflow.com/questions/78206948/how-to-set-up-yarnrc-yml-for-multiple-private-npm-packages-with-different-regis
- 3: [Feature] Add
minimumReleaseAgeoption similar to pnpm yarnpkg/berry#6899 - 4: feat: implement
npmMinimalAgeGateandnpmPreapprovedPackagesconfig options yarnpkg/berry#6901 - 5: feat: set default npmMinimalAgeGate to 4320 minutes (3 days) yarnpkg/berry#7092
Fix npmMinimalAgeGate value format: use numeric minutes, not string "3d".
npmMinimalAgeGate is a valid Yarn configuration option that enforces a minimum age gate on npm packages. However, the value must be numeric (representing minutes), not a string. The intended 3-day gate should be set to 4320 (3 days × 24 hours × 60 minutes), not "3d". Without the correct numeric format, Yarn will fail to enforce this security control.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.yarnrc.yml at line 1, The npmMinimalAgeGate value is currently a string
("3d") but Yarn requires a numeric value in minutes; update the
npmMinimalAgeGate setting to the numeric minutes for 3 days (4320) without
quotes so the key npmMinimalAgeGate reads as a number (4320) instead of "3d".
Adds repo-level package manager guardrails after the TanStack npm supply-chain incident:
These are intentionally behavior-changing install defaults, so this is opened as a PR instead of pushed straight to the default branch.
Summary by CodeRabbit