# Supply-chain hardening for the repo's Node dev tooling.
#
# minimum-release-age: refuse any package version published less than 48h ago.
# Compromised-maintainer attacks are caught and yanked within hours, so a
# cooldown is what stops a poisoned release entering a lockfile at all. Needs
# pnpm >= 10.16 (see `packageManager` in package.json) — npm has no equivalent,
# which is why this repo's Node deps are on pnpm.
minimum-release-age=2880
