fix: repair the supply-chain soak — enforce minimumReleaseAge and drop the stale exclusion list

[unional]

This repairs a control that was silently inactive

This is not a loosening of policy — it is a tightening in two places at once.

The repo intended a 24h supply-chain soak via minimumreleaseage=1440 in .npmrc. From there it does nothing useful:

• pnpm auto-enables strict soak mode only when the setting comes from pnpm-workspace.yaml / config.yaml / CLI / env. From .npmrc it runs in loose mode.
• In loose mode, when pnpm meets a package younger than the window it does not fail — it silently appends that package to minimumReleaseAgeExclude and installs anyway.
• npm itself does not recognise minimumreleaseage as a valid npmrc key.

Observable proof in this repo: pnpm config get minimumReleaseAge returned undefined before this change and 1440 after. Before, pnpm install --frozen-lockfile never reached a supply-chain step; after, it runs Verifying lockfile against supply-chain policies (415 entries).

The exclusion list

pnpm-workspace.yaml carried a 23-entry minimumReleaseAgeExclude block, added wholesale in #221 "to allow specific known-good transitive versions past the minimum release-age gate". Entries looked like:

- brace-expansion@1.1.12 || 1.1.13 || 1.1.16 || 2.0.2 || 2.0.3 || 2.1.2 || 5.0.5 || 5.0.6 || 5.0.7
- minimatch@3.1.3 || 3.1.4 || 9.0.6 || 9.0.7 || 10.2.1 || 10.2.3
- js-yaml@3.14.2 || 3.15.0 || 4.1.1 || 4.1.2 || 4.3.0

These are multi-version blanket waivers on 23 widely-depended-on packages, written in July. Under loose mode they were harmless noise, because nothing was being enforced anyway. The moment strict mode is switched on they become the opposite: a permanent, standing hole through the control, covering the packages an attacker would most want to reach.

Every version named has long since aged well past 24 hours, so none of it is doing any work. The whole block is removed, and with it gone and strict mode on, all 415 lockfile entries pass.

What changed

• Removed .npmrc (it held nothing but minimumreleaseage).
• Added to pnpm-workspace.yaml:

  minimumReleaseAge: 1440
  minimumReleaseAgeStrict: true

• Deleted the 23-entry minimumReleaseAgeExclude block.

The overrides: block and its advisory comments are untouched.

What strict mode caught

Nothing — with no exclusions at all. That is the point: the exclusion list was not protecting any real resolution, so removing it costs nothing and closes the hole.

Verification

• pnpm install --frozen-lockfile clean: ✓ Lockfile passes supply-chain policies (415 entries).
• pnpm verify green (lint, build, coverage 100%, depcheck, typecheck, size-limit).

No changeset: this is repo-internal configuration and must not publish anything.

[changeset-bot]

⚠️ No Changeset found

Latest commit: cfb7e8f

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR