Skip to content

chore: enforce npm min-release-age dependency cooldown #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joker23 wants to merge 8 commits into
base: main
Choose a base branch
from
+10 −2
Open

chore: enforce npm min-release-age dependency cooldown #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
714ad6c
chore: enforce npm min-release-age dependency cooldown
devin-ai-integration[bot] Aug 5, 2026
5bfdaa1
ci: use npm >=11.6 so min-release-age is enforced
devin-ai-integration[bot] Aug 5, 2026
65c9a80
ci: pin npm to a version that supports min-release-age
devin-ai-integration[bot] Aug 5, 2026
2ded8dc
chore: exempt LaunchDarkly SDK packages from the cooldown
devin-ai-integration[bot] Aug 7, 2026
ae186b2
chore: limit cooldown exemptions to packages actually used
devin-ai-integration[bot] Aug 7, 2026
7a0237e
ci: use npm 12 in release workflow so the cooldown applies to releases
devin-ai-integration[bot] Aug 7, 2026
a877c3b
chore: apply cooldown to the contract-tests install
devin-ai-integration[bot] Aug 7, 2026
2bdf06c
chore: mirror cooldown exemptions in the contract-tests config
devin-ai-integration[bot] Aug 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
matrix:
variations: [
{os: ubuntu-latest, node: latest},
{os: ubuntu-latest, node: 18}
{os: ubuntu-latest, node: 22}

@devin-ai-integration devin-ai-integration Bot Aug 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Continuous integration no longer tests the oldest supported Node version

The build matrix no longer includes any older Node version ({os: ubuntu-latest, node: 22} replacing 18 at .github/workflows/ci.yml:19) even though the package still declares support down to Node 12, so breakage on older supported runtimes goes undetected.
Impact: Users on older but officially supported Node versions can receive a release that fails for them without any test having caught it.

Mismatch between declared engine range, contributing guide, and the CI matrix

CONTRIBUTING.md states "The project should be built and tested against the lowest compatible version, Node 12", and package.json declares "engines": {"node": ">= 12.0.0"}. After this change the matrix only covers latest and 22. Either the engines range / contributing guide should be updated to match the new minimum, or an older Node entry should be retained in the matrix.

Prompt for agents 
The CI matrix in .github/workflows/ci.yml now only tests Node 'latest' and Node 22, but package.json declares engines node >= 12.0.0 and CONTRIBUTING.md states the project should be built and tested against the lowest compatible version (Node 12). Decide on the real minimum supported Node version and make the three sources consistent: update package.json engines and CONTRIBUTING.md if the minimum is being raised, or keep an older Node entry in the CI matrix that matches the declared minimum.
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

]

runs-on: ${{ matrix.variations.os }}
Expand All @@ -29,6 +29,8 @@ jobs:
with:
node-version: ${{ matrix.variations.node }}
registry-url: 'https://registry.npmjs.org'
- name: Use npm version supporting min-release-age
run: npm install -g npm@^12.0.0
- name: Install
run: npm install
- name: Test
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/release-please.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ jobs:
- name: Update NPM
shell: bash
# Must be greater than 11.5.1 for OIDC.
run: npm install -g npm@11.6.2
run: npm install -g npm@^12.0.0

- name: Install Dependencies
run: npm install
Expand Down
3 changes: 3 additions & 0 deletions .npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
min-release-age=3
Comment thread
devin-ai-integration[bot] marked this conversation as resolved.

@devin-ai-integration devin-ai-integration Bot Aug 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 New dependency-age safety delay is set far too short to have any effect

The waiting period before newly published packages may be installed is configured as 3 (min-release-age=3 in .npmrc:1), but this setting is measured in minutes, so brand-new package versions are accepted after only three minutes instead of the intended multi-day delay.
Impact: The protection against freshly published (potentially compromised) dependency versions is effectively disabled.

Units of the npm min-release-age setting

npm's min-release-age config is a number of minutes. A value of 3 means any version published more than 3 minutes ago is installable, which provides essentially no quarantine window. A 3-day delay would be 4320. The presence of min-release-age-exclude[] entries for launchdarkly-eventsource and launchdarkly-js-sdk-common (.npmrc:2-3) indicates the intent was a delay long enough that LaunchDarkly's own freshly released packages would otherwise be blocked — which only makes sense with a much larger value.

Suggested change
min-release-age=3
min-release-age=4320
Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

min-release-age-exclude[]=launchdarkly-eventsource
min-release-age-exclude[]=launchdarkly-js-sdk-common
Comment thread
cursor[bot] marked this conversation as resolved.
3 changes: 3 additions & 0 deletions contract-tests/.npmrc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
min-release-age=3
Comment thread
devin-ai-integration[bot] marked this conversation as resolved.
Comment thread
cursor[bot] marked this conversation as resolved.
min-release-age-exclude[]=launchdarkly-eventsource
min-release-age-exclude[]=launchdarkly-js-sdk-common
Loading