build(config): block npm package versions newer than 3 days - #4483
Conversation
Add min-release-age=3 to root and visualization .npmrc to mitigate fast-burn supply-chain attacks. Enforced by npm >= 11.10, silently ignored by older versions; npm ci and locked versions are unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe PR updates npm configuration in both the root and visualization directories to enforce supply-chain security. Both Changesnpm Supply Chain Security Configuration
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.npmrc:
- Around line 10-15: The documentation comment for the min-release-age setting
is inaccurate: update the description around the min-release-age key
(min-release-age=3) to state it was introduced in npm CLI v11.10.0, that it
enforces an absolute cutoff of versions published more than N days ago
(calculated as now - N days) and that it applies to dependency resolution during
commands like npm install but does not affect npm ci (which uses the lockfile);
also remove the unsupported claim "silently ignored by older npm" or replace it
with a cited reference if you add one.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 64863658-cf3b-43a9-b69d-6bb56d7a816a
📒 Files selected for processing (2)
.npmrcvisualization/.npmrc
| # Refuse to resolve package versions published less than 3 days ago (value in days, | ||
| # enforced by npm >= 11.10, silently ignored by older npm). Fast-burn supply-chain | ||
| # compromises are typically detected and unpublished within this window. Only affects | ||
| # resolving new versions — `npm ci` and already-locked versions are unaffected. For a | ||
| # deliberate fresh install, override with `npm install <pkg> --min-release-age=0`. | ||
| min-release-age=3 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What version of npm introduced the min-release-age configuration option and how does it work?
💡 Result:
The min-release-age configuration option was introduced in npm CLI version 11.10.0 [1][2]. How it works: The min-release-age configuration allows you to set a cooldown period for dependency installations to help mitigate supply chain risks [3][1]. When this option is set (as a number of days), npm will only install package versions that were published to the registry more than that number of days ago [4][5][6]. Key operational details: 1. Mechanism: Internally, npm converts the relative min-release-age (in days) into an absolute date (using the current time minus the specified number of days) and applies it similarly to the existing --before configuration [4][7][6]. 2. Precedence: While min-release-age and --before are related, they can coexist in different configuration sources. If both are defined within the same source, the explicit absolute date provided by --before takes precedence [7][5][6]. 3. Usage: You can set it in your.npmrc file or via command-line flags (e.g., npm install --min-release-age=7) [1][2]. 4. Limitations: This configuration is primarily effective for commands that perform dependency resolution, such as npm install [8][5]. It does not affect npm ci, as that command installs packages verbatim from the lockfile without performing new resolution [8]. If no versions satisfy the age requirement for a dependency, the command will error [4][5][6].
Citations:
- 1: https://www.brandonpugh.com/til/node/package-version-cooldown/
- 2: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104
- 3: https://github.com/npm/cli/pull/8965/changes
- 4: npm/cli@66d6e11
- 5: https://fossies.org/windows/www/node-v26.3.0-win-x64.zip/node-v26.3.0-win-x64/node_modules/npm/man/man7/config.7
- 6: https://docs.npmjs.com/cli/v11/commands/npm-update/
- 7: npm/cli@6aa332d
- 8: [Support]
min-release-agefornpm cinpm/cli#9281
Update the .npmrc min-release-age documentation to match npm CLI behavior.
min-release-agewas introduced in npm CLI v11.10.0 and enforces a cutoff so npm only considers versions published more than N days ago (effectively applying an absolute date derived from “now - N days”).- The option applies to dependency resolution performed by commands like
npm installand does not affectnpm ci, sincenpm ciinstalls directly from the lockfile without re-resolving. - The “silently ignored by older npm” claim isn’t documented in the official CLI references cited here—remove it or add a supporting citation.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.npmrc around lines 10 - 15, The documentation comment for the
min-release-age setting is inaccurate: update the description around the
min-release-age key (min-release-age=3) to state it was introduced in npm CLI
v11.10.0, that it enforces an absolute cutoff of versions published more than N
days ago (calculated as now - N days) and that it applies to dependency
resolution during commands like npm install but does not affect npm ci (which
uses the lockfile); also remove the unsupported claim "silently ignored by older
npm" or replace it with a cited reference if you add one.
|
2 participants
Add min-release-age=3 to root and visualization .npmrc to mitigate fast-burn supply-chain attacks. Enforced by npm >= 11.10, silently ignored by older versions; npm ci and locked versions are unaffected.
{Meaningful title}
Please read the CONTRIBUTING.md before opening a PR.
Closes: #
Description
Descriptive pull request text, answering:
Definition of Done
A PR is only ready for merge once all the following acceptance criteria are fulfilled:
Screenshots or gifs
Summary by CodeRabbit