enable minimumReleaseAge

.github/ng-renovate/pnpm-workspace.yaml

@@ -0,0 +1,3 @@
+# The minimum age of a release to be considered for dependency installation.
+# The value is in minutes (1440 minutes = 1 day).
+minimumReleaseAge: 1440

bazel/pnpm-workspace.yaml

@@ -1,3 +1,6 @@
+# The minimum age of a release to be considered for dependency installation.
+# The value is in minutes (1440 minutes = 1 day).
+minimumReleaseAge: 1440
 packages:
   - .
   - spec-bundling/test/

package.json

@@ -2,11 +2,11 @@
   "name": "@angular/build-tooling",
   "version": "0.0.0-{SCM_HEAD_SHA}",
   "private": true,
-  "packageManager": "[email protected].0",
+  "packageManager": "[email protected].1",
   "engines": {
     "npm": "Please use pnpm instead of NPM to install dependencies",
     "yarn": "Please use pnpm instead of Yarn to install dependencies",
-    "pnpm": "10.16.0"
+    "pnpm": "10.16.1"
   },
   "scripts": {
     "prepare": "husky",

pnpm-workspace.yaml

@@ -22,3 +22,40 @@ packages:
   - github-actions/saucelabs
   - github-actions/browserstack
   - github-actions/bazel/configure-remote
+# The minimum age of a release to be considered for dependency installation.
+# The value is in minutes (1440 minutes = 1 day).
+minimumReleaseAge: 1440
+# List of packages to exclude from the minimum release age check.
+# Wildcards are not yet supported: https://github.com/pnpm/pnpm/issues/9983
+minimumReleaseAgeExclude:
+  - '@angular-devkit/architect'
+  - '@angular-devkit/build-angular'
+  - '@angular-devkit/build-webpack'
+  - '@angular-devkit/core'
+  - '@angular-devkit/schematics-cli'
+  - '@angular-devkit/schematics'
+  - '@angular-devkit/architect-cli'
+  - '@angular-devkit/architect'
+  - '@angular/animations'
+  - '@angular/benchpress'
+  - '@angular/cdk'
+  - '@angular/ng-dev'
+  - '@angular/cli'
+  - '@angular/ssr'
+  - '@angular/common'
+  - '@angular/compiler-cli'
+  - '@angular/compiler'
+  - '@angular/core'
+  - '@angular/forms'
+  - '@angular/language-service'
+  - '@angular/localize'
+  - '@angular/material'
+  - '@angular/material-moment-adapter'
+  - '@angular/platform-browser-dynamic'
+  - '@angular/platform-browser'
+  - '@angular/platform-server'
+  - '@angular/router'
+  - '@angular/service-worker'
+  - '@ngtools/webpack'
+  - '@schematics/angular'
+  - 'ng-packagr'

renovate-presets/default.json5

@@ -73,6 +73,12 @@
     // ============================================================================
     // ECOSYSTEM-SPECIFIC GROUPING
     // ============================================================================
+    // Delay NPM updates to mitigate dependency chain attacks by malicious actors.
+    // This rule only affects direct dependencies.
+    {
+      minimumReleaseAge: '1 day',
+      matchManagers: ['npm'],
+    },
 
     // Group Bazel updates
     {
@@ -95,6 +101,7 @@
       enabled: true, // Enable NPM updates of cross-repo dependencies on all branches.
       groupName: 'cross-repo angular dependencies',
       followTag: 'next',
+      minimumReleaseAge: null,
       separateMajorMinor: false,
       schedule: ['at any time'],
       matchPackageNames: [