Merge pull request #10372 from gitbutlerapp/supply-chain-protection

Set up minimum package age in pnpm

Author: Caleb-T-Owens

package.json

@@ -6,7 +6,7 @@
 		"node": ">=20.11"
 	},
 	"type": "module",
-	"packageManager": "pnpm@10.15.1",
+	"packageManager": "pnpm@10.17.0",
 	"scripts": {
 		"dev:ui": "pnpm --filter @gitbutler/ui storybook",
 		"dev:web": "turbo watch --filter @gitbutler/web dev",

pnpm-workspace.yaml

@@ -1,3 +1,7 @@
+# Don't allow package versions less than two days old to be installed.
+# https://pnpm.io/settings#minimumreleaseage
+# Packages can be exclude from this setting with the `minimumReleaseAgeExclude` property.
+minimumReleaseAge: 2880
 packages:
   - 'apps/*'
   - 'packages/*'