@helloleo/plugins 0.2.29-beta.0 → 0.2.29-beta.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -1,5 +1,11 @@
|
|
|
1
1
|
# Supply-chain guard: refuse npm package versions published less than 3 days
|
|
2
2
|
# ago (compromised-release window). Versions already in bun.lock install
|
|
3
3
|
# normally. Escape hatch: minimumReleaseAgeExcludes = ["pkg"].
|
|
4
|
+
#
|
|
5
|
+
# First-party @helloleo packages are excluded. The guard exists to blunt a
|
|
6
|
+
# compromised third-party release, and we publish these ourselves, so the only
|
|
7
|
+
# thing the window buys here is three days during which a project cannot
|
|
8
|
+
# install the runtime it was just scaffolded against.
|
|
4
9
|
[install]
|
|
5
10
|
minimumReleaseAge = 259200
|
|
11
|
+
minimumReleaseAgeExcludes = ["@helloleo/runtime", "@helloleo/plugins"]
|