fg-devkit 1.21.1 → 1.21.2

package/README.md

@@ -173,15 +173,18 @@ pnpm exec fgd audit-override-commit --no-commit  # leave the changes in the work
    younger than `minimumReleaseAge` (re-run later), when the package is a direct dependency (bump it with
    `policy-upgrade-commit`), or when no patch exists (candidate for `auditConfig.ignoreGhsas`).
 4. Prunes overrides that no longer change the audit.
-5. If findings that are still reported have active (not expired) `<suppress>` entries in fg-devkit's shared
+5. Removes `minimumReleaseAgeExclude` entries that are no longer needed (see `prune-release-age-exclude` below).
+   This step also runs when `pnpm audit` is clean.
+6. If findings that are still reported have active (not expired) `<suppress>` entries in fg-devkit's shared
    `configs/dependency-check-suppressions.xml`, writes the repo's `dependency-check-suppressions.xml` with only
    those entries, so OWASP Dependency-Check accepts exactly the risks this repo has. Findings with no patch and
    no suppression are listed so you can add one.
-6. Installs and runs the repo's `lint-check`, `lint:ts`, `test`, `test:unit` and `build` scripts when present.
+7. Installs and runs the repo's `lint-check`, `lint:ts`, `test`, `test:unit` and `build` scripts when present.
    Nothing is committed if a check fails.
-7. Commits the lockfile refresh (`vuln(package): refresh lockfile` / `vuln(): refresh N packages in lockfile`),
-   the override changes (`vuln(package): override version`, `vuln(): override N packages`) and the
-   suppressions file (`chore(repo): sync dependency-check suppressions`) separately.
+8. Commits the lockfile refresh (`vuln(package): refresh lockfile` / `vuln(): refresh N packages in lockfile`),
+   the override changes (`vuln(package): override version`, `vuln(): override N packages`), the release-age
+   excludes (`chore(repo): prune minimumReleaseAgeExclude`) and the suppressions file
+   (`chore(repo): sync dependency-check suppressions`) separately.
 
 Report, remove, or remove and auto-commit workspace overrides that no longer change `pnpm audit`:
 
@@ -191,6 +194,20 @@ pnpm exec fgd prune-overrides --fix
 pnpm exec fgd prune-overrides --commit
 ```
 
+Report, remove, or remove and auto-commit `minimumReleaseAgeExclude` entries that are no longer needed:
+
+```bash
+pnpm exec fgd prune-release-age-exclude
+pnpm exec fgd prune-release-age-exclude --fix
+pnpm exec fgd prune-release-age-exclude --commit
+```
+
+A pinned version (`name@1.2.3` or `name@1.2.3 || 1.2.4`) is only needed while it is in the lockfile and younger than
+`minimumReleaseAge` (1440 minutes unless configured). Versions that are old enough, or no longer installed, are
+removed, and an entry with no versions left is removed entirely. Name rules such as `my-package` or `@scope/*` allow
+every future release on purpose and are always kept. With `--fix` the lockfile is re-verified against the release-age
+policy, and `pnpm-workspace.yaml` is restored if pnpm rejects it.
+
 ## tsconfig in consuming repos
 
 Use `fgd sync-project-configs` (or `fgd sync-tooling-configs`) to write the local `tsconfig.json` template from `fg-devkit`.

package/configs/eslint.config.base.d.ts

@@ -0,0 +1,16 @@
+import type { Linter } from 'eslint'
+
+export interface CreateBaseConfigOptions {
+  tsconfigRootDir?: string
+  tsconfigFiles?: string[]
+  additionalIgnores?: string[]
+  extraNonTypeAwareFiles?: string[]
+  enablePrettier?: boolean
+  enableI18n?: boolean
+  i18nLocaleDir?: string
+  additionalRules?: Linter.RulesRecord
+  additionalPlugins?: NonNullable<Linter.Config['plugins']>
+  additionalSettings?: NonNullable<Linter.Config['settings']>
+}
+
+export default function createBaseConfig(options?: CreateBaseConfigOptions): Linter.Config[]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fg-devkit",
-  "version": "1.21.1",
+  "version": "1.21.2",
   "description": "Shared configs, scripts, and DX tooling for Vue / TypeScript frontend repos",
   "type": "module",
   "license": "UNLICENSED",
@@ -13,7 +13,10 @@
   "exports": {
     "./tsconfig.base.json": "./configs/tsconfig.base.json",
     "./tsconfig.app.sync.json": "./configs/tsconfig.app.sync.json",
-    "./eslint.config.base.js": "./configs/eslint.config.base.js",
+    "./eslint.config.base.js": {
+      "types": "./configs/eslint.config.base.d.ts",
+      "default": "./configs/eslint.config.base.js"
+    },
     "./prettier.config.js": "./configs/prettier.config.js",
     "./lefthook.yml": "./configs/lefthook.yml",
     "./vscode-settings.json": "./configs/vscode-settings.json",

package/scaffold/vue/package.json

@@ -32,7 +32,7 @@
     "@intlify/unplugin-vue-i18n": "11.2.5",
     "@tanstack/vue-query-devtools": "6.3.1",
     "@types/node": "22.16.5",
-    "fg-devkit": "1.21.1",
+    "fg-devkit": "1.21.2",
     "@vitejs/plugin-vue": "6.0.9",
     "tailwindcss": "4.3.3",
     "tsx": "4.23.15",

package/scripts/audit-fix-plan.mjs

@@ -434,3 +434,137 @@ export function filterSuppressions(xmlText, ghsas, now = Date.now()) {
   }
   return result
 }
+
+// ---------------------------------------------------------------------------
+// minimumReleaseAgeExclude pruning
+// ---------------------------------------------------------------------------
+
+/**
+ * Split a minimumReleaseAgeExclude entry into its package name and exact versions.
+ * `versions` is null for name rules (`fg-devkit`, `@scope/*`), which allow every
+ * future release of that package on purpose and are never pruned.
+ */
+export function parseReleaseAgeExcludeEntry(entry) {
+  const text = String(entry).trim()
+  const at = text.lastIndexOf('@')
+  if (at <= 0) return { name: text, versions: null }
+  return {
+    name: text.slice(0, at),
+    versions: text
+      .slice(at + 1)
+      .split('||')
+      .map((version) => version.trim())
+      .filter(Boolean),
+  }
+}
+
+/**
+ * Decide which version-pinned minimumReleaseAgeExclude entries are still needed.
+ *
+ * A version is still needed only while it is resolved in the lockfile *and* younger than
+ * minimumReleaseAge. Anything else (old enough now, or no longer installed) is dropped.
+ * Name rules, patterns, non-exact versions and versions without a known publish time are
+ * kept unchanged, so nothing is removed on a guess.
+ *
+ * @param {string[]} entries
+ * @param {{
+ *   lockfileVersions: Map<string, Set<string>>,
+ *   publishTime: (name: string, version: string) => number | undefined,
+ *   minimumReleaseAgeMinutes: number,
+ *   now?: number,
+ * }} context
+ * @returns {{ entry: string, next: string | null, dropped: { version: string, reason: 'old-enough' | 'not-installed' }[] }[]}
+ *   `next` is the entry to keep (`null` = remove the entry, same string = unchanged).
+ */
+export function planReleaseAgeExcludePrune(entries, context) {
+  const now = context.now ?? Date.now()
+  const maxAgeMs = context.minimumReleaseAgeMinutes * 60000
+  return entries.map((entry) => {
+    const { name, versions } = parseReleaseAgeExcludeEntry(entry)
+    if (versions === null || name.includes('*') || versions.length === 0) {
+      return { entry, next: entry, dropped: [] }
+    }
+    if (versions.some((version) => !parseVersion(version))) return { entry, next: entry, dropped: [] }
+
+    const kept = []
+    const dropped = []
+    for (const version of versions) {
+      if (!context.lockfileVersions.get(name)?.has(version)) {
+        dropped.push({ version, reason: 'not-installed' })
+        continue
+      }
+      const published = context.publishTime(name, version)
+      if (published === undefined || !Number.isFinite(published)) {
+        kept.push(version)
+      } else if (now - published >= maxAgeMs) {
+        dropped.push({ version, reason: 'old-enough' })
+      } else {
+        kept.push(version)
+      }
+    }
+    if (dropped.length === 0) return { entry, next: entry, dropped }
+    return { entry, next: kept.length > 0 ? `${name}@${kept.join(' || ')}` : null, dropped }
+  })
+}
+
+/** Items of a top-level YAML block list (`key:` followed by `  - item` lines). */
+export function readWorkspaceList(text, key) {
+  const lines = String(text ?? '').split('\n')
+  const start = lines.findIndex((line) => line === `${key}:` || line.startsWith(`${key}: #`))
+  if (start === -1) return []
+  const items = []
+  for (let i = start + 1; i < lines.length; i += 1) {
+    const line = lines[i]
+    if (line.trim() === '' || line.trim().startsWith('#')) continue
+    const item = line.match(/^\s+-\s+(.*?)\s*$/)
+    if (!item) break
+    items.push(unquoteYaml(item[1]))
+  }
+  return items
+}
+
+function renderYamlListItem(value) {
+  return /^[\w@./-][\w@./ |<>=*^~-]*$/.test(value) && !/[:#]/.test(value) && !value.startsWith('@')
+    ? value
+    : `'${value.replace(/'/g, "''")}'`
+}
+
+/**
+ * Apply `{ entry -> next }` replacements to a top-level YAML block list, keeping
+ * indentation, quoting style and comments. `next === null` removes the item; the key is
+ * removed too when its list becomes empty.
+ */
+export function rewriteWorkspaceList(text, key, replacements) {
+  const lines = String(text ?? '').split('\n')
+  const start = lines.findIndex((line) => line === `${key}:` || line.startsWith(`${key}: #`))
+  if (start === -1) return text
+  let remaining = 0
+  let end = start + 1
+  const output = lines.slice(0, start + 1)
+  for (; end < lines.length; end += 1) {
+    const line = lines[end]
+    if (line.trim() === '' || line.trim().startsWith('#')) {
+      output.push(line)
+      continue
+    }
+    const item = line.match(/^(\s+-\s+)(.*?)\s*$/)
+    if (!item) break
+    const value = unquoteYaml(item[2])
+    if (!replacements.has(value)) {
+      output.push(line)
+      remaining += 1
+      continue
+    }
+    const next = replacements.get(value)
+    if (next === null) continue
+    const quoted = /^['"]/.test(item[2]) ? `'${next.replace(/'/g, "''")}'` : renderYamlListItem(next)
+    output.push(`${item[1]}${quoted}`)
+    remaining += 1
+  }
+  if (remaining === 0) {
+    output.splice(start, output.length - start)
+    // Drop blank lines left where the section was.
+    while (output.length > 0 && output.at(-1) === '' && lines[end] === '') output.pop()
+  }
+  return [...output, ...lines.slice(end)].join('\n')
+}

package/scripts/audit-fix-plan.test.mjs

@@ -12,6 +12,9 @@ import {
   lowestPatchedVersion,
   normalizeAdvisories,
   planOverrides,
+  planReleaseAgeExcludePrune,
+  readWorkspaceList,
+  rewriteWorkspaceList,
   upsertWorkspaceOverrides,
 } from './audit-fix-plan.mjs'
 
@@ -285,3 +288,107 @@ test('filterSuppressions keeps only active entries that match the repo findings'
   // Expired entries are dropped even when they match.
   assert.doesNotMatch(filterSuppressions(xml, ['GHSA-vfj7-8cjw-p6xm'], Date.parse('2026-12-02T00:00:00Z')), /GHSA-vfj7/)
 })
+
+test('planReleaseAgeExcludePrune drops versions that are old enough or no longer installed', () => {
+  const now = Date.parse('2026-10-06T12:00:00Z')
+  const hoursAgo = (hours) => now - hours * 3600000
+  const times = {
+    'lefthook@2.1.15': hoursAgo(24 * 30),
+    'lefthook@2.1.17': hoursAgo(2),
+    'tsx@4.23.9': hoursAgo(24 * 10),
+    'fallow@3.31.0': hoursAgo(5),
+  }
+  const plan = planReleaseAgeExcludePrune(
+    [
+      'fg-devkit',
+      '@fallow-cli/*',
+      'lefthook@2.1.15 || 2.1.17',
+      'tsx@4.23.9',
+      'fallow@3.31.0',
+      'gone@1.0.0',
+      'x@^1.0.0',
+    ],
+    {
+      lockfileVersions: new Map([
+        ['lefthook', new Set(['2.1.15', '2.1.17'])],
+        ['tsx', new Set(['4.23.9'])],
+        ['fallow', new Set(['3.31.0'])],
+        ['x', new Set(['1.2.0'])],
+      ]),
+      publishTime: (name, version) => times[`${name}@${version}`],
+      minimumReleaseAgeMinutes: 1440,
+      now,
+    },
+  )
+  assert.deepEqual(
+    plan.map(({ entry, next }) => [entry, next]),
+    [
+      ['fg-devkit', 'fg-devkit'],
+      ['@fallow-cli/*', '@fallow-cli/*'],
+      ['lefthook@2.1.15 || 2.1.17', 'lefthook@2.1.17'],
+      ['tsx@4.23.9', null],
+      ['fallow@3.31.0', 'fallow@3.31.0'],
+      ['gone@1.0.0', null],
+      ['x@^1.0.0', 'x@^1.0.0'],
+    ],
+  )
+  assert.deepEqual(plan[5].dropped, [{ version: '1.0.0', reason: 'not-installed' }])
+})
+
+test('planReleaseAgeExcludePrune keeps versions with unknown publish time', () => {
+  const plan = planReleaseAgeExcludePrune(['private@1.0.0'], {
+    lockfileVersions: new Map([['private', new Set(['1.0.0'])]]),
+    publishTime: () => undefined,
+    minimumReleaseAgeMinutes: 1440,
+  })
+  assert.equal(plan[0].next, 'private@1.0.0')
+})
+
+test('readWorkspaceList and rewriteWorkspaceList edit only the given list', () => {
+  const text = [
+    'allowBuilds:',
+    '  esbuild: true',
+    'minimumReleaseAgeExclude:',
+    '  - fg-devkit',
+    '  - tsx@4.23.9',
+    '  - lefthook@2.1.15 || 2.1.17',
+    "  - '@fallow-cli/darwin-arm64@3.31.0'",
+    'overrides:',
+    "  'a@<1.0.1': '1.0.1'",
+    '',
+  ].join('\n')
+  assert.deepEqual(readWorkspaceList(text, 'minimumReleaseAgeExclude'), [
+    'fg-devkit',
+    'tsx@4.23.9',
+    'lefthook@2.1.15 || 2.1.17',
+    '@fallow-cli/darwin-arm64@3.31.0',
+  ])
+  const result = rewriteWorkspaceList(
+    text,
+    'minimumReleaseAgeExclude',
+    new Map([
+      ['tsx@4.23.9', null],
+      ['lefthook@2.1.15 || 2.1.17', 'lefthook@2.1.17'],
+      ['@fallow-cli/darwin-arm64@3.31.0', null],
+    ]),
+  )
+  assert.equal(
+    result,
+    [
+      'allowBuilds:',
+      '  esbuild: true',
+      'minimumReleaseAgeExclude:',
+      '  - fg-devkit',
+      '  - lefthook@2.1.17',
+      'overrides:',
+      "  'a@<1.0.1': '1.0.1'",
+      '',
+    ].join('\n'),
+  )
+  const emptied = rewriteWorkspaceList(
+    'minimumReleaseAgeExclude:\n  - tsx@4.23.9\nallowBuilds:\n  esbuild: true\n',
+    'minimumReleaseAgeExclude',
+    new Map([['tsx@4.23.9', null]]),
+  )
+  assert.equal(emptied, 'allowBuilds:\n  esbuild: true\n')
+})

package/scripts/audit-override-commit.mjs

@@ -10,11 +10,14 @@
  *      pnpm-workspace.yaml. Findings with no patch, a patch in another major, a patch
  *      younger than minimumReleaseAge, or on a direct dependency are reported, not overridden.
  *   4. Prune overrides that no longer change the audit (prune-overrides --fix).
- *   5. If findings that are still reported have active <suppress> entries in fg-devkit's
+ *   5. Prune minimumReleaseAgeExclude entries that are no longer needed
+ *      (prune-release-age-exclude --fix). Runs even when the audit is clean.
+ *   6. If findings that are still reported have active <suppress> entries in fg-devkit's
  *      shared dependency-check-suppressions.xml, write the repo's copy with only those
  *      entries, so OWASP Dependency-Check accepts exactly the risks this repo has.
- *   6. Install and run the repo's checks (lint-check, lint:ts, test, test:unit, build).
- *   7. Commit the refresh, the override changes and the suppressions file separately.
+ *   7. Install and run the repo's checks (lint-check, lint:ts, test, test:unit, build).
+ *   8. Commit the refresh, the overrides, the release-age excludes and the suppressions
+ *      file separately.
  *
  * Usage:
  *   pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
@@ -34,7 +37,9 @@ import {
   isReleaseAgeExcluded,
   normalizeAdvisories,
   parseAuditJson,
+  parseReleaseAgeExcludeEntry,
   planOverrides,
+  readWorkspaceList,
   upsertWorkspaceOverrides,
 } from './audit-fix-plan.mjs'
 import {
@@ -246,6 +251,44 @@ function writeOverrides(overrides) {
   runOrFail('pnpm', ['install', '--lockfile-only', '--ignore-scripts', '--no-frozen-lockfile'])
 }
 
+/**
+ * Remove minimumReleaseAgeExclude entries that are no longer needed. Returns the
+ * entries removed and the narrowed entries added, for the commit message.
+ */
+function pruneReleaseAgeExclude() {
+  const before = readWorkspaceList(readFile('pnpm-workspace.yaml') ?? '', 'minimumReleaseAgeExclude')
+  if (before.length === 0) return { removed: [], added: [] }
+  console.log(`${TAG} Checking minimumReleaseAgeExclude…`)
+  const result = run(process.execPath, [path.join(scriptDir, 'prune-release-age-exclude.mjs'), '--fix'])
+  if (result.status !== 0) {
+    console.warn(`${TAG} Could not prune minimumReleaseAgeExclude; left unchanged.`)
+    return { removed: [], added: [] }
+  }
+  const after = readWorkspaceList(readFile('pnpm-workspace.yaml') ?? '', 'minimumReleaseAgeExclude')
+  return {
+    removed: before.filter((entry) => !after.includes(entry)),
+    added: after.filter((entry) => !before.includes(entry)),
+  }
+}
+
+/** `removed entry` or `old entry -> narrowed entry` lines. */
+function describeExcludeChanges({ removed, added }) {
+  const nameOf = (entry) => parseReleaseAgeExcludeEntry(entry).name
+  return removed.map((entry) => {
+    const narrowed = added.find((item) => nameOf(item) === nameOf(entry))
+    return narrowed ? `${entry} -> ${narrowed}` : `${entry}`
+  })
+}
+
+function buildReleaseAgeExcludeCommitMessage(changes) {
+  return {
+    subject: 'chore(repo): prune minimumReleaseAgeExclude',
+    body: describeExcludeChanges(changes)
+      .map((line) => `- ${line}`)
+      .join('\n'),
+  }
+}
+
 function pruneOverrides() {
   if (!/^overrides:/m.test(readFile('pnpm-workspace.yaml') ?? '')) return
   console.log(`${TAG} Pruning overrides that no longer affect pnpm audit…`)
@@ -294,7 +337,7 @@ function verify() {
   }
 }
 
-function printSummary({ fixedByRefresh, plan, heldBack, applied, remaining, suppressions }) {
+function printSummary({ fixedByRefresh, plan, heldBack, applied, remaining, suppressions, excludeChanges }) {
   const suppressed = new Set(suppressions.covered.map((advisory) => advisory.ghsa))
   const unique = (items) => [...new Set(items)]
   const lines = []
@@ -337,6 +380,7 @@ function printSummary({ fixedByRefresh, plan, heldBack, applied, remaining, supp
     'Could not read the patched range, check manually:',
     plan.unparseable.map((item) => `${item.name}: ${item.patched} (${item.ghsas.join(', ')})`),
   )
+  section('Removed from minimumReleaseAgeExclude (no longer needed):', describeExcludeChanges(excludeChanges))
   if (remaining.length > 0) {
     lines.push(`Still reported by pnpm audit: ${remaining.length} advisory range(s).`)
   } else {
@@ -360,60 +404,79 @@ function main() {
 
   console.log(`${TAG} Running pnpm audit…`)
   const initial = audit()
+  let refreshed = original
+  let refreshChanges = []
+  let fixedByRefresh = []
+  let plan = { overrides: [], noPatch: [], crossMajor: [], direct: [], unparseable: [] }
+  let heldBack = []
+  let allowed = []
+  let remaining = []
+
   if (initial.length === 0) {
-    console.log(`${TAG} pnpm audit is clean. Nothing to do.`)
-    return 0
+    console.log(`${TAG} pnpm audit is clean.`)
+  } else {
+    console.log(`${TAG} ${initial.length} advisory range(s) in ${new Set(initial.map((a) => a.name)).size} package(s).`)
+
+    // 2. Refresh within ranges.
+    refreshLockfile(initial)
+    refreshed = snapshot()
+    refreshChanges = diffLockfileVersions(original['pnpm-lock.yaml'], refreshed['pnpm-lock.yaml'])
+
+    // 3. Plan overrides for what is left.
+    const afterRefresh = audit()
+    const remainingIds = new Set(afterRefresh.map((advisory) => advisory.id))
+    fixedByRefresh = [
+      ...new Set(initial.filter((advisory) => !remainingIds.has(advisory.id)).map((a) => `${a.name} (${a.ghsa})`)),
+    ]
+    plan = planOverrides(afterRefresh, { directDependencies: directDependencies() })
+    ;({ allowed, heldBack } = applyReleaseAgeGate(plan.overrides))
+    if (allowed.length > 0) writeOverrides(allowed)
+
+    // 4. Prune overrides.
+    pruneOverrides()
+    remaining = allowed.length > 0 ? audit() : afterRefresh
   }
-  console.log(`${TAG} ${initial.length} advisory range(s) in ${new Set(initial.map((a) => a.name)).size} package(s).`)
-
-  // 2. Refresh within ranges.
-  refreshLockfile(initial)
-  const refreshed = snapshot()
-  const refreshChanges = diffLockfileVersions(original['pnpm-lock.yaml'], refreshed['pnpm-lock.yaml'])
-
-  // 3. Plan overrides for what is left.
-  const afterRefresh = audit()
-  const remainingIds = new Set(afterRefresh.map((advisory) => advisory.id))
-  const fixedByRefresh = [
-    ...new Set(initial.filter((advisory) => !remainingIds.has(advisory.id)).map((a) => `${a.name} (${a.ghsa})`)),
-  ]
-  const plan = planOverrides(afterRefresh, { directDependencies: directDependencies() })
-  const { allowed, heldBack } = applyReleaseAgeGate(plan.overrides)
-  if (allowed.length > 0) writeOverrides(allowed)
-
-  // 4. Prune, 5. sync suppressions, 6. verify.
-  pruneOverrides()
-  const remaining = allowed.length > 0 ? audit() : afterRefresh
+  const afterOverrides = snapshot()
+
+  // 5. Release-age excludes, 6. suppressions, 7. verify.
+  const excludeChanges = pruneReleaseAgeExclude()
   const suppressions = syncSuppressions(remaining)
-  printSummary({ fixedByRefresh, plan, heldBack, applied: allowed, remaining, suppressions })
-  verify()
+  printSummary({ fixedByRefresh, plan, heldBack, applied: allowed, remaining, suppressions, excludeChanges })
 
-  // 7. Commit.
   const final = snapshot()
-  const overrideChanges = collectOverrideChanges(overridesBefore, collectOverrides(cwd))
   const nothingChanged = !suppressionsWritten && TRACKED_FILES.every((file) => final[file] === original[file])
   if (nothingChanged) {
     console.log(`${TAG} No file changes.`)
     return 0
   }
+  verify()
+
+  // 8. Commit.
   if (!shouldCommit) {
     console.log(`${TAG} --no-commit: changes left in the working tree.`)
     return 0
   }
-
+  const overrideChanges = collectOverrideChanges(overridesBefore, collectOverrides(cwd))
   if (refreshChanges.length > 0 && stageContents(refreshed) > 0) {
     commit(buildRefreshCommitMessage(refreshChanges))
   }
-  if (overrideChanges.length > 0) {
-    for (const item of overrideChanges) {
-      console.log(`  - ${item.name}: ${item.from ?? '(missing)'} -> ${formatOverrideValue(item.to)}`)
-    }
+  for (const item of overrideChanges) {
+    console.log(`  - ${item.name}: ${item.from ?? '(missing)'} -> ${formatOverrideValue(item.to)}`)
   }
-  if (stageContents(final) > 0) {
+  if (stageContents(afterOverrides) > 0) {
     commit(
       overrideChanges.length > 0
         ? buildOverrideCommitMessage(overrideChanges)
-        : buildRefreshCommitMessage(diffLockfileVersions(refreshed['pnpm-lock.yaml'], final['pnpm-lock.yaml'])),
+        : buildRefreshCommitMessage(
+            diffLockfileVersions(refreshed['pnpm-lock.yaml'], afterOverrides['pnpm-lock.yaml']),
+          ),
+    )
+  }
+  if (stageContents(snapshot()) > 0) {
+    commit(
+      excludeChanges.removed.length > 0 || excludeChanges.added.length > 0
+        ? buildReleaseAgeExcludeCommitMessage(excludeChanges)
+        : buildRefreshCommitMessage(diffLockfileVersions(afterOverrides['pnpm-lock.yaml'], final['pnpm-lock.yaml'])),
     )
   }
   if (suppressionsWritten) {

package/scripts/fg-devkit.mjs

@@ -18,6 +18,7 @@
  *   pnpm exec fg-devkit policy-upgrade-commit [--prune-overrides] [ncu-args...]
  *   pnpm exec fg-devkit audit-override-commit [--no-verify] [--no-commit]
  *   pnpm exec fg-devkit prune-overrides [--fix] [--commit]
+ *   pnpm exec fg-devkit prune-release-age-exclude [--fix] [--commit]
  *   pnpm exec fg-devkit sync-project-configs   (VS Code + tooling sync; overwrites config files)
  *   pnpm exec fg-devkit sync-tooling-configs   (tooling sync only; overwrites config files)
  *   pnpm exec fg-devkit sync-dependency-check-suppressions-commit [--all]
@@ -479,6 +480,7 @@ const DIRECT_COMMANDS = {
   'policy-upgrade-commit': 'policy-upgrade-commit.mjs',
   'audit-override-commit': 'audit-override-commit.mjs',
   'prune-overrides': 'prune-overrides.mjs',
+  'prune-release-age-exclude': 'prune-release-age-exclude.mjs',
   'sync-project-configs': 'sync-project-configs.mjs',
   'sync-tooling-configs': 'sync-tooling-configs.mjs',
   'sync-dependency-check-suppressions-commit': 'sync-dependency-check-suppressions-commit.mjs',
@@ -546,6 +548,8 @@ Commands:
                                  Fix pnpm audit findings: refresh lockfile first, override only when a range blocks the fix, verify, auto-commit
   prune-overrides [--fix] [--commit]
                                  Report unused workspace overrides; --fix removes them; --commit also auto-commits
+  prune-release-age-exclude [--fix] [--commit]
+                                 Report minimumReleaseAgeExclude entries that are no longer needed; --fix removes them; --commit also auto-commits
   sync-project-configs            VS Code + tooling sync (overwrites config files)
   sync-tooling-configs            Tooling sync only (overwrites config files)
   sync-dependency-check-suppressions-commit [--all]
@@ -975,8 +979,15 @@ async function runInteractiveMenu() {
           { name: 'Sync and auto-commit', value: 'sync-commit' },
           { name: 'Upgrade package.json packages and auto-commit', value: 'upgrade-commit' },
           { name: 'Upgrade package.json packages, prune overrides, and auto-commit', value: 'upgrade-commit-prune' },
-          { name: 'Fix vulnerability overrides and auto-commit', value: 'audit-override-commit' },
+          {
+            name: 'Fix vulnerabilities (refresh, override, prune) and auto-commit',
+            value: 'audit-override-commit',
+          },
           { name: 'Prune unused vulnerability overrides and auto-commit', value: 'prune-overrides' },
+          {
+            name: 'Prune unneeded minimumReleaseAgeExclude entries and auto-commit',
+            value: 'prune-release-age-exclude',
+          },
           { name: 'Cancel', value: 'cancel' },
         ],
         default: 'check',
@@ -999,6 +1010,9 @@ async function runInteractiveMenu() {
       if (choice === 'prune-overrides') {
         return runSelectedAction(() => runNode('prune-overrides.mjs', ['--commit']))
       }
+      if (choice === 'prune-release-age-exclude') {
+        return runSelectedAction(() => runNode('prune-release-age-exclude.mjs', ['--commit']))
+      }
       return 1
     }
 

package/scripts/prune-release-age-exclude.mjs

@@ -0,0 +1,161 @@
+#!/usr/bin/env node
+/**
+ * Find minimumReleaseAgeExclude entries in pnpm-workspace.yaml that are no longer needed.
+ *
+ * A pinned version (`name@1.2.3 || 1.2.4`) is only needed while it is resolved in the
+ * lockfile and still younger than minimumReleaseAge. Versions that are old enough now, or
+ * no longer installed, are removed; an entry with no versions left is removed entirely.
+ * Name rules (`fg-devkit`, `@scope/*`) allow every future release on purpose and are kept.
+ *
+ * Usage:
+ *   pnpm exec fg-devkit prune-release-age-exclude           # report only
+ *   pnpm exec fg-devkit prune-release-age-exclude --fix     # remove what is not needed
+ *   pnpm exec fg-devkit prune-release-age-exclude --commit  # remove and auto-commit
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+import { parseArgs } from 'node:util'
+import {
+  DEFAULT_MINIMUM_RELEASE_AGE_MINUTES,
+  lockfileVersions,
+  parseAuditJson,
+  planReleaseAgeExcludePrune,
+  readWorkspaceList,
+  rewriteWorkspaceList,
+} from './audit-fix-plan.mjs'
+
+const TAG = '[prune-release-age-exclude]'
+const KEY = 'minimumReleaseAgeExclude'
+const WORKSPACE_FILE = 'pnpm-workspace.yaml'
+const COMMIT_SUBJECT = 'chore(repo): prune minimumReleaseAgeExclude'
+const cwd = process.cwd()
+
+const { values: args } = parseArgs({
+  options: {
+    fix: { type: 'boolean', default: false },
+    commit: { type: 'boolean', default: false },
+    help: { type: 'boolean', short: 'h', default: false },
+  },
+  strict: true,
+})
+
+if (args.help) {
+  console.log(`Usage: pnpm exec fg-devkit prune-release-age-exclude [--fix] [--commit]
+
+Reports ${KEY} entries in ${WORKSPACE_FILE} that are no longer needed: pinned
+versions that are older than minimumReleaseAge, or no longer in the lockfile.
+Name rules such as "fg-devkit" or "@scope/*" are always kept.
+
+  --fix     Remove them and re-verify the lockfile
+  --commit  Remove them and auto-commit`)
+  process.exit(0)
+}
+
+function run(command, commandArgs, { capture = true } = {}) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    env: process.env,
+    encoding: 'utf8',
+    stdio: capture ? ['ignore', 'pipe', 'pipe'] : 'inherit',
+    maxBuffer: 50 * 1024 * 1024,
+  })
+  if (result.error) throw result.error
+  return result
+}
+
+function readJsonOutput(command, commandArgs) {
+  const result = run(command, commandArgs)
+  if (result.status !== 0) return undefined
+  try {
+    return parseAuditJson(result.stdout)
+  } catch {
+    return undefined
+  }
+}
+
+function describe(item) {
+  const reasons = item.dropped.map(
+    ({ version, reason }) =>
+      `${version} (${reason === 'old-enough' ? 'older than minimumReleaseAge' : 'not in lockfile'})`,
+  )
+  return item.next === null
+    ? `${item.entry}: remove, ${reasons.join(', ')}`
+    : `${item.entry} -> ${item.next}: drop ${reasons.join(', ')}`
+}
+
+function main() {
+  const workspacePath = path.join(cwd, WORKSPACE_FILE)
+  const lockfilePath = path.join(cwd, 'pnpm-lock.yaml')
+  if (!fs.existsSync(workspacePath) || !fs.existsSync(lockfilePath)) {
+    console.log(`${TAG} No ${WORKSPACE_FILE} or pnpm-lock.yaml. Nothing to check.`)
+    return 0
+  }
+
+  const original = fs.readFileSync(workspacePath, 'utf8')
+  const entries = readWorkspaceList(original, KEY)
+  if (entries.length === 0) {
+    console.log(`${TAG} No ${KEY} entries.`)
+    return 0
+  }
+
+  const config = readJsonOutput('pnpm', ['config', 'list', '--json']) ?? {}
+  const minutes = Number(config.minimumReleaseAge ?? DEFAULT_MINIMUM_RELEASE_AGE_MINUTES)
+  const timesByName = new Map()
+  const publishTime = (name, version) => {
+    if (!timesByName.has(name)) timesByName.set(name, readJsonOutput('pnpm', ['view', name, 'time', '--json']) ?? {})
+    const time = Date.parse(timesByName.get(name)[version] ?? '')
+    return Number.isFinite(time) ? time : undefined
+  }
+
+  console.log(
+    `${TAG} Checking ${entries.length} ${KEY} entr${entries.length === 1 ? 'y' : 'ies'} (minimumReleaseAge ${minutes} min)…`,
+  )
+  const plan = planReleaseAgeExcludePrune(entries, {
+    lockfileVersions: lockfileVersions(fs.readFileSync(lockfilePath, 'utf8')),
+    publishTime,
+    minimumReleaseAgeMinutes: minutes,
+  })
+  const changes = plan.filter((item) => item.next !== item.entry)
+  if (changes.length === 0) {
+    console.log(`${TAG} Every entry is still needed.`)
+    return 0
+  }
+
+  console.log(`${TAG} Not needed (${changes.length}):`)
+  for (const item of changes) console.log(`  - ${describe(item)}`)
+
+  if (!args.fix && !args.commit) {
+    console.log(`${TAG} Re-run with --fix to remove them, or --commit to remove and auto-commit.`)
+    return 0
+  }
+
+  fs.writeFileSync(
+    workspacePath,
+    rewriteWorkspaceList(original, KEY, new Map(changes.map((item) => [item.entry, item.next]))),
+  )
+  // pnpm verifies the lockfile against the release-age policy here; restore on failure.
+  const verify = run('pnpm', ['install', '--lockfile-only', '--ignore-scripts', '--no-frozen-lockfile'])
+  if (verify.status !== 0) {
+    fs.writeFileSync(workspacePath, original)
+    console.error(`${TAG} pnpm rejected the lockfile without these entries, restored ${WORKSPACE_FILE}.`)
+    console.error((verify.stderr || verify.stdout || '').trim())
+    return 1
+  }
+  console.log(`${TAG} Updated ${WORKSPACE_FILE}.`)
+
+  if (!args.commit) return 0
+  const files = [WORKSPACE_FILE, 'pnpm-lock.yaml'].filter((file) => fs.existsSync(path.join(cwd, file)))
+  if (run('git', ['add', '--', ...files], { capture: false }).status !== 0) return 1
+  const body = changes.map((item) => `- ${describe(item)}`).join('\n')
+  console.log(`${TAG} Auto-committing: ${COMMIT_SUBJECT}`)
+  return run('git', ['commit', '-m', COMMIT_SUBJECT, '-m', body], { capture: false }).status ?? 1
+}
+
+try {
+  process.exit(main())
+} catch (error) {
+  console.error(`${TAG} ${error instanceof Error ? error.message : error}`)
+  process.exit(2)
+}