From 804e5b441681a1dd68c7e1ebe4f90b7d35da8d9d Mon Sep 17 00:00:00 2001
From: Jens-Fabian Goetzmann <mail@jefago.com>
Date: Fri, 22 May 2026 11:41:51 -0600
Subject: [PATCH] chore: enforce 7-day minimum release age for npm deps

Guards against supply-chain attacks via freshly-published malicious
package versions. Honored by pnpm 10+ and npm 11.5+; ignored by older
clients.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .npmrc | 1 +
 1 file changed, 1 insertion(+)
 create mode 100644 .npmrc

diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000..e595aad
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+minimum-release-age=10080