Skip to content

Commit d6b459d

Browse files
alan-agius4alan-agius4
authored
build: enable minimumReleaseAge to mitigate dependency chain attacks (angular#31880)
This change configures pnpm's `minimumReleaseAge` setting to 1 day (1440 minutes). This is a security measure to mitigate dependency chain attacks, where malicious actors publish a new version of a dependency with malicious code and then trick users into updating to it before it can be discovered and reported. By delaying the adoption of new releases, we reduce the window of opportunity for such attacks. The list of excluded packages contains trusted and frequently updated dependencies from the Angular team, which are considered safe to use without this delay.
1 parent a2906dd commit d6b459d

File tree

5 files changed

+149
-1
lines changed

5 files changed

+149
-1
lines changed

‎integration/harness-e2e-cli/pnpm-workspace.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
2+
# The minimum age of a release to be considered for dependency installation.
3+
# The value is in minutes (1440 minutes = 1 day).
4+
minimumReleaseAge: 1440
5+
# List of packages to exclude from the minimum release age check.
6+
# Wildcards are not yet supported: https://github.com/pnpm/pnpm/issues/9983
7+
minimumReleaseAgeExclude:
8+
- '@angular-devkit/architect'
9+
- '@angular-devkit/build-angular'
10+
- '@angular-devkit/build-webpack'
11+
- '@angular-devkit/core'
12+
- '@angular-devkit/schematics-cli'
13+
- '@angular-devkit/schematics'
14+
- '@angular-devkit/architect-cli'
15+
- '@angular-devkit/architect'
16+
- '@angular/animations'
17+
- '@angular/benchpress'
18+
- '@angular/cdk'
19+
- '@angular/ng-dev'
20+
- '@angular/cli'
21+
- '@angular/ssr'
22+
- '@angular/common'
23+
- '@angular/compiler-cli'
24+
- '@angular/compiler'
25+
- '@angular/core'
26+
- '@angular/forms'
27+
- '@angular/language-service'
28+
- '@angular/localize'
29+
- '@angular/material'
30+
- '@angular/material-moment-adapter'
31+
- '@angular/platform-browser-dynamic'
32+
- '@angular/platform-browser'
33+
- '@angular/platform-server'
34+
- '@angular/router'
35+
- '@angular/service-worker'
36+
- '@ngtools/webpack'
37+
- '@schematics/angular'

‎integration/ng-add-standalone/pnpm-workspace.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
2+
# The minimum age of a release to be considered for dependency installation.
3+
# The value is in minutes (1440 minutes = 1 day).
4+
minimumReleaseAge: 1440
5+
# List of packages to exclude from the minimum release age check.
6+
# Wildcards are not yet supported: https://github.com/pnpm/pnpm/issues/9983
7+
minimumReleaseAgeExclude:
8+
- '@angular-devkit/architect'
9+
- '@angular-devkit/build-angular'
10+
- '@angular-devkit/build-webpack'
11+
- '@angular-devkit/core'
12+
- '@angular-devkit/schematics-cli'
13+
- '@angular-devkit/schematics'
14+
- '@angular-devkit/architect-cli'
15+
- '@angular-devkit/architect'
16+
- '@angular/animations'
17+
- '@angular/benchpress'
18+
- '@angular/cdk'
19+
- '@angular/ng-dev'
20+
- '@angular/cli'
21+
- '@angular/ssr'
22+
- '@angular/common'
23+
- '@angular/compiler-cli'
24+
- '@angular/compiler'
25+
- '@angular/core'
26+
- '@angular/forms'
27+
- '@angular/language-service'
28+
- '@angular/localize'
29+
- '@angular/material'
30+
- '@angular/material-moment-adapter'
31+
- '@angular/platform-browser-dynamic'
32+
- '@angular/platform-browser'
33+
- '@angular/platform-server'
34+
- '@angular/router'
35+
- '@angular/service-worker'
36+
- '@ngtools/webpack'
37+
- '@schematics/angular'

‎integration/ng-add/pnpm-workspace.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
2+
# The minimum age of a release to be considered for dependency installation.
3+
# The value is in minutes (1440 minutes = 1 day).
4+
minimumReleaseAge: 1440
5+
# List of packages to exclude from the minimum release age check.
6+
# Wildcards are not yet supported: https://github.com/pnpm/pnpm/issues/9983
7+
minimumReleaseAgeExclude:
8+
- '@angular-devkit/architect'
9+
- '@angular-devkit/build-angular'
10+
- '@angular-devkit/build-webpack'
11+
- '@angular-devkit/core'
12+
- '@angular-devkit/schematics-cli'
13+
- '@angular-devkit/schematics'
14+
- '@angular-devkit/architect-cli'
15+
- '@angular-devkit/architect'
16+
- '@angular/animations'
17+
- '@angular/benchpress'
18+
- '@angular/cdk'
19+
- '@angular/ng-dev'
20+
- '@angular/cli'
21+
- '@angular/ssr'
22+
- '@angular/common'
23+
- '@angular/compiler-cli'
24+
- '@angular/compiler'
25+
- '@angular/core'
26+
- '@angular/forms'
27+
- '@angular/language-service'
28+
- '@angular/localize'
29+
- '@angular/material'
30+
- '@angular/material-moment-adapter'
31+
- '@angular/platform-browser-dynamic'
32+
- '@angular/platform-browser'
33+
- '@angular/platform-server'
34+
- '@angular/router'
35+
- '@angular/service-worker'
36+
- '@ngtools/webpack'
37+
- '@schematics/angular'

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"engines": {
1313
"npm": "Please use pnpm instead of NPM to install dependencies",
1414
"yarn": "Please use pnpm instead of Yarn to install dependencies",
15-
"pnpm": "^10.0.0"
15+
"pnpm": "10.16.1"
1616
},
1717
"scripts": {
1818
"ng-dev": "node --no-warnings=ExperimentalWarning --loader ts-node/esm/transpile-only node_modules/@angular/ng-dev/bundles/cli.mjs",

‎pnpm-workspace.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,40 @@ catalog:
3535
'@angular/router': 21.0.0-next.3
3636
'@schematics/angular': 21.0.0-next.3
3737
'rxjs': ^6.6.7
38+
39+
# The minimum age of a release to be considered for dependency installation.
40+
# The value is in minutes (1440 minutes = 1 day).
41+
minimumReleaseAge: 1440
42+
# List of packages to exclude from the minimum release age check.
43+
# Wildcards are not yet supported: https://github.com/pnpm/pnpm/issues/9983
44+
minimumReleaseAgeExclude:
45+
- '@angular-devkit/architect'
46+
- '@angular-devkit/build-angular'
47+
- '@angular-devkit/build-webpack'
48+
- '@angular-devkit/core'
49+
- '@angular-devkit/schematics-cli'
50+
- '@angular-devkit/schematics'
51+
- '@angular-devkit/architect-cli'
52+
- '@angular-devkit/architect'
53+
- '@angular/animations'
54+
- '@angular/benchpress'
55+
- '@angular/cdk'
56+
- '@angular/ng-dev'
57+
- '@angular/cli'
58+
- '@angular/ssr'
59+
- '@angular/common'
60+
- '@angular/compiler-cli'
61+
- '@angular/compiler'
62+
- '@angular/core'
63+
- '@angular/forms'
64+
- '@angular/language-service'
65+
- '@angular/localize'
66+
- '@angular/material'
67+
- '@angular/material-moment-adapter'
68+
- '@angular/platform-browser-dynamic'
69+
- '@angular/platform-browser'
70+
- '@angular/platform-server'
71+
- '@angular/router'
72+
- '@angular/service-worker'
73+
- '@ngtools/webpack'
74+
- '@schematics/angular'

0 commit comments

Comments
 (0)