mirror of
https://github.com/renovatebot/renovate.git
synced 2026-11-04 11:33:40 +00:00
Tobias Bieniek
fa7f6ec002
* feat(presets): add `security:minimumReleaseAgeCrates` preset This adds a three-day minimum release age for the `crate` datasource and preserves the existing exception for pin updates. The preset is based on the existing `security:minimumReleaseAgeNpm` preset, with its exceptions limited to update types relevant to crates.io. It accounts for the initial 72-hour crates.io deletion window and gives scanners time to identify malicious releases. * fix(presets): scope crate release age by update type This replaces the pin-specific override with one package rule for `major`, `minor`, and `patch` crate updates. It keeps updates without release timestamps out of the cooldown. The focused tests cover included and excluded update types. * fix(presets): warn about unsupported crate update types This exempts lock file maintenance, replacement, and pin updates from the crate minimum release age policy. It adds PR body notes that explain why each update requires manual age validation. * fix(presets): use singular crate release age name This renames `security:minimumReleaseAgeCrates` to `security:minimumReleaseAgeCrate`. It aligns the preset with the `crate` datasource name before release. * Update lib/config/presets/internal/security.preset.ts Co-authored-by: Jamie Tanna <github@jamietanna.co.uk> --------- Co-authored-by: Jamie Tanna <jamie.tanna@mend.io> Co-authored-by: Jamie Tanna <github@jamietanna.co.uk>