tom-ricci

Configuring minimum release age across npm, pnpm, yarn, and bun

Setting a minimum release age (a "cooldown") on dependencies is a cheap, high-leverage defense against supply-chain attacks. Most malicious package versions are detected and yanked within hours, so a 24-hour delay filters out the smash-and-grab incidents (axios 1.14.1, ua-parser-js, Solana web3.js, etc.).

All four major Node.js package managers now support this, but each one used a different name and a different unit. Here is what you need.

Minimum versions

Tool	Setting	Unit	Introduced in

tom-ricci

from cmu_graphics import *

class Settings:
    color = ""
    x = []
    y = []
    points = []

def createSettings():
    color = input("What color do you want the shape to be? ")