Use cooldowns to reduce the risk of supply chain attacks#1465
Merged
Conversation
Without this file, we are only receiving security updates [1] Add a cooldown similar to editor API to reduce the risk of supply chain attacks. It will also delay us updating to cutting edge new releases that might have issues. Note that this doesn't dependabot security updates. [1] - https://docs.github.com/en/code-security/concepts/supply-chain-security/about-the-dependabot-yml-file
This reduces the risk of supply chain attacks by preventing us from installing very new packages[1]. It also reduces the risk us from relying on a package that is removed (since it's harder to remove a package after a 72 hours[1]) While this does a similar task to the dependabot cooldown, it will also prevent us from installing new packages locally. I've added our internal packages ot the pre-approved list as we often want to update these immediately after making changes. I'm unsure how this interacts with dependabot - if it will still make PRs for security issues and if those updates might fail. This is something I will monitor. I've chosen a slightly shorter cooldown compared to dependabot as I don't want this to be a barrier to us manually upgrading packages we intend to. [1] - https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate [2] - https://docs.npmjs.com/unpublishing-packages-from-the-registry
zetter-rpf
temporarily deployed
to
previews/1465/merge
GitHub Actions
Inactive
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens dependency-update hygiene by adding “cooldown”/minimum-age gates in both GitHub Dependabot and Yarn, reducing the chance of immediately ingesting newly published (and potentially risky) upstream releases.
Changes:
- Configure Dependabot to run daily npm version checks while applying a cooldown period before proposing updates.
- Configure Yarn’s npm resolution to require a minimum package-version age, with a small allowlist of preapproved packages.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.yarnrc.yml |
Adds Yarn npm minimum-age gating (npmMinimalAgeGate) plus an allowlist via npmPreapprovedPackages. |
.github/dependabot.yml |
Introduces Dependabot configuration for npm updates with a cooldown and daily schedule. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
We should be using the same corepack binary and yarnrc as other environments. Perhaps adding 'nodeLinker: node-modules' was needed at one point, but it's now in the default yarn file.
zetter-rpf
changed the title
zetter-rpf
changed the title
zetter-rpf
changed the title
abcampo-iry
approved these changes
May 13, 2026
Contributor
abcampo-iry
left a comment
abcampo-iry
left a comment
There was a problem hiding this comment.
This looks reasonable
DNR500
approved these changes
May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related to a similar change in editor-standalone: https://github.com/RaspberryPiFoundation/editor-standalone/pull/881
This does three things:
npmMinimalAgeGatesetting.See commits for more