morten/morten-olsen.github.io
1
0
Fork 0
mirror of https://github.com/morten-olsen/morten-olsen.github.io.git synced 2026-02-08 01:46:28 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update index.mdx

Browse Source
This commit is contained in:
Morten Olsen
2025-09-22 07:52:55 +02:00
committed by GitHub
parent 6f6e970a1e
commit 4acf4093ec
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/content/articles/node-security/index.mdx
View File

@@ -104,7 +104,7 @@ Goal: shrink the blast radius across the four targets (developer, CI/CD, servers
- **What to do:** - **What to do:**
- **Delay non-security updates** to let the ecosystem notice regressions or malicious releases: - **Delay non-security updates** to let the ecosystem notice regressions or malicious releases:
- **`pnpm`:** Set [`minimumReleaseAge`](https://pnpm.io/settings#minimumreleaseage) in `pnpm-workspace.yaml` or `.npmrc` (e.g., `10080` for 7 days). - **`pnpm (>=10.16.0)`:** Set [`minimumReleaseAge`](https://pnpm.io/settings#minimumreleaseage) in `pnpm-workspace.yaml` or `.npmrc` (e.g., `10080` for 7 days).
- **Renovate:** Use [`minimumReleaseAge`](https://docs.renovatebot.com/configuration-options/#minimumreleaseage) to hold PRs until a package has “aged.” - **Renovate:** Use [`minimumReleaseAge`](https://docs.renovatebot.com/configuration-options/#minimumreleaseage) to hold PRs until a package has “aged.”
- If you prefer manual updates, tools like [`taze`](https://www.npmjs.com/package/taze) can help you batch and filter upgrades. - If you prefer manual updates, tools like [`taze`](https://www.npmjs.com/package/taze) can help you batch and filter upgrades.
- **Exception:** apply security patches immediately (Dependabot/Renovate security PRs). - **Exception:** apply security patches immediately (Dependabot/Renovate security PRs).