Add minimumReleaseAge to pnpm config#2943
Conversation
RobinTail
added
dependencies
|
Caution Review failedThe pull request is closed. WalkthroughAdds Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
pnpm-workspace.yaml (2)
15-15: Clarify the quarantine window inline.Add a brief inline comment to make the 2‑day window obvious to future maintainers.
-minimumReleaseAge: 2880 +minimumReleaseAge: 2880 # 2 days
16-23: Add '@types/node' to minimumReleaseAgeExcludepackage.json contains "@types/node" (^24.0.0); add it so type-only bumps aren't blocked.
minimumReleaseAgeExclude: - eslint - express - http-errors - typescript - tsx - vitest - zod + - '@types/node'
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
pnpm-workspace.yaml(1 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: RobinTail
PR: RobinTail/express-zod-api#2697
File: CHANGELOG.md:5-5
Timestamp: 2025-06-02T21:11:20.768Z
Learning: In the express-zod-api repository, RobinTail follows a release workflow where package.json version is only updated on the master branch after merging all planned release changes. Changelog entries may show future version numbers while package.json remains at the previous version during feature development, and this is intentional workflow, not a version inconsistency that needs to be flagged.
Learnt from: RobinTail
PR: RobinTail/express-zod-api#0
File: :0-0
Timestamp: 2025-05-28T19:19:27.727Z
Learning: In pnpm workspaces, most configuration can now be done directly in pnpm-workspace.yaml using the `settings` section instead of requiring .npmrc files. This includes workspace linking, dependency resolution, and performance settings.
📚 Learning: 2025-05-28T19:19:27.727Z
Learnt from: RobinTail
PR: RobinTail/express-zod-api#0
File: :0-0
Timestamp: 2025-05-28T19:19:27.727Z
Learning: In pnpm workspaces, most configuration can now be done directly in pnpm-workspace.yaml using the `settings` section instead of requiring .npmrc files. This includes workspace linking, dependency resolution, and performance settings.
Applied to files:
pnpm-workspace.yaml
🔇 Additional comments (2)
pnpm-workspace.yaml (2)
15-23: Good defense-in-depth addition.Time-delaying new releases with targeted exclusions reduces supply‑chain risk without blocking common dev‑tool updates.
15-23: minimumReleaseAge belongs in Renovate config, not pnpm-workspace.yaml
- minimumReleaseAge (formerly stabilityDays) is a Renovate configuration option — put it in renovate.json or .github/renovate.json; it is not a pnpm workspace key. (docs.renovatebot.com)
- Repo check: root package.json pins [email protected] and there is a root renovate.json that currently doesn’t set minimumReleaseAge — the entries in pnpm-workspace.yaml (lines 15–23) will be ignored.
- minimumReleaseAgeExclude is not a documented Renovate field; use packageRules.matchPackageNames to exempt or override packages instead. (docs.renovatebot.com)
- Note: Dependabot also offers a cooldown/minimum-age feature — if you run Dependabot too, avoid configuring both tools to wait (you’ll double-delay updates). (github.blog)
Likely an incorrect or invalid review comment.
1 participant
Summary by CodeRabbit