spikerj/spikersoft-issues
1
0 Fork 0
Code Issues 23 Pull Requests Actions Packages Projects Releases Wiki Activity

[Angular] pnpm hygiene: prune aged-out minimumReleaseAgeExclude pins; decide on minimumReleaseAgeStrict #1175

New Issue
Open
opened 2026-10-02 04:44:20 +00:00 by spikerj · 0 comments
spikerj commented 2026-10-02 04:44:20 +00:00
Owner
Copy link
Copy source

Why

pnpm-workspace.yaml minimumReleaseAgeExclude has accumulated ~30 version-pinned exclusions (pnpm 11.12, FullCalendar 7.0.1, the 2026-07-22 refresh, the Angular 22.0.6/22.0.8 patch train…). Each comment says "drop once older than the cutoff" — they all are now. Dead entries make it hard to see which exclusions are live.

Also minimumReleaseAgeStrict is false, so pnpm silently auto-adds exclusions for young direct deps during installs (that's how the Angular patch-train block appeared). Setting it true makes skipping the release-age gate an explicit, reviewed decision — a supply-chain improvement.

Acceptance criteria

  • remove every exclusion for a version older than the cutoff (and versions no longer in the lockfile)
  • decide minimumReleaseAgeStrict: true (recommended) and document the "how to bump a <24h release on purpose" step in the file comment
  • pnpm install --frozen-lockfile green in CI

Size: XS.

Filed from the 2026-10-02 spikersoft-angular pnpm outdated changelog review.

## Why `pnpm-workspace.yaml` `minimumReleaseAgeExclude` has accumulated ~30 version-pinned exclusions (pnpm 11.12, FullCalendar 7.0.1, the 2026-07-22 refresh, the Angular 22.0.6/22.0.8 patch train…). Each comment says "drop once older than the cutoff" — they all are now. Dead entries make it hard to see which exclusions are live. Also `minimumReleaseAgeStrict` is **false**, so pnpm silently *auto-adds* exclusions for young direct deps during installs (that's how the Angular patch-train block appeared). Setting it **true** makes skipping the release-age gate an explicit, reviewed decision — a supply-chain improvement. ## Acceptance criteria - [ ] remove every exclusion for a version older than the cutoff (and versions no longer in the lockfile) - [ ] decide `minimumReleaseAgeStrict: true` (recommended) and document the "how to bump a <24h release on purpose" step in the file comment - [ ] `pnpm install --frozen-lockfile` green in CI Size: **XS**. --- _Filed from the 2026-10-02 spikersoft-angular `pnpm outdated` changelog review._
spikerj added the enhancement label 2026-10-02 04:44:20 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 epic
Cross-repo epic — children live in per-repo trackers
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels enhancement
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#1175