Dependency policy

Apply one quarantine, update, and audit policy across the fleet.

Use pnpm for Lupinum workspaces. Commit the lockfile. Pin the package manager in packageManager.

Quarantine new releases

Set these values in pnpm-workspace.yaml:

yaml

minimumReleaseAge: 1440
minimumReleaseAgeStrict: true
minimumReleaseAgeIgnoreMissingTime: false

The 24-hour quarantine reduces exposure to a compromised dependency version immediately after publication. It does not delay changes to our own code.

Do not bypass the quarantine for convenience. A critical fix can use one exact, reviewed exception when no safe older version works. Record the package, version, reason, owner, and removal time. Remove the exception after the time expires.

An exact Lupinum prerelease can use a temporary first-party exception when a fleet migration requires it. Apply the same record and removal rule.

Update dependencies

Use Renovate for routine update pull requests. Use Dependabot alerts for known security problems. Do not use two bots to open the same routine upgrades.

Review release notes for major updates and for tools that run during install, build, test, or publication. Run the full repository verification after a lockfile change.

Audit all deployable code

pnpm audit:all must cover public packages, the documentation app, examples, and other deployable workspaces. A production-package audit is an additional check. It is not a substitute for the full audit.

Pin Changelogen to the approved exact version. Do not use latest in a release workflow because the release tool itself is part of the trusted path.