`devEngines` is ignored by npm releases such as `10.8.2`, so those
clients can install dependencies without applying the seven-day
`min-release-age` setting added in #401. Declare the same minimum in
`engines.npm` and enable `engine-strict` to make that legacy installer
requirement fatal. Keep `devEngines` for its earlier checks on newer npm
versions, and pin the build and checksum workflows to Node.js `24.19.0`
so their bundled `npm` supports the policy.
Related: astral-sh/setup-uv#1026 and astral-sh/ruff#27844 enforce the
same legacy-aware `npm` version floor. astral-sh/ruff-action#400 covers
Dependabot's update cooldown, and astral-sh/ruff-action#402 separately
verifies registry signatures and available provenance.
---------
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
CI already disables npm lifecycle scripts, but ordinary installs from
the repository still run them. Add `.npmrc` defaults that disable those
scripts and apply the same seven-day `min-release-age` policy used by
`setup-uv`. Require npm `11.10.0` or newer through `devEngines` so older
versions cannot silently ignore the age setting. Explicit project
commands such as `npm run package` remain available.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
The repository has no explicit Dependabot cooldown, so routine updates
do not follow the 30-day policy used by `setup-uv`. Add
`cooldown.default-days: 30` for npm and GitHub Actions while retaining
the daily schedule. Dependabot security updates remain outside the
cooldown.
Co-authored-by: zaniebot <242828183+zaniebot@users.noreply.github.com>
