From 877ecae5b12ae4629a8e4152d10d1ccf2987ecde Mon Sep 17 00:00:00 2001
From: Nicolas Bonet <nicolas@expensify.com>
Date: Wed, 16 Sep 2026 12:44:18 -0500
Subject: [PATCH] Add npm min-release-age cooldown for supply chain protection

Only resolve package versions published at least 7 days ago. npm ci and
lockfile-clean installs are unaffected. See https://github.com/Expensify/Expensify/issues/636594
---
 .npmrc | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.npmrc b/.npmrc
index d67f374..7147343 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1 +1,5 @@
 node-linker=hoisted
+
+# Supply chain protection: only resolve package versions published at least 7 days ago.
+min-release-age=7
+min-release-age-exclude[]=eslint-config-expensify