feat(pnpm): update minimumReleaseAgeExclude for security updates

[RahulGautamSingh]

Changes

• When updating a npm dependency (security update), check if the minimumReleaseAge is set or not.
• Incase, it's set update/add the minimumReleaseAgeExclude setting if:
  1. No minimumReleaseAgeExclude block is present in the workspace file
  2. Modify existing exlcude setting if it is not just the depName or patterns (eg,. - '@myorgs/*')

Context

Please select one of the following:

• This closes an existing Issue, Closes: feat(pnpm): add minimumReleaseAgeExclude for security updates #39168
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository:

[RahulGautamSingh]

Not proud of the code but it's working .. Refactoring the code and adding tests now.

@karlhorky if you can perform some tests incase I might have missed handling some cases, that'd be very appreciated.

Test repo: https://github.com/Rahul-renovate-testing/pnpm-test-mra & https://github.com/Rahul-renovate-testing/pnpm-test-mra-2

[karlhorky]

The diff of the testing PR at Rahul-renovate-testing/pnpm-test-mra#4 seems good!

It is showcasing adding a new version when:

• minimumReleaseAgeExclude array exists
• the dependency is included in minimumReleaseAgeExclude

Looking through the code of this PR, it seems like a case may be missed with:

• minimumReleaseAgeExclude array exists
• the dependency is not yet included in minimumReleaseAgeExclude

cc @zkochan @btea @KSXGitHub on the off chance that you would have time to review this PR to Renovate, which will edit pnpm-workspace.yaml with new minimumReleaseAgeExclude entries for security upgrade PRs (to allow immediately upgrading)

[RahulGautamSingh]

Looking through the code of this PR, it seems like a case may be missed with:

• minimumReleaseAgeExclude array exists
• the dependency is not yet included in minimumReleaseAgeExclude

Thanks! Fixed it in the latest commit. Tested here: https://github.com/Rahul-renovate-testing/pnpm-test-mra/pull/5/files

[RahulGautamSingh]

Build docs failing cause of netwrok issues and codecov failure doesn't make sense 😕

[jamietanna]

Can you please update the PRs on the sample repos?

[jamietanna]

Can we get a test repo with a security update please? So we can confirm this works

[RahulGautamSingh]

Can you please update the PRs on the sample repos?

Done.

[RahulGautamSingh]

Can we get a test repo with a security update please? So we can confirm this works

Here: Rahul-renovate-testing/repro-conflicting-dependabot-and-renovate-config-vs-pnpm-minimumReleaseAge#5
12:23
build still fails, due to transtitive deps not being allowed due to very large MRA

[jamietanna]

Awesome, thanks @RahulGautamSingh!

[karlhorky]

build still fails, due to transtitive deps not being allowed due to very large minimumReleaseAge

Hmm I guess a bunch of those transitive dependencies are related to the updated version Next.js 15.4.7? My minimiumReleaseAgeExclude config for Next.js 15.5.9:

  # - https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
  # - https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
  # - https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9
  # - https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4
  - next@15.5.9
  - '@next/env@15.5.9'
  - '@next/mdx@15.5.9'
  - '@next/swc-darwin-arm64@15.5.9'
  - '@next/swc-darwin-x64@15.5.9'
  - '@next/swc-linux-arm64-gnu@15.5.9'
  - '@next/swc-linux-arm64-musl@15.5.9'
  - '@next/swc-linux-x64-gnu@15.5.9'
  - '@next/swc-linux-x64-musl@15.5.9'
  - '@next/swc-win32-arm64-msvc@15.5.9'
  - '@next/swc-win32-x64-msvc@15.5.9'

That's unfortunate, because it would still block the security PR for updated packages which have bumped their dependencies to new versions too... 🤔

@zkochan what do you think of allowing minimumReleaseAgeExclude to also specify transitives?

minimumReleaseAgeExclude:
  - withTransitives: next@15.5.9

Or, alternatively, a pnpm command to add a package + its transitive dependencies to minimumReleaseAgeExclude? (first requires pnpm config set to support non-primitives) Eg:

pnpm config set 'minimiumReleaseAgeExclude[]' next --with-transitives --location project

Or, using --depth instead of --with-transitives:

pnpm config set 'minimiumReleaseAgeExclude[]' next --depth Infinity --location project

Or, listing all of the package + transitives violations to minimumReleaseAge, trustPolicy: 'no-downgrade', etc with a --depth flag would be a smaller step:

pnpm audit-package next@15.5.9 --policy minimumReleaseAge --depth Infinity
# or
pnpm violations next@15.5.9 --policy minimumReleaseAge --depth Infinity

[jamietanna]

Will give time till tomorrow for re-reviews, before we merge 👍

[github-actions]

🎉 This PR is included in version 42.89.0 🎉

The release is available on:

• GitHub release
• 42.89.0

Your semantic-release bot 📦🚀