staticaland/dependencies
Hold new dependency releases for a cooldown, configure Renovate, freeze install commands to their lock files, and deny install-time script execution
Set up dependency cooldowns - a minimum release age that holds back freshly published package versions - across a project's package managers and update bots. Use when the user wants protection from compromised releases, or mentions cooldown, minimum release age, or exclude-newer.
Replace resolving install commands with frozen ones - npm ci, uv sync --locked - at every site meant to reproduce a lockfile: CI workflows, image builds, task runners, deploy scripts, and docs. Use when the user wants reproducible installs, or mentions npm install in CI, npm ci, clean-install, --frozen-lockfile, or lockfile drift. Covers npm and uv.
Stop dependency install scripts from executing - a committed ignore-scripts for npm, --no-build for uv - then allowlist by name the few packages that genuinely build something. Use when the user wants to block postinstall scripts, harden a project against a compromised release, or mentions ignore-scripts, lifecycle scripts, or npm rebuild. Covers npm and uv.
Add or extend Renovate with a seven-day minimum release age and immutable updates: lock files and integrity hashes, GitHub Action SHAs, and container digests. Use when adopting Renovate, replacing another update bot, covering missing manifests, or updating tools, images, actions, or custom files.