chore(security): npm supply-chain cooldown + pnpm 11.5.1

[Sahil5963]

Why

Rising npm supply-chain attacks (compromised maintainer accounts pushing malicious patch releases). This adds a dependency cooldown so we never install a version that's brand-new — the window where malicious releases are almost always caught and unpublished — plus a CI backstop to enforce it.

What

1. Cooldown gate (pnpm official minimumReleaseAge) — pnpm-workspace.yaml

• minimumReleaseAge: 10080 → refuse any dependency version (incl. transitive) published < 7 days ago.
• minimumReleaseAgeExclude: ["@yourgpt/*"] → our own first-party packages are exempt.
• Enforced at install/resolution time. Verified active: pnpm install now reports "Verifying lockfile against supply-chain policies … ✓ passes."

2. pnpm 9.15.0 → 11.5.1 — package.json packageManager

• Required: minimumReleaseAge needs pnpm ≥ 10.16. (pnpm/action-setup@v4 in CI reads this field automatically.)

3. pnpm 11 migration fallout handled

• Migrated pnpm.overrides (@types/react* pins) → overrides: in pnpm-workspace.yaml (pnpm ≥ 10 no longer reads the package.json pnpm field — these pins would have silently stopped applying).
• Added onlyBuiltDependencies allowlist for trusted native build scripts (esbuild, sharp, @parcel/watcher, workerd, unrs-resolver, msw) — pnpm ≥ 10 blocks dependency lifecycle scripts by default. Anything new requesting a build script is now blocked pending review.

4. CI enforcement backstop — .github/workflows/dependency-age-gate.yml + scripts/check-dependency-age.mjs

• Fails any PR introducing a dependency version younger than the cooldown, by checking npm publish dates against the lockfile diff. Catches bypasses the local setting can't (older pnpm, different package manager, hand-edited lockfile).
• Pure Node builtins — no third-party actions/deps, so the gate adds zero supply-chain surface.

Notes for reviewers

• Lockfile untouched — no dependency version churn; the migrated overrides resolve identically.
• Keep the two windows in sync: minimumReleaseAge: 10080 (minutes) and the workflow's COOLDOWN_DAYS: "7" are the same 7 days (days × 1440 = minutes). Noted in comments in both files.
• First CI run exercises pnpm 11's build-script blocking; if a job fails on a missing native build, add that package to onlyBuiltDependencies.
• Branched off main (not beta) to keep this isolated from the 8 in-flight beta release commits. You'll likely want to land the same hardening on beta too.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
copilot-playground	Ready	Preview, Comment	Jun 5, 2026 6:29am
copilot-sdk-docs	Ready	Preview, Comment	Jun 5, 2026 6:29am