From 763f1ffe14a34de49a98e0baebe59f09d53f606b Mon Sep 17 00:00:00 2001
From: Steffen Beyer <steffen@beyer.io>
Date: Sun, 24 May 2026 19:53:30 +0200
Subject: [PATCH] build: configure npm release delay

Use npm's native min-release-age setting in devenv and assets npm config so dependency resolution avoids very fresh publishes.
---
 assets/.npmrc | 1 +
 devenv.nix    | 2 ++
 2 files changed, 3 insertions(+)
 create mode 100644 assets/.npmrc

diff --git a/assets/.npmrc b/assets/.npmrc
new file mode 100644
index 0000000..7253a5c
--- /dev/null
+++ b/assets/.npmrc
@@ -0,0 +1 @@
+min-release-age=7
diff --git a/devenv.nix b/devenv.nix
index f0fe1a7..cba15a9 100644
--- a/devenv.nix
+++ b/devenv.nix
@@ -13,6 +13,8 @@ in {
     MIX_OS_DEPS_COMPILE_PARTITION_COUNT = 8;
     # Enable JS/LV debugging (required?)
     NODE_ENV = "development";
+    # Delay npm dependency resolution to reduce rushed supply-chain updates.
+    NPM_CONFIG_MIN_RELEASE_AGE = "7";
   };
 
   # https://devenv.sh/packages/