[rush-lib] Add support for PNPM's minimumReleaseAge setting

[mrzepinski]

Pull Request Summary - Add PNPM minimumReleaseAge and minimumReleaseAgeExclude Support

PR Title

[rush-lib] Add support for PNPM's minimumReleaseAge setting

Summary

This PR adds support for PNPM's minimumReleaseAge and minimumReleaseAgeExclude settings in Rush's pnpm-config.json file. These settings help mitigate supply chain attacks by requiring a minimum age (in minutes) for package versions before they can be installed, with the ability to exclude trusted packages from this restriction.

Fixes #5372

Details

Changes Implemented (Updated based on code review feedback):

1. Added minimumReleaseAge and minimumReleaseAgeExclude properties

   • Added to IPnpmOptionsJson interface and PnpmOptionsConfiguration class
   • Full JSDoc documentation with examples and version requirements
   • minimumReleaseAge: number (minutes to wait after package release)
   • minimumReleaseAgeExclude: string[] (package names/patterns to exclude from the check)

2. Updated JSON schema (pnpm-config.schema.json)

   • Added validation for minimumReleaseAge (type: number)
   • Added validation for minimumReleaseAgeExclude (type: array of strings)
   • Includes comprehensive descriptions and examples

3. Settings written to workspace package.json (refactored based on feedback)

   • Modified InstallHelpers.generateCommonPackageJson() to write both settings to common/temp/package.json in the pnpm section
   • This approach is more robust than passing CLI arguments
   • Follows the same pattern as other PNPM workspace settings

4. Added PNPM version validation

   • Warns users if PNPM version < 10.16.0
   • Clear messaging guides users to either remove the settings or upgrade PNPM
   • Follows the same pattern as globalIgnoredOptionalDependencies

5. Removed CLI argument approach

   • Removed command-line argument passing from BaseInstallManager.ts
   • Removed .npmrc duplicate detection (no longer needed with package.json approach)

6. Updated API documentation in rush-lib.api.md

7. Added comprehensive template documentation

   • Updated Rush initialization template with examples
   • Clear documentation about PNPM version requirements
   • Examples showing both settings working together

8. Added test coverage

   • Updated PnpmOptionsConfiguration.test.ts to verify both settings
   • Added test fixture with both minimumReleaseAge and minimumReleaseAgeExclude

Design decisions:

• Both settings are optional and default to undefined when not specified
• Requires PNPM 10.16.0 or newer (documented and validated)
• Settings are written to workspace package.json instead of passed as CLI args (more reliable)
• minimumReleaseAgeExclude supports glob patterns (e.g., @myorg/*) per PNPM 10.17.0+

Backwards compatibility:

✅ This change is fully backwards compatible. Both settings are optional, and existing configurations will continue to work unchanged.

Performance impact:

• No performance impact when the settings are not configured
• When enabled, PNPM handles the filtering, with minimal impact during dependency resolution

Code Review Updates

This PR has been updated based on feedback from @D4N14L and @iclanton:

• ✅ Added minimumReleaseAgeExclude support
• ✅ Refactored to write settings to workspace package.json instead of CLI args
• ✅ Added PNPM version validation (10.16.0+)
• ✅ Removed rush-lib change file (keeping only template change file)
• ✅ Fixed TSDoc warning for @ character escaping

[mrzepinski]

@microsoft-github-policy-service agree

[D4N14L]

General question, what is the value of doing this here? The NPMRC shipped with the project is equally capable, and you don't have the issue of specification in two separate places.

Though, this question isn't unique to your PR, as there are other settings that do this as well. CC @octogonz since he may have some insight/opinions here.

[mrzepinski]

@iclanton Let's review please ;) all the remarks were completed