chore: enforce dependency release age checks

.github/workflows/auth-integration-tests.yml

@@ -25,7 +25,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/build-packages.yml

@@ -7,12 +7,18 @@ on:
     paths:
       - 'packages/**'
       - 'scripts/build.ts'
+      - 'scripts/check-release-age.ts'
+      - 'bun.lock'
+      - 'bunfig.toml'
       - 'package.json'
       - '.github/workflows/build-packages.yml'
   pull_request:
     paths:
       - 'packages/**'
       - 'scripts/build.ts'
+      - 'scripts/check-release-age.ts'
+      - 'bun.lock'
+      - 'bunfig.toml'
       - 'package.json'
       - '.github/workflows/build-packages.yml'
 
@@ -26,7 +32,10 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
+
+      - name: Check dependency release age
+        run: bun run security:release-age
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/core-integration-tests.yml

@@ -30,7 +30,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/core_tests.yml

@@ -26,7 +26,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/dependency-release-age.yml

@@ -0,0 +1,36 @@
+name: dependency-release-age
+
+on:
+  push:
+    branches:
+      - master
+    paths:
+      - 'bun.lock'
+      - 'bunfig.toml'
+      - 'package.json'
+      - 'packages/*/package.json'
+      - 'scripts/check-release-age.ts'
+      - '.github/workflows/dependency-release-age.yml'
+  pull_request:
+    paths:
+      - 'bun.lock'
+      - 'bunfig.toml'
+      - 'package.json'
+      - 'packages/*/package.json'
+      - 'scripts/check-release-age.ts'
+      - '.github/workflows/dependency-release-age.yml'
+
+jobs:
+  dependency-release-age:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.11
+
+      - name: Check dependency release age
+        run: bun run security:release-age

.github/workflows/docs.yml

@@ -31,7 +31,7 @@ jobs:
           fetch-depth: 0
       - uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
       - name: Setup Pages
         uses: actions/configure-pages@v4
       - name: Install dependencies

.github/workflows/expo-sqlite-integration-tests.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/format.yml

@@ -42,7 +42,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/indexeddb-integration-tests.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/publish.yml

@@ -23,7 +23,10 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
+
+      - name: Check dependency release age
+        run: bun run security:release-age
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/sqlite-bun-integration-tests.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

.github/workflows/sqlite3-integration-tests.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
-          bun-version: 1.2.18
+          bun-version: 1.3.11
 
       - name: Install dependencies
         run: bun install --frozen-lockfile

bunfig.toml

@@ -0,0 +1,3 @@
+[install]
+# Only resolve npm package versions that have been available for at least 7 days.
+minimumReleaseAge = 604800

package.json

@@ -33,6 +33,7 @@
     "docs:dev": "vitepress dev packages/docs",
     "docs:build": "vitepress build packages/docs",
     "docs:preview": "vitepress preview packages/docs",
+    "security:release-age": "bun scripts/check-release-age.ts",
     "format": "prettier . --write",
     "format:check": "prettier . --check"
   }