legacy-peer-deps=true

# Supply-chain quarantine: don't resolve to a freshly published version.
# Compromised-maintainer publishes are typically yanked within days, so a
# waiting period catches them without blocking routine upgrades. Lockfile
# installs (`--frozen-lockfile`, i.e. all of CI) are unaffected — this only
# gates *new* resolutions. Two keys because the two clients spell it
# differently: npm >=11.10 wants days, pnpm wants minutes.
min-release-age=7
minimum-release-age=10080
