chore(bunfig): restore minimumReleaseAge to 604800

[waleedlatif1]

Summary

• Restores bunfig.toml's minimumReleaseAge from 0 back to 604800 (7 days)
• It was temporarily set to 0 in chore(typescript): upgrade to TypeScript 7 (native Go compiler) #5521 to let TypeScript 7.0.2 (published the same day) clear the supply-chain install-age gate for that merge
• Now that the merge is done, restoring the gate to its normal value

Type of Change

• Chore / security config restore

Testing

N/A — one-line config value revert

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		Jul 9, 2026 12:04am

[cursor]

PR Summary

Low Risk
Single config revert with no app logic impact; slightly stricter install policy than the temporary 0 value.

Overview
Reverts a temporary minimumReleaseAge = 0 in bunfig.toml back to 604800 (seven days), re-enabling Bun's supply-chain install-age check after it was disabled to allow a same-day TypeScript release during a prior merge.

No application code or runtime behavior changes—only install-time dependency policy.

^{Reviewed by Cursor Bugbot for commit a40fab9. Configure here.}

[greptile-apps]

Greptile Summary

This PR restores the Bun install age gate.

• Sets minimumReleaseAge back to 604800 seconds.
• Re-enables the 7-day package publication cooldown in bunfig.toml.

Confidence Score: 4/5

Non-frozen Bun install paths can fail while the newly merged TypeScript packages are still inside the 7-day age gate.

• The changed config restores the intended supply-chain gate.
• The same line can reject recently published dependencies during developer setup or Docker image builds that re-resolve packages.
• Frozen CI installs are less exposed, but non-frozen install paths still need a guard or delay.

bunfig.toml

Security Review

The PR restores a supply-chain hardening setting, but the timing can temporarily block valid installs for newly merged packages that are still inside the cooldown window.

Important Files Changed

Filename	Overview
bunfig.toml	Restores Bun's install age gate to 7 days, which can block non-frozen installs for recently published dependencies.

_{Reviews (1): Last reviewed commit: "chore(bunfig): restore minimumReleaseAge..." | Re-trigger Greptile}

[greptile-apps]

Install Age Gate Blocks TS7

When this 7-day gate is restored before the newly merged TypeScript 7 packages age out, Bun install paths that re-resolve packages can reject those versions. Developer installs and Docker builds that run bun install without --frozen-lockfile can fail until the package publish times pass the gate window.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!