From 7729bd05903386677737294437b2e521103b082c Mon Sep 17 00:00:00 2001
From: Pieter Oliver <68863060+pieterocp@users.noreply.github.com>
Date: Tue, 21 Apr 2026 19:22:09 +0100
Subject: [PATCH] chore(npm): restrict npm installs + package bumps for a week
 (try to prevent 0-days from upstream dependency changes)

---
 .github/dependabot.yml                       | 2 ++
 .github/workflows/continuous-integration.yml | 2 +-
 .node-version                                | 2 +-
 .npmrc                                       | 1 +
 4 files changed, 5 insertions(+), 2 deletions(-)
 create mode 100644 .npmrc

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 54456255..450791f0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,3 +16,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index c55eb9db..0fb61fcf 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -46,7 +46,7 @@ jobs:
           node-version-file: .node-version
 
       - name: Install Dependencies
-        run: npm i
+        run: npm ci --ignore-scripts
 
       - name: Run linters
         run: make lint-prettier
diff --git a/.node-version b/.node-version
index 0a492611..5bf4400f 100644
--- a/.node-version
+++ b/.node-version
@@ -1 +1 @@
-24.11.0
+24.15.0
diff --git a/.npmrc b/.npmrc
new file mode 100644
index 00000000..7417ed69
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1 @@
+min-release-age=7
\ No newline at end of file