feat: set default minimumReleaseAge to 3 days (259200s)

[sotanengel]

🛡️ Motivation: Recent Supply Chain Attacks

This change is motivated by a wave of confirmed supply chain attacks in 2025–2026:

Incident	Date	Impact
Shai-Hulud npm Worm	Sep 2025	200+ npm packages compromised via stolen GitHub tokens; secrets exfiltrated from CI/CD
Trivy GitHub Actions Compromise	Mar 2026	Build pipeline of the popular security scanner hijacked; malicious script injection risk
Polyfill.io Domain Hijack	Ongoing	Domain acquisition used to distribute malicious JS to 100,000+ websites
axios npm Compromise	Mar 2026	Maintainer account takeover; RAT-infected version published

Key finding: According to Andrew Nesbitt's research, 8 out of 10 recent supply chain attacks were detected and removed within 1 week of publication. A 3-day cooldown would have blocked most of them automatically.

🔧 What This PR Does

Sets the default minimumReleaseAge to 259200 seconds (3 days = 3 × 24 × 60 × 60).

• Before: packages are installable immediately after publishing
• After: packages must be at least 3 days old before they can be installed by default
• Opt-out: users can set minimumReleaseAge = 0 in bunfig.toml to restore the previous behavior

📋 Compliance Alignment

• NIST Cybersecurity Framework (CSF) 2.0 — Emphasizes Supply Chain Risk Management (C-SCRM) as a core function
• CISA: Securing the Software Supply Chain — Official US government roadmap recommending proactive dependency vetting

🔗 References

• https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html
• https://zenn.dev/dely_jp/articles/supply-chain-kowai

✅ How did you verify your code works?

1. Unit test update: Updated test/cli/install/minimum-release-age.test.ts — the "frozen lockfile" test now explicitly passes --minimum-release-age 0 on the initial install to bypass the new default, confirming the flag works as an opt-out mechanism.
2. Default activation: Verified that minimum_release_age_ms is non-null by default, so the existing guard (if (options.minimum_release_age_ms) |age_ms|) in the install path will enforce the cooldown without any user configuration.
3. Opt-out path: Confirmed that setting minimumReleaseAge = 0 in bunfig.toml or passing --minimum-release-age 0 on the CLI correctly overrides the default back to no restriction.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[coderabbitai]

Walkthrough

The default minimum release age for packages is changed from null (no minimum) to 259200000 milliseconds (3 days) in PackageManagerOptions. A test is updated to explicitly disable this new default behavior using a CLI flag.

Changes

Cohort / File(s)	Summary
Package Manager Configuration src/install/PackageManager/PackageManagerOptions.zig	Changed default value of minimum_release_age_ms from null to 259200000.0 milliseconds (3 days), establishing a default minimum release age filter while retaining ability to override via config, CLI, or environment variables.
Test Updates test/cli/install/minimum-release-age.test.ts	Updated "frozen lockfile" test to explicitly disable the new 3-day minimum-release-age default by adding --minimum-release-age 0 flag to the initial install step.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely summarizes the main change: setting the default minimumReleaseAge to 3 days, which is the core feature being introduced.
Description check	✅ Passed	PR description is comprehensive and well-structured, with clear motivation, implementation details, and verification steps that exceed the template requirements.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sotanengel]

@dylan-conway
@RiskyMH