chore: configure dependency minimum release age / cooldown

[Piccirello]

Adds a minimum release age ("cooldown") to this repo's package-manager
configuration so newly published dependency versions wait ~7 days before they
can be adopted. This reduces exposure to compromised or unstable packages that
are caught and unpublished shortly after release.

Applied per package manager found in the repo:

• Dependabot (.github/dependabot.yml): cooldown.default-days: 7 per ecosystem
• pnpm (pnpm-workspace.yaml): minimumReleaseAge: 10080 (minutes)
• npm (.npmrc): min-release-age=7 (days)
• yarn (.yarnrc.yml): npmMinimalAgeGate: "7d"
• bun (bunfig.toml): minimumReleaseAge = 604800 (seconds)
• uv (pyproject.toml): exclude-newer = "7 days"

Generated and verified with semgrep (package_managers.* rules); the check passes
after this change.

[greptile-apps]

_{Reviews (1): Last reviewed commit: "chore: configure dependency minimum rele..." | Re-trigger Greptile}

[github-actions]

posthog-python Compliance Report

Date: 2026-05-28 22:21:39 UTC
Duration: 176074ms

✅ All Tests Passed!

45/45 tests passed

---

Capture Tests

✅ 29/29 tests passed

View Details

Test	Status	Duration
Format Validation.Event Has Required Fields	✅	516ms
Format Validation.Event Has Uuid	✅	1506ms
Format Validation.Event Has Lib Properties	✅	1506ms
Format Validation.Distinct Id Is String	✅	1506ms
Format Validation.Token Is Present	✅	1506ms
Format Validation.Custom Properties Preserved	✅	1504ms
Format Validation.Event Has Timestamp	✅	1506ms
Retry Behavior.Retries On 503	✅	9516ms
Retry Behavior.Does Not Retry On 400	✅	3505ms
Retry Behavior.Does Not Retry On 401	✅	3506ms
Retry Behavior.Respects Retry After Header	✅	9512ms
Retry Behavior.Implements Backoff	✅	23526ms
Retry Behavior.Retries On 500	✅	7498ms
Retry Behavior.Retries On 502	✅	7510ms
Retry Behavior.Retries On 504	✅	7514ms
Retry Behavior.Max Retries Respected	✅	23517ms
Deduplication.Generates Unique Uuids	✅	1504ms
Deduplication.Preserves Uuid On Retry	✅	7512ms
Deduplication.Preserves Uuid And Timestamp On Retry	✅	14519ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	7506ms
Deduplication.No Duplicate Events In Batch	✅	1501ms
Deduplication.Different Events Have Different Uuids	✅	1506ms
Compression.Sends Gzip When Enabled	✅	1505ms
Batch Format.Uses Proper Batch Structure	✅	1506ms
Batch Format.Flush With No Events Sends Nothing	✅	1004ms
Batch Format.Multiple Events Batched Together	✅	1504ms
Error Handling.Does Not Retry On 403	✅	3508ms
Error Handling.Does Not Retry On 413	✅	3506ms
Error Handling.Retries On 408	✅	7512ms

Feature_Flags Tests

✅ 16/16 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	1003ms
Request Payload.Flags Request Uses V2 Query Param	✅	1005ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	1005ms
Request Payload.Flags Request Omits Authorization Header	✅	1005ms
Request Payload.Token In Flags Body Matches Init	✅	1005ms
Request Payload.Groups Round Trip	✅	1005ms
Request Payload.Groups Default To Empty Object	✅	1005ms
Request Payload.Person Properties Distinct Id Auto Populated When Caller Omits It	✅	1005ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	1006ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	1005ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	1005ms
Request Lifecycle.No Flags Request On Init Alone	✅	503ms
Request Lifecycle.No Flags Request On Normal Capture	✅	1506ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	1009ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	1002ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	1508ms

[greptile-apps]

_{Reviews (2): Last reviewed commit: "chore: configure dependency minimum rele..." | Re-trigger Greptile}