Org-wide rollout to help mitigate future supply-chain attacks
(e.g. tanstack Shai-Hulud 2026-05-11). Contact @amckinley for details.
Cooldown delays version-update PRs by 7 days so malicious package
versions that are yanked within hours of publish never reach our
lockfiles. Security updates bypass cooldown.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Austin McKinley