minimumReleaseAgeExclude updating bypasses security processes?

[geuben]

How are you running Renovate?

A Mend.io-hosted app

Which platform you running Renovate on?

GitHub.com

Which version of Renovate are you using?

No response

Please tell us more about your question or problem

the automatic updating of minimumReleaseAgeExclude added in #40020 feels like it now bypasses our security process, putting us at more risk.

The minimunReleaseAge is there to introduce time for new releases to be vetted and verified before you upgrade to them, slowing down the spread of supply chain attacks.

By automating the bypassing of this mechanism, that protection is gone. If the supply chain attack is able to create a vulnerability alert, they can have their poisoned version installed immediately and automatically.

Am I missing something?

Logs (if relevant)

No response

[karlhorky]

@geuben yeah it sounds like you're missing something.

From the title of PR #40020 (emphasis mine):

feat(pnpm): update minimumReleaseAgeExclude *for security updates*

Security updates should roll out faster than minimumReleaseAge, because they are about resolving a security problem. Security updates have been vetted by GitHub and have low supply chain attack risk, versus the security improvement they are making.

You can read more in my original discussion:

• Configure pnpm `minimumReleaseAgeExclude` with exact versions for security updates #38766

[geuben]

"Security updates have been vetted and have low supply chain attack risk"

by who? using what process? is said process documented anywhere?

[karlhorky]

@geuben Updated to mention GitHub above. I'm not sure of the exact process or whether it's documented