# Hardening direct dependencies: pinned versions are saved instead of ranges (^/~)
save-exact=true

# Supply Chain Quarantine: Blocks packages released within the last 7 days to mitigate "zero-day" compromises.
# NOTE: To pull an urgent security patch released today, temporarily lower this value or comment it out.
min-release-age=7

# Malware Mitigation: Strictly blocks all post-install lifecycle scripts from dependencies.
# NOTE: If a trusted package breaks because it requires scripts, you may need to run its script manually.
ignore-scripts=true
