From 4b9ac1d49a52560952d2591f05b6adb9ae77969a Mon Sep 17 00:00:00 2001
From: Constantin <74049135+constantin-jais@users.noreply.github.com>
Date: Sat, 10 Oct 2026 05:23:03 +0200
Subject: [PATCH] chore(bun): carry the three-day release-age guard on every
 install root

The fleet gate check-release-age (project-governance) requires every
tracked bunfig.toml to set [install] minimumReleaseAge >= 259200 with no
undeclared minimumReleaseAgeExcludes, and every directory holding a tracked
bun.lock to hold a bunfig.toml: Bun reads the configuration of the
directory it runs in, so a lockfile next to no configuration installs
unguarded (threat triage 2026-10-09, menace 6).

Claude-Session: https://claude.ai/code/session_01F18JyLzoGrRpt7efAr4E92
Signed-off-by: Constantin <74049135+constantin-jais@users.noreply.github.com>
---
 bunfig.toml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bunfig.toml b/bunfig.toml
index 8a7bca8..96a2dd1 100644
--- a/bunfig.toml
+++ b/bunfig.toml
@@ -4,3 +4,7 @@
 [install]
 # Shared React packages must resolve one runtime across application workspaces.
 linker = "hoisted"
+# Fleet release-age guard (project-governance check-release-age): a version
+# younger than three days is not resolved.
+minimumReleaseAge = 259200
+minimumReleaseAgeExcludes = []