[marcleblanc2]

A malicious or broken release is usually pulled within days. Renovate opened
pull requests for markdownlint-cli2 0.24.1 and uv 0.13.8 within hours of
their release.

• renovate.json: minimumReleaseAge: "3 days". Renovate opens no branch for
  a release until it is 3 days old. Security updates skip the wait, which is
  Renovate's default. src-py-lib is exempt, so a new release of our own
  library can ship here the same day.
• .npmrc: min-release-age=3. npm resolves no version younger than 3 days
  when it writes package-lock.json. npm ci installs what the lock file
  names and is not affected.
• Workflows: pip install --uploaded-prior-to P3D for the uv pin. A pin
  younger than 3 days fails the job, security updates included.

Renovate has no release dates for lock file maintenance, so it now holds that
update. A follow-up will set uv's exclude-newer and then let lock file
maintenance run again. uv lock rejects exclude-newer today, because the
locked ruff 0.17.5 is younger than 3 days until 2026-11-15 17:54 UTC.

Test plan

• npx --yes --package renovate renovate-config-validator renovate.json:
  config validated
• pip 26.2.2, the version on the Linux and macOS runners:
  pip install --dry-run --uploaded-prior-to P3D "uv==0.13.4" resolves, and
  "uv==0.13.8" (published 2026-11-12) fails with
  No matching distribution found
• With min-release-age=3: npm ci --ignore-scripts and
  npm install --package-lock-only pass, and package-lock.json is unchanged
• actionlint and npm run lint:markdown pass
• Not tested: what Renovate does with the setting, which shows only after
  merge, and release.yml, which runs only on a tag

[github-actions]

Open the Diff Tour for this PR in Sourcegraph