[marcleblanc2]

A malicious or broken release is usually pulled within days. Renovate opened
pull requests for markdownlint-cli2 0.24.1 and uv 0.13.8 within hours of
their release.

• renovate.json: minimumReleaseAge: "3 days". Renovate opens no branch for
  a release until it is 3 days old. Security updates skip the wait, which is
  Renovate's default.
• Workflows: pip install --uploaded-prior-to P3D for the uv pin. A pin
  younger than 3 days fails the job, security updates included.

Renovate has no release dates for lock file maintenance, so it now holds that
update. A follow-up will set uv's exclude-newer and npm's min-release-age
and then let lock file maintenance run again. uv lock rejects exclude-newer
today, because the locked ruff 0.17.5 is younger than 3 days until
2026-11-15 17:54 UTC.

Test plan

• npx --yes --package renovate renovate-config-validator renovate.json:
  config validated
• pip 26.2.2, the version on the runners:
  pip install --dry-run --uploaded-prior-to P3D "uv==0.13.4" resolves, and
  "uv==0.13.8" (published 2026-11-12) fails with
  No matching distribution found
• actionlint and markdownlint-cli2 pass
• Not tested: what Renovate does with the setting, which shows only after
  merge, and release.yml, which runs only on a tag

[github-actions]

Open the Diff Tour for this PR in Sourcegraph