Add NPM minimum release age of 7 days

.github/workflows/test-and-deploy-storybook.yml

@@ -18,7 +18,7 @@ jobs:
 
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 22
+          node-version: 24
 
       - run: npm ci
       - run: npm test

.npmrc

@@ -0,0 +1 @@
+min-release-age=7

README.md

@@ -52,6 +52,9 @@ In unusual situations, you can suppress the checks by adding the flag `-n` to yo
 
 To run the checks *before* you commit, run `npm run test`.
 
+Note that we've set *one week* as the minimum amount of time that must have passed since a dependency has been released, before it may be pulled in.
+This helps to guard against supply-chain attacks.
+
 Contributors are expected to abide by the project's [Code of Conduct](./CODE_OF_CONDUCT.md) and to be respectful of the project and people working on it.
 
 ## Additional Resources

RetPageOriginDockerfile

@@ -2,7 +2,7 @@
 # this dockerfile produces image/container that serves customly packaged hubs and admin static files
 # the result container should serve reticulum as "hubs_page_origin" and "admin_page_origin" on (path) "/hubs/pages"
 ###
-from node:22 as builder
+from node:24 as builder
 env QT_QPA_PLATFORM offscreen
 # Detect architecture and install PhantomJS manually from Ubuntu archive
 run apt update && apt -y install wget && \
@@ -23,9 +23,9 @@ copy admin/package-lock.json admin/
 run cd admin && npm ci --legacy-peer-deps && cd ..
 copy . .
 env BASE_ASSETS_PATH="{{rawhubs-base-assets-path}}"
-run npm run build 
+run npm run build
 run cd admin && npm run build && cp -R dist/* ../dist && cd ..
-run mkdir -p dist/pages && mv dist/*.html dist/pages && mv dist/hub.service.js dist/pages && mv dist/schema.toml dist/pages          
+run mkdir -p dist/pages && mv dist/*.html dist/pages && mv dist/hub.service.js dist/pages && mv dist/schema.toml dist/pages
 run mkdir /hubs/rawhubs && mv dist/pages /hubs/rawhubs && mv dist/assets /hubs/rawhubs && mv dist/favicon.ico /hubs/rawhubs/pages
 
 from alpine/openssl as ssl

admin/.npmrc

@@ -0,0 +1 @@
+min-release-age=7

admin/package.json

@@ -9,8 +9,8 @@
     "url": "https://github.com/Hubs-Foundation/hubs.git"
   },
   "engines": {
-    "node": ">=22.0.1",
-    "npm": ">=10.0.1"
+    "node": ">=24.0.2",
+    "npm": ">=11.10.0"
   },
   "scripts": {
     "start": "webpack serve --mode=development --env hubsCloudDev=1",

package.json

@@ -9,6 +9,10 @@
     "type": "git",
     "url": "https://github.com/Hubs-Foundation/hubs.git"
   },
+  "engines": {
+    "node": ">=24.0.2",
+    "npm": ">=11.10.0"
+  },
   "bugs": {
     "url": "https://github.com/Hubs-Foundation/hubs/issues"
   },