chore: Add protections against malicious package updates in Renovate (#360)

Author: caitlynstocker

renovate-config.js

@@ -5,21 +5,27 @@ module.exports = {
         ":ignoreModulesAndTests",
         ":pinVersions",
         ":rebaseStalePrs",
-        ":automergeDigest",
-        ":automergePatch",
+        // Automatic merging is temporarily disabled.
+        // ":automergeDigest",
+        // ":automergePatch",
         ":automergePr",
         ":automergeRequireAllStatusChecks",
-        ":automergeLinters",
-        ":automergeTesters",
-        ":automergeTypes",
+        // ":automergeLinters",
+        // ":automergeTesters",
+        // ":automergeTypes",
         "packages:eslint",
         "workarounds:typesNodeVersioning",
         "github>whitesource/merge-confidence:beta",
     ],
     branchPrefix: "renovate/",
     platform: "github",
     repositories: ["OctopusDeploy/login"],
-    packageRules: [],
+    packageRules: [
+        {
+        matchDatasources: ['npm'],
+        minimumReleaseAge: '2 days'
+        }
+    ],
     timezone: "Australia/Brisbane",
     onboarding: false,
     requireConfig: false,