chore(bunfig): restore minimumReleaseAge supply-chain gate with scoped excludes

[waleedlatif1]

Summary

• restores the minimumReleaseAge = 604800 (7-day) supply-chain gate in bunfig.toml that was temporarily set to 0 to unblock the TS7 upgrade (chore(typescript): upgrade to TypeScript 7 (native Go compiler) #5521)
• adds minimumReleaseAgeExcludes for the three packages currently inside the gate so bun install --frozen-lockfile passes today instead of staying red until 2026-07-15:
  • @typescript/native-preview — permanent: it only publishes nightly dev builds, so every version is structurally younger than any age gate
  • typescript + @typescript/typescript6 — vetted in chore(typescript): upgrade to TypeScript 7 (native Go compiler) #5521; they age out on 2026-07-15 / 2026-07-13 and the entries can be dropped after that (noted in a comment in the file)

Type of Change

• Chore

Testing

Verified locally in a clean worktree with the exact CI command:

• bun install --frozen-lockfile with the excludes → succeeds (1854 packages)
• same command with the excludes removed → fails with blocked by minimum-release-age: 604800, confirming the gate is actually enforcing

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 12, 2026 7:55pm

[cursor]

PR Summary

Low Risk
Install-time dependency policy only; no runtime, auth, or application logic changes.

Overview
Re-enables Bun’s 7-day minimumReleaseAge supply-chain gate in bunfig.toml (was temporarily 0 for the TS7 upgrade in #5521).

Adds minimumReleaseAgeExcludes so bun install --frozen-lockfile still works for vetted or structurally “too new” packages: permanent exclude for @typescript/native-preview (nightly-only), and temporary excludes for typescript and @typescript/typescript6 until those lockfile versions age past the gate (mid-July 2026), with comments documenting when to remove the latter two.

^{Reviewed by Cursor Bugbot for commit 643e651. Configure here.}

[greptile-apps]

Greptile Summary

This PR restores Bun's package age gate with targeted TypeScript exclusions.

• Restores minimumReleaseAge to 7 days in bunfig.toml.
• Excludes the currently blocked TypeScript packages from the age gate.
• Documents when the temporary TypeScript exclusions can be removed.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
bunfig.toml	Restores the 7-day install age gate and adds scoped exclusions for the TypeScript packages that are still inside the gate window.

_{Reviews (2): Last reviewed commit: "chore(bunfig): restore minimumReleaseAge..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 643e651. Configure here.}