[saddlepaddle]

What

Removes every entry from minimumReleaseAgeExcludes in bunfig.toml, along with the comment blocks explaining them. With no entries left, the key itself is gone; minimumReleaseAge = 259200 stays and now applies to everything.

Two commits, so the Expo batch can be reviewed separately from the rest:

1. Expo SDK 56 batch — expo, expo-asset, expo-constants, expo-dev-client, expo-file-system, expo-font, expo-image, expo-image-manipulator, expo-image-picker, expo-linking, expo-media-library, expo-modules-core, expo-router, expo-web-browser, @expo/ui, react-native-screens
2. The rest — next, the eight @next/* binaries, hono, and the ten @xterm/* packages

Why

Each of these was a dated, temporary bypass, and every one has passed the expiry its own comment set:

Group	Reason it was added	Pinned version	Age	Comment's expiry
Expo SDK 56 (16)	batch had to resolve together or the app SIGABRTs at launch on a DYLD Symbol not found	expo-modules-core@56.0.23 et al	3d+	2026-08-16
next + @next/* (9)	SSRF / cache-confusion / middleware-bypass security release	16.2.11	26d	2026-07-24
hono (1)	CORS middleware ReDoS, GHSA-8j4g-w8fx-2239	4.12.34	13d	2026-08-06
@xterm/* (10)	shared-atlas page-merge garble fix (xtermjs/xterm.js#6042)	beta.289 / beta.297	7-34d	2026-07-16

Worth calling out for next and hono specifically: these are the most attack-attractive dependencies in the repo, and a standing exclusion means a compromised publish of either would install immediately. minimumReleaseAge exists to buy a detection window exactly there, so removing them restores the protection where it matters most. The dated comments show the intended pattern is to add a narrow exclusion at the moment a bypass is genuinely needed, not to leave one standing.

Verification

Resolution is completely unchanged — this only affects which versions bun is willing to resolve, and every package here is pinned exact in package.json, so the exclusions never had anything left to do.

bun install reports Checked 3014 installs across 3337 packages (no changes) and bun.lock is byte-identical (git diff bun.lock is empty). bunfig.toml is the only changed file.

All 15 Expo packages resolve identically before and after:

expo = 56.0.19                   expo-image = 56.0.11
expo-modules-core = 56.0.23      expo-linking = 56.0.16
expo-file-system = 56.0.9        expo-router = 56.2.18
expo-image-manipulator = 56.0.24 expo-web-browser = 56.0.6
expo-media-library = 56.0.10     expo-dev-client = 56.0.24
expo-image-picker = 56.0.23      react-native-screens = 4.26.0
expo-constants = 56.0.23
expo-asset = 56.0.22
expo-font = 56.0.7

And the rest: next 16.2.11, hono 4.12.34, @xterm/xterm 6.1.0-beta.289, @xterm/addon-webgl 0.20.0-beta.297, @xterm/addon-ligatures 0.11.0-beta.220 (still held at beta.220 — its beta.289 bundle imports node:diagnostics_channel, which breaks the vite renderer build; it was never in the exclusion list and is unaffected).

bun run lint and bun run typecheck both pass.

Summary by CodeRabbit

• Chores
  • Updated package installation configuration by removing outdated package exclusion settings and related comments.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5945f2ac-8151-482b-a017-f4ad10ebf290

📥 Commits

Reviewing files that changed from the base of the PR and between a05b20f and 9ba9079.

📒 Files selected for processing (1)

• bunfig.toml

💤 Files with no reviewable changes (1)

• bunfig.toml

Included review availability: Your plan includes up to 10 reviews per rolling hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The Bun install configuration removes the complete minimumReleaseAgeExcludes setting, including package exclusions and explanatory comments.

Changes

Cohort / File(s)	Summary
Release-age configuration bunfig.toml	Removes the minimumReleaseAgeExcludes setting and its package exclusions and comments.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 9ba90

This localized configuration change restores release-age protection for all dependencies without changing resolved versions; the lockfile is unchanged and lint and typecheck pass. No actionable merge-blocking risk remains beyond normal checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the removal of expired release-age exclusions and uses conventional commit format.
Description check	✅ Passed	The description explains the changes, rationale, affected packages, and verification results, but it omits the repository checklist section.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch drop-expired-expo-release-age-2026-08-17-00-00-03

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🧹 Preview Cleanup Complete

The following preview resources have been cleaned up:

• ✅ Neon database branch

Thank you for your contribution! 🎉