Bump skuba from 12.2.0 to 12.3.0

[dependabot]

Bumps skuba from 12.2.0 to 12.3.0.

Release notes

Sourced from skuba's releases.

skuba@12.3.0

Minor Changes

• lint: Add minimumReleaseAge and minimumReleaseAgeExclude to pnpm-workspace.yaml (#2065)

  These security-focused settings were introduced in pnpm v10.16 to reduce the risk of installing compromised packages. They work by delaying installation of newly released dependencies, giving time for malicious versions to be discovered and removed from the registry.

  minimumReleaseAge specifies the number of minutes that must pass after a version is published before pnpm will install it. minimumReleaseAgeExclude allows you to bypass this restriction for trusted packages, and supports patterns as of pnpm v10.17.0.

  Note: You must be using pnpm v10.16 or later for minimumReleaseAge to work, and pnpm v10.17 or later for minimumReleaseAgeExclude patterns to work properly. With earlier versions of pnpm, these features will not function and pnpm will install any version without applying the minimum release age restrictions.

• lint: Set ignorePatchFailures: false to ensure pnpm patches don't fail silently (#2067)

Patch Changes

• lint: Reclassify new Promise(executor) as safe in skuba/no-sync-in-promise-iterable (#2058)

• lint: Support static Array.from(), Array.fromAsync(), Array.of() methods in skuba/no-sync-in-promise-iterable (#2060)

• deps: @​octokit/types ^15.0.0 (#2064)

Changelog

Sourced from skuba's changelog.

12.3.0

Minor Changes

• lint: Add minimumReleaseAge and minimumReleaseAgeExclude to pnpm-workspace.yaml (#2065)

  These security-focused settings were introduced in pnpm v10.16 to reduce the risk of installing compromised packages. They work by delaying installation of newly released dependencies, giving time for malicious versions to be discovered and removed from the registry.

  minimumReleaseAge specifies the number of minutes that must pass after a version is published before pnpm will install it. minimumReleaseAgeExclude allows you to bypass this restriction for trusted packages, and supports patterns as of pnpm v10.17.0.

  Note: You must be using pnpm v10.16 or later for minimumReleaseAge to work, and pnpm v10.17 or later for minimumReleaseAgeExclude patterns to work properly. With earlier versions of pnpm, these features will not function and pnpm will install any version without applying the minimum release age restrictions.

• lint: Set ignorePatchFailures: false to ensure pnpm patches don't fail silently (#2067)

Patch Changes

• lint: Reclassify new Promise(executor) as safe in skuba/no-sync-in-promise-iterable (#2058)

• lint: Support static Array.from(), Array.fromAsync(), Array.of() methods in skuba/no-sync-in-promise-iterable (#2060)

• deps: @​octokit/types ^15.0.0 (#2064)

Commits

• 0c4170a Version Packages (#2059)
• fe2df2f Add minimumReleaseAge (#2065)
• 2b887fb devDeps: npm dev dependencies (#2069)
• a18c18b Set ignorePatchFailures (#2067)
• f1c1372 template: opentelemetry (#2061)
• 430d964 deps: @​octokit/types ^15.0.0 (#2064)
• 2c8858c update: dependency pnpm to v10.17.0 (#2062)
• 7679eca update: lock file maintenance (#2063)
• 8582577 template: @​opentelemetry/instrumentation-aws-sdk ^0.59.0 (#2057)
• 0d01271 lint: Support static Array methods (#2060)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #542.