(FR): Implement exclusion mechanism for 'minimumReleaseAge' feature for CVE mitigation

minimumReleaseAge was recently implemented which is a great addition to combat supply chain attacks, unfortunately not having an exclusion mechanism makes adoption hard.

In the situation where there's an urgent CVE that needs mitigation by immediately updating an affected package there's no way to allow that particular package to be excluded from the minimum release age.

As prior art, pnpm have already implemented a mechanism https://pnpm.io/settings#minimumreleaseageexclude so might be a good idea to align with that.

As ever, thanks for all the hard work!

Additional use case: Organizations will often want to be able to consume their own packages immediately and only apply minimum release age to third party packages, so would want to exclude @my-org/* (for example) from the config.

chore(build): bump base image and security improvement (#282)

In the Python world, uv allows overriding the minimum release age requirement for specific packages on a one-off basis, avoiding the need to put the exemption in a config file where it may be forgotten way beyond its welcome.

For example:

uv lock --upgrade --exclude-newer-package "cryptography=0s"

In this case, cryptography would update to the latest version, no matter how recent, while the general minimum release age requirement would still apply to all other depdencencies.

As daiscog said, the exclude rule is useful for allowing your internal packages to be updated without limitation. However, I would also propose an additional behavior that's kind of in line with what janikarki said - if a newer version has been explicitly installed, it should also be exempt from the minimum age restriction. In other words, if a package has the following versions:

my-package@1.0.0 - 5 days old
my-package@1.0.1 - 2 days old
my-package@1.0.2 - 1 day old

and my .npmrc has minimum-release-age=3,
a dependency of my-package@^1.0.0 in my package.json would install 1.0.0, but
a dependency of my-package@^1.0.1 would install 1.0.1, even though it's newer than my 3-day minimum.

This behavior would be nice because adding a minimumReleaseAgeExclude entry for my-package would work for a one-off update to mitigate CVEs, but you have to remember to remove that entry at some point in the future, or else you're essentially trusting that package to never have any zero-day issues in the future.

This is needed like yesterday, what can the community do here? can we finalize a solution so we can work on a pr?

@niemyjski

@niemyjski Looking at the PR links directly above your comment, it looks like @caseyjhol created a PR in Mar 2026 which could address this:

feat: add min-release-age-exclude with glob pattern support cli#9175

@wraithgar answered in comment 4253575699 that it overlaps with dependency types and lifecycle support:

This is a feature that overlaps with several other things folks want, including allowing dependency types and allowing lifecycle scripts. Because of that we have an rfc discussion ongoing in npm/rfcs#861 to try to come up with something that will work as a pattern for all of these approaches. We don't want to throw quick solutions at this which are hard to maintain or implement.

So looks like this feature will be in the design phase after #861 is hashed out further.

Possible API direction: One of the last sketches for the #861 API proposal from @everett1992 includes an override for min-release-age (second example mine):

{
  // Use latest release of @scope packages.
  "[name^='@scope/']": { "min-release-age": 0 },

  // Bypass min-release-age for next@16.2.6
  "#next@16.2.6": { "min-release-age": 0 },
}

Source: #861 (comment)

chore: default minimumPackageAgeDays to 0 (opt-in)

feat(npm,pnpm): add supply-chain release-age embargo

@dburrows

@dburrows Thanks for taking the time to share your idea! New ideas are always appreciated and are better suited for our RFC repo instead since that's the right place in order to get more attention from the rest of the team and the community.

I've transferred the issue to that repo for future discussion

merged!

chore: keep @rvoh floors at latest; temporarily skip npm app-generati…

Navigation Menu

Repository navigation

(FR): Implement exclusion mechanism for 'minimumReleaseAge' feature for CVE mitigation #895

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

(FR): Implement exclusion mechanism for 'minimumReleaseAge' feature for CVE mitigation #895

Description

Activity

daiscog commented on Feb 23, 2026

janikarki commented on Mar 31, 2026

fritz-c commented on Mar 31, 2026

niemyjski commented on May 12, 2026

karlhorky commented on May 13, 2026

v-mragunandhan24 commented on Jun 9, 2026

owlstronaut commented on Jun 10, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions