[Bug?]: Disabling global `npmMinimalAgeGate` does not disable scoped `npmMinimalAgeGate`

[delilahw]

Self-service

• I'd be willing to implement a fix

Describe the bug

Hi!

In #6899, we added support for the global option npmMinimalAgeGate, which could be disabled by setting its value to 0. Then we added granularity by allowing npmMinimalAgeGate to be configured on a per-npmScope basis in #7156. The PR description stated that the scoped value should fall back to the global value:

Allow npmMinimalAgeGate inside an npmScopes entry, falling back to the global value when unset

However, when global npmMinimalAgeGate is set to 0 (disabled) and scoped npmMinimalAgeGate is unset, then the scoped value does not inherit 0 from the global scope. Instead, it defaults to 1440.

# This global value of `0` should be inherited by each scope.
npmMinimalAgeGate: 0

npmScopes:
    scopeName:
        npmRegistryServer: 'https://example.com/.../npm/registry/'
        # The `npmMinimalAgeGate` option is unset on this scope.
        # The effective `npmMinimalAgeGate` would default to `1440` on this scope.

A workaround is to explicitly set npmMinimalAgeGate: 0 on the scope:

npmMinimalAgeGate: 0

npmScopes:
    scopeName:
        npmRegistryServer: 'https://example.com/.../npm/registry/'
        npmMinimalAgeGate: 0

To reproduce

Contents of .yarnrc.yml:

npmMinimalAgeGate: 0

npmScopes:
    scopeName:
        npmRegistryServer: 'https://example.com/.../npm/registry/'

Reproduction commands:

$ yarn --version
4.17.0

$ yarn config get npmMinimalAgeGate
0

$ yarn config get npmScopes --json | jq '.scopeName.npmMinimalAgeGate'
1440

Environment

System:
    OS: macOS 15.7.7
    CPU: (10) arm64 Apple M1 Max
  Binaries:
    Node: 22.18.0 - /private/var/folders/3_/wgnsf7pd4ln2kd4jlwjcsfm00000gn/T/xfs-3958d02e/node
    Yarn: 4.17.0 - /private/var/folders/3_/wgnsf7pd4ln2kd4jlwjcsfm00000gn/T/xfs-3958d02e/yarn
    npm: 10.9.3 - /Users/delilah/.n/bin/npm
    Deno: 2.7.5 - /opt/homebrew/bin/deno

Additional context

No response

[MrBanana05]

@arcanis
We're using a global default of seven days. In our case, this bug results in lower Minimum Release Ages than globally configured. This is a security issue and needs to be fixed asap!