Is there a way that we can ensure that the pnpm latest version is at least a week old?

[QuintenPeulingCodesharpNl]

At the moment pnpm@latest or pnpm@latest-11 returns packages that could also be suffering from a supply chain attack, because they are very new. We'd like to have a way to install new packages of at least a week old. What's the best way to do that? I couldn't find terminal options or setting files for instance.

[sueun-dev]

pnpm has this built in: minimumReleaseAge (in minutes) in pnpm-workspace.yaml. set minimumReleaseAge: 10080 and it ignores anything published in the last week, resolving to the newest version that's old enough. pnpm 11 already defaults it to 1440 (1 day), so you're just bumping that up.

verified on 10.16: chalk@<6 normally resolves 5.6.2, but under a big age gate pnpm drops to 1.1.3 (2016), so it's real publish-time filtering, not a warning. minimumReleaseAgeExclude lets you allow specific packages through, e.g. an urgent security patch.