Renovate and various package manager min age unaligned

[MikeMcC399]

Current behavior

The renovate.json configuration includes:

    "minimumReleaseAge": "7 days",
    {
      "matchPackageNames": ["cypress"],
      "minimumReleaseAge": "0 days"
    }

Package manager settings in the repo are not set up with aligned entries. This means that a local update may introduce dependencies that do not meet the minimumReleaseAge

Desired behavior

Using package managers locally should not install dependencies that conflict with Renovate rules.

Suggestion

Add or modify corresponding settings depending on the package manager involved.

npm is used in the root of the repo and in multiple examples directories. pnpm, Yarn v1 Classic and Yarn Modern are used in examples only.

npm

npm is not yet set up.

• min-release-age available since npm@11.10.0
• min-release-age-exclude available in npm@11.17.0 (not yet published in Node.js 24 Active LTS)

pnpm

pnpm examples are set up with minimumReleaseAge of 4320 in minutes. This is equivalent to 3 days.

An exception for cypress is in place using minimumreleaseageexclude.

Yarn v1 Classic

There is no provision in Yarn v1 Classic for a minimum release age.

Yarn v1 Classic pre-dates the supply chain attacks that have prompted minimum release age protection. Yarn v1 Classic in itself is unsupported since 2020. The action however continues to allow its use.

Yarn Modern

Yarn Modern examples are set up with npmMinimalAgeGate set to 3d (3 days).

An exception for cypress is in place using npmPreapprovedPackages.

Status

Set minimum age to 7 days in package managers:

• npm
• pnpm
• Yarn Classic - no functionality available for this. The Yarn v1 Classic repo is frozen and no longer maintained
• Yarn Modern

[MikeMcC399]

• pnpm examples updated with chore(deps): set pnpm minimumReleaseAge to 10080 minutes (7 days) #1817

[MikeMcC399]

• Yarn Modern examples updated with chore(deps): set Yarn Modern minimumReleaseAge to 7d (7 days) #1818

[MikeMcC399]

npm suggestion

Add settings to the root .npmrc configuration:

min-release-age=7
min-release-age-exclude[]="cypress"

With the current Node.js 24.18.10 (with npm 11.16.0 bundled), this however results in the warning:

npm warn Unknown project config "min-release-age-exclude". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.

min-release-age-exclude is available in npm@11.17.0 (not yet published in Node.js 24 Active LTS).

I will defer submitting a PR for this change until Node.js 24 has released with minimum npm@11.17.0 and GitHub Actions Ubuntu runner images have been released with the minimum required version of npm cached. This will probably be towards the end of July 2026.