npm min-release-age is in days, pnpm minimumReleaseAge is in minutes

min-release-age in npm takes a number of days. With min-release-age=2 in .npmrc, npm only resolves versions that have been available for more than two days. I checked everything below on npm 11.19.0.

The npm documentation for the setting says npm installs only versions available “more than the given number of days ago”. The type is a number and the default is null, which means no waiting period.

Why the unit is easy to get wrong

pnpm has the same protection under a similar name, minimumReleaseAge, and it counts minutes. The pnpm documentation uses 1440 as its example for one day.

Copy that value into .npmrc and min-release-age=1440 asks npm for versions that are almost four years old. npm then fails on any dependency that has no version that old, so you find out quickly. The opposite mistake is silent. minimumReleaseAge: 2 in pnpm is a two-minute wait, which protects against almost nothing.

How to see the value npm is using

npm config get min-release-age

This prints 2 on my machine. The long listing also shows where the value comes from:

npm config ls -l | grep -E '^(; )?(before|min-release-age)'

before = null
; min-release-age = null ; overridden by user
min-release-age-exclude = []
min-release-age = 2

The commented line is the default. The last line is the value from my user .npmrc.

Letting one package through

npm documents min-release-age-exclude for this. It takes package names or glob patterns:

min-release-age=2
min-release-age-exclude[]=@myorg/*

Only the named packages skip the wait. Their dependencies still follow it.

For a single command, pass the flag. The command line outranks .npmrc in npm’s documented precedence (cli, then env, project, user, global), so the flag replaces the file’s value for that run:

npm install some-package --min-release-age=0

To confirm the flag wins without installing anything, run npm config get min-release-age --min-release-age=0. It prints 0.

If a repository has both an .npmrc and pnpm settings, write the unit in a comment next to each number, and run npm config get min-release-age after any change. The pnpm side needs the closer look, because a value that is too small there produces no error.