3 ms·

I've made it a habit now to use the --before=2026-05-30 flag when installing packages, where it'll pick the version released before the date you specify, I usua

I've made it a habit now to use the --before=2026-05-30 flag when installing packages, where it'll pick the version released before the date you specify, I usually pick around 5 days ago

sourcegrift 4mo ago
Yarn 4 can automate this
- vinnymac 4mo ago
  In case others are unaware, you just have to set https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate to the value you want. It defaults to 1 day.
- nullsex 4mo ago
  If supply-chain security is a concern yarn is the worst js package manager you can pick. It comes far down their priority list, below "just make things work without need for user input". Whatever you thought you configured will simply be ignored many times and that's considered a feature. Go look in that projects issue tracker and commit log for changes to relevant configuration and you will know what I mean. Even yarn 1.22 is a safer choice.
mihaelm 4mo ago
I just use `pnpm` and set up a liberal `minimumReleaseAge`: https://pnpm.io/settings#minimumreleaseage https://pnpm.io/settings#minimumreleaseage Thankfully, it's on by default since v11.
sync 4mo ago
If using straight npm (v11.10.0 or higher), you can just add to .npmrc in the project root: min-release-age=5
t-sauer 4mo ago
If you use npm 11, you can simplify your workflow by setting min-release-age to 5. https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age https://docs.npmjs.com/cli/v11/using-npm/config#min-release-...