Contribution

• I'd be willing to implement this feature (contributing guide)

Describe the user story

1. pnpm audit or Dependabot reports vulnerabilities in your repositories/packages
2. However, all patched versions written there are too new to be updated to due to minimumReleaseAge, so you cannot suppress the alert by pnpm up right now
3. You have to wait until these versions mature

Describe the solution you'd like

A new option in pnpm-workspace.yaml to allow the minimum patched version shown in pnpm audit or GitHub Advisory in pnpm-workspace.yaml.
These versions are often for vulnerability fix, supervised by vulnerability reporters, or/and safer than the other versions.

Update: transitive dependencies that block the installation of those packages should be allowed too, but only the not-yet-deprecated oldest versions.

Describe the drawbacks of your solution

Packages authors might have committed mistakes in these versions and immediately released hotfix versions.

Describe alternatives you've considered

• Time will solve everything but your application or package (or its dependents) might be attacked while waiting.
• Add entries in minimumReleaseAgeExclude just for one day, which produces extra commits.