Contribution

• I'd be willing to implement this feature (contributing guide)

Describe the user story

1. Project configures minimumReleaseAge: 10080 (7 days)

2. New critical security fix of Next.js appears which is newer than 7 days

3. User attempts to upgrade to new Next.js version

4. ERR_PNPM_NO_MATURE_MATCHING_VERSION error appears for a package not yet added to minimumReleaseAgeExclude (starting with next, continuing on with @next/env, @next/swc-darwin-arm64, etc), eg:

   $ pnpm add next@15.5.9
    ERR_PNPM_NO_MATURE_MATCHING_VERSION  No matching version found for next@15.5.9 published by Tue Jan 13 2026 10:38:05 GMT+0100 (Central European Standard Time) while fetching it from https://registry.npmjs.org/. Version 3.8.0 satisfies the specs but was released at Thu Jan 15 2026 00:56:17 GMT+0100 (Central European Standard Time)
   
   This error happened while installing a direct dependency of /Users/k/p/project
   
   The latest release of next is "15.5.9". Published at 1/15/2026
   
   Other releases are:
     ...
   
   If you need the full list of all ... published versions run "$ pnpm view next versions".
   
   If you want to install the matched version ignoring the time it was published, you can add the package name to the minimumReleaseAgeExclude setting. Read more about it: https://pnpm.io/settings#minimumreleaseageexclude

5. User attempts to edit pnpm-workspace.yaml to configure minimumReleaseAgeExclude with the package mentioned, such as:
   pnpm-workspace.yaml

   minimumReleaseAgeExclude:
     - next@15.5.9

6. User attempts to run pnpm install again, but another error occurs - loop back up to step 3 again, over and over 💥 until all of the packages have been added to minimumReleaseAgeExclude, as shown below

The final list of packages I needed to configure for Next.js 15.5.9:

minimumReleaseAgeExclude:
  # - https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp
  # - https://github.com/vercel/next.js/security/advisories/GHSA-mwv6-3258-q52c
  # - https://github.com/vercel/next.js/security/advisories/GHSA-w37m-7fhw-fmv9
  # - https://github.com/vercel/next.js/security/advisories/GHSA-5j59-xgg2-r9c4
  - next@15.5.9
  - '@next/env@15.5.9'
  - '@next/mdx@15.5.9'
  - '@next/swc-darwin-arm64@15.5.9'
  - '@next/swc-darwin-x64@15.5.9'
  - '@next/swc-linux-arm64-gnu@15.5.9'
  - '@next/swc-linux-arm64-musl@15.5.9'
  - '@next/swc-linux-x64-gnu@15.5.9'
  - '@next/swc-linux-x64-musl@15.5.9'
  - '@next/swc-win32-arm64-msvc@15.5.9'
  - '@next/swc-win32-x64-msvc@15.5.9'

Describe the solution you'd like

Allow specifying withTransitives for entries to minimumReleaseAgeExclude, to also exclude transitive dependencies coming from dependencies of a particular version of a package:

minimumReleaseAgeExclude:
  - withTransitives: next@15.5.9

In many cases, if a user adds next@16.2.4 to minimumReleaseAgeExclude, that means that they implicitly trust it. That trust could be propagated to all transitive dependencies too with this withTransitives option.

Prior art

The propagation of trust is similar to the Content-Security-Policy strict-dynamic source expression, which specifies:

the trust explicitly given to a script present in the markup ... shall be propagated to all the scripts loaded by that root script

Describe the drawbacks of your solution

Performance: I'm not sure, but maybe this is expensive?

Describe alternatives you've considered

1. pnpm config set 'minimiumReleaseAgeExclude[]' next --depth Infinity --location project - first requires pnpm config set to support non-primitives
2. pnpm violations next@15.5.9 --policy minimumReleaseAge --depth Infinity New command for recursively listing security violations #10489

cc @tats-u