feat: set default minimumReleaseAge to 1 day (1440 minutes) by sotanengel · Pull Request #11158 · pnpm/pnpm

sotanengel · 2026-03-31T20:16:58Z

Motivation: Recent Supply Chain Attacks

This change is motivated by a wave of confirmed supply chain attacks in 2025–2026:

Incident	Date	Impact
Shai-Hulud npm Worm	Sep 2025	200+ npm packages compromised via stolen GitHub tokens; secrets exfiltrated from CI/CD
Trivy GitHub Actions Compromise	Mar 2026	Build pipeline of the popular security scanner hijacked; malicious script injection risk
Polyfill.io Domain Hijack	Ongoing	Domain acquisition used to distribute malicious JS to 100,000+ websites
axios npm Compromise	Mar 2026	Maintainer account takeover; RAT-infected version published

Key finding: According to Andrew Nesbitt's research, 8 out of 10 recent supply chain attacks were detected and removed within 1 week of publication. A cooldown period would have blocked most of them automatically.

What This PR Does

Sets the default minimumReleaseAge to 1440 minutes (1 day = 24 × 60).

Before: packages are installable immediately after publishing
After: packages must be at least 1 day old before they can be installed by default
Opt-out: users can set minimumReleaseAge: 0 in pnpm-workspace.yaml to restore the previous behavior

Compliance Alignment

NIST Cybersecurity Framework (CSF) 2.0 — Emphasizes Supply Chain Risk Management (C-SCRM) as a core function
CISA: Securing the Software Supply Chain — Official US government roadmap recommending proactive dependency vetting

References

Copilot

Pull request overview

Sets a non-zero default for pnpm’s “cooldown” security feature so newly published package versions are not immediately eligible for installation unless users opt out.

Changes:

Set the default minimum-release-age config value to 4320 minutes (3 days).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

sotanengel · 2026-03-31T20:31:38Z

Addressed the Copilot review feedback in commit 5fe0f86:

Missing Changeset: Added .changeset/default-minimum-release-age.md with minor bumps for @pnpm/config.reader and pnpm.
Test Coverage: Added two tests in config/reader/test/index.ts:
- Verifies minimumReleaseAge defaults to 4320 (3 days)
- Verifies users can override it to 0 via .npmrc using the correct kebab-case key minimum-release-age=0
Docs key format: The PR description used camelCase; the correct opt-out in .npmrc is minimum-release-age=0 (kebab-case), which is also confirmed by the new test.

zkochan · 2026-03-31T20:37:01Z

+"@pnpm/config.reader": minor
+"pnpm": minor


That's a major change.

zkochan

We could ship it in v11. However, the biggest problem is that the publish time of a package is only available in the non-abbreviated package document. This document is much bigger than he abbreviated one. Hence, this change would make installation slower.

sotanengel · 2026-03-31T21:21:36Z

Thanks for the feedback! Updated the changeset to major.
I'd like to target this for v11 as you suggested — is there a v11 branch I should base this PR on?

…ly chain attack protection Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…rence

zkochan · 2026-04-03T23:59:57Z

Poll results show that most of the users want some delay: https://x.com/pnpmjs/status/2039099810943304073

sotanengel · 2026-04-04T02:18:10Z

Thanks. Let me know if you’d like me to make any follow-up changes from my side🙇

… in tests

welcome · 2026-04-04T11:26:25Z

Congrats on merging your first pull request! 🎉🎉🎉

mbtools · 2026-04-07T08:29:56Z

I understand that recent events have triggered this but imho changing this default is a VERY BAD idea.

It effectively blocks all patches of all known security issues for everyone for 24 hours vs. blocking still relatively rare supply chain attacks that impact some projects some of the time. This puts every project using pnpm 11 at an exponentially greater risk at all times!

It's nice that the setting exists but it must remain off by default.

Reverse this, please 🙏

zkochan · 2026-04-07T09:32:05Z

This is a setting that you can change to your personal liking. The default value of the setting was decided by a vote, where the majority wanted some delay by default.

mbtools · 2026-04-07T09:48:01Z

Please refer me to the voting results? Who voted?

zkochan · 2026-04-07T10:03:32Z

The poll was referenced in my message above: https://x.com/pnpmjs/status/2039099810943304073

mbtools · 2026-04-07T10:17:47Z

I love pnpm but this choice is bonkers.

600 "people" on xwitter is what should represent the community? and no background information given to the "voters"? sorry, but lol.

Malicious actors will have a blast. They can simply scan repos for pnpm-workspace.yaml and the missing minimumReleaseAge: 0 setting. Then pick any vuln in the deps and have a guaranteed 24 hours to attack with a high rate of success. That's the opposite of "security by default".

I'm fairly certain that we will regret this change. Good luck

zkochan · 2026-04-07T11:15:05Z

Your style of communication is unprofessional. Hence, I don't feel motivated to discuss this matter with you.

sotanengel requested a review from zkochan as a code owner March 31, 2026 20:16

Copilot AI review requested due to automatic review settings March 31, 2026 20:16

Copilot started reviewing on behalf of sotanengel March 31, 2026 20:17 View session

Copilot AI reviewed Mar 31, 2026

View reviewed changes

Comment thread config/reader/src/index.ts Outdated

Comment thread config/reader/src/index.ts Outdated

Comment thread config/reader/src/index.ts Outdated

zkochan reviewed Mar 31, 2026

View reviewed changes

zkochan requested changes Mar 31, 2026

View reviewed changes

zkochan added the type: breaking change label Mar 31, 2026

sotanengel force-pushed the feat/default-minimum-release-age-3days branch from 277c546 to 1ed1852 Compare March 31, 2026 21:30

sotanengel and others added 3 commits April 4, 2026 01:52

feat: set default minimumReleaseAge to 4320 minutes (3 days) for supp…

eb17530

…ly chain attack protection Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

fix: add changeset and test coverage for minimumReleaseAge default

7745fac

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

chore: update changeset to major

4c00bde

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

zkochan force-pushed the feat/default-minimum-release-age-3days branch from 1ed1852 to 4c00bde Compare April 3, 2026 23:52

zkochan changed the title ~~feat: set default minimumReleaseAge to 3 days (4320 minutes)~~ feat: set default minimumReleaseAge to 1 day (1440 minutes) Apr 3, 2026

fix: change default minimumReleaseAge to 1 day and remove .npmrc refe…

ca5ccbf

…rence

zkochan added 2 commits April 4, 2026 02:01

fix: improve changeset wording and remove redundant config tests

85e2c7b

fix: disable minimumReleaseAge in e2e tests

4bb5356

zkochan added 3 commits April 4, 2026 10:42

fix: set minimumReleaseAge to 0 in all test DEFAULT_OPTS

f4cc5fd

fix: disable minimumReleaseAge in tests that spawn pnpm CLI directly

eae6a72

fix: pass env with minimumReleaseAge=0 explicitly to crossSpawn calls…

742f881

… in tests

zkochan approved these changes Apr 4, 2026

View reviewed changes

zkochan merged commit c7203b9 into pnpm:main Apr 4, 2026
8 checks passed

zkochan added this to the v11.0 milestone Apr 7, 2026

pnpm locked as too heated and limited conversation to collaborators Apr 7, 2026

		"@pnpm/config.reader": minor
		"pnpm": minor

Uh oh!

Conversation

sotanengel commented Mar 31, 2026 • edited by zkochan Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation: Recent Supply Chain Attacks

What This PR Does

Compliance Alignment

References

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sotanengel commented Mar 31, 2026

Uh oh!

zkochan Mar 31, 2026

Choose a reason for hiding this comment

Uh oh!

zkochan left a comment

Choose a reason for hiding this comment

Uh oh!

sotanengel commented Mar 31, 2026

Uh oh!

zkochan commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sotanengel commented Apr 4, 2026

Uh oh!

Uh oh!

welcome Bot commented Apr 4, 2026

Uh oh!

mbtools commented Apr 7, 2026

Uh oh!

zkochan commented Apr 7, 2026

Uh oh!

mbtools commented Apr 7, 2026

Uh oh!

zkochan commented Apr 7, 2026

Uh oh!

mbtools commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zkochan commented Apr 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

sotanengel commented Mar 31, 2026 •

edited by zkochan

Loading

zkochan commented Apr 3, 2026 •

edited

Loading

mbtools commented Apr 7, 2026 •

edited

Loading