Skip to main content

Node dependency cooldown

node-dependency-cooldown configures node projects to delay newly published packages before they become eligible for installation. It detects supported lockfiles (bun, pnpm, npm) recursively and creates or updates the package-manager configuration beside each lockfile.

Run it with the default 7-day cooldown:

quant-ranger update \
  --repository octo-org/octo-repo \
  node-dependency-cooldown

The resulting settings are:

bunfig.toml
[install]
minimumReleaseAge = 604800

Mind that the units are different for bun (seconds), pnpm (minutes), and npm (days).

pnpm also gets blockExoticSubdeps: true, which rejects dependencies fetched from non-registry sources. Existing stronger cooldowns are preserved. Weaker values are raised to the requested minimum.

Change the minimum age​

--minimum-release-age-days accepts a positive whole number and applies the correct unit for every detected package manager:

quant-ranger update \
  --repository octo-org/octo-repo \
  node-dependency-cooldown \
  --minimum-release-age-days 14

Exclude packages​

Bun's minimumReleaseAgeExcludes accepts exact package names. pnpm's minimumReleaseAgeExclude and npm's min-release-age-exclude also accept patterns. The options are therefore separate and repeatable:

quant-ranger update \
  --repository octo-org/octo-repo \
  node-dependency-cooldown \
  --bun-minimum-release-age-exclude @example/config \
  --bun-minimum-release-age-exclude @example/ui \
  --minimum-release-age-exclude '@example/*' \
  --minimum-release-age-exclude generated-package

This adds only missing entries and preserves existing exclusions:

bunfig.toml
[install]
minimumReleaseAge = 604800
minimumReleaseAgeExcludes = ["@example/config", "@example/ui"]
note

Unrelated settings and comments are preserved. If an existing configuration uses a form that cannot be edited safely, quant-ranger logs a warning and leaves that setting alone instead of rewriting the file broadly.