Package release cooldowns: exact settings, units, and enforcement boundaries

What it is

Status as of 25 October 2026. A release cooldown delays adoption based on publication time. Re-check the version-selected package-manager references and current updater documentation before rollout; defaults and supported settings change. These are configuration controls, not evidence that an aged package is safe.

Tool	Exact setting	Value and scope
npm	min-release-age	Number of days; dependency resolution
pnpm	minimumReleaseAge	Number of minutes in pnpm-workspace.yaml
uv	exclude-newer	Timestamp or duration; registry distribution upload time
Renovate	minimumReleaseAge	Duration string; update eligibility
Dependabot	cooldown.default-days	Days; version-update eligibility

Why it matters

A delay at pull-request creation does not by itself constrain every installation. Manual updates and package-manager resolution need their own policy. Renovate's documentation specifically warns about newly selected transitive dependencies and recommends configuring both layers. An update schedule is also different: it controls when checks run, not how old each candidate is.

How to apply

• Choose and document a waiting interval. For an illustrative one-week policy, npm uses min-release-age=7 in .npmrc; pnpm uses minimumReleaseAge: 10080, calculated as 7 × 24 × 60 minutes. These are policy examples, not a measured safe waiting period. npm's before accepts an absolute cutoff and takes precedence over min-release-age within the same configuration source.
• For pnpm versions supporting them, set minimumReleaseAgeStrict: true and minimumReleaseAgeIgnoreMissingTime: false when the intended policy is to reject unresolved age checks. The documented non-strict behavior can accept a younger version when none qualifies; missing timestamps can also skip the check. Review minimumReleaseAgeExclude exceptions.
• For uv, place exclude-newer = "1 week" under [tool.uv] in pyproject.toml, or use the --exclude-newer option. Durations use fixed elapsed time; timestamps allow an absolute cutoff. The filter compares individual distribution uploads and needs registry upload-time metadata. The cutoff recorded in uv.lock changes when resolution runs again, not simply when the clock advances.
• For Renovate, configure minimumReleaseAge with a duration, internalChecksFilter: "strict", and minimumReleaseAgeBehaviour: "timestamp-required". Inspect updater logs for exceptions: its npm integration documents retrying without --before after an existing lock file causes an ETARGET failure. Do not assume every lock-file operation received the same protection.
• In each applicable Dependabot updates entry, configure cooldown with default-days; optional semver-major-days, semver-minor-days, and semver-patch-days need ecosystem support. exclude overrides include. This also covers pip projects through Dependabot's package-ecosystem: "pip"; it is updater configuration, not a pip command-line flag.
• Verify the policy with a clean resolution and a known recent legitimate release: record tool version, registry timestamp, effective configuration, and the selected or rejected version. Check a transitive dependency too. Keep the check free of production credentials.

Pitfalls

Age is not a malware scan, and exceptions can remove the intended boundary. Dependabot cooldowns exclude security updates; Renovate also bypasses its age checks for security updates. npm warns and fails when its cutoff blocks an audit fix. Review urgent fixes individually and remove temporary exceptions after use. A cooldown does not clean a previously compromised environment.