minimum release age

3 videos across 3 channels

Minimum release age is a security control designed to reduce supply-chain risks by ensuring new packages or updates spend a grace period before they can be adopted widely. In discussions spanning npm, PHP registries, and other ecosystems, advocates argue that enforcing a delay helps surface malicious releases, enables multi-factor verification, and gives maintainers and users time to review changes. The conversation also covers practical settings across package managers (npm, pnpm, Yarn, Bun, Deno) and the broader push toward safer, more auditable software supply chains.