feat: enable default minimum dependency age (#35458)

Enables a minimum dependency age by default so npm version resolution
skips releases published within the last 24 hours (1440 minutes) when nothing
else is configured. This adds a small cooldown that mitigates installing a
freshly published, potentially compromised version the moment it lands.

The default sits at the bottom of the existing precedence chain, so it
only applies when no age is set anywhere else. Resolution order is: the CLI
flag, then `minimumDependencyAge` in `deno.json`, then `min-release-age` in
`.npmrc`, then the `NPM_CONFIG_MIN_RELEASE_AGE` /
`npm_config_min_release_age` environment variables, and finally the 1440 minute default.

`NPM_CONFIG_MIN_RELEASE_AGE` is now read as an npm-style fallback for
`min-release-age`, with an explicit `.npmrc` value still taking
precedence over it.

A numeric `0` (and `false`) for `minimumDependencyAge` now disables the
filter, matching the existing string `"0"` behavior and avoiding
surprises when a user's clock is off.

Because the default is opt-out, the shared local npm fixture test
environments set `NPM_CONFIG_MIN_RELEASE_AGE=0` so existing specs keep resolving the
latest fixture versions. The new integration tests remove that override to
cover the real product default, the explicit-disable path, and the env var
fallback.

---------

Co-authored-by: Nathan Whitaker <nathan@deno.com>

Author: nathanwhitbot

libs/config/deno_json/mod.rs

@@ -2646,9 +2646,15 @@ impl ConfigFile {
     {
       match value {
         serde_json::Value::Null => Ok(None),
-        serde_json::Value::Number(minutes) => Ok(Some(
-          NewestDependencyDate::Enabled(parse_number(minutes, sys)?),
-        )),
+        serde_json::Value::Number(minutes) => {
+          if minutes.as_i64() == Some(0) {
+            Ok(Some(NewestDependencyDate::Disabled))
+          } else {
+            Ok(Some(NewestDependencyDate::Enabled(parse_number(
+              minutes, sys,
+            )?)))
+          }
+        }
         serde_json::Value::String(value) => Ok(Some(
           crate::util::parse_minutes_duration_or_date(sys, value)?,
         )),
@@ -3268,6 +3274,19 @@ mod tests {
     assert!(config.age.is_some());
     assert!(config.exclude.is_empty());
 
+    // Numeric 0 disables the filter.
+    let config = parse(r#"{ "minimumDependencyAge": 0 }"#);
+    assert_eq!(config.age, Some(NewestDependencyDate::Disabled));
+    assert!(config.exclude.is_empty());
+
+    let config = parse(r#"{ "minimumDependencyAge": "0" }"#);
+    assert_eq!(config.age, Some(NewestDependencyDate::Disabled));
+    assert!(config.exclude.is_empty());
+
+    let config = parse(r#"{ "minimumDependencyAge": false }"#);
+    assert_eq!(config.age, Some(NewestDependencyDate::Disabled));
+    assert!(config.exclude.is_empty());
+
     // Unknown field still errors.
     let specifier = Url::parse("file:///deno/deno.json").unwrap();
     let config_file = ConfigFile::new(

libs/npmrc/lib.rs

@@ -79,7 +79,7 @@ impl NpmRc {
     let mut registry = None;
     let mut scope_registries: HashMap<String, String> = HashMap::new();
     let mut registry_configs: HashMap<String, RegistryConfig> = HashMap::new();
-    let mut min_release_age_days: Option<u64> = None;
+    let mut min_release_age_days = min_release_age_days_from_env(sys);
 
     for kv_or_section in kv_or_sections {
       match kv_or_section {
@@ -254,6 +254,19 @@ impl NpmRc {
   }
 }
 
+pub fn min_release_age_days_from_env(sys: &impl EnvVar) -> Option<u64> {
+  for env_var_name in
+    ["NPM_CONFIG_MIN_RELEASE_AGE", "npm_config_min_release_age"]
+  {
+    if let Ok(value) = sys.env_var(env_var_name)
+      && let Ok(days) = value.trim().parse::<u64>()
+    {
+      return Some(days);
+    }
+  }
+  None
+}
+
 fn get_scope_name(package_name: &str) -> Option<&str> {
   let no_at_pkg_name = package_name.strip_prefix('@')?;
   no_at_pkg_name.split_once('/').map(|(scope, _)| scope)
@@ -851,6 +864,16 @@ registry=${VAR_FOUND}
     sys.env_set_var("MIN_AGE", "7");
     let npm_rc = NpmRc::parse(&sys, "min-release-age=${MIN_AGE}").unwrap();
     assert_eq!(npm_rc.min_release_age_days, Some(7));
+
+    // npm config environment variable
+    let sys = InMemorySys::default();
+    sys.env_set_var("NPM_CONFIG_MIN_RELEASE_AGE", "4");
+    let npm_rc = NpmRc::parse(&sys, "").unwrap();
+    assert_eq!(npm_rc.min_release_age_days, Some(4));
+
+    // .npmrc value takes precedence over the environment fallback.
+    let npm_rc = NpmRc::parse(&sys, "min-release-age=5").unwrap();
+    assert_eq!(npm_rc.min_release_age_days, Some(5));
   }
 
   #[test]

libs/resolver/factory.rs

@@ -93,6 +93,8 @@ use crate::workspace::SloppyImportsOptions;
 use crate::workspace::WorkspaceNpmLinkPackagesRc;
 use crate::workspace::WorkspaceResolver;
 
+const DEFAULT_MINIMUM_DEPENDENCY_AGE_MINUTES: i64 = 1440;
+
 // todo(https://github.com/rust-lang/rust/issues/109737): remove once_cell after get_or_try_init is stabilized
 #[cfg(feature = "sync")]
 type Deferred<T> = once_cell::sync::OnceCell<T>;
@@ -1015,20 +1017,14 @@ impl<TSys: WorkspaceFactorySys> ResolverFactory<TSys> {
         let workspace = &workspace_factory.workspace_directory()?.workspace;
         workspace.minimum_dependency_age(workspace_factory.sys())?
       };
-      // fall back to .npmrc's `min-release-age` when not configured in deno.json
-      if config.age.is_none()
-        && let Some(days) = workspace_factory.npmrc()?.min_release_age_days
-      {
-        let now = chrono::DateTime::<chrono::Utc>::from(
-          workspace_factory.sys().sys_time_now(),
+      if config.age.is_none() {
+        apply_minimum_dependency_age_fallbacks(
+          &mut config,
+          workspace_factory.npmrc()?.min_release_age_days,
+          chrono::DateTime::<chrono::Utc>::from(
+            workspace_factory.sys().sys_time_now(),
+          ),
         );
-        config.age = Some(if days == 0 {
-          NewestDependencyDate::Disabled
-        } else {
-          NewestDependencyDate::Enabled(
-            now - chrono::Duration::days(days as i64),
-          )
-        });
       }
       if let Some(newest_dependency_date) =
         config.age.and_then(|d| d.into_option())
@@ -1306,6 +1302,29 @@ impl<TSys: WorkspaceFactorySys> ResolverFactory<TSys> {
   }
 }
 
+fn apply_minimum_dependency_age_fallbacks(
+  config: &mut MinimumDependencyAgeConfig,
+  npmrc_min_release_age_days: Option<u64>,
+  now: chrono::DateTime<chrono::Utc>,
+) {
+  if config.age.is_some() {
+    return;
+  }
+
+  // Fall back to .npmrc's `min-release-age` when not configured in deno.json.
+  config.age = Some(if let Some(days) = npmrc_min_release_age_days {
+    if days == 0 {
+      NewestDependencyDate::Disabled
+    } else {
+      NewestDependencyDate::Enabled(now - chrono::Duration::days(days as i64))
+    }
+  } else {
+    NewestDependencyDate::Enabled(
+      now - chrono::Duration::minutes(DEFAULT_MINIMUM_DEPENDENCY_AGE_MINUTES),
+    )
+  });
+}
+
 /// Parses npm overrides from a workspace's root package.json.
 ///
 /// Returns `NpmOverrides::default()` if no overrides are present or if parsing fails.
@@ -1334,3 +1353,66 @@ pub fn npm_overrides_from_workspace(
     }
   }
 }
+
+#[cfg(test)]
+mod tests {
+  use chrono::TimeZone;
+  use deno_config::deno_json::MinimumDependencyAgeConfig;
+  use deno_config::deno_json::NewestDependencyDate;
+
+  use super::apply_minimum_dependency_age_fallbacks;
+
+  fn now() -> chrono::DateTime<chrono::Utc> {
+    chrono::Utc.with_ymd_and_hms(2025, 6, 1, 0, 0, 0).unwrap()
+  }
+
+  #[test]
+  fn minimum_dependency_age_falls_back_to_default() {
+    let mut config = MinimumDependencyAgeConfig::default();
+    apply_minimum_dependency_age_fallbacks(&mut config, None, now());
+    assert_eq!(
+      config.age,
+      Some(NewestDependencyDate::Enabled(
+        now() - chrono::Duration::minutes(1440)
+      ))
+    );
+  }
+
+  #[test]
+  fn minimum_dependency_age_preserves_exclude_with_default() {
+    let mut config = MinimumDependencyAgeConfig {
+      age: None,
+      exclude: vec!["npm:chalk".to_string()],
+    };
+    apply_minimum_dependency_age_fallbacks(&mut config, None, now());
+    assert_eq!(
+      config.age,
+      Some(NewestDependencyDate::Enabled(
+        now() - chrono::Duration::minutes(1440)
+      ))
+    );
+    assert_eq!(config.exclude, vec!["npm:chalk".to_string()]);
+  }
+
+  #[test]
+  fn minimum_dependency_age_prefers_npmrc_over_default() {
+    let mut config = MinimumDependencyAgeConfig::default();
+    apply_minimum_dependency_age_fallbacks(&mut config, Some(2), now());
+    assert_eq!(
+      config.age,
+      Some(NewestDependencyDate::Enabled(
+        now() - chrono::Duration::days(2)
+      ))
+    );
+  }
+
+  #[test]
+  fn minimum_dependency_age_preserves_explicit_disable() {
+    let mut config = MinimumDependencyAgeConfig {
+      age: Some(NewestDependencyDate::Disabled),
+      exclude: Vec::new(),
+    };
+    apply_minimum_dependency_age_fallbacks(&mut config, Some(2), now());
+    assert_eq!(config.age, Some(NewestDependencyDate::Disabled));
+  }
+}

libs/resolver/npmrc.rs

@@ -238,6 +238,6 @@ pub fn create_default_npmrc(sys: &impl EnvVar) -> ResolvedNpmRc {
       },
     )]),
     registry_configs: Default::default(),
-    min_release_age_days: None,
+    min_release_age_days: deno_npmrc::min_release_age_days_from_env(sys),
   }
 }

tests/integration/pm_tests.rs

@@ -186,6 +186,26 @@ fn add_npm() {
   }));
 }
 
+#[test]
+fn add_npm_latest_default_minimum_dependency_age_downgrades() {
+  let context = pm_context_builder().build();
+  let temp_dir = context.temp_dir().path();
+
+  let output = context
+    .new_command()
+    .env_remove("NPM_CONFIG_MIN_RELEASE_AGE")
+    .args("add npm:@denotest/min-release-age-latest@latest")
+    .run();
+  output.assert_exit_code(0);
+  let output = output.combined_output();
+  assert_contains!(output, "Add npm:@denotest/min-release-age-latest@1.0.0");
+  temp_dir.join("deno.json").assert_matches_json(json!({
+    "imports": {
+      "@denotest/min-release-age-latest": "npm:@denotest/min-release-age-latest@^1.0.0"
+    }
+  }));
+}
+
 #[test]
 fn add_npm_latest_minimum_dependency_age_downgrades() {
   let context = pm_context_builder().build();
@@ -209,6 +229,29 @@ fn add_npm_latest_minimum_dependency_age_downgrades() {
   }));
 }
 
+#[test]
+fn add_npm_latest_minimum_dependency_age_disabled() {
+  let context = pm_context_builder().build();
+  let temp_dir = context.temp_dir().path();
+  temp_dir.join("deno.json").write_json(&json!({
+    "minimumDependencyAge": false,
+  }));
+
+  let output = context
+    .new_command()
+    .args("add npm:@denotest/min-release-age-latest@latest")
+    .run();
+  output.assert_exit_code(0);
+  let output = output.combined_output();
+  assert_contains!(output, "Add npm:@denotest/min-release-age-latest@2.0.0");
+  temp_dir.join("deno.json").assert_matches_json(json!({
+    "minimumDependencyAge": false,
+    "imports": {
+      "@denotest/min-release-age-latest": "npm:@denotest/min-release-age-latest@^2.0.0"
+    }
+  }));
+}
+
 #[test]
 fn add_npm_latest_npmrc_min_release_age_downgrades() {
   let context = pm_context_builder().build();

tests/util/lib/lib.rs

@@ -63,6 +63,7 @@ pub static IS_CI: Lazy<bool> = Lazy::new(|| std::env::var("CI").is_ok());
 pub fn env_vars_for_npm_tests() -> Vec<(String, String)> {
   vec![
     ("NPM_CONFIG_REGISTRY".to_string(), npm_registry_url()),
+    ("NPM_CONFIG_MIN_RELEASE_AGE".to_string(), "0".to_string()),
     ("JSR_NPM_URL".to_string(), npm_jsr_registry_url()),
     ("NODEJS_ORG_MIRROR".to_string(), nodejs_org_mirror_url()),
     ("NO_COLOR".to_string(), "1".to_string()),
@@ -137,6 +138,7 @@ pub fn env_vars_for_jsr_provenance_tests() -> Vec<(String, String)> {
 pub fn env_vars_for_jsr_npm_tests() -> Vec<(String, String)> {
   vec![
     ("NPM_CONFIG_REGISTRY".to_string(), npm_registry_url()),
+    ("NPM_CONFIG_MIN_RELEASE_AGE".to_string(), "0".to_string()),
     ("JSR_NPM_URL".to_string(), npm_jsr_registry_url()),
     ("JSR_URL".to_string(), jsr_registry_url()),
     (