npm, pnpm and Yarn each document settings for a release age delay, git dependency control and lockfile checks, but the names, units and defaults differ. This table lists what each project's own docs say, so you can write a team standard without guessing. Verify against your installed version.
The comparison
| Control | npm | pnpm | Yarn |
|---|---|---|---|
| Delay new versions | min-release-age in days, or before with a date | minimumReleaseAge in minutes, default 1440 since v11 | npmMinimalAgeGate, example value 1w |
| Exempt packages from the delay | min-release-age-exclude | minimumReleaseAgeExclude | npmPreapprovedPackages, which exempts from all gates |
| Control git dependencies | allow-git with all, none or root | blockExoticSubdeps, default true, allows only direct exotic sources | approvedGitRepositories allowlist |
| Frozen installs | npm ci fails on mismatch and never writes | frozen lockfile settings | enableImmutableInstalls, default on CI |
| Verify lockfile content | integrity hashes in the lockfile | re-applies age and trust policy to lockfile entries unless trustLockfile is true | enableHardenedMode checks lockfile against the registry |
| Trust evidence | audit signatures command | trustPolicy no-downgrade | not covered here |
| Third party install scripts | ignore-scripts, default false | see our separate post | enableScripts, default false |
Sources for each cell are the docs listed below. Where a cell says not covered here, I did not verify it, so do not read it as absent.
Reading the table
Units differ. npm uses days, pnpm uses minutes, Yarn takes a duration string. A copy and paste of "1" across tools means very different delays.
Defaults differ. pnpm turned on a one day age by default in v11, but in non-strict mode unless you set the value yourself. Yarn runs third party postinstall scripts off by default. npm's script default is to run them.
Exemptions differ in scope. Yarn's preapproved list exempts from every package gate, not just the age gate. A pnpm exclude applies by name to all versions unless you name a version.
Writing a team standard
- Choose one package manager per repository, and pin it. See Corepack and the packageManager field.
- Set a release age delay in the project config, with an explicit value.
- Block or allowlist git dependencies.
- Use the frozen install command in CI. See frozen lockfile flags compared.
- Decide the script policy and write it down. See how to disable install scripts.
- Put exceptions in version control with a reason, and review them on a schedule.
What settings cannot do
Settings reduce the odds of installing something bad. They do not tell you what is inside your tree today, whether a vulnerable function is reachable, or when a new advisory lands on something you already installed. That needs inventory and monitoring.
Where Safeguard fits
Safeguard's dependency scanning and SBOM generation work across these lockfile formats, with reachability analysis to prioritize findings and policies and gates to enforce your rules on pull requests. A free scan is at https://gold.safeguard.sh/scan.
Quick check
Is a one day delay the same in npm, pnpm and Yarn?
No. npm counts days, pnpm counts minutes, and Yarn takes a duration string. Check the unit before copying a value.
Do these settings replace vulnerability scanning?
No. They limit what installs. You still need an inventory and monitoring for advisories on components already in your tree.
Sources
- pnpm settings: dependency resolution
- Yarn configuration reference
- npm config definitions
- npm ci documentation
- npm docs: verifying registry signatures
Last reviewed: 19 October 2026.
