minimumReleaseAge makes pnpm wait a set number of minutes after a version is published before installing it. trustPolicy set to no-downgrade refuses a version whose trust level is lower than earlier releases of the same package. One is about timing, the other is about evidence of who published it.
minimumReleaseAge: timing
The pnpm documentation explains the idea: malware is usually detected quickly, so delaying updates by 24 hours will most likely prevent you from installing a bad version. The setting is the minimum number of minutes that must pass after a version is published before pnpm will install it. The documentation describes a default of 1440 minutes, one day, and shows 10080 for a week. Setting it to 0 opts out.
It works because registries typically remove affected versions within hours, per the same page. There is always a window between publication and detection, and the setting keeps your laptop out of it.
The limit is obvious. A malicious version that stays undetected for longer than your delay still gets in. It is a probability reducer, not a guarantee.
trustPolicy: evidence
The trustPolicy setting looks at how a package was published. With the no-downgrade value, pnpm blocks installation if a package's trust level decreased compared with earlier releases. The documentation gives an example: previously published by a trusted publisher, now only with provenance or with no trust evidence at all.
That pattern is meaningful. A package that always shipped from a trusted publishing pipeline and then suddenly ships from somewhere weaker is worth a pause, whatever the reason.
Side by side
- Question answered. Release age asks whether this version is old enough. Trust policy asks whether this version is as well attested as the last one.
- What it catches. Release age catches fast detected malware. Trust policy catches a change in how a package reaches the registry.
- What it misses. Release age misses slow detected malware. Trust policy misses packages that never had strong evidence to begin with.
- Escape hatches. Both have exclusion settings for specific packages. The docs also describe a setting to ignore trust checks under conditions described in the settings reference.
Using them on a laptop
- Turn on a release age of at least a day, and pick a week for tools you rarely update.
- Enable no-downgrade trust policy and watch for the first few failures. Most will be benign.
- Keep the exclusion lists short, each with a comment saying why.
- Review the exclusions when you review dependencies.
When an urgent security fix cannot wait a day, use the exclusion for that one package and version, then remove it.
Evidence is not proof of safety
A trusted publisher or provenance attestation shows where a package came from. It does not show that the code is harmless. Keep scanning your dependency tree after install.
If you want a quick look at what your projects actually resolve, Safeguard offers SBOM and dependency scanning, and there is a free scan at gold.safeguard.sh/scan.
Click through it at your own pace, or open it full screen.
Quick check
Can I install an urgent fix before the delay ends?
Yes. Use the exclusion list for that package, and remove the entry afterwards.
Does a longer delay guarantee safety?
No. It only lowers the odds, because some malicious versions stay undetected for longer.
Sources
Last reviewed: 19 October 2026.
