Yarn's npmMinimalAgeGate setting stops Yarn from considering any package version published more recently than the age you set. The docs show a value of 1w. Packages you list in npmPreapprovedPackages are exempt from all package gates. Put the setting in your yarnrc file.
What the setting does
The Yarn configuration reference describes npmMinimalAgeGate as the minimum age of a package version, based on the publish date on the npm registry, to be considered for installation. A version newer than the gate is not considered. Yarn gives two reasons: to reduce the likelihood of installing compromised packages, and to avoid relying on versions that could still be unpublished. The docs note that the npm registry has specific rules for packages less than 3 days old.
# .yarnrc.yml
npmMinimalAgeGate: "1w"
The documented example value is a duration string, one week. Check the reference for the exact formats your Yarn version accepts before choosing something else.
Exempting packages
npmPreapprovedPackages takes an array of package descriptors or name glob patterns. A match is excluded from all of the package gates, not just the age gate. That is broader than it sounds, so keep the list short.
npmPreapprovedPackages:
- "@myorg/*"
Good candidates are your own scoped packages, which your own pipeline publishes and which should not wait a week to reach your apps. Poor candidates are widely used third party packages, because a compromise of a popular package is exactly the case the gate exists for.
Trade-offs to plan for
| Concern | What to do |
|---|---|
| A security fix was published yesterday | Preapprove that package for the one fix, or temporarily lower the gate in a reviewed change |
| Developers do not see why an install skipped a version | Document the gate in the contributing guide |
| The gate only reads publish dates | It does not detect a malicious package that is a week old |
| A mirror does not return dates | Test that your mirror passes through publish times |
The last two rows deserve emphasis. A delay helps against the common pattern where a bad release is caught and removed quickly. It does nothing against a package that stays malicious for weeks. Pair it with script controls: Yarn does not run postinstall scripts of third party packages by default, because enableScripts defaults to false.
Rolling it out
- Add the gate in a branch and run a fresh install.
- Note any failures. They show packages that your lockfile policy leaves open to brand new versions.
- Add narrow preapprovals with a comment for each.
- Add the file to code review owners, since changing the gate is a security decision.
- Compare with the other managers in our package manager settings comparison.
Where Safeguard fits
The gate controls what Yarn will pick. Safeguard's SBOM and dependency scanning show what ended up in your lockfiles, and continuous monitoring watches those components for new advisories after the install. A free scan is available at https://gold.safeguard.sh/scan.
Quick check
Does npmPreapprovedPackages only skip the age gate?
No. The Yarn docs say matching packages are excluded from all of the package gates, so use it sparingly.
Does an age gate stop a malicious package that stays up for weeks?
No. It only delays newly published versions. A bad release that survives the delay will install, so combine it with other controls.
Sources
Last reviewed: 19 October 2026.
