[king_zee]

I've made it a habit now to use the --before=2026-05-30 flag when installing packages, where it'll pick the version released before the date you specify, I usually pick around 5 days ago

[t-sauer]

If you use npm 11, you can simplify your workflow by setting min-release-age to 5. https://docs.npmjs.com/cli/v11/using-npm/config#min-release-...

[mihaelm]

I just use `pnpm` and set up a liberal `minimumReleaseAge`: https://pnpm.io/settings#minimumreleaseage

Thankfully, it's on by default since v11.

[sync]

If using straight npm (v11.10.0 or higher), you can just add to .npmrc in the project root:

min-release-age=5

[sourcegrift]

Yarn 4 can automate this

[nullsex]

If supply-chain security is a concern yarn is the worst js package manager you can pick. It comes far down their priority list, below "just make things work without need for user input". Whatever you thought you configured will simply be ignored many times and that's considered a feature.

Go look in that projects issue tracker and commit log for changes to relevant configuration and you will know what I mean.

Even yarn 1.22 is a safer choice.

[vinnymac]

In case others are unaware, you just have to set https://yarnpkg.com/configuration/yarnrc#npmMinimalAgeGate to the value you want. It defaults to 1 day.