Package managers delay new releases (Windows)

How to fix

Configure release-age protection for the package managers you use. A passing setup delays new package releases by at least 7 days. You only need to configure the tools you have installed.

%USERPROFILE% is your home folder, %APPDATA% is %USERPROFILE%\AppData\Roaming, and %LOCALAPPDATA% is %USERPROFILE%\AppData\Local.

JavaScript and Node.js

npm

Add these settings to %USERPROFILE%\.npmrc:

min-release-age=7
save-exact=true

min-release-age is measured in days and requires npm 11.14.0 or newer. You can use minimum-release-age=10080 (minutes) instead; either setting passes. save-exact=true pins exact versions in package.json.

Official documentation: npm config: min-release-age.

pnpm

pnpm 10 reads %LOCALAPPDATA%\pnpm\config\rc; pnpm 11 reads %LOCALAPPDATA%\pnpm\config\config.yaml. Add this to %LOCALAPPDATA%\pnpm\config\rc:

minimum-release-age=10080

or this to %LOCALAPPDATA%\pnpm\config\config.yaml:

minimumReleaseAge: 10080

pnpm measures the release age in minutes, so 10080 minutes is 7 days.

Official documentation: pnpm settings: minimumReleaseAge.

Bun

Add this section to %USERPROFILE%\.bunfig.toml:

[install]
minimumReleaseAge = 604800

Bun measures minimumReleaseAge in seconds, so 604800 seconds is 7 days.

Official documentation: bunfig.toml: install.minimumReleaseAge.

Yarn

Add this setting to %USERPROFILE%\.yarnrc.yml:

npmMinimalAgeGate: "7d"

Requires Yarn 4.11.0 or newer. A bare number such as 10080 is read as minutes.

Official documentation: Yarn settings: npmMinimalAgeGate.

Python

uv

Add this setting to %APPDATA%\uv\uv.toml:

exclude-newer = "7 days"

Use a relative duration such as 7 days, 7d, or P7D. An absolute date stops protecting you once it is in the past.

Official documentation: uv settings: exclude-newer.

pip

Add this section to %APPDATA%\pip\pip.ini:

[global]
uploaded-prior-to = P7D

Requires pip 26.1.0 or newer. pip only accepts days in the P7D form; an absolute timestamp goes stale.

Official documentation: pip user guide: filtering by upload time.

Poetry

Run poetry config solver.min-release-age 7, or add this section to %APPDATA%\pypoetry\config.toml:

[solver]
min-release-age = 7

Requires Poetry 2.4.0 or newer. The value is measured in days.

Official documentation: Poetry configuration: solver.min-release-age.

PDM

Add this section to %LOCALAPPDATA%\pdm\pdm\config.toml:

[strategy]
exclude-newer = "7d"

Requires PDM 2.27.0 or newer.

Official documentation: PDM configuration.

conda

Add these settings to %USERPROFILE%\.condarc:

solver: classic
exclude_newer: 7d

Requires conda 26.9.0 or newer. The default solver does not support exclude_newer, so the classic solver is required.

Official documentation: conda settings: exclude_newer.

PyPI publishing

%USERPROFILE%\.pypirc is used for publishing packages, not installing them. Remove plaintext passwords and tokens from this file. Use PyPI Trusted Publishing or keyring-based authentication instead.

Official documentation: PyPI Trusted Publishers.

Ruby, Elixir, and tool version managers

Bundler

Run bundle config set --global cooldown 7. This writes BUNDLE_COOLDOWN to %USERPROFILE%\.bundle\config. Requires Bundler 4.0.13 or newer. The value is a whole number of days.

Official documentation: RubyGems guide: cooldown.

Hex

Run mix hex.config cooldown 7d. This writes the cooldown to %USERPROFILE%\.hex\hex.config.

Official documentation: mix hex.config.

mise

Add this section to %USERPROFILE%\.config\mise\config.toml:

[settings]
minimum_release_age = "7d"

Official documentation: mise settings: minimum_release_age.