minimumReleaseAge does not reject young lockfile pins the way pnpm 11 does

[mwolson]

• Repo / case: https://github.com/mwolson/tmp-aube-issues/tree/main/pnpm-min-release-age
• aube: 1.37.0
• native pnpm: 11.20.0
• Category: Troubleshooting and Bugs

Summary

aube documents minimumReleaseAge: 1440 by default (matching pnpm 11), but under default settings it still installs package versions that native pnpm 11 rejects for being too young. The practical gaps are:

1. Lockfile re-verification: pnpm fails installs when a committed lockfile pins a version younger than minimumReleaseAge (ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION). aube installs that lockfile successfully.
2. Cold resolve of a young exact pin: with only a just-published exact version available, pnpm fails (ERR_PNPM_NO_MATURE_MATCHING_VERSION). aube installs it because minimumReleaseAgeStrict defaults to false and falls back to the young pin.

Setting minimumReleaseAgeStrict: true makes aube reject on resolve (ERR_AUBE_NO_MATURE_MATCHING_VERSION). That is a useful control, but it is not pnpm 11’s default, and it still does not cover lockfile supply-chain re-verification.

Real-world trigger

In a monorepo with packageManager: pnpm@11.10.0 and no explicit minimumReleaseAge key (so pnpm 11’s 1440 default applies), a same-day pin of @opencode-ai/sdk@0.0.0-beta-202608061351 caused native pnpm to fail with:

[ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION] 1 lockfile entries failed verification:
  @opencode-ai/sdk@0.0.0-beta-202608061351 was published at 2026-08-06T14:17:07.289Z,
  within the minimumReleaseAge cutoff (...)

The same tree installed successfully under aube (via aubeshim’s pnpm shim) with no age rejection.

That specific beta will age past 24h; the minimal repro below does not depend on it.

Minimal repro

git clone https://github.com/mwolson/tmp-aube-issues.git
cd tmp-aube-issues/pnpm-min-release-age
# needs: aube, real pnpm 11 (not an aubeshim shim), node, curl
# optional: PNPM_BIN=/path/to/real/pnpm
./repro.sh; echo exit=$?

Exit 1 while the gap is present. The script starts a local mock registry that always reports publishedAt=now for a tiny fresh-pkg@1.0.0, then compares:

• Scenario A: seed a lockfile with minimumReleaseAge: 0, flip to 1440, reinstall
  • pnpm → ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION
  • aube → installs
• Scenario B: cold resolve under minimumReleaseAge: 1440
  • pnpm → ERR_PNPM_NO_MATURE_MATCHING_VERSION
  • aube → installs
• Scenario C (control): aube with minimumReleaseAgeStrict: true → ERR_AUBE_NO_MATURE_MATCHING_VERSION

Docs checked

• https://aube.jdx.dev/security (minimumReleaseAge default 1440; strict opt-in)
• https://aube.jdx.dev/settings/#setting-minimumreleaseage
• https://aube.jdx.dev/settings/#setting-minimumreleaseagestrict
• https://pnpm.io/supply-chain-security
• Related but different: `outdated` and `update` show packages which don't pass `minimumReleaseAge` gate #1191 (outdated/update listing age-gated packages)

Expected

For pnpm-compatible projects that rely on the default 24h age gate:

1. Installing from a lockfile that pins a too-young version should fail (or at least warn hard), matching pnpm’s lockfile supply-chain verification.
2. Optionally, default behavior for young exact pins should match pnpm more closely, or docs should call out that aube’s non-strict fallback and missing lockfile age re-check are intentional differences from pnpm 11.

Actual (aube 1.37.0)

Young pins install under the documented default minimumReleaseAge: 1440 with minimumReleaseAgeStrict: false, including from existing lockfiles.

Happy to adjust the repro or wording if maintainers prefer framing this as a docs/parity clarification rather than a bug.

[jdx]

Thanks for the detailed report and repro. After reviewing this, the observed behavior is intentional in aube:

• Existing lockfile pins are authoritative. minimumReleaseAge applies when resolving a new version; aube does not revalidate and reject a version already selected by the lockfile.
• For a fresh resolution, minimumReleaseAgeStrict=true enables the hard failure described here (ERR_AUBE_NO_MATURE_MATCHING_VERSION). The repro confirms that path is working.

So this is a pnpm behavior difference rather than an aube bug. We are closing the associated PR without changing the resolution policy.

AI-assisted — Tool: Codex; model: unavailable; version: unavailable.