outdated and update show packages which don't pass minimumReleaseAge gate

[hilja]

Test setup: https://github.com/hilja/aube-update-repro

aube update -r -L -i suggest vite to be updated, at the moment 8.2.0 is 5 hours old. If I select it for an update, it rightfully doesn't do anything.

Same with aube outdated -r, lists vite 8.2.0 as outdated.

I'm using the default minimumReleaseAge.

[jdx]

Confirmed—thanks for the clear reproduction. The update resolver already enforced minimumReleaseAge, but outdated and the interactive update picker calculated their displayed targets separately from abbreviated registry metadata, which has no publish timestamps. That is why the commands offered Vite 8.2.0 and then made no change after selection.

PR #1192 fixes both paths by fetching timestamp-bearing metadata when the age policy is active and using the same policy-aware version picker as resolution: #1192

One extra detail from the reproduction: overrides.vite: 8.1.5 also independently pins Vite, but the reporting mismatch exists without that override and is covered by the regression tests.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.

[jdx]

Follow-up: #1192 fixed the reporting mismatch and has now merged. While expanding the coverage, I found that plain aube up --latest could also resolve the quarantined latest tag instead of the newest mature version.

#1193 fixes that path and adds an aggregated WARN_AUBE_MINIMUM_RELEASE_AGE_BLOCKED_UPDATE warning anywhere upgrades can be hidden by minimumReleaseAge: aube outdated, interactive update, and plain aube up.

AI-assisted — Tool: Codex; model: openai/gpt-5; version: unavailable.