[Support] `min-release-age` for `npm ci`

[pealtrufo]

Hi

Is min-release-age feature not available for npm ci? I can't see it in the documentation, and testing locally it doesn't seem to work so I am assuming it isn't. Is there any plans to add it?

Thanks

[kchindam-infy]

Hi @pealtrufo please check https://docs.npmjs.com/cli/v11/using-npm/config#min-release-age

[pealtrufo]

Thanks @kchindam-infy
Yes, I know it works for npm install. It doesn't seem to be the case for npm ci though.

https://docs.npmjs.com/cli/v11/commands/npm-install#min-release-age
https://docs.npmjs.com/cli/v11/commands/npm-ci

[owlstronaut]

npm ci installs the lockfile verbatim and doesn't perform resolution, so min-release-age has no effect. Use npm install --min-release-age=N when generating/updating the lockfile.

[pealtrufo]

Thanks @owlstronaut
What if the lockfile was generated locally without min-release-age and I want to ensure in my pipeline that the cooldown period is applied when installing with npm ci?

[owlstronaut]

That is currently a hole in the process. I considered adding something like that to the audit command, but it's a pretty expensive operation, particularly in CI - it means for each package in a tree, hitting the registry and seeing if it meets the requirement, and then you are hitting the registry again in the install step. I don't have a current good answer for your workflow outside of making sure what you commit is a package-lock generated with the min-release-age setup.