ARTIFACTORY: Recently published NPM packages may be blocked for 24 hours - New client enforcements

Introduction 

Due to recent supply-chain attacks involving NPM package types, NPM package managers have introduced a breaking change.

As part of this update, an immaturity policy setting has been added on the client side, with a default restriction period of 1 day.

Impact:
When a package is uploaded to Artifactory, the client’s default immaturity policy prevents the package from being downloaded for 24 hours after publication. As a result, newly published package versions will be available only after the one-day restriction period has elapsed.
Fetching newly published packages from remote registries (e.g., https://npmjs.com) is restricted for a 24-hour period following their publication.

Summary Table of the changes:

Package Manager	Setting	Default (when unset)	Unit	Opt out	Reference
Yarn Berry 4.x	npmMinimalAgeGate	1 day (recent versions)	minutes or "1d"	npmMinimalAgeGate: 0 in .yarnrc.yml	Yarn Age Gate
pnpm 11+	minimumReleaseAge	1440 (= 1 day)	minutes	minimumReleaseAge: 0 in pnpm- workspace.yaml	Delay dependency updates
pnpm 10.16-10.x	minimumReleaseAge	0 (off)	minutes	N/A (already off)	Not Relevant
npm 11.10+	min-release-age	null (off)	days	Don't set it, or remove from .npmrc	NPM Config min-release-age

** pnpm 11+ and recent Yarn both default to ~1 day. npm defaults to no gate unless you configure it.


Resolution 

To disable this new enforcement, you can change the configuration based on the client you are using, as described below:

Yarn Berry
Setting: npmMinimalAgeGate
Default: Historically 0 (disabled); in recent Yarn Berry 4.x the default is 1d (~1 day)
Unit: minutes (numeric) or duration strings (e.g. "1d","7d")
Client Error When Blocked: YN0016: json-package.json@npm:1.0.0: All versions satisfying "1.0.0" are quarantined.
Also blocks: npmPreapprovedPackages (allowlist-only installs)
Disable: set npmMinimalAgeGate: 0 in .yarnrc.yml

Commands to change the setting:

# Disable age gate (restore immediate installs)
yarn config set npmMinimalAgeGate 0

# Require packages to be at least 7 days old
yarn config set npmMinimalAgeGate 7

# Project-only (writes .yarnrc.yml in current repo)
yarn config set npmMinimalAgeGate 0 --home=false


pnpm
Setting: minimumReleaseAge (in pnpm-workspace.yaml on pnpm 11)
pnpm 11.0+ default: 1440 minutes (1 day)
pnpm 10.16-10.x default: 0 (off)
Disable (pnpm 11): minimumReleaseAge: 0
Related pnpm 11 defaults: blockExoticSubdeps: true, strictDepBuilds: true
Client Error When Blocked: [ERR_PNPM_NO_MATURE_MATCHING_VERSION] 1 version does not meet the minimumReleaseAge constraint:
  npm-test@1.0.0 was published at 2026-05-24T10:01:31.313Z, within the minimumReleaseAge cutoff (2026-05-23T10:04:06.650Z)

Commands to change the setting:

# Disable age gate (pnpm 11+ default is 1440 minutes)
pnpm config set minimumReleaseAge 0

# Require 7 days (10080 minutes)
pnpm config set minimumReleaseAge 10080

# User-wide config (pnpm 11+: ~/.config/pnpm/config.yaml)
pnpm config set minimumReleaseAge 0 --location=user

#In pnpm-workspace.yaml:
minimumReleaseAge: 0


NPM
Setting: min-release-age
Default: null - policy disabled until you set it
Unit: days (not minutes)
Added: npm 11.10+
Enable example (.npmrc): min-release-age=1
Client Error When Blocked: npm error code ETARGET
npm error notarget No matching version found for npm-test@1.0.0 with a date before 5/23/2026, 1:04:06 PM.
npm error notarget In most cases you or one of your dependencies are requesting a package version that doesn't exist.

Note: npm config get min-release-age may show null even when .npmrc has a value
(converted internally to before).

Commands to change (npm):

# Enable: only install versions at least 1 day old (value is in DAYS)
npm config set min-release-age=1 --location=project

# Enable: 7-day gate
npm config set min-release-age=7 --location=project

# Disable: remove the setting (default is off)
npm config delete min-release-age --location=project

# One-off install bypass (CLI overrides .npmrc)
npm install --min-release-age=0


Client errors generally appear as shown in the table below:

Package Manager	Error code/prefix	Typical message
Yarn Berry	YN0016	All versions satisfying" … " are quarantined
pnpm	ERR_PNPM_NO_MATCHING_VERSION	No matching version found (may mention publish date vs policy)
pnpm	ERR_PNPM_NO_MATURE_MATCHING_VERSION	Version … does not meet the minimumReleaseAge constraint
pnpm	ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION	Locked entry in pnpm-lock.yaml is too new
npm	(no dedicated code)	Generic install/resolution failure; may not mention min-release-age