I tried setting the minimum release age to “one month” because it takes Microsoft at least that long to remove reported malware. This caused dependency issues where PNPM struggled to match suitable versions. I settled for “one day”; long enough to allow some other sucker to beta test the next Shai‑Hulud.

I realize dependency resolution is hard enough as it is, but this feels like it could be added as just another layer on the existing optimization problem. Ideally, all of your dependencies would be at least one month old. But if that can’t be satisfied, you’d like to find a solution with as many old versions as possible: minimize the maximum timestamp or something.

score 1 · canonical