dependabot-npm_and_yarn 0.391.0 → 0.392.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e0783178e3793f20749b70800cb29d01e579ca1b483f378463d151d6ad880bf1
-  data.tar.gz: 54cf02c69a72bc84f73d700d750daa93faa9edec9de6f5a339a47031921d5ac2
+  metadata.gz: 1f8ae1a24dcec46ab349429b68c517aba99fa9308f3e020aa53db169c4f1614c
+  data.tar.gz: 15b8a2c1f6dc838d1b4638b5771e59237c3995720cc2b9a2543e09d1adf9477a
 SHA512:
-  metadata.gz: 7365a4460a19d39621a87895bb9af7d2b146521a42d6bbe0c1896ef3fcfd38cc268370430a5121d2623ac0275606b8f939a0d531e9b800cd51bed8af0933f6e4
-  data.tar.gz: 258cda2ea6cd40d761209c4687941a935b0da6ce36c9bd9ff71304ebe0ee67671a28a54ebf0d2b591b60c0c56bbb96ec2d7766d4e766e5db262ccffd4f3a08ba
+  metadata.gz: ace7c85c19a0ee524f22b71afbc4f0fe8c40d93751ccae53517f652fcec920cb73bdc13d08a22958002d6ac70abfa8da2f4ac7454da7df53a28202b0cc9fe6e0
+  data.tar.gz: d3c9658cce6589964732bff6236b0dfc40821de0cf523c28598d7f93d34e5defa3e2b1fc020b3a59bceb2d5ef8be5c45fc58a82ef2b3180f8ce34805ffa4bc26

data/lib/dependabot/npm_and_yarn/file_updater/npm_lockfile_updater.rb

@@ -30,16 +30,25 @@ module Dependabot
             dependencies: T::Array[Dependabot::Dependency],
             dependency_files: T::Array[Dependabot::DependencyFile],
             credentials: T::Array[Credential],
-            security_updates_only: T::Boolean
+            security_updates_only: T::Boolean,
+            release_age_days: T.nilable(Integer)
           )
             .void
         end
-        def initialize(lockfile:, dependencies:, dependency_files:, credentials:, security_updates_only: false)
+        def initialize(
+          lockfile:,
+          dependencies:,
+          dependency_files:,
+          credentials:,
+          security_updates_only: false,
+          release_age_days: nil
+        )
           @lockfile = lockfile
           @dependencies = dependencies
           @dependency_files = dependency_files
           @credentials = credentials
           @security_updates_only = security_updates_only
+          @release_age_days = release_age_days
         end
 
         sig { returns(Dependabot::DependencyFile) }
@@ -343,7 +352,7 @@ module Dependabot
 
           NativeHelpers.run_npm8_subdependency_update_command(
             dependency_names,
-            security_updates_only: security_updates_only?
+            min_release_age_arg: effective_min_release_age_arg
           )
 
           updated_content = File.read(lockfile_basename)
@@ -354,7 +363,7 @@ module Dependabot
             # npm audit fix exits non-zero when vulnerabilities remain, so we
             # rescue and use whatever lockfile changes it managed to make.
             begin
-              NativeHelpers.run_npm_audit_fix_command(security_updates_only: security_updates_only?)
+              NativeHelpers.run_npm_audit_fix_command(min_release_age_arg: effective_min_release_age_arg)
               sub_dependencies.each { |dep| dep.metadata[:audit_fix_used] = true }
             rescue SharedHelpers::HelperSubprocessFailed
               Dependabot.logger.info("npm audit fix failed or partially fixed — continuing with any changes made")
@@ -404,9 +413,8 @@ module Dependabot
           ]
 
           command_args << "--save-optional" if has_optional_dependencies
-          # Override any min-release-age set in .npmrc: security fixes must not be
-          # blocked by a release-age gate the user configured for regular updates.
-          command_args << "--min-release-age=0" if security_updates_only?
+          min_release_age_arg = effective_min_release_age_arg
+          command_args << min_release_age_arg if min_release_age_arg
 
           command = command_args.join(" ")
 
@@ -419,13 +427,67 @@ module Dependabot
           ]
 
           fingerprint_args << "--save-optional" if has_optional_dependencies
-          fingerprint_args << "--min-release-age=0" if security_updates_only?
+          # The cooldown day value varies per job, so keep it out of the fingerprint.
+          fingerprint_args << fingerprint_min_release_age_arg(min_release_age_arg) if min_release_age_arg
 
           fingerprint = fingerprint_args.join(" ")
 
           Helpers.run_npm_command(command, fingerprint: fingerprint)
         end
 
+        # Returns the `--min-release-age` argument to pass to npm (`install`,
+        # `update`, or `audit fix`), or nil when none applies. Security updates pass
+        # `=0` so a release-age gate never blocks a fix (this intentionally
+        # overrides any `.npmrc` gate). Regular updates pass the dependabot.yml
+        # cooldown floor (in days) so npm holds transitive dependencies back to
+        # versions at least that old. Requires npm >= 11.10 (the updater image
+        # ships a supporting version).
+        #
+        # When the repo also sets an explicit `min-release-age` in `.npmrc`, the
+        # longest release-age wins: the cooldown floor is only injected on the CLI
+        # when it exceeds the user's configured value, otherwise the user's (equal
+        # or longer) gate is left untouched so neither policy is silently weakened.
+        sig { returns(T.nilable(String)) }
+        def effective_min_release_age_arg
+          return nil unless npm_supports_min_release_age?
+
+          return "--min-release-age=0" if security_updates_only?
+
+          effective = Helpers.higher_release_age_gate(@release_age_days, npmrc_min_release_age)
+          return nil unless effective
+
+          "--min-release-age=#{effective}"
+        end
+
+        # Whether the npm that will run supports `--min-release-age` (npm 11.10+).
+        # npm runs through Corepack, so a repo pinned to an older npm via
+        # `packageManager` would reject the flag; gate it out for those. Memoized so
+        # the version subprocess runs at most once per update.
+        sig { returns(T::Boolean) }
+        def npm_supports_min_release_age?
+          @npm_supports_min_release_age = T.let(@npm_supports_min_release_age, T.nilable(T::Boolean))
+          return @npm_supports_min_release_age unless @npm_supports_min_release_age.nil?
+
+          @npm_supports_min_release_age = Helpers.npm_supports_min_release_age?
+        end
+
+        sig { params(arg: String).returns(String) }
+        def fingerprint_min_release_age_arg(arg)
+          arg == "--min-release-age=0" ? arg : "--min-release-age=<days>"
+        end
+
+        # The `min-release-age` (in days) configured across the repo's `.npmrc`
+        # files, or nil when unset. A value we cannot parse as a bare integer is
+        # reported as Float::INFINITY so an explicit-but-non-numeric user gate is
+        # never overridden by the cooldown floor.
+        sig { returns(T.nilable(T.any(Integer, Float))) }
+        def npmrc_min_release_age
+          Helpers.max_configured_release_age(
+            dependency_files,
+            [Helpers::ReleaseAgeGateSetting.new(filename: ".npmrc", key: "min-release-age", separator: "=")]
+          )
+        end
+
         sig { params(dependency: Dependabot::Dependency).returns(String) }
         def npm_install_args(dependency)
           git_requirement = dependency.requirements.find { |req| req.source_string("type") == "git" }

data/lib/dependabot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb

@@ -4,6 +4,7 @@
 require "dependabot/npm_and_yarn/helpers"
 require "dependabot/npm_and_yarn/package/registry_finder"
 require "dependabot/npm_and_yarn/registry_parser"
+require "dependabot/npm_and_yarn/version"
 require "dependabot/shared_helpers"
 
 module Dependabot
@@ -22,7 +23,8 @@ module Dependabot
             dependency_files: T::Array[Dependabot::DependencyFile],
             repo_contents_path: T.nilable(String),
             credentials: T::Array[Dependabot::Credential],
-            security_updates_only: T::Boolean
+            security_updates_only: T::Boolean,
+            release_age_days: T.nilable(Integer)
           ).void
         end
         def initialize(
@@ -30,13 +32,15 @@ module Dependabot
           dependency_files:,
           repo_contents_path:,
           credentials:,
-          security_updates_only: false
+          security_updates_only: false,
+          release_age_days: nil
         )
           @dependencies = dependencies
           @dependency_files = dependency_files
           @repo_contents_path = repo_contents_path
           @credentials = credentials
           @security_updates_only = security_updates_only
+          @release_age_days = release_age_days
           @error_handler = T.let(
             PnpmErrorHandler.new(
               dependencies: dependencies,
@@ -92,6 +96,18 @@ module Dependabot
 
         IRRESOLVABLE_PACKAGE = "ERR_PNPM_NO_MATCHING_VERSION"
         INVALID_REQUIREMENT = "ERR_PNPM_SPEC_NOT_SUPPORTED_BY_ANY_RESOLVER"
+
+        # pnpm introduced the `minimumReleaseAge` release-age gate in 10.16 and the
+        # `minimumReleaseAgeStrict` toggle in 11.0; older versions ignore them.
+        PNPM_MINIMUM_RELEASE_AGE_VERSION = "10.16"
+        PNPM_MINIMUM_RELEASE_AGE_STRICT_VERSION = "11.0"
+        # pnpm 10.x ignores minimumReleaseAge when shared-workspace-lockfile is
+        # disabled (pnpm/pnpm#10008); the fix ships in pnpm 11.
+        PNPM_WORKSPACE_RELEASE_AGE_FIX_VERSION = "11.0"
+        # pnpm 11 stopped reading non-registry settings (e.g. minimum-release-age)
+        # from .npmrc, so a .npmrc release-age gate is only effective on pnpm 10.x.
+        PNPM_NPMRC_RELEASE_AGE_DROPPED_VERSION = "11.0"
+
         UNREACHABLE_GIT = %r{Command failed with exit code 128: git ls-remote (?<url>.*github\.com/[^/]+/[^ ]+)}
         UNREACHABLE_GIT_V8 = %r{ERR_PNPM_FETCH_404[ [^:print]]+GET (?<url>https://codeload\.github\.com/[^/]+/[^/]+)/}
         FORBIDDEN_PACKAGE = /ERR_PNPM_FETCH_403[ [^:print]]+GET (?<dependency_url>.*): Forbidden - 403/
@@ -207,35 +223,242 @@ module Dependabot
 
           cmd = "update #{dependency_updates}  --lockfile-only --no-save -r"
           fingerprint = "update <dependency_updates>  --lockfile-only --no-save -r"
-          if security_updates_only?
-            # Override any minimumReleaseAge set in pnpm-workspace.yaml: security fixes must not be
-            # blocked by a release-age gate the user configured for regular updates.
-            cmd += " --config.minimumReleaseAge=0 --config.minimumReleaseAgeStrict=false"
-            fingerprint += " --config.minimumReleaseAge=0 --config.minimumReleaseAgeStrict=false"
-          end
-          Helpers.run_pnpm_command(cmd, fingerprint: fingerprint)
+          run_pnpm_command_with_release_age_gate(cmd, fingerprint)
         end
 
         sig { returns(T.nilable(String)) }
         def run_pnpm_install
-          cmd = "install --lockfile-only"
-          if security_updates_only?
-            # Override any minimumReleaseAge set in pnpm-workspace.yaml: security fixes must not be
-            # blocked by a release-age gate the user configured for regular updates.
-            cmd += " --config.minimumReleaseAge=0 --config.minimumReleaseAgeStrict=false"
+          # `install --lockfile-only` has no dynamic content, so it needs no
+          # fingerprint of its own. Passing nil lets the release-age gate handle
+          # fingerprinting only when it appends the (dynamic) minimumReleaseAge.
+          run_pnpm_command_with_release_age_gate("install --lockfile-only")
+        end
+
+        # pnpm's `minimumReleaseAge` needs the registry `time` field, which is
+        # absent from the abbreviated metadata pnpm uses for some packages during
+        # `pnpm update`, raising ERR_PNPM_MISSING_TIME. When that happens for a
+        # cooldown-derived gate we retry without it so the update still succeeds,
+        # rather than failing the whole job. Security bypass (`=0`) never triggers
+        # this because it disables the age lookup entirely.
+        sig { params(cmd: String, fingerprint: T.nilable(String)).returns(T.nilable(String)) }
+        def run_pnpm_command_with_release_age_gate(cmd, fingerprint = nil)
+          gate = release_age_gate_config
+          return execute_pnpm_command(cmd, fingerprint) unless gate
+
+          gate_fingerprint = security_updates_only? ? gate : fingerprint_minimum_release_age_config
+          gated_fingerprint = "#{fingerprint || cmd} #{gate_fingerprint}"
+          begin
+            execute_pnpm_command("#{cmd} #{gate}", gated_fingerprint)
+          rescue SharedHelpers::HelperSubprocessFailed => e
+            raise if security_updates_only? || !e.message.include?("ERR_PNPM_MISSING_TIME")
+
+            Dependabot.logger.warn(
+              "pnpm could not apply the cooldown release-age gate because the registry metadata " \
+              "is missing the \"time\" field (ERR_PNPM_MISSING_TIME); retrying without the " \
+              "transitive cooldown gate so the update is not blocked."
+            )
+            execute_pnpm_command(cmd, fingerprint)
+          end
+        end
+
+        sig { params(cmd: String, fingerprint: T.nilable(String)).returns(T.nilable(String)) }
+        def execute_pnpm_command(cmd, fingerprint)
+          if fingerprint
+            Helpers.run_pnpm_command(cmd, fingerprint: fingerprint)
+          else
+            Helpers.run_pnpm_command(cmd)
+          end
+        end
+
+        # Returns the pnpm `--config.minimumReleaseAge` arguments to apply, or nil.
+        # Security updates disable the gate (`=0`); regular updates apply the
+        # dependabot.yml cooldown floor (in minutes). `minimumReleaseAge` was added
+        # in pnpm 10.16, so older pnpm silently ignores it — rather than give a
+        # false guarantee we skip the gate (and warn) when the running pnpm is too
+        # old to enforce it.
+        sig { returns(T.nilable(String)) }
+        def release_age_gate_config
+          if !security_updates_only? && @release_age_days&.positive? && !pnpm_supports_minimum_release_age?
+            Dependabot.logger.warn(
+              "pnpm #{pnpm_version || '(unknown version)'} does not support minimumReleaseAge " \
+              "(added in pnpm 10.16); the release-age cooldown cannot be enforced for transitive " \
+              "dependencies on this pnpm version."
+            )
+            return nil
           end
-          Helpers.run_pnpm_command(cmd)
+
+          minutes = effective_release_age_minutes
+          return nil if minutes.nil?
+
+          # Security updates pass minimumReleaseAge=0 unconditionally: older pnpm
+          # ignores it, and a transient version-probe failure must not leave a native
+          # gate active and block the fix.
+          return minimum_release_age_gate_args(minutes) if security_updates_only?
+
+          minimum_release_age_gate_args(minutes)
+        end
+
+        # The pnpm `minimumReleaseAge` value (in minutes) to enforce for this
+        # update, independent of the pnpm version: 0 to bypass the gate for
+        # security fixes (which must not be blocked by a release-age gate the user
+        # configured for regular updates), the dependabot.yml cooldown floor for
+        # regular updates, or nil when no gate applies.
+        #
+        # When the repo also sets an explicit `minimumReleaseAge` in
+        # pnpm-workspace.yaml (or `.npmrc`), the longest release-age wins: the
+        # cooldown floor is only injected when it exceeds the user's configured
+        # value, otherwise the user's (equal or longer) gate is left untouched so
+        # neither policy is silently weakened (dependabot/dependabot-core#13165).
+        sig { returns(T.nilable(Integer)) }
+        def effective_release_age_minutes
+          return 0 if security_updates_only?
+
+          cooldown_minutes = @release_age_days && (@release_age_days * Helpers::MINUTES_PER_DAY)
+          Helpers.higher_release_age_gate(cooldown_minutes, pnpm_configured_minimum_release_age)
+        end
+
+        # Builds the pnpm `--config.minimumReleaseAge` args for `minutes`, adding
+        # the strict toggle only when appropriate (see `disable_strict_release_age?`).
+        sig { params(minutes: Integer).returns(String) }
+        def minimum_release_age_gate_args(minutes)
+          args = "--config.minimumReleaseAge=#{minutes}"
+          args += " --config.minimumReleaseAgeStrict=false" if disable_strict_release_age?
+          args
+        end
+
+        # pnpm defaults `minimumReleaseAgeStrict` to *on* when `minimumReleaseAge`
+        # is set via the CLI, which fails resolution when no version satisfies the
+        # window and is incompatible with the `--no-save` update command. We
+        # disable strict for Dependabot's CLI override on pnpm >= 11.0, where the
+        # toggle exists. Equal-or-longer native gates remain untouched because no
+        # CLI override is added for them.
+        sig { returns(T::Boolean) }
+        def disable_strict_release_age?
+          pnpm_supports_minimum_release_age_strict?
+        end
+
+        sig { returns(String) }
+        def fingerprint_minimum_release_age_config
+          args = "--config.minimumReleaseAge=<minutes>"
+          args += " --config.minimumReleaseAgeStrict=false" if disable_strict_release_age?
+          args
+        end
+
+        # The concrete pnpm version that will run, memoized (including a nil result)
+        # so the version subprocess runs at most once per update.
+        sig { returns(T.nilable(Dependabot::Version)) }
+        def pnpm_version
+          return @pnpm_version if defined?(@pnpm_version)
+
+          @pnpm_version = T.let(Helpers.pnpm_version, T.nilable(Dependabot::Version))
+        end
+
+        sig { returns(T::Boolean) }
+        def pnpm_supports_minimum_release_age?
+          version = pnpm_version
+          return false if version.nil? || version < Version.new(PNPM_MINIMUM_RELEASE_AGE_VERSION)
+
+          if pnpm_shared_workspace_lockfile_disabled? &&
+             version < Version.new(PNPM_WORKSPACE_RELEASE_AGE_FIX_VERSION)
+            Dependabot.logger.warn(
+              "pnpm #{version} ignores minimumReleaseAge when shared-workspace-lockfile is disabled " \
+              "(pnpm/pnpm#10008); the release-age cooldown cannot be enforced. Upgrade to pnpm 11+."
+            )
+            return false
+          end
+
+          true
+        end
+
+        sig { returns(T::Boolean) }
+        def pnpm_supports_minimum_release_age_strict?
+          version = pnpm_version
+          !version.nil? && version >= Version.new(PNPM_MINIMUM_RELEASE_AGE_STRICT_VERSION)
+        end
+
+        # pnpm 10.x ignores `minimumReleaseAge` when `shared-workspace-lockfile` is
+        # disabled (pnpm/pnpm#10008), so the cooldown cannot be enforced there.
+        sig { returns(T::Boolean) }
+        def pnpm_shared_workspace_lockfile_disabled?
+          dependency_files.any? do |file|
+            case File.basename(file.name)
+            when "pnpm-workspace.yaml"
+              yaml_boolean_setting(file.content.to_s, "shared-workspace-lockfile", ":") == false
+            when ".npmrc"
+              yaml_boolean_setting(file.content.to_s, "shared-workspace-lockfile", "=") == false
+            else
+              false
+            end
+          end
+        end
+
+        # Reads a YAML/INI boolean `key`, returning true/false, or nil when absent or
+        # non-boolean. Handles optionally quoted keys/values (`"key": True`), boolean
+        # casing, and trailing comments so a valid native setting is never misread.
+        # The last occurrence wins, matching how pnpm/INI resolve a repeated key.
+        sig { params(content: String, key: String, separator: String).returns(T.nilable(T::Boolean)) }
+        def yaml_boolean_setting(content, key, separator)
+          quoted_key = /["']?#{Regexp.escape(key)}["']?/
+          presence = /^\s*#{quoted_key}\s*#{Regexp.escape(separator)}/
+          last_line = content.lines.reverse_each.find { |line| line.match?(presence) }
+          return unless last_line
+
+          # npmrc/INI treats both `#` and `;` as comment delimiters; YAML uses `#`.
+          comment_chars = separator == "=" ? "#;" : "#"
+          match = last_line.match(
+            /^\s*#{quoted_key}\s*#{Regexp.escape(separator)}\s*["']?(\w+)["']?\s*(?:[#{comment_chars}].*)?$/
+          )
+          return unless match
+
+          case T.must(match[1]).downcase
+          when "true" then true
+          when "false" then false
+          end
+        end
+
+        # The largest `minimumReleaseAge` (in minutes) the repo configures for pnpm,
+        # read from pnpm-workspace.yaml (`minimumReleaseAge:`) or `.npmrc`
+        # (`minimum-release-age=`), or nil when unset. A value we cannot parse as a
+        # bare integer is reported as Float::INFINITY so an explicit-but-non-numeric
+        # user gate is never overridden by the cooldown floor.
+        sig { returns(T.nilable(T.any(Integer, Float))) }
+        def pnpm_configured_minimum_release_age
+          settings = [
+            Helpers::ReleaseAgeGateSetting.new(
+              filename: "pnpm-workspace.yaml", key: "minimumReleaseAge", separator: ":"
+            )
+          ]
+          # pnpm 11+ ignores non-registry settings in .npmrc, so a .npmrc
+          # `minimum-release-age` is only an effective user gate on pnpm 10.x.
+          # Counting it on pnpm 11 would wrongly suppress the cooldown CLI override
+          # while pnpm resolves with no age gate.
+          if pnpm_reads_npmrc_release_age?
+            settings << Helpers::ReleaseAgeGateSetting.new(
+              filename: ".npmrc", key: "minimum-release-age", separator: "="
+            )
+          end
+
+          Helpers.max_configured_release_age(dependency_files, settings)
+        end
+
+        sig { returns(T::Boolean) }
+        def pnpm_reads_npmrc_release_age?
+          version = pnpm_version
+          !version.nil? && version < Version.new(PNPM_NPMRC_RELEASE_AGE_DROPPED_VERSION)
         end
 
         # Tries `pnpm update --depth Infinity <dep>` for each dependency as a
         # first-tier fallback when the regular update is a no-op (typically
         # transitive deps not listed in any package.json), without relying on
-        # audit fixes that may modify manifests on older pnpm versions.
+        # audit fixes that may modify manifests on older pnpm versions. It is
+        # routed through the release-age gate so the fallback cannot bypass the
+        # transitive dependency cooldown.
         sig { void }
         def run_pnpm_deep_update_fallback
           recursive = workspace_files.any?
           dependencies.each do |dep|
-            NativeHelpers.run_pnpm_deep_update_command(dep.name, recursive: recursive)
+            cmd, fingerprint = NativeHelpers.pnpm_deep_update_command(dep.name, recursive: recursive)
+            run_pnpm_command_with_release_age_gate(cmd, fingerprint)
             dep.metadata[:deep_update_used] = true
           end
         rescue SharedHelpers::HelperSubprocessFailed
@@ -253,7 +476,8 @@ module Dependabot
           package_json_snapshots = Dir.glob("**/package.json").to_h { |f| [f, File.read(f)] }
 
           begin
-            NativeHelpers.run_pnpm_audit_fix_command
+            cmd, fingerprint = NativeHelpers.pnpm_audit_fix_command
+            run_pnpm_command_with_release_age_gate(cmd, fingerprint)
             run_pnpm_install
 
             manifest_changed = package_json_snapshots.any? { |f, c| File.read(f) != c }

data/lib/dependabot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb

@@ -31,7 +31,8 @@ module Dependabot
             dependency_files: T::Array[Dependabot::DependencyFile],
             repo_contents_path: T.nilable(String),
             credentials: T::Array[Dependabot::Credential],
-            security_updates_only: T::Boolean
+            security_updates_only: T::Boolean,
+            release_age_days: T.nilable(Integer)
           )
             .void
         end
@@ -40,13 +41,15 @@ module Dependabot
           dependency_files:,
           repo_contents_path:,
           credentials:,
-          security_updates_only: false
+          security_updates_only: false,
+          release_age_days: nil
         )
           @dependencies = dependencies
           @dependency_files = dependency_files
           @repo_contents_path = repo_contents_path
           @credentials = credentials
           @security_updates_only = security_updates_only
+          @release_age_days = release_age_days
           @error_handler = T.let(
             YarnErrorHandler.new(
               dependencies: dependencies,
@@ -345,40 +348,92 @@ module Dependabot
           ]
 
           original_content = File.read(yarn_lock.name)
-          Helpers.run_yarn_commands(*commands)
+          Helpers.run_yarn_commands(*commands, env: yarn_time_gate_env)
 
           updated_content = File.read(yarn_lock.name)
           if updated_content == original_content && Dependabot::Experiments.enabled?(:enable_audit_fix_fallback)
-            begin
-              NativeHelpers.run_yarn_audit_fix_command
-              dep.metadata[:audit_fix_used] = true
-            rescue SharedHelpers::HelperSubprocessFailed
-              Dependabot.logger.info(
-                "yarn npm audit --fix failed or partially fixed — continuing with any changes made"
-              )
-            end
+            run_yarn_audit_fix_fallback(dep)
             updated_content = File.read(yarn_lock.name)
           end
 
           { yarn_lock.name => updated_content }
         end
 
+        # Fallback for transitive deps where add/dedupe/remove is a no-op. Threads
+        # the release-age gate env so the audit-fix resolve honours the same cooldown
+        # (and security `=0` bypass) as the primary commands.
+        sig { params(dep: Dependabot::Dependency).void }
+        def run_yarn_audit_fix_fallback(dep)
+          NativeHelpers.run_yarn_audit_fix_command(env: yarn_time_gate_env)
+          dep.metadata[:audit_fix_used] = true
+        rescue SharedHelpers::HelperSubprocessFailed
+          Dependabot.logger.info(
+            "yarn npm audit --fix failed or partially fixed — continuing with any changes made"
+          )
+        end
+
         sig { returns(T::Boolean) }
         def security_updates_only?
           @security_updates_only
         end
 
-        # Returns an env hash that disables Yarn Berry's npmMinimalAgeGate for security updates.
-        # npmMinimalAgeGate was introduced in Yarn 4.10.0. Setting the corresponding
-        # YARN_NPM_MINIMAL_AGE_GATE env var on older Yarn Berry releases (or Yarn classic) raises
-        # "Unrecognized or legacy configuration settings found: npmMinimalAgeGate" and aborts the
-        # install, so we gate on a version check.
+        # Returns an env hash that sets Yarn Berry's YARN_NPM_MINIMAL_AGE_GATE.
+        # Security updates set it to 0 so a release-age gate never blocks a fix
+        # (this intentionally overrides any `.yarnrc.yml` gate). Regular updates set
+        # it to the dependabot.yml cooldown floor (in minutes) so yarn holds
+        # transitive dependencies back to versions at least that old. For regular
+        # updates an equal-or-longer `npmMinimalAgeGate` in .yarnrc.yml takes
+        # precedence, so it is left untouched.
+        #
+        # npmMinimalAgeGate was introduced in Yarn 4.10.0. Setting the env var on
+        # older Yarn Berry releases (or Yarn classic) raises "Unrecognized or legacy
+        # configuration settings found: npmMinimalAgeGate" and aborts the install,
+        # so we gate on a version check.
+        #
+        # Memoized (including a nil result): the value is deterministic for the
+        # updater's lifetime and this is invoked from several yarn command sites,
+        # so we avoid running `yarn --version` (and emitting duplicate log lines)
+        # more than once per update.
         sig { returns(T.nilable(T::Hash[String, String])) }
         def yarn_time_gate_env
-          return nil unless security_updates_only?
-          return nil unless Helpers.yarn_berry_supports_minimal_age_gate?
+          return @yarn_time_gate_env if defined?(@yarn_time_gate_env)
 
-          { "YARN_NPM_MINIMAL_AGE_GATE" => "0" }
+          gate_value = yarn_minimal_age_gate_value
+          env = if gate_value && Helpers.yarn_berry_supports_minimal_age_gate?
+                  { "YARN_NPM_MINIMAL_AGE_GATE" => gate_value }
+                end
+          @yarn_time_gate_env = T.let(env, T.nilable(T::Hash[String, String]))
+        end
+
+        # Returns the YARN_NPM_MINIMAL_AGE_GATE value (in minutes) for a regular
+        # update, or nil when none applies. Security updates pass "0" so a
+        # release-age gate never blocks a fix (this intentionally overrides any
+        # `.yarnrc.yml` gate).
+        #
+        # When the repo also sets an explicit `npmMinimalAgeGate` in `.yarnrc.yml`,
+        # the longest release-age wins: the cooldown floor is only injected via the
+        # env var when it exceeds the user's configured value, otherwise the user's
+        # (equal or longer) gate is left untouched so neither policy is silently
+        # weakened.
+        sig { returns(T.nilable(String)) }
+        def yarn_minimal_age_gate_value
+          return "0" if security_updates_only?
+
+          cooldown_minutes = @release_age_days && (@release_age_days * Helpers::MINUTES_PER_DAY)
+          effective = Helpers.higher_release_age_gate(cooldown_minutes, yarnrc_minimal_age_gate)
+          effective&.to_s
+        end
+
+        # The `npmMinimalAgeGate` (in minutes) configured across the repo's
+        # `.yarnrc.yml` files, or nil when unset. A value we cannot parse as a bare
+        # integer is reported as Float::INFINITY so an explicit-but-non-numeric user
+        # gate is never overridden by the cooldown floor.
+        sig { returns(T.nilable(T.any(Integer, Float))) }
+        def yarnrc_minimal_age_gate
+          Helpers.max_configured_release_age(
+            dependency_files,
+            [Helpers::ReleaseAgeGateSetting.new(filename: ".yarnrc.yml", key: "npmMinimalAgeGate", separator: ":")]
+          )
         end
 
         sig { returns(String) }

data/lib/dependabot/npm_and_yarn/file_updater.rb

@@ -6,6 +6,7 @@ require "dependabot/file_updaters/base"
 require "dependabot/file_updaters/vendor_updater"
 require "dependabot/file_updaters/artifact_updater"
 require "dependabot/errors"
+require "dependabot/package/release_cooldown_options"
 require "dependabot/npm_and_yarn/dependency_files_filterer"
 require "dependabot/npm_and_yarn/sub_dependency_files_filterer"
 require "sorbet-runtime"
@@ -435,6 +436,33 @@ module Dependabot
           )
       end
 
+      # The number of days from the dependabot.yml `cooldown` config to apply as
+      # a release-age floor for *transitive* dependencies. npm, pnpm and yarn each
+      # enforce this natively at install time, which is the only point at which
+      # Dependabot can constrain the versions the package manager resolves for the
+      # transitive tree. Returns nil for security updates (which must never be
+      # blocked by a release-age gate) or when no positive cooldown is configured.
+      # `default_days` is used because the native gates are a single global value
+      # and cannot express per-semver-type days or include/exclude patterns.
+      #
+      # The gate is also skipped when none of the dependencies being updated are
+      # subject to the cooldown (per its `include`/`exclude` patterns), so an
+      # update the user explicitly opted out of cooldown for is not gated.
+      sig { returns(T.nilable(Integer)) }
+      def cooldown_release_age_days
+        return nil if options.fetch(:security_updates_only, false)
+
+        cooldown = T.cast(
+          options[:update_cooldown],
+          T.nilable(Dependabot::Package::ReleaseCooldownOptions)
+        )
+        return nil if cooldown.nil?
+        return nil unless dependencies.any? { |dep| cooldown.included?(dep.name) }
+
+        days = cooldown.default_days
+        days.positive? ? days : nil
+      end
+
       sig { returns(Dependabot::NpmAndYarn::FileUpdater::YarnLockfileUpdater) }
       def yarn_lockfile_updater
         @yarn_lockfile_updater ||= T.let(
@@ -443,7 +471,8 @@ module Dependabot
             dependency_files: dependency_files,
             repo_contents_path: repo_contents_path,
             credentials: credentials,
-            security_updates_only: options.fetch(:security_updates_only, false) ? true : false
+            security_updates_only: options.fetch(:security_updates_only, false) ? true : false,
+            release_age_days: cooldown_release_age_days
           ),
           T.nilable(Dependabot::NpmAndYarn::FileUpdater::YarnLockfileUpdater)
         )
@@ -457,7 +486,8 @@ module Dependabot
             dependency_files: dependency_files,
             repo_contents_path: repo_contents_path,
             credentials: credentials,
-            security_updates_only: options.fetch(:security_updates_only, false) ? true : false
+            security_updates_only: options.fetch(:security_updates_only, false) ? true : false,
+            release_age_days: cooldown_release_age_days
           ),
           T.nilable(Dependabot::NpmAndYarn::FileUpdater::PnpmLockfileUpdater)
         )
@@ -474,7 +504,8 @@ module Dependabot
           dependencies: dependencies,
           dependency_files: dependency_files,
           credentials: credentials,
-          security_updates_only: options.fetch(:security_updates_only, false) ? true : false
+          security_updates_only: options.fetch(:security_updates_only, false) ? true : false,
+          release_age_days: cooldown_release_age_days
         )
       end
 

data/lib/dependabot/npm_and_yarn/helpers.rb

@@ -50,6 +50,9 @@ module Dependabot
       NPM_V6 = 6
       NPM_DEFAULT_VERSION = NPM_V11
 
+      # Minimum npm version that supports the `--min-release-age` CLI flag.
+      NPM_MINIMUM_RELEASE_AGE_VERSION = "11.10.0"
+
       # PNPM Version Constants
       PNPM_V10 = 10
       PNPM_V9 = 9
@@ -70,6 +73,91 @@ module Dependabot
       SUPPORTED_COREPACK_PACKAGE_MANAGERS = %w(npm yarn pnpm).freeze
       COREPACK_SIGNATURE_METADATA_ERROR = "No compatible signature found in package metadata"
 
+      # pnpm's `minimumReleaseAge` and yarn's `npmMinimalAgeGate` are expressed in
+      # minutes, whereas dependabot.yml cooldown and npm's `min-release-age` use
+      # days. Used to convert a cooldown floor (days) into the minutes those gates
+      # expect.
+      MINUTES_PER_DAY = 1440
+
+      # Resolves the release-age gate value a lockfile updater should enforce for a
+      # regular update, applying "highest precedence wins" between the Dependabot
+      # cooldown floor and any explicit native gate the user configured (both given
+      # in the same package-manager unit). Returns the value to pass on the CLI/env
+      # (overriding the user's config) when the cooldown is longer, or nil to leave
+      # the user's own (equal-or-longer) gate — or the absence of one — untouched.
+      # A non-numeric user gate should be passed as Float::INFINITY so it is never
+      # overridden. Security updates handle their own `=0` bypass and must not use
+      # this method.
+      sig do
+        params(cooldown: T.nilable(Integer), user_gate: T.nilable(T.any(Integer, Float))).returns(T.nilable(Integer))
+      end
+      def self.higher_release_age_gate(cooldown, user_gate)
+        return nil if cooldown.nil? || !cooldown.positive?
+        return nil if user_gate && cooldown <= user_gate
+
+        cooldown
+      end
+
+      # Describes where a native release-age gate can be configured: the file it
+      # may appear in, the setting key, and the separator between key and value
+      # ("=" for npmrc/ini-style files, ":" for YAML). Passed to
+      # `max_configured_release_age` so each ecosystem parses its user-configured
+      # gate through the same logic.
+      class ReleaseAgeGateSetting < T::Struct
+        const :filename, String
+        const :key, String
+        const :separator, String
+      end
+
+      # The largest explicitly-configured native release-age gate across the repo's
+      # dependency files, or nil when none is set. Each file whose basename matches
+      # one of `settings` is parsed for a bare integer value; a present-but-non-
+      # numeric value is reported as Float::INFINITY so an explicit user gate is
+      # never overridden by the cooldown floor (see `higher_release_age_gate`).
+      sig do
+        params(
+          dependency_files: T::Array[DependencyFile],
+          settings: T::Array[ReleaseAgeGateSetting]
+        ).returns(T.nilable(T.any(Integer, Float)))
+      end
+      def self.max_configured_release_age(dependency_files, settings)
+        values = dependency_files.filter_map do |file|
+          setting = settings.find { |candidate| candidate.filename == File.basename(file.name) }
+          next unless setting
+
+          configured_release_age(file.content.to_s, setting)
+        end
+        values.max
+      end
+
+      # Resolves the effective release-age value a single file sets for `setting`,
+      # or nil when the key is absent. npmrc/INI and YAML both let the *last*
+      # occurrence of a key win, so we read the last matching line rather than the
+      # first (e.g. `min-release-age=30` then `min-release-age=3` resolves to 3). A
+      # present-but-non-numeric value is reported as Float::INFINITY.
+      sig { params(content: String, setting: ReleaseAgeGateSetting).returns(T.nilable(T.any(Integer, Float))) }
+      def self.configured_release_age(content, setting)
+        key = Regexp.escape(setting.key)
+        separator = Regexp.escape(setting.separator)
+        # Match an optionally quoted key (`"minimumReleaseAge":`) so a valid quoted
+        # YAML key is not treated as absent.
+        quoted_key = /["']?#{key}["']?/
+        presence = /^\s*#{quoted_key}\s*#{separator}/
+        # Allow an optionally quoted value and an optional trailing comment
+        # (e.g. `minimumReleaseAge: "4320" # 3 days`). npmrc/INI treats both `#` and
+        # `;` as comment delimiters; YAML uses `#` only. Otherwise a quoted or
+        # commented value is treated as non-numeric (Float::INFINITY).
+        comment_chars = setting.separator == "=" ? "#;" : "#"
+        value = /^\s*#{quoted_key}\s*#{separator}\s*["']?(\d+)["']?\s*(?:[#{comment_chars}].*)?$/
+
+        last_line = content.lines.reverse_each.find { |line| line.match?(presence) }
+        return unless last_line
+
+        match = last_line.match(value)
+        match ? T.must(match[1]).to_i : Float::INFINITY
+      end
+      private_class_method :configured_release_age
+
       sig { params(lockfile: T.nilable(DependencyFile)).returns(Integer) }
       def self.npm_version_numeric(lockfile)
         detected_npm_version = detect_npm_version(lockfile)
@@ -141,6 +229,62 @@ module Dependabot
         PNPM_FALLBACK_VERSION
       end
 
+      # The concrete pnpm version that will run for this update — resolved via
+      # Corepack when the corepack experiment is enabled (honouring the repo's
+      # `packageManager` pin), otherwise the pnpm on PATH. Returns nil when the
+      # version can't be determined. Used to gate version-specific config such as
+      # `minimumReleaseAge` (added in pnpm 10.16) and `minimumReleaseAgeStrict`
+      # (added in pnpm 11.0), which older pnpm versions silently ignore.
+      sig { returns(T.nilable(Dependabot::Version)) }
+      def self.pnpm_version
+        raw = if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
+                package_manager_version(PNPMPackageManager::NAME, env: merge_corepack_env(nil))
+              else
+                local_package_manager_version(PNPMPackageManager::NAME)
+              end
+        Version.new(raw)
+      rescue StandardError => e
+        Dependabot.logger.warn("Could not determine pnpm version to gate release-age settings: #{e.message}")
+        nil
+      end
+
+      # The concrete npm version that will run — via Corepack when the corepack
+      # experiment is enabled (honouring the repo's `packageManager` pin, which can
+      # select npm 7-11), otherwise the npm on PATH. Returns nil when it can't be
+      # determined. Used to gate `--min-release-age`, added in npm 11.10.
+      sig { returns(T.nilable(Dependabot::Version)) }
+      def self.npm_version
+        raw = if Dependabot::Experiments.enabled?(:enable_corepack_for_npm_and_yarn)
+                package_manager_version(NpmPackageManager::NAME, env: merge_corepack_env(nil))
+              else
+                local_package_manager_version(NpmPackageManager::NAME)
+              end
+        Version.new(raw)
+      rescue StandardError => e
+        Dependabot.logger.warn("Could not determine npm version to gate release-age settings: #{e.message}")
+        nil
+      end
+
+      # True when the running npm supports `--min-release-age` (npm 11.10+). Because
+      # npm runs through Corepack, a repo pinned to an older npm via `packageManager`
+      # would reject the flag, so the cooldown gate must be skipped for it.
+      sig { returns(T::Boolean) }
+      def self.npm_supports_min_release_age?
+        version = npm_version
+        return false if version.nil?
+
+        supported = version >= Version.new(NPM_MINIMUM_RELEASE_AGE_VERSION)
+        if supported
+          Dependabot.logger.info("npm #{version} supports --min-release-age.")
+        else
+          Dependabot.logger.info(
+            "npm #{version} does not support --min-release-age (requires 11.10.0+); the release-age " \
+            "cooldown gate will not be applied to transitive dependencies."
+          )
+        end
+        supported
+      end
+
       sig { params(key: String, default_value: String).returns(T.untyped) }
       def self.fetch_yarnrc_yml_value(key, default_value)
         if File.exist?(".yarnrc.yml") && (yarnrc = YAML.load_file(".yarnrc.yml"))
@@ -254,10 +398,7 @@ module Dependabot
         version = Version.new(run_single_yarn_command("--version"))
         supported = version >= Version.new("4.10.0")
         if supported
-          Dependabot.logger.info(
-            "Yarn #{version} supports npmMinimalAgeGate. " \
-            "Setting YARN_NPM_MINIMAL_AGE_GATE=0 to bypass the release-age gate for security updates."
-          )
+          Dependabot.logger.info("Yarn #{version} supports npmMinimalAgeGate.")
         else
           Dependabot.logger.info(
             "Yarn #{version} does not support npmMinimalAgeGate (requires 4.10.0+). " \
@@ -268,8 +409,9 @@ module Dependabot
       rescue StandardError => e
         Dependabot.logger.warn(
           "Could not determine Yarn version to check npmMinimalAgeGate support: #{e.message}. " \
-          "Assuming unsupported (returning false). YARN_NPM_MINIMAL_AGE_GATE will not be set, " \
-          "so the registry's release-age gate may still block security updates."
+          "Assuming unsupported (returning false). YARN_NPM_MINIMAL_AGE_GATE will not be set, so the " \
+          "security-update `=0` bypass cannot be applied — any release-age gate configured in " \
+          ".yarnrc.yml (npmMinimalAgeGate) or enforced by the registry may still block security updates."
         )
         false
       end
@@ -301,11 +443,11 @@ module Dependabot
       # set to false. Yarn commands should _not_ be ran outside of this helper
       # to ensure that postinstall scripts are never executed, as they could
       # contain malicious code.
-      sig { params(commands: T::Array[String]).void }
-      def self.run_yarn_commands(*commands)
+      sig { params(commands: T::Array[String], env: T.nilable(T::Hash[String, String])).void }
+      def self.run_yarn_commands(*commands, env: nil)
         setup_yarn_berry
         commands.each do |cmd, fingerprint|
-          run_single_yarn_command(cmd, fingerprint: fingerprint) if cmd
+          run_single_yarn_command(cmd, fingerprint: fingerprint, env: env) if cmd
         end
       end
 

data/lib/dependabot/npm_and_yarn/native_helpers.rb

@@ -24,8 +24,10 @@ module Dependabot
         File.join(__dir__, "../../../helpers")
       end
 
-      sig { params(dependency_names: T::Array[String], security_updates_only: T::Boolean).returns(String) }
-      def self.run_npm8_subdependency_update_command(dependency_names, security_updates_only: false)
+      sig do
+        params(dependency_names: T::Array[String], min_release_age_arg: T.nilable(String)).returns(String)
+      end
+      def self.run_npm8_subdependency_update_command(dependency_names, min_release_age_arg: nil)
         # NOTE: npm options
         # - `--force` ignores checks for platform (os, cpu) and engines
         # - `--ignore-scripts` disables prepare and prepack scripts which are run
@@ -37,9 +39,10 @@ module Dependabot
           "--ignore-scripts",
           "--package-lock-only"
         ]
-        # Override any min-release-age set in .npmrc: security fixes must not be
-        # blocked by a release-age gate the user configured for regular updates.
-        command_args << "--min-release-age=0" if security_updates_only
+        # Apply the effective release-age gate: `=0` bypasses any `.npmrc` gate for
+        # security fixes, a positive value enforces the dependabot.yml cooldown
+        # floor on transitive updates. nil leaves npm's own resolution untouched.
+        command_args << min_release_age_arg if min_release_age_arg
         command = command_args.join(" ")
 
         fingerprint_args = [
@@ -49,41 +52,51 @@ module Dependabot
           "--ignore-scripts",
           "--package-lock-only"
         ]
-        fingerprint_args << "--min-release-age=0" if security_updates_only
+        fingerprint_args << fingerprint_min_release_age_arg(min_release_age_arg) if min_release_age_arg
         fingerprint = fingerprint_args.join(" ")
 
         Helpers.run_npm_command(command, fingerprint: fingerprint)
       end
 
-      sig { params(security_updates_only: T::Boolean).returns(String) }
-      def self.run_npm_audit_fix_command(security_updates_only: false)
+      sig { params(min_release_age_arg: T.nilable(String)).returns(String) }
+      def self.run_npm_audit_fix_command(min_release_age_arg: nil)
         # Fallback for transitive dependencies in workspace repos where
         # `npm update` is a no-op because the package isn't in package.json.
         # `npm audit fix` updates all fixable vulnerabilities in the lockfile.
         # `--force` ignores checks for platform (os, cpu) and engines,
         # matching the flags used by run_npm8_subdependency_update_command.
         command = "audit fix --force --package-lock-only --ignore-scripts"
-        # Override any min-release-age set in .npmrc: security fixes must not be
-        # blocked by a release-age gate the user configured for regular updates.
-        command += " --min-release-age=0" if security_updates_only
-        fingerprint = command
+        # Apply the effective release-age gate (see run_npm8_subdependency_update_command).
+        command += " #{min_release_age_arg}" if min_release_age_arg
+        fingerprint = "audit fix --force --package-lock-only --ignore-scripts"
+        fingerprint += " #{fingerprint_min_release_age_arg(min_release_age_arg)}" if min_release_age_arg
 
         Helpers.run_npm_command(command, fingerprint: fingerprint)
       end
 
-      sig { returns(String) }
-      def self.run_pnpm_audit_fix_command
+      # Masks the varying cooldown day count out of the telemetry fingerprint while
+      # keeping the security `=0` bypass distinguishable (mirrors the npm lockfile
+      # updater's `fingerprint_min_release_age_arg`).
+      sig { params(arg: String).returns(String) }
+      def self.fingerprint_min_release_age_arg(arg)
+        arg == "--min-release-age=0" ? arg : "--min-release-age=<days>"
+      end
+
+      sig { returns([String, String]) }
+      def self.pnpm_audit_fix_command
         # Fallback for transitive dependencies where `pnpm update` is a no-op.
         # pnpm 11's update fix method updates vulnerable packages in the lockfile.
         # Older supported versions only accept `--fix`, which may add manifest overrides.
         version_output = Helpers.run_pnpm_command("-v", fingerprint: "-v")
         fix_option = pnpm_major_version(version_output) >= 11 ? "--fix=update" : "--fix"
         command = "audit #{fix_option}"
+        [command, command]
+      end
 
-        Helpers.run_pnpm_command(
-          command,
-          fingerprint: command
-        )
+      sig { returns(String) }
+      def self.run_pnpm_audit_fix_command
+        command, fingerprint = pnpm_audit_fix_command
+        Helpers.run_pnpm_command(command, fingerprint: fingerprint)
       end
 
       sig { params(output: String).returns(Integer) }
@@ -97,27 +110,36 @@ module Dependabot
       end
       private_class_method :pnpm_major_version
 
-      sig { params(dependency_name: String, recursive: T::Boolean).returns(String) }
-      def self.run_pnpm_deep_update_command(dependency_name, recursive: false)
+      sig { params(dependency_name: String, recursive: T::Boolean).returns([String, String]) }
+      def self.pnpm_deep_update_command(dependency_name, recursive: false)
         # `pnpm update --depth Infinity <dep>` traverses the full dependency
         # graph, allowing transitive dependencies to be updated in the lockfile
         # without relying on audit fixes that may modify manifests on older pnpm versions.
         # `-r --include-workspace-root` is required for workspace repos so the
         # update is applied across all packages.
         flags = recursive ? "-r --include-workspace-root " : ""
-        Helpers.run_pnpm_command(
-          "#{flags}update #{dependency_name} --depth Infinity --lockfile-only",
-          fingerprint: "#{flags}update <dependency_name> --depth Infinity --lockfile-only"
-        )
+        cmd = "#{flags}update #{dependency_name} --depth Infinity --lockfile-only"
+        fingerprint = "#{flags}update <dependency_name> --depth Infinity --lockfile-only"
+        [cmd, fingerprint]
       end
 
-      sig { returns(String) }
-      def self.run_yarn_audit_fix_command
+      sig { params(dependency_name: String, recursive: T::Boolean).returns(String) }
+      def self.run_pnpm_deep_update_command(dependency_name, recursive: false)
+        cmd, fingerprint = pnpm_deep_update_command(dependency_name, recursive: recursive)
+        Helpers.run_pnpm_command(cmd, fingerprint: fingerprint)
+      end
+
+      sig { params(env: T.nilable(T::Hash[String, String])).returns(String) }
+      def self.run_yarn_audit_fix_command(env: nil)
         # Fallback for transitive dependencies where `yarn up -R` is a no-op.
-        # `yarn npm audit --fix` updates vulnerable deps in the lockfile.
+        # `yarn npm audit --fix` updates vulnerable deps in the lockfile. The
+        # release-age gate env is threaded through so this lockfile-resolving
+        # command honours the same cooldown (and security `=0` bypass) as the
+        # primary add/dedupe/remove commands.
         Helpers.run_yarn_command(
           "npm audit --fix --mode update-lockfile",
-          fingerprint: "npm audit --fix --mode update-lockfile"
+          fingerprint: "npm audit --fix --mode update-lockfile",
+          env: env
         )
       end
     end

data/lib/dependabot/npm_and_yarn/update_checker/subdependency_version_resolver.rb

@@ -329,13 +329,15 @@ module Dependabot
 
               NativeHelpers.run_npm8_subdependency_update_command(
                 [dependency.name],
-                security_updates_only: security_updates_only?
+                min_release_age_arg: security_updates_only? ? "--min-release-age=0" : nil
               )
 
               updated_content = File.read(lockfile_name)
               if updated_content == original_content && Dependabot::Experiments.enabled?(:enable_audit_fix_fallback)
                 begin
-                  NativeHelpers.run_npm_audit_fix_command(security_updates_only: security_updates_only?)
+                  NativeHelpers.run_npm_audit_fix_command(
+                    min_release_age_arg: security_updates_only? ? "--min-release-age=0" : nil
+                  )
                   dependency.metadata[:audit_fix_used] = true
                 rescue SharedHelpers::HelperSubprocessFailed
                   Dependabot.logger.info("npm audit fix failed or partially fixed — continuing with any changes made")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dependabot-npm_and_yarn
 version: !ruby/object:Gem::Version
-  version: 0.391.0
+  version: 0.392.0
 platform: ruby
 authors:
 - Dependabot
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.391.0
+        version: 0.392.0
 - !ruby/object:Gem::Dependency
   name: debug
   requirement: !ruby/object:Gem::Requirement
@@ -388,7 +388,7 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/dependabot/dependabot-core/issues
-  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.391.0
+  changelog_uri: https://github.com/dependabot/dependabot-core/releases/tag/v0.392.0
 rdoc_options: []
 require_paths:
 - lib