Skip to content

Following the README for type safety prevents/breaks npm's min-release-age option #728

Description

@dslatkin

Describe the bug

The docs describe in the README that to get type support through JSDoc, you can install a dev dep.

If you turn on npm 11.10's new min-release-age option (used to help against supply chain attacks), you then will not be able to npm install your dependencies, even after a successful npm update.

If you uninstall or don't have the dev dep mentioned in the README, then trying to install it gives that error anyways.

The error looks like:

npm error code 1
npm error git dep preparation failed
npm error command /usr/local/bin/node /usr/local/share/npm-global/lib/node_modules/npm/bin/npm-cli.js install --force --cache=/home/node/.npm --prefer-offline=false --prefer-online=false --offline=false --before=2026-08-16T23:36:27.301Z --no-progress --no-save --no-audit --include=dev --include=peer --include=optional --no-package-lock-only --no-dry-run
npm error Exit prior to config file resolving
npm error cause
npm error --min-release-age cannot be provided when using --before

To Reproduce
Steps to reproduce the behavior:

  1. Add min-release-age=1 to .npmrc
  2. `npm i -D @actions/github-script@github:actions/github-script
  3. npm clean-install
  4. See error above

Expected behavior
I would expect to be able to use npm's min-release-age option when only using types from this package.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions