Verifying locked config dependencies against the registry enforces
minimumReleaseAge, but resolving them did not. A config dependency range
therefore resolved to a version that a later clean frozen install
rejected.
Keep the age gate on verification, since a config dependency's pnpmfile
runs on every install, and apply the same cutoff and
minimumReleaseAgeExclude when resolving config dependencies and their
optional subdependencies, in both the Rust and TypeScript CLIs. A
version+integrity pin resolves without the cutoff, as verification
already skips pins. Config
dependencies are resolved before any updateConfig hook runs, so only an
exclude in pnpm-workspace.yaml can cover one.
Closespnpm/pnpm#16660
---------
Signed-off-by: C. Spencer Beggs <spencer@beggs.codes>
Co-authored-by: Zoltan Kochan <z@kochan.io>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
