Configuring minimum release age across npm, pnpm, and yarn

npm, pnpm, and Yarn now support a minimum release age (also known as a cooldown) for package installations, helping reduce the risk of software supply-chain attacks. By delaying newly published package versions for at least 24 hours, developers can avoid installing malicious releases that are often detected and removed shortly after publication. The feature is available as min-release-age in npm, minimumReleaseAge in pnpm, and npmMinimalAgeGate in Yarn, although each package manager uses different configuration names and time units. Projects using Renovate or Dependabot should configure equivalent cooldown settings separately, as package managers only enforce the delay during installation.