Skip to main content

Dependency quarantine

Understand why pnpm blocks a new version and choose the safe response.

The 24-hour quarantine measures time from each dependency version's publication on the registry. Different repositories can become unblocked at different times because their blocked versions were published at different times.

The standard is one duration, not one fleet-wide clock.

Confirm the blocked package

Read the install error and check the exact version's npm publication time. Do not assume the top-level package caused the block. A new transitive dependency can be the cause.

Choose a response

  1. Use an older safe version when it meets the requirement.
  2. Wait until the exact version is 24 hours old.
  3. For an urgent security or production fix, review the exact version and add one temporary exception.

Record the reason and removal time for an exception. Never use a range or a large standing ignore list.

Hotfixes remain possible

A fix to Lupinum-owned code can be certified and released immediately. The quarantine delays only newly published dependencies that enter an install. It does not impose a delay after every Lupinum release.