Post

Reminder that Yarn lets you filter out fresh packages with `npmMinimalAgeGate` and it's a good idea to use it on your work repos!

Yarn

@yarnpkg.dev

12 May

Unfortunately it can't help people that happen to create new projects right when the vulnerability is up, since they rarely configure that in their home folder. And making it a default could impair security fixes (for instance the Next.js/React CVEs).

Yarn

@yarnpkg.dev

The right fixes would likely be for the npm registry to *finally* add support for 2FA publishing in a way compatible with both automations and monorepos. They announced some interest couple of months ago, but it hasn't transformed so far.

12/5/26, 7:15 am0 reposts1 like

No replies yet.