DepsGuard looks for npm, pnpm, yarn, bun, uv, pip, poetry, and aube on your machine, reads their config files, compares them to recommended supply-chain settings, and can apply fixes interactively. It also scans for Renovate and Dependabot configs in your repos. It never runs package installs; it only edits config files you approve, and it writes backups before any change.
If your organization ships DepsGuard via Homebrew, Scoop, or WinGet, use their instructions. Setting up or automating those channels (Homebrew core PRs, buckets, WinGet PRs, CI secrets) is maintainer documentation; see AGENTS.md under Release & distribution.
Rundepsguard to launch the interactive TUI. It scans your system and shows a table of findings. Press any key to continue to the fix selector. Repo-level config discovery starts from the current directory and searches downward. Use depsguard scan for a read-only report, or depsguard --no-search to skip the recursive file search and only check user-level configs.
Note: some settings require a minimum version. If your version is too old you'll see:
ℹ min-release-age – requires npm ≥ 11.10 (have 10.2.0).
Upgrade with npm install -g npm@latest and re-run.
Navigate & select – use ↑↓ to move through the list (^u^d to page). Press Space to toggle a fix on or off. Use quick-filter keys to bulk-select by file: a all, n .npmrc, u uv.toml, etc. – press once to select, again to deselect, a third time to clear the filter. Press f to show only currently selected fixes.
Preview – press d to see a diff of what will change before you commit to anything.
Apply – press Enter to apply the selected fixes. A timestamped backup is created before any file is written.
Rescan – DepsGuard automatically reruns the scan after applying, so you can verify everything is green.
Restore – run depsguard restore at any time to roll back from the backup list. Press q or Esc to quit.
What gets checked
Manager
Config
Setting
Target
Why
npm
~/.npmrc
min-release-age
7 (days)
Delay brand-new releases (requires npm >= 11.10)
npm/pnpm
~/.npmrc
ignore-scripts
true
Reduce install-script risk (npm honors this in .npmrc; pnpm >= 11 reads it from pnpm-workspace.yaml / global config.yaml, not .npmrc)
pnpm
~/.npmrc
minimum-release-age
10080 (minutes)
Delay new versions by 7 days (pnpm 10.16–10.x only; pnpm >= 11 ignores .npmrc; use pnpm-workspace.yaml)
pnpm
global rc (pnpm <= 10)
minimum-release-age
10080 (minutes)
Delay new versions by 7 days (requires pnpm >= 10.16)
Fail on unreviewed build scripts (requires pnpm >= 10.3)
pnpm
global rc (pnpm <= 10)
ignore-scripts
true
Block malicious install scripts
pnpm
global config.yaml (pnpm >= 11)
minimumReleaseAge
10080 (minutes)
Delay new versions by 7 days
Config file locations
Manager
Linux
macOS
Windows
npm/pnpm/aube
~/.npmrc
~/.npmrc
%USERPROFILE%\.npmrc
pnpm global (pnpm <= 10)
$XDG_CONFIG_HOME/pnpm/rc or ~/.config/pnpm/rc
$XDG_CONFIG_HOME/pnpm/rc or ~/Library/Preferences/pnpm/rc
%LOCALAPPDATA%\pnpm\config\rc
pnpm global (pnpm >= 11)
$XDG_CONFIG_HOME/pnpm/config.yaml or ~/.config/pnpm/config.yaml
$XDG_CONFIG_HOME/pnpm/config.yaml or ~/Library/Preferences/pnpm/config.yaml
%LOCALAPPDATA%\pnpm\config\config.yaml
yarn
~/.yarnrc.yml
~/.yarnrc.yml
%USERPROFILE%\.yarnrc.yml
pnpm
pnpm-workspace.yaml
pnpm-workspace.yaml
pnpm-workspace.yaml
bun
$XDG_CONFIG_HOME/.bunfig.toml or ~/.bunfig.toml
$XDG_CONFIG_HOME/.bunfig.toml or ~/.bunfig.toml
%USERPROFILE%\.bunfig.toml
uv
$XDG_CONFIG_HOME/uv/uv.toml or ~/.config/uv/uv.toml
$XDG_CONFIG_HOME/uv/uv.toml or ~/.config/uv/uv.toml
%APPDATA%\uv\uv.toml
pip
$XDG_CONFIG_HOME/pip/pip.conf or ~/.config/pip/pip.conf
~/Library/Application Support/pip/pip.conf or ~/.config/pip/pip.conf (or $XDG_CONFIG_HOME/pip/pip.conf when set)
%APPDATA%\pip\pip.ini
poetry
$XDG_CONFIG_HOME/pypoetry/config.toml or ~/.config/pypoetry/config.toml
User-level config files are read from their standard locations (including XDG-based paths where the tool supports them). Repo-level configs are discovered by searching downward from the current directory, skipping known large directories (node_modules, .git, target, Library, .cache, and others) so scans stay fast. Repo-level .npmrc, .yarnrc.yml, pnpm-workspace.yaml, Renovate configs, and Dependabot configs are all searched. pnpm settings can live in ~/.npmrc (pnpm <= 10 only; pnpm >= 11 reads only auth/registry settings from .npmrc), the pnpm global config file (rc on pnpm <= 10, config.yaml on pnpm >= 11), or pnpm-workspace.yaml; DepsGuard checks all three locations independently. For pip, uv, and poetry, DepsGuard resolves the single effective user-level config and reports just that file, rather than flagging shadowed files separately. pip and poetry merge their config files by precedence (the highest-precedence file that sets the cooldown wins, or the preferred location if none do); uv reads a single user file ($XDG_CONFIG_HOME/uv/uv.toml when XDG_CONFIG_HOME is set, otherwise ~/.config/uv/uv.toml) rather than merging both. For bun, if multiple user-level config files exist (for example both an XDG path and a home-directory path), DepsGuard scans each existing file separately. aube reads the same ~/.npmrc as npm/pnpm (minimumReleaseAge, in minutes) and is also checked on discovered repo-level .npmrc files; pip and poetry are scanned at their user-level config (pip.conf / pypoetry/config.toml).
Urgent security fix
If the patched version is newer than your cooldown window, add a narrow exception, install the fix, and then remove the exception.
Prefer a package-specific exception over lowering the global cooldown. That keeps the delay in place for every other dependency.
Manager
How to bypass the cooldown
npm
npm install <pkg>@<ver> --min-release-age=0
pnpm
Add an entry to minimumReleaseAgeExclude in pnpm-workspace.yaml, run pnpm add <pkg>@<ver>, then remove the entry. Excluding by package name works on pnpm 10.16+; pinning a specific version (<pkg>@<ver>) additionally requires pnpm 10.19+. pnpm has no documented CLI override for minimumReleaseAge.
yarn
Add <pkg> (or a glob) to npmPreapprovedPackages in .yarnrc.yml, or run YARN_NPM_MINIMAL_AGE_GATE=0s yarn up <pkg>@<ver> for one command. npmPreapprovedPackages exempts matches from all Yarn package gates, not only the age gate.
bun
Add <pkg> to install.minimumReleaseAgeExcludes in a repo-level bunfig.toml or user-level ~/.bunfig.toml, or run bun add <pkg>@<ver> --minimum-release-age 0.
aube
Add <pkg> to minimumReleaseAgeExclude in .npmrc, or set AUBE_MINIMUM_RELEASE_AGE=0 (or npm_config_minimum_release_age=0) for a single install.
uv
Add "<pkg>" = false to exclude-newer-package in uv.toml or pyproject.toml, run uv add <pkg>==<ver>, then remove the entry. exclude-newer-package is a separate per-package override of the global exclude-newer cutoff. uv's CLI accepts --exclude-newer-package PACKAGE=DATE but not PACKAGE=false.
pip
Run pip install <pkg>==<ver> --uploaded-prior-to=P0D for one install. P0D disables the cooldown only for that command; pip has no per-package exclusion in config.
poetry
Add <pkg> to solver.min-release-age-exclude (comma-separated) in poetry.toml/, run , then remove the entry. exempts every package from a named index instead.
Before you bypass the cooldown:
Check whether the CVE actually affects your usage.
Check whether a known-good older version is already available. A rollback may be safer.
Remove temporary exceptions after the upgrade.
Backups and restore
Before modifying a file, DepsGuard writes a backup to ~/.depsguard/backups/.
Run depsguard restore to list backups and restore one.
Dependency Cooldowns (cooldowns.dev): a reference guide and companion shell helper (cooldowns.sh) focused specifically on minimum-release-age cooldowns. Complements DepsGuard: it covers a broader set of ecosystems on the cooldown axis (pip, uv, npm, pnpm, Yarn, Bun, Deno, Cargo), while DepsGuard covers npm/pnpm/yarn/bun/aube/uv/pip/poetry plus Renovate/Dependabot and adds other hardening settings (ignore-scripts, block-exotic-subdeps, trust-policy, strict-dep-builds) with an interactive TUI, diff preview, and backup/restore.
$XDG_CONFIG_HOME/pypoetry/config.toml (when set) or ~/Library/Application Support/pypoetry/config.toml
%APPDATA%\pypoetry\config.toml
renovate
renovate.json, .renovaterc, .github/renovate.json, etc.
(same)
(same)
dependabot
.github/dependabot.yml
(same)
(same)
config.toml
poetry add <pkg>@<ver>
solver.min-release-age-exclude-source
Renovate
Security updates already bypass minimumReleaseAge. For a version update, add a packageRules entry with matchPackageNames: ["<pkg>"] and minimumReleaseAge: null.
Dependabot
Security updates already bypass cooldown. For a version update, add <pkg> to cooldown.exclude.
arnica/depsguard
