Package manager knowledge base

The facts depcurfew relies on, each linked to the official documentation or changelog it was verified against.

Legend: ↗ source · ❓ uncertain (official sources are incomplete) · ⚠️ disputed (official sources disagree; every variant is shown) · 1.2.3+ means "from version 1.2.3".

12 tools · 601 facts · 97 uncertain · 15 disputed · verified 2026-10-28 to 2026-10-31.

Release-age cooldown

How each tool delays freshly published versions.

Install scripts

Whether dependency lifecycle scripts run, and how to allow specific packages.

Project files

How depcurfew recognizes each package manager in a repository.

Dependency sources

Settings that allow or forbid dependencies from git, remote tarballs and local paths.

Additional facts

Further facts used by generators and doctor.

npm

• childEnvironment (✅ verified): {"marker":"npm_execpath","prefix":"npm_config_"} ↗
• denyList (✅ verified): {"file":"package.json","setting":"allowScripts","value":false,"since":"11.16.0"} ↗
• trustedPublishing (✅ verified): {"minimumNpm":"11.5.1","minimumNode":"22.14.0","githubPermission":"id-token: write","automaticProvenance":true,"firstPublishWithinDays":2} ↗
• stagedPublishing (✅ verified): {"minimumNpm":"11.15.0","minimumNode":"22.14.0","stage":"npm stage publish","approve":"npm stage approve","reject":"npm stage reject","newPackagePlaceholder":"0.0.0-stage"} ↗
• trustCommand (✅ verified): {"command":"npm trust github","minimumNpm":"11.15.0","packageMustExist":true,"permissions":["--allow-publish","--allow-stage-publish"]} ↗
• lockfileFormat (✅ verified): {"installScripts":"hasInstallScript","gitPrefixes":["git+","git:"],"filePrefix":"file:","linkFlag":"link","registryTarball":"^https?://[^/]+/.+/-/[^/]+-\\d","specWithoutResolved":"version","dependencyFields":["dependencies","optionalDependencies","peerDependencies","devDependencies"]} ↗
• overrides (✅ verified): {"field":"overrides","selfKey":"."} ↗
• npmrcScope (✅ verified): {"read":"project root","workspacePackages":"ignored","globalMode":"ignored"} ↗
• npmrcFormat (✅ verified): {"commentLines":["#",";"],"inlineComments":["#",";"],"escape":"\\","sectionHeader":"^\\[([^\\]]*)\\]\\s*$","keyWithoutValue":"true","settingsFrom":"top level"} ↗
• npmrcListSyntax (✅ verified): [] ↗
• allowAllScripts (✅ verified): {"setting":"dangerously-allow-all-scripts","since":"11.16.0","value":true} ↗
• excludeWildcards (✅ verified): {"since":"11.17.0","trailingOnly":false} ↗
• latestVersion (✅ verified): 12.2.1 ↗
• beforeInteraction (✅ verified): {"setting":"before","exclusive":{"since":"11.10.0","until":"11.15.0"},"beforeWinsSince":"11.15.0"} ↗
• strictAllowScripts (✅ verified): {"setting":"strict-allow-scripts","value":true,"since":"11.16.0"} ↗
• unknownNpmrcKeys (✅ verified): unknown keys in .npmrc files only warn unless strict-npmrc is set; unknown command-line flags throw since npm 12 ↗
• commandLine (✅ verified): {"add":[["npm","install"],["npm","add"],["npm","i"],["npm","in"],["npm","ins"],["npm","inst"],["npm","insta"],["npm","instal"],["npm","isnt"],["npm","isnta"],["npm","isntal"],["npm","isntall"],["npm","install-test"],["npm","it"]],"run":[{"command":["npx"],"packageOptions":["--package","-p"],"lineOptions":["--call","-c"]},{"command":["npm","exec"],"packageOptions":["--package"],"lineOptions":["--call","-c"]},{"command":["npm","x"],"packageOptions":["--package"],"lineOptions":["--call","-c"]}],"create":[{"command":["npm","init"],"packageOptions":[]},{"command":["npm","create"],"packageOptions":[]},{"command":["npm","innit"],"packageOptions":[]}],"createNames":"prefix","valueOptions":[]} ↗
• valueOptions (✅ verified): --access, --allow-directory, --allow-file, --allow-git, --allow-remote, --allow-scripts, --also, --audit-level, --auth-type, --before, --ca, --cache, --cache-max, --cache-min, --cafile, --call, --cert, --cidr, --cpu, --depth, --diff, --diff-dst-prefix, --diff-src-prefix, --diff-unified, --edit-dir, --editor, --expect-result-count, --expires, --extension-file, --fetch-retries, --fetch-retry-factor, --fetch-retry-maxtimeout, --fetch-retry-mintimeout, --fetch-timeout, --git, --global-ignore-file, --globalconfig, --heading, --https-proxy, --include, --init-author-email, --init-author-name, --init-author-url, --init-license, --init-module, --init-type, --init-version, --install-strategy, --key, --libc, --local-address, --location, --lockfile-version, --loglevel, --logs-dir, --logs-max, --maxsockets, --message, --min-release-age, --min-release-age-exclude, --name, --node-gyp, --node-options, --noproxy, --omit, --only, --orgs, --orgs-permission, --os, --otp, --pack-destination, --package, --packages, --packages-and-scopes-permission, --password, --patches-dir, --prefix, --preid, --provenance-file, --proxy, --registry, --replace-registry-host, --save-prefix, --sbom-format, --sbom-type, --scope, --scopes, --script-shell, --searchexclude, --searchlimit, --searchopts, --searchstaleness, --shell, --tag, --tag-version-prefix, --to, --token-description, --umask, --user-agent, --userconfig, --viewer, --which, --workspace, -C, -L, -c, -m, -w ↗
• flagOptions (✅ verified): --all, --allow-same-version, --allow-scripts-pending, --allow-scripts-pin, --allow-unused-patches, --audit, --bin-links, --browser, --bypass-2fa, --color, --commit-hooks, --dangerously-allow-all-scripts, --description, --dev, --diff-ignore-all-space, --diff-name-only, --diff-no-prefix, --diff-text, --dry-run, --engine-strict, --expect-results, --force, --foreground-scripts, --format-package-lock, --fund, --git-tag-version, --global, --global-style, --if-present, --ignore-existing, --ignore-extension, --ignore-patch-failures, --ignore-scripts, --include-attestations, --include-staged, --include-workspace-root, --init-private, --install-links, --json, --keep-edit-dir, --legacy-bundling, --legacy-peer-deps, --link, --long, --offline, --omit-lockfile-registry-resolved, --optional, --package-lock, --package-lock-only, --packages-all, --parseable, --prefer-dedupe, --prefer-offline, --prefer-online, --production, --progress, --provenance, --read-only, --rebuild-bundle, --save, --save-bundle, --save-dev, --save-exact, --save-optional, --save-peer, --save-prod, --shrinkwrap, --sign-git-commit, --sign-git-tag, --strict-allow-scripts, --strict-npmrc, --strict-peer-deps, --strict-ssl, --timing, --unicode, --update-notifier, --usage, --version, --versions, --workspaces, --workspaces-update, --yes ↗
• parsing (✅ verified): {"abbreviations":true,"anyDashes":true,"negation":"--no-","shorthands":{"enjoy-by":["--before"],"d":["--loglevel","info"],"dd":["--loglevel","verbose"],"ddd":["--loglevel","silly"],"quiet":["--loglevel","warn"],"q":["--loglevel","warn"],"s":["--loglevel","silent"],"silent":["--loglevel","silent"],"verbose":["--loglevel","verbose"],"desc":["--description"],"help":["--usage"],"local":["--no-global"],"n":["--no-yes"],"no":["--no-yes"],"porcelain":["--parseable"],"readonly":["--read-only"],"reg":["--registry"],"iwr":["--include-workspace-root"],"ws":["--workspaces"],"a":["--all"],"c":["--call"],"f":["--force"],"g":["--global"],"L":["--location"],"l":["--long"],"m":["--message"],"p":["--parseable"],"C":["--prefix"],"S":["--save"],"B":["--save-bundle"],"D":["--save-dev"],"E":["--save-exact"],"O":["--save-optional"],"P":["--save-prod"],"?":["--usage"],"H":["--usage"],"h":["--usage"],"v":["--version"],"w":["--workspace"],"y":["--yes"]}} ↗
• versionSelection (✅ verified): {"tagOption":"--tag","tagVariable":"npm_config_tag","tagKey":"tag","bareRange":"*"} ↗
• packageSpecs (✅ verified): {"git":["git://","git+ssh://","git+http://","git+https://","git+file://","github:","gist:","bitbucket:","gitlab:"],"local":["file:"],"workspace":[],"alias":"npm:","remoteTarball":["http://","https://"],"tarballExtensions":[".tar",".tar.gz",".tgz"],"shorthand":"github:"} ↗
• registryConfig (✅ verified): {"file":".npmrc","userFile":"~/.npmrc","key":"registry","scopeKeySuffix":":registry"} ↗
• registryOverrides (✅ verified): {"registryOptions":["--registry","--@<scope>:registry"],"registryVariables":["npm_config_registry"],"configOptions":["--userconfig","--globalconfig"],"configVariables":["npm_config_userconfig","npm_config_globalconfig"]} ↗
• lockfileInstalls (❓ uncertain): npm ci installs versions pinned in package-lock.json without applying min-release-age ❓ ↗

pnpm

• denyList (✅ verified): {"file":"pnpm-workspace.yaml","setting":"allowBuilds","value":false,"since":"10.26.0"} ↗
• commandLine (✅ verified): {"add":[["pnpm","add"]],"run":[{"command":["pnx"],"packageOptions":["--package"],"shellOptions":["--shell-mode","-c"]},{"command":["pnpx"],"packageOptions":["--package"],"shellOptions":["--shell-mode","-c"]},{"command":["pnpm","dlx"],"packageOptions":["--package"],"shellOptions":["--shell-mode","-c"]}],"create":[{"command":["pnpm","create"],"packageOptions":[]}],"createNames":"prefix-unless-prefixed","valueOptions":["--save-prefix","--save-catalog-name","--lockfile-dir","--filter","-F","--registry","--allow-build","--cpu","--os","--libc","-C","--dir","--workspace-packages","--env-file","--reporter","--loglevel"]} ↗
• packageSpecs (✅ verified): {"git":["github:","bitbucket:","gitlab:","gist:","git+ssh://"],"local":["link:","file:"],"workspace":["workspace:"],"remoteTarball":["http://","https://"],"tarballExtensions":[".tar",".tar.gz",".tgz"],"shorthand":"github:"} ↗
• registryOverrides (✅ verified): {"registryOptions":["--registry","--@<scope>:registry"],"registryVariables":["pnpm_config_registry"],"configOptions":["--userconfig","--npmrc-auth-file"],"configVariables":["pnpm_config_npmrc_auth_file","pnpm_config_userconfig"]} ↗
• parsing (✅ verified): {"abbreviations":true,"anyDashes":true,"negation":"--no-","settingPrefix":"--config.","shorthands":{"s":["--reporter=silent"],"d":["--loglevel=info"],"dd":["--loglevel=verbose"],"ddd":["--loglevel=silly"],"L":["--latest"],"r":["--recursive"],"silent":["--reporter=silent"],"verbose":["--loglevel=verbose"],"quiet":["--loglevel=warn"],"q":["--loglevel=warn"],"h":["--help"],"H":["--help"],"?":["--help"],"usage":["--help"],"v":["--version"],"f":["--force"],"local":["--no-global"],"l":["--long"],"p":["--parseable"],"porcelain":["--parseable"],"prod":["--production"],"development":["--dev"],"g":["--global"],"S":["--save"],"D":["--save-dev"],"P":["--save-prod"],"E":["--save-exact"],"O":["--save-optional"],"C":["--dir"],"w":["--workspace-root"],"i":["--interactive"],"F":["--filter"],"y":["--yes"]}} ↗
• minimumReleaseAgeStrict (✅ verified): {"setting":"minimumReleaseAgeStrict","value":true,"since":"11.0.0"} ↗
• cooldownExactVersions (✅ verified): 10.17.0 ↗
• lockfileDocuments (✅ verified): {"bootMarker":"---","graph":"last"} ↗
• lockfileFormat (✅ verified): {"installScripts":null,"gitKeyPrefix":"git+","gitHostedFlag":"gitHosted","gitHostedTarballHosts":["codeload.github.com","bitbucket.org","gitlab.com"],"gitType":"git","directoryType":"directory"} ↗
• npmrcPrecedence (✅ verified): {"winner":"pnpm-workspace.yaml","over":[".npmrc","npm_config_*"]} ↗
• npmrcCooldownKey (✅ verified): {"key":"minimum-release-age","until":"11.0.0"} ↗
• sharedWorkspaceLockfile (✅ verified): {"setting":"sharedWorkspaceLockfile","npmrcKey":"shared-workspace-lockfile","default":true} ↗
• perProjectNpmrc (❓ uncertain): {"sharedWorkspaceLockfile":false,"until":"11.0.0"} ❓ ↗
• ignoredSince (✅ verified): {"since":"11.0.0","npmrc":"auth and registry settings","packageJsonField":"pnpm"} ↗
• lockfileRecheck (❓ uncertain): 10.16.0+: false
  11.1.3+: true ❓ ↗
• allowAllBuilds (✅ verified): {"setting":"dangerouslyAllowAllBuilds","since":"10.9.0","value":true,"off":[false,0,null,""]} ↗
• excludeWildcards (✅ verified): {"since":"10.17.0","trailingOnly":false} ↗
• onlyBuiltDependencies (✅ verified): {"since":"6.32.1","workspaceFileSince":"10.5.0","removedIn":"11.0.0"} ↗
• ignoredBuiltDependencies (✅ verified): {"since":"10.1.0","workspaceFileSince":"10.5.0"} ↗
• npmrcBuildSettings (✅ verified): {"allowAll":{"key":"dangerously-allow-all-builds","off":["false","null","undefined"],"since":"10.9.0"},"until":"11.0.0","projectKeys":[{"since":"10.13.0","value":["dangerouslyAllowAllBuilds","onlyBuiltDependencies","onlyBuiltDependenciesFile","neverBuiltDependencies"]},{"since":"10.26.0","value":["dangerouslyAllowAllBuilds","onlyBuiltDependencies","onlyBuiltDependenciesFile","neverBuiltDependencies","allowBuilds"]}]} ↗
• yamlMergeKeys (✅ verified): true ↗
• latestVersion (✅ verified): 12.16.1 ↗
• npmrcIgnored (✅ verified): pnpm 11+ reads only auth and registry settings from .npmrc, ignores the package.json "pnpm" field and no longer reads npm_config_* variables ↗
• buildPermissions (✅ verified): {"setting":"permissions","capability":"build","since":"12.11.0","allow":true,"deny":false} ↗
• legacyAllowList (✅ verified): 10.0.0+: onlyBuiltDependencies (package.json pnpm field; pnpm-workspace.yaml since 10.5.0)
  10.26.0+: allowBuilds; onlyBuiltDependencies and ignoredBuiltDependencies deprecated
  11.0.0+: allowBuilds only; onlyBuiltDependencies, neverBuiltDependencies and ignoredBuiltDependencies removed ↗
• strictDepBuilds (✅ verified): 10.3.0+: false
  11.0.0+: true ↗
• strictMode (✅ verified): 11.0.0+: minimumReleaseAgeStrict defaults to false
  11.0.4+: strict whenever minimumReleaseAge is set explicitly
  12.0.0+: explicit values treated as non-strict (regression)
  12.3.0+: strict whenever minimumReleaseAge is set explicitly ↗
• ignoreMissingTime (✅ verified): minimumReleaseAgeIgnoreMissingTime defaults to true: packages whose registry metadata has no publish time skip the age check ↗
• lockfileVerification (❓ uncertain): 10.16.0+: frozen-lockfile installs do not re-check versions already in the lockfile
  11.1.3+: lockfile entries are re-checked; trustLockfile: true (11.3.0) turns this off ❓ ↗
• unknownWorkspaceKeys (✅ verified): pnpm 11 and earlier silently ignore misspelled pnpm-workspace.yaml settings; pnpm 12 warns ↗

Yarn (Berry)

• yamlMergeKeys (✅ verified): false ↗
• classicUserFile (✅ verified): {"until":"2.0.0","file":".yarnrc"} ↗
• denyList (✅ verified): {"file":"package.json","setting":"dependenciesMeta.<package>.built","value":false,"since":"2.0.0"} ↗
• commandLine (✅ verified): {"add":[["yarn","add"]],"run":[{"command":["yarn","dlx"],"packageOptions":["-p","--package"]}],"create":[{"command":["yarn","create"],"packageOptions":["-p","--package"]}],"createNames":"prefix-unless-prefixed","workspaceCommands":[{"command":["yarn","workspace"],"operands":1}],"valueOptions":["--mode"]} ↗
• packageSpecs (✅ verified): {"git":[],"local":["link:","portal:","file:"],"workspace":["workspace:"]} ↗
• registryOverrides (✅ verified): {"registryOptions":[],"registryVariables":["YARN_NPM_REGISTRY_SERVER"],"configOptions":[],"configVariables":["YARN_RC_FILENAME"]} ↗
• lockfileFormat (✅ verified): {"installScripts":null,"registry":"npm:","workspace":"workspace:","patch":"patch:","file":"file:","directory":["portal:","link:"],"gitCommit":"#commit=","tarball":"\\.(?:tar\\.gz|tgz)$"} ↗
• durationStrings (✅ verified): {"since":"4.11.0","syntax":"compact","before":"no effect"} ↗
• scriptsSwitch (✅ verified): {"setting":"enableScripts","allow":true,"deny":false} ↗
• excludeWildcards (✅ verified): {"since":"4.10.0","trailingOnly":false} ↗
• berryLockfileMarker (❓ uncertain): __metadata ❓ ↗
• classicLockfileHeader (✅ verified): # yarn lockfile v1 ↗
• latestVersion (✅ verified): 4.18.1 ↗
• bypassFlag (✅ verified): --no-time-gate on yarn add and yarn up (4.15.0+) ↗
• perScopeGate (✅ verified): {"scopes":"npmScopes","setting":"npmMinimalAgeGate","since":"4.17.0","unset":"1d"} ↗
• upgradeMigration (✅ verified): When the lockfile predates the new defaults and the key is unset, yarn install writes enableScripts: true, approvedGitRepositories: ["**"] and npmMinimalAgeGate: 0 into .yarnrc.yml ↗
• missingPublishTime (✅ verified): Versions without a publish time are quarantined while the gate is on ↗
• unknownSettings (❓ uncertain): Unknown keys in the project .yarnrc.yml throw (unless enableStrictSettings is false), so settings newer than the pinned Yarn break installs ❓ ↗

Bun

• commandLine (✅ verified): {"add":[["bun","add"]],"run":[{"command":["bunx"],"packageOptions":["-p","--package"]},{"command":["bun","x"],"packageOptions":["-p","--package"]}],"create":[{"command":["bun","create"],"packageOptions":[]}],"createNames":"prefix","valueOptions":["--omit","--filter","--ca","--cafile","--registry","--network-concurrency","--backend","--concurrent-scripts","--cache-dir","--config","--cwd","--env-file","--minimum-release-age"]} ↗
• packageSpecs (✅ verified): {"git":["github:","git+ssh://","git+https://"],"local":[],"workspace":[],"scp":true} ↗
• registryOverrides (✅ verified): {"registryOptions":["--registry"],"registryVariables":["BUN_CONFIG_REGISTRY"],"configOptions":["--config","-c"],"configVariables":[]} ↗
• lockfileFormat (✅ verified): {"installScripts":"hasInstallScript","installScriptsSince":"1.4.4","git":["git+","github:"],"directory":["file:","link:"],"workspace":"workspace:","tarball":"\\.(?:tar\\.gz|tgz)$"} ↗
• durationStrings (✅ verified): {"since":"1.4.4","syntax":"compact-or-words"} ↗
• excludeWildcards (✅ verified): {"since":null,"trailingOnly":false} ↗
• latestVersion (✅ verified): 1.4.4 ↗
• trustedDependenciesReplacesDefaults (✅ verified): Adding trustedDependencies replaces the built-in trusted list, so default-trusted packages that are not listed stop running scripts ↗
• lockedVersionsNotRechecked (✅ verified): minimumReleaseAge only affects new resolutions; versions already in bun.lock are kept ↗
• bunxCooldown (✅ verified): bunx applies --minimum-release-age only since 1.4.4 ↗

Deno

• denyList (✅ verified): {"file":"deno.json","setting":"allowScripts.deny","value":"npm:<package>","since":"2.6.0"} ↗
• commandLine (✅ verified): {"add":[["deno","add"],["deno","install"]],"run":[{"command":["deno","x"],"packageOptions":["--package","-p"],"binaryPath":true},{"command":["dx"],"packageOptions":["--package","-p"],"binaryPath":true},{"command":["denox"],"packageOptions":["--package","-p"],"binaryPath":true},{"command":["dnx"],"packageOptions":["--package","-p"],"binaryPath":true}],"create":[],"createNames":"prefix","fileOptions":["--entrypoint","-e"],"valueOptions":["--name","-n","--root","--os","--arch","-L","--log-level"],"commandOptions":[{"command":["deno","x"],"valueOptions":["--package","-p","--config","-c","--import-map","--cert","--min-dep-age","--location","--seed","--preload","--require","--conditions","--inspect-publish-uid"]},{"command":["dx"],"valueOptions":["--package","-p","--config","-c","--import-map","--cert","--min-dep-age","--location","--seed","--preload","--require","--conditions","--inspect-publish-uid"]},{"command":["denox"],"valueOptions":["--package","-p","--config","-c","--import-map","--cert","--min-dep-age","--location","--seed","--preload","--require","--conditions","--inspect-publish-uid"]},{"command":["dnx"],"valueOptions":["--package","-p","--config","-c","--import-map","--cert","--min-dep-age","--location","--seed","--preload","--require","--conditions","--inspect-publish-uid"]}]} ↗
• lockfileFormat (✅ verified): {"installScripts":"scripts","installScriptsSinceLockfile":"5","sources":null} ↗
• durationStrings (✅ verified): {"since":null,"syntax":"iso8601"} ↗
• ageObjectKey (✅ verified): age ↗
• excludeWildcards (✅ verified): {"since":"2.9.2","trailingOnly":true} ↗
• npmSpecifierPrefix (✅ verified): npm: ↗
• allowAllScripts (✅ verified): {"setting":"allowScripts","since":"2.6.0","value":true} ↗
• latestVersion (✅ verified): 2.9.8 ↗
• npmrcFormat (⚠️ disputed): ⚠️ whole days only, e.g. min-release-age=3 ↗ / a duration with a unit, e.g. min-release-age=72h ↗
• fileLinkSkipped (⚠️ disputed): ⚠️ file: and link: dependencies in the project package.json are silently skipped ↗ / file: and link: specifiers in registry metadata of npm packages are skipped ↗
• denoXCooldown (✅ verified): deno x honors minimumDependencyAge only since 2.9.4 ↗
• dxRunsScripts (✅ verified): dx defaults to --allow-all and runs lifecycle scripts once the download prompt is accepted ↗

uv

• pylockCreatedBy (✅ verified): uv ↗
• configTables (✅ verified): {"pyproject.toml":"tool.uv","uv.toml":""} ↗
• pyprojectTable (✅ verified): tool.uv ↗
• configPrecedence (✅ verified): uv.toml wins over [tool.uv] in the same directory; only the nearest directory with either is read, and in a workspace only the root ↗
• configFileOrder (✅ verified): uv.toml, pyproject.toml ↗
• workspaceRootOnly (✅ verified): true ↗
• buildSwitch (✅ verified): {"setting":"no-build","value":true,"since":"0.2.12","covers":["registry","git","remoteTarball","file","directory"]} ↗
• durationStrings (✅ verified): {"since":"0.9.17","syntax":"words-or-iso8601"} ↗
• durationUnits (✅ verified): hours, days, weeks ↗
• excludeWildcards (✅ verified): {"since":null,"trailingOnly":false} ↗
• excludeValue (✅ verified): false ↗
• missingUploadTime (✅ verified): A file from an index that gives no upload time is treated as unavailable while a delay is set ↗
• registryOnly (✅ verified): The delay applies only to packages read from a registry, not to git, URL or path dependencies ↗
• requiredVersion (✅ verified): {"table":"tool.uv","key":"required-version","since":"0.5.14"} ↗
• lockfileFormat (❓ uncertain): {"sources":{"registry":"registry","git":"git","remoteTarball":"url","file":"path","directory":"directory","editable":"editable","virtual":"virtual"},"sdist":"sdist","wheels":"wheels","packages":"package"} ❓ ↗
• ignoredByToolCommands (✅ verified): uv tool install, uv tool run and uvx ignore pyproject.toml and uv.toml in the project and read only user and system configuration ↗
• lockedSettings (✅ verified): {"settings":["exclude-newer","exclude-newer-package"],"lock":"uv lock","failing":["uv sync --locked","uv lock --check"]} ↗
• commandLine (✅ verified): {"add":[["uv","add"],["uv","pip","install"],["uv","tool","install"]],"run":[{"command":["uvx"],"packageOptions":["--from"],"extraPackageOptions":["-w","--with","--with-editable"]},{"command":["uv","tool","run"],"packageOptions":["--from"],"extraPackageOptions":["-w","--with","--with-editable"]},{"command":["uv","run"],"packageOptions":[],"extraPackageOptions":["-w","--with","--with-editable"],"packageArgument":false,"scriptUrls":true}],"create":[],"valueOptions":["--cache-dir","--config-file","--color","--allow-insecure-host","--trusted-host","--directory","--project","--python-preference","--python-fetch","--preview-features","--preview-feature","--index","--default-index","-i","--index-url","--extra-index-url","-f","--find-links","-P","--upgrade-package","--upgrade-group","--reinstall-package","--index-strategy","--keyring-provider","--resolution","--prerelease","--prerelease-package","--fork-strategy","-C","--config-setting","--config-settings","--config-settings-package","--no-build-isolation-package","--exclude-newer","--exclude-newer-package","--link-mode","--no-sources-package","--refresh-package","--no-build-package","--no-binary-package","-c","--constraints","--constraint","--overrides","--override","--excludes","--exclude","-b","--build-constraints","--build-constraint","-r","--requirements","--requirement","--group","--extra","--no-editable-package","-p","--python","-t","--target","--prefix","--python-version","--python-platform","--output-format","--torch-backend","--optional","--bounds","--rev","--tag","--branch","--package","--script","--no-install-package","--only-install-package","-w","--with","--with-editable","--with-requirements","--no-extra","--no-group","--only-group","--env-file","--max-recursion-depth","--from","--with-executables-from"],"parsing":{"groupedShortOptions":true},"addPackageOptions":["-w","--with","--with-editable","--with-executables-from"],"editableOptions":["--with-editable"],"commaSeparatedOptions":["-w","--with","--with-editable","--with-executables-from"],"interpreterNames":["python","pythonw","cpython","pypy","graalpy","pyodide"],"commandOptions":[{"command":["uv","pip","install"],"valueOptions":["-e","--editable","--no-binary","--only-binary"],"editableOptions":["-e","--editable"]},{"command":["uv","add"],"valueOptions":["-m","--marker"]}]} ↗
• registryOverrides (✅ verified): {"registryOptions":["--index","--default-index","-i","--index-url","--extra-index-url","-f","--find-links"],"registryVariables":["UV_INDEX","UV_DEFAULT_INDEX","UV_INDEX_URL","UV_EXTRA_INDEX_URL","UV_FIND_LINKS"],"configOptions":["--config-file"],"configVariables":["UV_CONFIG_FILE"]} ↗
• selection (✅ verified): {"prereleases":{"onFlags":["--pre"],"modeOptions":["--prerelease"],"packageModeOptions":["--prerelease-package"],"onModes":["allow"],"offModes":["disallow"],"modeVariables":["UV_PRERELEASE"]},"buildFromSource":{"onFlags":["--no-binary"],"offFlags":["--binary"],"onPackages":["--no-binary-package"],"flagVariables":["UV_NO_BINARY"],"onPackageVariables":["UV_NO_BINARY_PACKAGE"]},"commands":[{"command":["uv","pip","install"],"buildFromSource":{"onLists":["--no-binary"],"offLists":["--only-binary"]}}]} ↗
• latestVersion (✅ verified): 0.13.6 ↗
• pipTable (✅ verified): {"table":"pip","keys":{"exclude-newer":"exclude-newer","exclude-newer-package":"exclude-newer-package","no-binary-package":"no-binary"}} ↗

pip

• configSections (✅ verified): {"global":"global","commandsOverride":true} ↗
• pylockCreatedBy (✅ verified): pip ↗
• requirementsOptions (✅ verified): -i, --index-url, --pypi-url, --extra-index-url, --no-index, -c, --constraint, -r, --requirement, -e, --editable, -f, --find-links, --no-binary, --only-binary, --prefer-binary, --require-hashes, --no-require-hashes, --pre, --all-releases, --only-final, --trusted-host, --use-feature ↗
• requirementsParser (✅ verified): {"longOptions":["--index-url","--pypi-url","--extra-index-url","--no-index","--constraint","--requirement","--editable","--find-links","--no-binary","--only-binary","--prefer-binary","--require-hashes","--no-require-hashes","--pre","--all-releases","--only-final","--trusted-host","--use-feature","--hash","--config-settings"],"shortOptions":["-i","-c","-r","-e","-f","-C"],"abbreviations":true} ↗
• buildSwitch (❓ uncertain): {"setting":"--only-binary","value":":all:","since":"7.0.0","covers":["registry"]} ❓ ↗
• configFileNames (✅ verified): pip.conf, pip.ini ↗
• configFileVariable (✅ verified): PIP_CONFIG_FILE ↗
• environmentVariable (✅ verified): PIP_UPLOADED_PRIOR_TO ↗
• durationStrings (✅ verified): {"since":"26.1.0","syntax":"iso8601"} ↗
• missingUploadTime (✅ verified): Installation fails when an index gives no upload time while --uploaded-prior-to is set ↗
• lockfileFormat (✅ verified): {"packages":"packages","vcs":"vcs","directory":"directory","archive":"archive","sdist":"sdist","wheels":"wheels","index":"index","createdBy":"created-by","sources":{"git":"vcs","remoteTarball":"archive","directory":"directory"}} ↗
• requirementsForms (✅ verified): name==version with --hash options, name @ URL for an archive, a local archive or project path, and VCS URLs (name @ git+https://… or -e git+…) ↗
• requirementsFormat (✅ verified): {"vcs":{"git":["git+"],"other":["hg+","svn+","bzr+"]},"direct":" @ ","editable":["-e","--editable"],"egg":"#egg=","comment":"#","continuation":"\\"} ↗
• requirementsIncludes (✅ verified): {"requirements":["-r","--requirement"],"constraints":["-c","--constraint"]} ↗
• requirementsPaths (✅ verified): {"separators":["/","\\"],"currentDirectory":".","archiveExtensions":[".zip",".whl",".tar.bz2",".tbz",".tar.gz",".tgz",".tar",".tar.xz",".txz",".tlz",".tar.lz",".tar.lzma"],"urlSchemes":["http","https","ftp"],"fileScheme":"file:"} ↗
• lockfilePattern (✅ verified): ^pylock.([^.]+).toml$ ↗
• commandLine (✅ verified): {"add":[["pip","install"],["pip3","install"]],"run":[],"create":[],"valueOptions":["-r","--requirement","-c","--constraint","--build-constraint","--requirements-from-script","-e","--editable","--group","-t","--target","--platform","--python-version","--implementation","--abi","--root","--prefix","--src","--source","--source-dir","--source-directory","--upgrade-strategy","-C","--config-settings","--progress-bar","--root-user-action","--report","-i","--index-url","--pypi-url","--extra-index-url","-f","--find-links","--refresh-package","--uploaded-prior-to","--no-binary","--only-binary","--all-releases","--only-final","--python","--log","--log-file","--local-log","--keyring-provider","--proxy","--retries","--resume-retries","--timeout","--default-timeout","--exists-action","--trusted-host","--cert","--client-cert","--cache-dir","--use-feature","--use-deprecated"],"flagOptions":["--no-deps","--no-dependencies","--only-deps","--only-dependencies","--dry-run","--user","--no-user","-U","--upgrade","--force-reinstall","-I","--ignore-installed","--ignore-requires-python","--no-build-isolation","--use-pep517","--check-build-dependencies","--break-system-packages","--compile","--no-compile","--no-warn-script-location","--no-warn-conflicts","--require-hashes","--no-require-hashes","--no-clean","--no-index","--pre","--prefer-binary","-h","--help","--debug","--isolated","--require-virtualenv","--require-venv","-v","--verbose","-V","--version","-q","--quiet","--no-input","--no-proxy-env","--no-cache-dir","--disable-pip-version-check","--no-color","--no-python-version-warning"],"parsing":{"abbreviations":true,"groupedShortOptions":true},"editableOptions":["-e","--editable"]} ↗
• registryOverrides (✅ verified): {"registryOptions":["-i","--index-url","--pypi-url","--extra-index-url","-f","--find-links"],"registryVariables":["PIP_INDEX_URL","PIP_PYPI_URL","PIP_EXTRA_INDEX_URL","PIP_FIND_LINKS"],"configOptions":[],"configVariables":["PIP_CONFIG_FILE"]} ↗
• selection (✅ verified): {"prereleases":{"onFlags":["--pre"],"onLists":["--all-releases"],"offLists":["--only-final"],"flagVariables":["PIP_PRE"],"onListVariables":["PIP_ALL_RELEASES"],"offListVariables":["PIP_ONLY_FINAL"]},"buildFromSource":{"onLists":["--no-binary"],"offLists":["--only-binary"],"onListVariables":["PIP_NO_BINARY"],"offListVariables":["PIP_ONLY_BINARY"]}} ↗
• pipxSelection (✅ verified): {"prereleases":{"flagVariables":["PIP_PRE"],"onListVariables":["PIP_ALL_RELEASES"],"offListVariables":["PIP_ONLY_FINAL"]},"buildFromSource":{"onListVariables":["PIP_NO_BINARY"],"offListVariables":["PIP_ONLY_BINARY"]}} ↗
• pipxCommandLine (✅ verified): {"add":[["pipx","install"]],"run":[{"command":["pipx","run"],"packageOptions":["--spec"],"extraPackageOptions":["--with"],"scriptSuffixes":[".py"]}],"create":[],"valueOptions":["-i","--index-url","--pip-args","--preinstall","--lock","--include-resources-from","--upgrade-strategy","--suffix","--python","--fetch-python","--app","--cooldown","--backend","--output","--python-args"],"flagOptions":["-q","--quiet","-v","--verbose","--skip-maintenance","--global","-f","--force","-U","--upgrade","--include-deps","--system-site-packages","--fetch-missing-python","-e","--editable","--no-cache","--refresh","--no-path-check","--path","--pypackages","--version"],"parsing":{"abbreviations":true,"groupedShortOptions":true},"addPackageOptions":["--preinstall"]} ↗
• pipxRegistryOverrides (✅ verified): {"registryOptions":["-i","--index-url"],"registryVariables":[],"configOptions":["--pip-args"],"configVariables":[]} ↗
• latestVersion (✅ verified): 26.2.2 ↗

Poetry

• pylockCreatedBy (✅ verified): poetry-plugin-export ↗
• configTable (✅ verified): {"solver":"solver","installer":"installer"} ↗
• pyprojectTable (✅ verified): tool.poetry ↗
• configLocation (✅ verified): poetry.toml is read only from the directory of the pyproject.toml Poetry found (the current directory or the nearest parent with one) ↗
• buildSwitch (✅ verified): {"setting":"installer.only-binary","value":[":all:"],"since":"2.0.0","covers":["registry"]} ↗
• excludeFormat (⚠️ disputed): ⚠️ comma-separated string ↗ / TOML array ↗
• excludeWildcards (✅ verified): {"since":null,"trailingOnly":false} ↗
• missingUploadTime (✅ verified): A release whose source gives no upload times is not filtered by solver.min-release-age ↗
• lockedVersionsKept (❓ uncertain): poetry lock and poetry add keep versions already in poetry.lock even when they are newer than the delay allows; poetry update and poetry lock --regenerate resolve them again ❓ ↗
• requiredVersion (✅ verified): {"table":"tool.poetry","key":"requires-poetry","since":"2.0.0"} ↗
• lockfileFormat (❓ uncertain): {"sources":{"git":"git","remoteTarball":"url","file":"file","directory":"directory","registry":"legacy"},"packages":"package","source":"source","files":"files"} ❓ ↗
• commandLine (✅ verified): {"add":[["poetry","add"]],"run":[],"create":[],"valueOptions":["-C","--directory","-P","--project","-G","--group","-E","--extras","--optional","--python","--platform","--markers","--source"],"parsing":{"groupedShortOptions":true}} ↗
• registryOverrides (✅ verified): {"registryOptions":["--source"],"registryVariables":[],"configOptions":[],"configVariables":[]} ↗
• versionConstraints (✅ verified): {"separator":"@","latest":"latest","caret":"^","tilde":"~","any":"*"} ↗
• selection (✅ verified): {"prereleases":{"onFlags":["--allow-prereleases"]},"buildFromSource":{"onListVariables":["POETRY_INSTALLER_NO_BINARY"],"offListVariables":["POETRY_INSTALLER_ONLY_BINARY"],"listBooleans":true}} ↗
• latestVersion (✅ verified): 2.5.1 ↗

PDM

• pylockCreatedBy (✅ verified): pdm ↗
• configTables (✅ verified): {"pyproject.toml":"tool.pdm.resolution"} ↗
• pyprojectTable (✅ verified): tool.pdm ↗
• buildSwitch (✅ verified): {"setting":"only-binary","value":":all:","since":"2.15.0","covers":["registry"]} ↗
• durationStrings (✅ verified): {"since":"2.26.8","syntax":"compact"} ↗
• durationUnits (✅ verified): hours, days, weeks ↗
• excludeWildcards (✅ verified): {"since":null,"trailingOnly":false} ↗
• excludeValue (✅ verified): false ↗
• missingUploadTime (✅ verified): A distribution without an upload time is treated as unavailable while a cutoff applies to its package ↗
• lockfileFormat (❓ uncertain): {"packages":"package","files":"files","file":"file","vcs":["git","hg","svn","bzr"],"url":"url","path":"path","editable":"editable"} ❓ ↗
• lockedSettings (✅ verified): {"settings":"table","lock":"pdm lock","failing":["pdm lock --check","pdm install --check"]} ↗
• uvMode (❓ uncertain): {"file":"pdm.toml","key":"use_uv"} ❓ ↗
• commandLine (✅ verified): {"add":[["pdm","add"]],"run":[],"create":[],"valueOptions":["-c","--config","--pep582","-L","--lockfile","-G","--group","-k","--skip","-e","--editable","-p","--project","--venv","--override"],"flagOptions":["-V","--version","-h","--help","-v","--verbose","-q","--quiet","--no-cache","-I","--ignore-python","-n","--non-interactive","-g","--global","-d","--dev","--no-sync","--frozen-lockfile","--no-lock","--save-compatible","--save-safe-compatible","--save-wildcard","--save-exact","--save-minimum","--update-reuse","--update-eager","--update-all","--update-reuse-installed","--pre","--prerelease","--stable","-u","--unconstrained","--no-editable","--no-self","-x","--fail-fast","--no-isolation","--dry-run"],"parsing":{"abbreviations":true,"groupedShortOptions":true},"editableOptions":["-e","--editable"]} ↗
• registryOverrides (✅ verified): {"registryOptions":[],"registryVariables":["PDM_PYPI_URL"],"configOptions":["-c","--config"],"configVariables":["PDM_CONFIG_FILE"]} ↗
• selection (✅ verified): {"prereleases":{"onFlags":["--pre","--prerelease"],"offFlags":["--stable"]},"buildFromSource":{"onListVariables":["PDM_NO_BINARY"],"offListVariables":["PDM_ONLY_BINARY"]}} ↗
• latestVersion (✅ verified): 2.29.5 ↗

Pipenv

• pylockCreatedBy (✅ verified): pipenv ↗
• configTables (✅ verified): {"Pipfile":"pipenv"} ↗
• durationStrings (✅ verified): {"since":"2026.6.2","syntax":"compact"} ↗
• durationUnits (✅ verified): days ↗
• missingUploadTime (✅ verified): An index without upload times makes the setting accepted but without effect ↗
• resolverBypass (❓ uncertain): {"table":"pipenv","keys":["resolver_backend","resolver"],"value":"pure-python"} ❓ ↗
• lockfileFormat (✅ verified): {"meta":"_meta","git":"git","file":"file","path":"path","editable":"editable","hashes":"hashes"} ↗
• commandLine (✅ verified): {"add":[["pipenv","install"]],"run":[],"create":[],"valueOptions":["--pypi-mirror","--python","--extra-pip-args","--resolver","--categories","--extras","--config-settings","-i","--index","-r","--requirements","-e","--editable"],"flagOptions":["-h","--help","--version","--where","--venv","--py","--envs","--rm","--bare","--man","--support","-v","--verbose","-q","--quiet","--clear","--site-packages","--no-site-packages","--pre","-d","--dev","--all","--ignore-pipfile","--skip-lock","--system","--deploy"],"parsing":{"abbreviations":true,"groupedShortOptions":true},"editableOptions":["-e","--editable"]} ↗
• registryOverrides (✅ verified): {"registryOptions":["-i","--index","--pypi-mirror"],"registryVariables":["PIPENV_PYPI_MIRROR"],"configOptions":["--extra-pip-args"],"configVariables":["PIPENV_DOTENV_LOCATION"]} ↗
• selection (✅ verified): {"prereleases":{"onFlags":["--pre"]},"buildFromSource":{"onListVariables":["PIP_NO_BINARY"],"offListVariables":["PIP_ONLY_BINARY"]}} ↗
• latestVersion (✅ verified): 2026.10.4 ↗

Renovate

• durationStrings (✅ verified): {"since":null,"syntax":"words"} ↗
• minimumReleaseAgePresets (✅ verified): {"presets":["config:best-practices","security:minimumReleaseAgeNpm"],"value":"3 days","since":"42.0.0","datasource":"npm"} ↗
• excludeRule (✅ verified): {"list":"packageRules","match":"matchPackageNames","value":null} ↗
• securityUpdatesSetting (✅ verified): vulnerabilityAlerts, minimumReleaseAge ↗
• excludeWildcards (✅ verified): {"since":"38.0.0","trailingOnly":false} ↗
• ruleDescription (✅ verified): description ↗
• packageJsonConfig (✅ verified): {"file":"package.json","key":"renovate"} ↗
• durationUnits (✅ verified): hours, days ↗
• presets (✅ verified): config:best-practices extends security:minimumReleaseAgeNpm (since 42.0.0): "3 days" and internalChecksFilter "strict" for the npm datasource, except pin, replacement, lockFileMaintenance, bump, lockfileUpdate and rollback ↗
• datasources (✅ verified): {"npm":"npm","pypi":"pypi"} ↗
• negativeMatch (✅ verified): ! ↗
• packageRuleMatching (✅ verified): {"negation":"!","allPatterns":"*","packageMatchers":["matchPackageNames","matchDepNames"],"datasourceMatcher":"matchDatasources","updateTypeMatcher":"matchUpdateTypes"} ↗
• packageRulesOrder (✅ verified): {"presetsFirst":true,"overridesTopLevel":true,"laterWins":true} ↗
• delayedUpdateTypes (✅ verified): major, minor, patch ↗
• internalPresets (✅ verified): {"prefixes":[":","default:","abandonments:","config:","customManagers:","docker:","global:","group:","helpers:","mergeConfidence:","monorepo:","packages:","preview:","replacements:","schedule:","security:","workarounds:"],"settingDelay":["config:best-practices","security:minimumReleaseAgeCrate","security:minimumReleaseAgeNpm","security:minimumReleaseAgePypi"]} ↗
• pypiPresets (✅ verified): {"presets":["security:minimumReleaseAgePypi"],"value":"3 days","since":"44.8.0","datasource":"pypi"} ↗
• pnpmSecurityExclusions (❓ uncertain): {"managers":["pnpm"],"file":"pnpm-workspace.yaml","setting":"minimumReleaseAgeExclude","comment":"# Renovate security update: ","versionSeparator":" || "} ❓ ↗
• pythonManagers (✅ verified): {"uv":"pep621","poetry":"poetry","pip":"pip_requirements","pdm":"pep621","pipenv":"pipenv"} ↗
• passesDelayToManager (✅ verified): earlier: []
  44.34.0+: poetry ↗
• missingTimestamp (✅ verified): earlier: updates without a release timestamp pass the check
  42.0.0+: minimumReleaseAgeBehaviour timestamp-required: such updates are held ↗
• internalChecksFilter (✅ verified): Defaults to "strict" since 33.0.0; with "none" or "flexible" branches and PRs are created before the delay ends and only automerge waits ↗
• independentOfPackageManager (✅ verified): minimumReleaseAge is set independently of the package manager's own release-age configuration ↗
• digestBypassFixed (⚠️ disputed): ⚠️ 44.3.1 ↗ / 44.10.0 ↗

Dependabot

• yamlMergeKeys (❓ uncertain): false ❓ ↗
• cooldownKeys (✅ verified): {"days":"default-days","exclude":"exclude","semverDays":["semver-major-days","semver-minor-days","semver-patch-days"]} ↗
• excludeWildcards (✅ verified): {"since":"0.0.0","trailingOnly":false} ↗
• cooldownInclude (✅ verified): {"key":"include","everything":"*"} ↗
• ecosystems (✅ verified): {"npm":["npm","pnpm","yarn"],"bun":["bun"],"deno":["deno"],"pip":["pip","poetry","pipenv"],"uv":["uv"]} ↗
• dayRange (⚠️ disputed): ⚠️ 1 to 90 days ↗ / 0 removes the cooldown ↗
• maximumDays (✅ verified): 90 ↗
• missingPublishDate (✅ verified): Updates proceed when the registry gives no publication date (fail open); for Docker only Docker Hub tag_last_pushed is used ↗
• transitiveGating (❓ uncertain): Regular updates pass the cooldown to npm (11.10+), pnpm (10.16+) and Yarn Berry to hold back transitive dependencies; the Bun updater passes none ❓ ↗
• semverKeysScope (✅ verified): semver-major/minor/patch-days apply only to SemVer ecosystems such as npm, Bun and Deno; others use default-days ↗

Environment

How repositories pin tool versions (Corepack, devEngines, Volta, asdf) and how GitHub Actions installs them.

• corepack.packageManagerField (✅ verified): {"key":"packageManager","managers":["npm","pnpm","yarn"]} ↗
• corepack.devEnginesSince (✅ verified): 0.32.0 ↗
• corepack.envFileSince (✅ verified): 0.32.0 ↗
• corepack.bundledWithNode (✅ verified): earlier: false
  14.19.0+: true
  25.0.0+: false ↗
• devEngines (✅ verified): {"key":"devEngines","packageManagerKey":"packageManager","runtimeKey":"runtime"} ↗
• devEnginesSince (✅ verified): 10.9.0 ↗
• volta.manifest (✅ verified): {"key":"volta","tools":["node","npm","pnpm","yarn"]} ↗
• volta.maintained (✅ verified): false ↗
• asdf.toolVersionsFile (✅ verified): .tool-versions ↗
• asdf.plugins (✅ verified): {"nodejs":"node","pnpm":"pnpm","yarn":"yarn","bun":"bun","deno":"deno","python":"python","uv":"uv","poetry":"poetry"} ↗
• githubActions.workflows (✅ verified): {"directory":".github/workflows","extensions":[".yml",".yaml"]} ↗
• githubActions.setupNode (✅ verified): {"action":"actions/setup-node","installs":["node"],"inputs":[{"name":"node-version","kind":"version","tool":"node"},{"name":"node-version-file","kind":"version-file","tool":"node"}]} ↗
• githubActions.pnpmActionSetup (✅ verified): {"action":"pnpm/action-setup","installs":["pnpm"],"inputs":[{"name":"version","kind":"version","tool":"pnpm"}]} ↗
• githubActions.pnpmSetup (✅ verified): {"action":"pnpm/setup","installs":["pnpm"],"inputs":[{"name":"version","kind":"version","tool":"pnpm"},{"name":"runtime","kind":"runtime"},{"name":"node-version-file","kind":"version-file","tool":"node"}]} ↗
• githubActions.setupBun (✅ verified): {"action":"oven-sh/setup-bun","installs":["bun"],"inputs":[{"name":"bun-version","kind":"version","tool":"bun"},{"name":"bun-version-file","kind":"version-file","tool":"bun"}]} ↗
• githubActions.setupDeno (✅ verified): {"action":"denoland/setup-deno","installs":["deno"],"inputs":[{"name":"deno-version","kind":"version","tool":"deno"},{"name":"deno-version-file","kind":"version-file","tool":"deno"}]} ↗
• githubActions.setupPython (✅ verified): {"action":"actions/setup-python","installs":["python"],"inputs":[{"name":"python-version","kind":"version","tool":"python"},{"name":"python-version-file","kind":"version-file","tool":"python"},{"name":"pip-version","kind":"version","tool":"pip"}]} ↗
• githubActions.setupUv (✅ verified): {"action":"astral-sh/setup-uv","installs":["uv"],"inputs":[{"name":"version","kind":"version","tool":"uv"},{"name":"version-file","kind":"version-file","tool":"uv"}]} ↗
• githubActions.installPoetry (✅ verified): {"action":"snok/install-poetry","installs":["poetry"],"inputs":[{"name":"version","kind":"version","tool":"poetry"}]} ↗
• githubActions.actionsPoetry (✅ verified): {"action":"abatilo/actions-poetry","installs":["poetry"],"inputs":[{"name":"poetry-version","kind":"version","tool":"poetry"}]} ↗
• githubActions.codeScanningUpload (✅ verified): {"action":"github/codeql-action/upload-sarif","inputs":{"sarifFile":"sarif_file","category":"category"},"permissions":{"always":{"security-events":"write"},"privateRepositories":{"actions":"read","contents":"read"}}} ↗
• githubActions.stopCommands (✅ verified): {"stop":"::stop-commands::{token}","resume":"::{token}::"} ↗
• githubActions.annotations (✅ verified): {"commands":{"error":"error","warning":"warning","note":"notice"},"properties":{"file":"file","line":"line","title":"title"},"escape":[["%","%25"],["\r","%0D"],["\n","%0A"]],"escapeProperty":[[":","%3A"],[",","%2C"]]} ↗
• githubActions.annotationLimits (✅ verified): {"perLevelPerStep":10,"perJob":50} ↗
• githubActions.checkRuns (✅ verified): {"endpoint":"/repos/{repository}/check-runs","apiVersion":"2022-11-28","permission":{"checks":"write"},"summaryMaxLength":65535,"variables":{"apiUrl":"GITHUB_API_URL","repository":"GITHUB_REPOSITORY","sha":"GITHUB_SHA","eventPath":"GITHUB_EVENT_PATH"},"pullRequestHeadSha":["pull_request","head","sha"]} ↗
• githubActions.stepSummary (✅ verified): {"variable":"GITHUB_STEP_SUMMARY","maxBytes":1048576} ↗
• npmRegistry.api (✅ verified): {"url":"https://registry.npmjs.org/","packagePath":"/{escaped name}","timeField":"time","distTagsField":"dist-tags","defaultTag":"latest","versionsField":"versions","scriptsField":"scripts","deprecatedField":"deprecated","installScripts":["preinstall","install","postinstall"]} ↗
• npmRegistry.notFoundStatus (❓ uncertain): 404 ❓ ↗
• npmRegistry.search (❓ uncertain): {"path":"/-/v1/search","maxSize":250,"weeklyDownloadsField":"downloads.weekly"} ❓ ↗
• pypiIndex.api (✅ verified): {"url":"https://pypi.org/simple/","accept":"application/vnd.pypi.simple.v1+json","notFoundStatus":404,"filesField":"files","filenameField":"filename","uploadTimeField":"upload-time","yankedField":"yanked","versionsField":"versions","statusField":"project-status","statusValueField":"status","statusReasonField":"reason"} ↗
• pypiIndex.projectStatus (✅ verified): {"blocked":["quarantined"],"warned":["archived","deprecated"]} ↗
• claudeCode.hooks (✅ verified): {"settingsFile":".claude/settings.json","event":"PreToolUse","matcherSeparator":"|","input":{"event":"hook_event_name","tool":"tool_name","command":"tool_input.command","cwd":"cwd"},"output":{"container":"hookSpecificOutput","event":"hookEventName","decision":"permissionDecision","reason":"permissionDecisionReason"},"decisions":{"deny":"deny","ask":"ask"},"blockingExitCode":2,"onFailure":{"field":"onFailure","value":"block","since":"2.1.295"},"projectDir":"${CLAUDE_PROJECT_DIR}","settings":{"hooks":"hooks","matcher":"matcher","handlers":"hooks","type":"type","commandType":"command","command":"command","args":"args"}} ↗
• claudeCode.shellTools (✅ verified): {"tool":"Bash","shell":"bash"}, {"tool":"PowerShell","shell":"powershell"}, {"tool":"Monitor","shell":"bash"} ↗
• git.ignore (✅ verified): {"file":".gitignore","excludeFile":".git/info/exclude","indexFile":".git/index","trackedFilesIgnored":false} ↗
• git.ignoreCase (✅ verified): {"configFile":".git/config","section":"core","key":"ignorecase","trueValues":["yes","on","true","1"]} ↗
• windows.commandShims (✅ verified): {"extensions":[".cmd",".ps1"],"batchExtension":".cmd","argumentsVariable":"%*"} ↗
• windows.batchArguments (✅ verified): {"extensions":[".bat",".cmd"]} ↗
• python.nameNormalization (✅ verified): {"separators":"[-_.]+","replacement":"-"} ↗
• python.namePattern (✅ verified): ^([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9._-]*[A-Za-z0-9])$ ↗
• python.projectFile (✅ verified): pyproject.toml ↗
• python.wheelExtension (✅ verified): .whl ↗
• python.sourceDistributionExtensions (✅ verified): .tar.gz, .zip, .tar.bz2, .tbz, .tgz, .tar, .tar.xz, .txz, .tlz, .tar.lz, .tar.lzma ↗
• python.hatch (✅ verified): {"pyprojectTable":"tool.hatch","configFile":"hatch.toml"} ↗
• python.interpreter (✅ verified): {"executables":["python","python3","py"],"moduleOption":"-m","commandOption":"-c","valueOptions":["-W","-X","--check-hash-based-pycs"],"groupedShortOptions":true} ↗

Notes

Context recorded with verified facts.

npm

• cooldown.configFiles: Any npm config layer works: project .npmrc (read only at the project root and not for global installs), ~/.npmrc, the global npmrc, npm_config_min_release_age or the CLI. package.json cannot set it. ↗
• cooldown.unit: Type is null or Number; 0 turns the delay off. Fractional days are not documented. ↗
• cooldown.default: Unchanged in npm 12. ↗
• cooldown.securityUpdates: npm audit fix keeps the vulnerable version, warns that the fix was blocked (since 11.18.0) and exits non-zero. Add the package to min-release-age-exclude or relax the delay. ↗
• installScripts.defaultPolicy: strict-allow-scripts (default false) turns a dependency script that allowScripts does not cover "from a warning into a hard error ... instead of running with a notice", so from 11.16.0 such scripts still run. npm 11.21.1 ran esbuild's postinstall on 2026-10-29 ("has install scripts not yet covered by allowScripts"); npm 12.2.1 blocked it ("had install scripts blocked"). The v11 install-scripts command page says scripts are blocked by default, which the config definition, the 11.16.0 pull request, the GitHub changelog and the test contradict. npm 12 also blocks implicit node-gyp builds and prepare scripts of git, file and link dependencies. ↗
• installScripts.allowList.file: Only the root package.json counts; allowScripts in dependencies is ignored. npx, npm exec and global installs use the allow-scripts config instead. ↗
• installScripts.disableAll: Default false. Overrides allowScripts and dangerously-allow-all-scripts. npm run/test/start still run the named script, but not its pre/post scripts. ↗
• sources.git.values: root allows only git dependencies listed in the project package.json. ↗
• sources.remoteTarball.values: Tarballs on the configured registry hostname are always allowed. The 2026-05-22 GitHub changelog mentions only all and none; the config reference also lists root. ↗
• sources.file.values: The 2026-05-22 GitHub changelog mentions only all and none; the config reference also lists root. ↗
• sources.file.default: npm 12 did not change the default. ↗
• sources.directory.values: The 2026-05-22 GitHub changelog mentions only all and none; the config reference also lists root. ↗
• sources.directory.default: npm 12 did not change the default. ↗
• project.lockfiles: npm 11 and earlier prefer npm-shrinkwrap.json over package-lock.json when both exist; npm 12 no longer reads or writes npm-shrinkwrap.json (same format, rename it). ↗
• project.workspaces: An array of folder paths or globs. ↗
• user.files: userconfig defaults to ~/.npmrc ("The location of user-level configuration settings. This may be overridden by the npm_config_userconfig environment variable or the --userconfig command line option"); ~ is resolved against this.env.HOME || homedir(). Same in 11.21.1. The project .npmrc is loaded first and may set userconfig= itself. Only the keys above the first [section] header are settings (extra.npmrcFormat). ↗
• user.settings: Every config definition is read from any config file; only prefix is refused in a project .npmrc. allowScripts in package.json is project-only: at user level the allow-list is the allow-scripts key (allow only, every name becomes true; resolve-allow-scripts.js), used where the root package.json has no allowScripts and for npx, npm exec and npm install -g. The source keys use the later of the disputed first versions. ↗
• user.unknownKeys: Unknown .npmrc (file) configs warn by default, matching pre-npm-12 behavior, but error when strict-npmrc is set. ↗
• user.invalidValueFails: A value of the wrong type is reported as invalid config and the default is used. ↗
• user.weakening: A key in the project .npmrc replaces the user value, lists included (prototype chain, no merging); the CLI and npm_config_* variables beat both. dangerously-allow-all-scripts is on for every value but false, null and undefined: npm reads .npmrc values and npm_config_* variables with parseField (https://github.com/npm/cli/blob/v11.21.1/workspaces/config/lib/parse-field.js), which trims them, turns an empty value of a Boolean setting into true and only "true", "false", "null" and "undefined" into their values, and leaves 0, 1, yes or no as strings; load() does not run the nopt type check (validate() runs only in npm config), and arborist tests the flat option for truth (!this.options.dangerouslyAllowAllScripts in workspaces/arborist/lib/arborist/rebuild.js at 11.21.1). ↗
• user.variables: Environment variables starting with npm_config_ are interpreted as configuration parameters; config values are case-insensitive, so NPM_CONFIG_FOO=bar works the same. loadEnv in workspaces/config/lib/index.js (11.21.1 and 12.2.1) skips variables whose value is empty and reads them in the order of the environment, so of two spellings the later one wins. userconfig defaults to ~/.npmrc (definitions.js), and npm exports the resolved path as npm_config_userconfig to every command it runs (see extra.childEnvironment), so that value names the default file. ↗
• extra.childEnvironment: setEnvs gives the scripts and commands npm runs (npm run, npx, npm exec) every setting that is not its default as npm_config_<key> in lower case with - as _, whichever file or flag set it, unless the definition has envExport: false (allow-scripts, min-release-age and min-release-age-exclude in 11.21.1 and 12.2.1); keys npm does not know, such as pnpm keys in .npmrc, are exported too. userconfig is always exported, because its default is the literal ~/.npmrc and the value the resolved path. It also sets npm_execpath to the npm it runs. The same in 10.9.4 and 12.2.1 (12.x and 11.x also export npm_config_node_gyp and npm_config_npm_version). ↗
• extra.denyList: A false entry in the root package.json allowScripts is an explicit denial: deny wins over allow, and denied packages are skipped silently, also under strict-allow-scripts ("const verdict = isScriptAllowed(node, policy); if (verdict === true || verdict === false) { continue }", the same in 11.16.0 check-allow-scripts.js). npm install-scripts deny writes a name-only false entry. ↗
• extra.trustedPublishing: Publishing from GitHub-hosted runners with OIDC instead of a token. Provenance is generated automatically, only for a public package from a public repository. A new trusted publisher configuration expires unless its first publish succeeds within 2 days. It can be limited to npm stage publish (the default for configurations created after 2026-09-03). ↗
• extra.stagedPublishing: Staging needs no 2FA, so CI can do it; approving or rejecting needs 2FA (CLI or npmjs.com). Staging a package that does not exist yet creates it with the public placeholder version 0.0.0-stage. Pre-release versions need an explicit --tag. --provenance also applies to npm stage publish. Rejecting the only staged version of such a new package also unpublished the placeholder (observed 2026-10-29 with npm 11.21.1), and after a whole package is unpublished its name is blocked for 24 hours (https://github.com/npm/documentation/blob/main/content/policies/unpublish.mdx). ↗
• extra.trustCommand: Configures a trusted publisher from the CLI; needs 2FA on the account and write access, and the package must already exist. At least one permission flag is required. ↗
• extra.lockfileFormat: Entries under packages: resolved is the registry tarball URL, the git URL with its commit (git+ssh://… or git+https://…#sha), file:<path> for local tarballs and directories, or the link target when link is true. hasInstallScript marks a preinstall, install or postinstall script (prepare scripts of non-registry sources are not flagged). npm tells registry tarballs from other URLs with the registryTarball pattern (workspaces/arborist/lib/install-scripts.js), so a tarball URL on a registry host looks like a registry package. An entry without resolved is installed as <name>@<version> (workspaces/arborist/lib/arborist/reify.js, #extractOrLink, in 11.19.1 and 12.2.1), so its version field is the source then. Entries keep the dependency fields of their package.json: dependencies, optionalDependencies and peerDependencies for every package, devDependencies for the root (workspaces/arborist/lib/shrinkwrap.js, pkgMetaKeys and the isTop branch, in 11.21.1 and 12.2.1); a dependency declared there as a URL comes from that URL even when it is a registry tarball. ↗
• extra.overrides: Only the root package.json counts. Keys are package names, optionally with a version or range (name@range), and nest to any depth to scope an override under a parent; "." inside a nested object overrides the parent package itself; values take any dependency specifier, including tarball URLs, and $name refers to the spec of a direct dependency. Overrides are not written to package-lock.json (checked with npm 11.21.1), so a URL override of a registry tarball looks like a registry package there. With replace-registry-host at its default npmjs, npm writes the configured registry in place of registry.npmjs.org in resolved URLs (workspaces/config/lib/definitions/definitions.js). ↗
• extra.npmrcScope: Only the .npmrc at the root of the project npm runs in is read. Inside a workspace package npm moves the prefix to the workspace root (using-npm/workspaces.md) and warns "ignoring workspace config" for the package .npmrc (workspaces/config/lib/index.js). The project .npmrc "is not read in global mode, such as when running npm install -g" (same page, v11.21.1 and v12.2.1). ↗
• extra.npmrcFormat: npm reads .npmrc with the ini package: 7.0.0 in npm 12.2.1, and 6.0.0, whose lib/ini.js is the same, in npm 11.10.0 to 11.21.1 (package-lock.json of npm/cli). A line whose first non-blank character is # or ; is a comment. An unquoted key or value ends at the first # or ; that is not escaped with a backslash, so ignore-scripts=true # note sets true; a value in double quotes is parsed as a JSON string and one in single quotes loses its quotes, both keeping # and ;. A line without = sets the key to true. A [name] header at the start of a line, with nothing but spaces after it, starts a section: the keys below it belong to that section until the next header. npm applies only the top-level keys as settings (#loadObject in workspaces/config/lib/index.js at v12.2.1), so a key below a header has no effect. ↗
• extra.npmrcListSyntax: Array values are written by adding [] after the key, one line per value, e.g. min-release-age-exclude[]=@myorg/*. ↗
• extra.allowAllScripts: Boolean, default false: runs every dependency install script whether or not allowScripts approves it; --ignore-scripts still wins. First present in the 11.16.0 definitions. ↗
• extra.excludeWildcards: min-release-age-exclude takes package names or minimatch globs from its first version. ↗
• extra.latestVersion: Marked as the latest GitHub release on 2026-10-28; the 11.x line is still maintained (11.21.1). ↗
• extra.beforeInteraction: before is a date: npm installs only versions available on or before it. In 11.10.0 to 11.14.x the definitions of min-release-age and before name each other as exclusive, and npm stops with "--min-release-age cannot be provided when using --before" (or the reverse) once both are set in its config sources (#loadObject in workspaces/config/lib/index.js and definitions.js at v11.14.1). Since 11.15.0 both may be set: "If before and min-release-age are both set in the same source, before wins"; across sources the usual precedence applies (cli > env > project > user > global), so a before in the project .npmrc replaces its own min-release-age (definitions.js at v11.15.0 and v12.2.1; release notes of 11.15.0). ↗
• extra.strictAllowScripts: strict-allow-scripts=true makes the install fail on a dependency with install scripts that allowScripts does not cover, instead of running them with a notice (default false). Entries denied with false are skipped silently; --ignore-scripts and --dangerously-allow-all-scripts override it. ↗
• extra.unknownNpmrcKeys: Matters for generated .npmrc files: keys npm does not know (e.g. pnpm-only keys) print a warning on every npm command. The 12.0.0 entry: unknown CLI flags "now throw instead of warning. (Unknown .npmrc configs still warn by default; opt into erroring with the new strict-npmrc config.)"; lib/base-cmd.js at 12.2.1 does the same. ↗
• extra.commandLine: Aliases of install (add, i and the typo aliases in, ins, inst, insta, instal, isnt, isnta, isntal, isntall), install-test (it), exec (x) and init (create, innit), the same in 11.19.1. install-test takes the same arguments as install (docs/lib/content/commands/npm-install-test.md). npm exec and npx take the packages to download from --package; -p means --package only in npx (in npm it is --parseable); without --package the first positional argument names the package, and -c/--call takes a command string that runs with the packages, shell operators included (npm-exec.md). npm init <initializer> runs npm exec create-<initializer>: foo → create-foo, @usr → @usr/create, @usr/foo@2.0.0 → @usr/create-foo@2.0.0 (npm-init.md). ↗
• extra.valueOptions: npm options that always take a value: every definition whose type does not include Boolean, as --name, and the short forms -C (prefix), -L (location), -c (call), -m (message) and -w (workspace). Options whose type includes Boolean (such as color and browser) may stand alone, so they are taken for flags. ↗
• extra.flagOptions: npm options whose type includes Boolean, which may stand alone: the definitions of 12.2.1 and of 11.21.1 (where shrinkwrap is one too; 12.2.1 adds ignore-existing, ignore-extension, ignore-patch-failures, allow-unused-patches, keep-edit-dir and strict-npmrc). With valueOptions they are every npm option, so an abbreviated option can be resolved as npm resolves it. ↗
• extra.parsing: The shorthands npm passes to nopt: the list in definitions/index.js and the short names of the definitions (the same in 11.21.1). nopt (node_modules/nopt/lib/nopt-lib.js, versions 8.1.0 in npm 10.9.4, 9.0.0 in 11.21.1 and 10.0.1 in 12.2.1, same parse and resolveShort) strips every leading dash, so -reg, --reg and -registry work; takes an exact option first, then an exact shorthand, then a word of one-letter shorthands (-gD), then an unambiguous prefix of an option name (abbrev), then a prefix of a shorthand; and reads --no-<name> as a negated flag that takes no value. npm 10 expands abbreviations silently, npm 11 warns "Expanding --regis to --registry. This will stop working in the next major version of npm." and npm 12 refuses them with EUNKNOWNCONFIG (abbrevHandler in workspaces/config/lib/index.js of 11.21.1 and 12.2.1). Shorthands are expanded only on the command line, not in .npmrc or npm_config_ variables. npx turns -p into --package and expands exact shorthands itself before npm exec reads the rest (bin/npx-cli.js). ↗
• extra.versionSelection: tag (default latest): "If you ask npm to install a package and don't tell it a specific version, then it will install the specified tag"; like any setting it comes from --tag, npm_config_tag or .npmrc. A name without a version is name@* (npm-package-arg 14.0.0, lib/npa.js). npm-pick-manifest 12.0.0 (node_modules/npm-pick-manifest/lib/index.js) picks the version of that dist-tag when the range is * or the version satisfies the range, unless it is deprecated; otherwise the highest satisfying version, preferring versions that are not deprecated; prereleases match a range only when it names one, so name@* with latest on a prerelease installs that prerelease. npm exec and npm init pick with the same settings. ↗
• extra.packageSpecs: Forms of npm install <spec>: a folder; a tarball file, whose name must end in .tar, .tar.gz or .tgz; a tarball URL, which must start with http:// or https://; a git remote URL with the protocol git, git+ssh, git+http, git+https or git+file; <githubname>/<githubrepo> or github:<githubname>/<githubrepo>; gist:, bitbucket: and gitlab: shorthands; <alias>@npm:<name>. The file: prefix for local paths is documented in docs/lib/content/configuring-npm/package-json.md (Local Paths). ↗
• extra.registryConfig: userconfig, the location of user-level settings, defaults to ~/.npmrc; registry is the base URL of the npm registry (default https://registry.npmjs.org/); a per-project .npmrc can set it like any config key (docs/lib/content/using-npm/config.md). npm config set @myco:registry=http://reg.example.com associates a scope with a registry, and any npm install of a package with that scope then requests it from there (https://docs.npmjs.com/cli/v12/using-npm/scope#associating-a-scope-with-a-registry). ↗
• extra.registryOverrides: registry is a URL; userconfig and globalconfig are the user and global configuration files. Putting --foo bar on the command line sets the foo configuration parameter, and environment variables that start with npm_config_ are configuration parameters too, without regard to case (docs/lib/content/using-npm/config.md); @scope:registry is the key of a scope's registry (https://docs.npmjs.com/cli/v12/using-npm/scope). ↗

pnpm

• cooldown.configFiles: pnpm-workspace.yaml works in every version that has the setting. The global config.yaml exists only from 11.0.0 ("the new global config.yaml"); pnpm 10 reads user-level settings from ~/.npmrc and <configDir>/rc instead (see user.files). pnpm 10 also reads minimum-release-age from .npmrc; pnpm 11+ reads only auth and registry settings from .npmrc and ignores the package.json "pnpm" field. ↗
• cooldown.unit: Integer number of minutes, e.g. 1440 = 1 day; no duration strings. ↗
• cooldown.default: The built-in 1440 is non-strict: pnpm adds immature versions to minimumReleaseAgeExclude instead of failing (see strictMode). ↗
• cooldown.securityUpdates: No setting bypasses the delay. Since 11.0.0, pnpm audit --fix adds the minimum patched version of each advisory to minimumReleaseAgeExclude (since 11.22.0 only while it is still inside the window). ↗
• installScripts.defaultPolicy: Unreviewed builds only warn in pnpm 10; strictDepBuilds is true by default since 11.0.0, so they fail the install. Prepare scripts of git-hosted dependencies are blocked since 10.26.0. ↗
• installScripts.allowList.setting: Replaced onlyBuiltDependencies, which was removed in 11.0.0 (see legacyAllowList). Since 12.11.0, permissions.<package>.build takes precedence over allowBuilds (extra.buildPermissions). ↗
• installScripts.disableAll: Default false; --ignore-scripts on the CLI. Also skips the project's own scripts. ↗
• sources.git.setting: Blocks git repositories and tarball URLs for transitive dependencies only; no setting blocks them as direct dependencies. ↗
• sources.remoteTarball.setting: Blocks git repositories and tarball URLs for transitive dependencies only; no setting blocks them as direct dependencies. ↗
• project.workspaces: Globs with ! exclusions. Without packages only the root is in the workspace; pnpm still reads settings from the file in single-package projects. pnpm ignores workspaces in package.json. ↗
• user.files: getConfigDir: $XDG_CONFIG_HOME/pnpm when it is set, else ~/Library/Preferences/pnpm on macOS, %LOCALAPPDATA%/pnpm/config on Windows (~/.config/pnpm without LOCALAPPDATA) and ~/.config/pnpm elsewhere; the same in 10.34.9 (config/config/src/dirs.ts) and 12.17.0 (pnpm/crates/config-dir/src/lib.rs). pnpm 10 reads <configDir>/rc, INI with kebab-case keys (config/config/src/index.ts at 10.34.9; first version not tracked), and also ~/.npmrc for every setting, which beats rc: loadNpmConf reads the command line, npm_config_* variables, the project and workspace .npmrc, ~/.npmrc (userconfig, path.resolve(os.homedir(), ".npmrc") in https://github.com/pnpm/npm-conf/blob/v3.0.3/lib/defaults.js) and the global npmrc, and only then is rc added as "pnpm-global", below all of them (index.ts at 10.34.9). From 11.0.0 the settings file is <configDir>/config.yaml with camelCase keys (11.0.0 changelog: "the new global config.yaml"), and ~/.npmrc and <configDir>/auth.ini carry only auth, registry and network settings. The 11.x and 12.x docs page cli/config.md still names a global rc file for registry and auth settings, which that code no longer reads. ↗
• user.settings: pnpm 10 reads the kebab-case keys from rc as from any .npmrc (config/config/src/types.ts: only-built-dependencies at 10.0.0, strict-dep-builds at 10.3.0, minimum-release-age and minimum-release-age-exclude at 10.16.0, block-exotic-subdeps at 10.26.0); since 10.13.0 build settings from these files apply only to projects whose package.json "pnpm" field and pnpm-workspace.yaml set none of dangerouslyAllowAllBuilds, onlyBuiltDependencies(File), neverBuiltDependencies or allowBuilds, and always to global installs. pnpm 11+ applies a config.yaml key only when isConfigFileKey accepts it and it is camelCase: the minimumReleaseAge keys and blockExoticSubdeps since 11.0.0, strictDepBuilds since 11.0.7 (in excludedPnpmKeys in 11.0.0-11.0.6). allowBuilds is project-only from 11.0.0 and dropped with a warning, so pnpm 11+ has no user-level allow-list. pnpm 12 silently drops blockExoticSubdeps from config.yaml although its key gate accepts it (clear_workspace_resolution_fields in pnpm/crates/config/src/workspace_yaml/workspace_scope.rs, 12.0.0 to 12.17.0). pnpm self-update takes the minimumReleaseAge settings only from config.yaml, the environment and the command line, never from the project. ↗
• user.weakening: A key in pnpm-workspace.yaml replaces the user value, lists included (applyWorkspaceSetting: pnpmConfig[key] = value); PNPM_CONFIG_* variables and the command line beat both. In pnpm 10 the same keys in ~/.npmrc beat rc, and since 10.13.0 build settings from either file reach only projects without build settings of their own, and global installs (config/config/src/index.ts at 10.34.9; before 10.13.0 dangerously-allow-all-builds also joined a project's onlyBuiltDependencies). In config.yaml, dangerouslyAllowAllBuilds also overrides a project's allowBuilds: false in pnpm 11 and 12.0.0-12.11.x (see extra.allowAllBuilds). pnpm 10 has no default delay and its strict-dep-builds and block-exotic-subdeps default to false, so 0 or false there weakens nothing; trustLockfile is a global key since it appeared in 11.3.0. The switch that allows every build is on for any value pnpm does not read as off, because pnpm tests it for truth (see extra.allowAllBuilds): in config.yaml only false, 0, null and an empty string are off, so "false", yes and "true" (strings for js-yaml) are on; in rc and ~/.npmrc pnpm 10 parses values with parseField of @pnpm/npm-conf (lib/util.js at https://github.com/pnpm/npm-conf/blob/v3.0.2/lib/util.js, the same in 3.0.3, which pnpm 10.28.0 and 10.34.9 use), which turns only "false", "null" and "undefined" into falsy values, an empty value of a Boolean setting into true, and leaves yes, 1 and 0 as strings, which are true. ↗
• user.variables: pnpm 11 reads pnpm_config_<key> in lower case or PNPM_CONFIG_<KEY> in upper case, not mixed case (getEnvKeySuffix), over pnpm-workspace.yaml and under the command line; pnpm 12 reads the same two forms (pnpm/crates/config/src/env_overlay.rs at 12.17.0). pnpm 11+ ignores npm_config_* except npm_config_userconfig, which then moves only the auth .npmrc. The 11.0.0 release notes (https://github.com/pnpm/pnpm/releases/tag/v11.0.0): "pnpm no longer reads npm_config_* environment variables", "Added support for loading environment variables whose names start with pnpm_config_ into config"; pnpm 10.34.9 reads pnpm_config_ only for verify-deps-before-run (config/config/src/index.ts). pnpm 10 reads npm_config_* in any case, skipping empty values (addEnv in lib/conf.js of @pnpm/npm-conf 3.0.3), under pnpm-workspace.yaml (npmrcPrecedence), and parses them with the same parseField as .npmrc, so npm_config_dangerously_allow_all_builds is off only for false, null and undefined (1 and yes stay true strings); its npm_config_userconfig defaults to ~/.npmrc (lib/defaults.js). pnpm 11 parses a Boolean pnpm_config_ value with parseBoolean of env.ts, which takes only true as true (false gives false, any other text no value). XDG_CONFIG_HOME and LOCALAPPDATA move the config directory (user.files). ↗
• extra.denyList: allowBuilds: { pkg: false } records a denial: the build is decided, not reported as unreviewed and does not fail strictDepBuilds ("A recorded build the policy denies was decided on purpose"). pnpm 10.26 maps false to ignoredBuiltDependencies, which only silences the report. Under dangerouslyAllowAllBuilds a denied package still builds before pnpm 12.12.0. ↗
• extra.commandLine: From cli/add.md, cli/pnx.md, cli/create.md and pnpm-cli.md at that commit. pnx (pnpm 12) has the aliases pnpm dlx and pnpx; pnpm 10 documents pnpm dlx with the alias pnpx (versioned_docs/version-10.x/cli/dlx.md). --shell-mode (-c) runs the command inside a shell, e.g. pnx --package cowsay -c 'echo hi | cowsay'. pnpm create maps foo and create-foo to create-foo, @scope to @scope/create and @scope/foo to @scope/create-foo, and runs it with pnx. --registry and --allow-build are shown with =, the other value options with a separate value. --package belongs to pnx only and is listed there. -F is the short form of --filter (filtering.md). --reporter takes the name of a reporter (cli/install.md) and --loglevel a level (the loglevel setting in settings/cli.md, given as a flag); both take a separate value too. ↗
• extra.packageSpecs: Sources of pnpm add: the npm registry, jsr:, crate: and pypi: (other registries), workspace packages (the workspace: range protocol, docs/workspaces.md), local directories (./dir is saved as link:, file:./dir is copied), local tarballs ending in .tar, .tar.gz or .tgz, remote tarballs starting with http:// or https://, and git repositories as user/repo (github: by default), github:, bitbucket:, gitlab:, gist: or a full URL such as git+ssh://… or https://github.com/….git. ↗
• extra.registryOverrides: registry and @scope:registry are read from the command line over .npmrc (docs/npmrc.md in pnpm/pnpm.io). Every pnpm_config_<key> or PNPM_CONFIG_<KEY> variable whose key is a setting sets it (src/env.ts, parseEnvVars), registry included. The user-level .npmrc, which may set any registry, is the file named by --npmrc-auth-file, --userconfig, pnpm_config_npmrc_auth_file, pnpm_config_userconfig, npmrcAuthFile in the global config.yaml or npm_config_userconfig (getNpmrcAuthFile; src/loadNpmrcFiles.ts reads it in place of ~/.npmrc). pnpm 10 reads npm_config_* variables as npm does. ↗
• extra.parsing: pnpm parses its command line with @pnpm/nopt 0.3.1 (github.com/pnpm/nopt, lib/nopt.js), a fork of nopt: every leading dash is stripped, an exact shorthand or a word of one-letter shorthands is expanded, and an unambiguous prefix of an option of the command is taken for that option, so pnpm add --reg=<url> sets registry; --no-<name> is a negated flag. Options pnpm does not know make it stop with an error (pnpm11/pnpm/src/main.ts, dropUnknownOptions). --config.<key>=<value> sets the setting <key> (separateConfigDotArgs, normalizeOptions), also in pnpm 10.34.9 (cli/parse-cli-args/src/index.ts). The shorthands are pnpm11/pnpm/src/shorthands.ts; pnpm 10.34.9 has the same without y. ↗
• extra.minimumReleaseAgeStrict: When false, pnpm falls back to a version that does not meet minimumReleaseAge; when true, resolution fails. It defaults to true when minimumReleaseAge is set explicitly, except in 11.0.0-11.0.3 and 12.0.0-12.2.x (see strictMode): pnpm 11.0.0 and 12.0.0 installed a version 4 hours old with minimumReleaseAge: 4320 on 2026-10-29, and 12.0.0 added it to minimumReleaseAgeExclude. ↗
• extra.cooldownExactVersions: pnpm 10.17.0: "Don't ignore the minimumReleaseAge check, when the package is requested by exact version". pnpm 10.16.0 installed typescript@7.1.0-dev.20261029.1, 4 hours old, with minimumReleaseAge: 4320 on 2026-10-29. ↗
• extra.lockfileDocuments: A lockfile whose first line is --- has two YAML documents: a boot document with configDependencies and packageManagerDependencies, written when the project has config dependencies, declares devEngines.packageManager or pins pnpm 12 or newer; then the project lockfile (importers, packages, snapshots), which is always the last document. Seen with pnpm 12.16.1 and packageManager pnpm@12.16.1 on 2026-10-29. ↗
• extra.lockfileFormat: lockfileVersion 9.0 (pnpm 9 to 12). Registry packages are keyed name@version; git dependencies name@git+<repo>#<commit> with resolution type git, or a tarball from a git host (gitHosted: true; older lockfiles lack the flag, so the host decides); tarball URLs name@https://…; local tarballs name@file:….tgz; local directories have resolution type directory; link: and workspace: dependencies appear only under importers. requiresBuild was removed in lockfile v9, so install scripts are not recorded. A tarball URL under the configured registry is resolved as that registry package and version (resolving/npm-resolver/src/parseBareSpecifier.ts in v10.34.9), so it is keyed name@version and keeps the URL only in the importer specifier; seen in lockfiles written by pnpm 10.34.9 and 12.16.1. ↗
• extra.npmrcPrecedence: pnpm 10 applies pnpm-workspace.yaml settings over .npmrc and npm_config_* variables; command-line options win over both (same order on v10.16.0). The 10.18.3 changelog says pnpm config set --location=project writes to pnpm-workspace.yaml "matching read priority". The 10.x docs do not state the order. ↗
• extra.npmrcCooldownKey: pnpm 10 reads minimum-release-age from .npmrc as a number and maps it to minimumReleaseAge (minutes), so the value means the same in both files; pnpm-workspace.yaml wins when both set it (npmrcPrecedence). pnpm 11.0.0 stopped reading it from .npmrc (ignoredSince). ↗
• extra.sharedWorkspaceLockfile: Same name and default in pnpm 11 and 12, where it is read only from pnpm-workspace.yaml. ↗
• extra.ignoredSince: Structured form of npmrcIgnored: from 11.0.0 on, other .npmrc settings and the package.json "pnpm" field have no effect. ↗
• extra.allowAllBuilds: off: the values that leave it off. pnpm tests the value for truth and checks no type: pnpm 10 and 11 read pnpm-workspace.yaml with js-yaml (extra.yamlMergeKeys) and copy each key as it is (getOptionsFromPnpmSettings at 10.28.0, applyWorkspaceSetting at 11.28.10), so a string such as "false", "no" or "true" is on; depcurfew treats every value but false, 0, null and an empty string as on. pnpm 12 reads it into an Option<bool> (dangerously_allow_all_builds in pnpm/crates/config/src/workspace_yaml/settings.rs at 12.16.1) with the YAML 1.1 words of serde-saphyr 0.0.29 (parse_yaml11_bool: true, yes, y, on and false, no, n, off, in any case and also quoted), and stops on any other value, so no value is on there that depcurfew reads as off. Boolean, default false; added in 10.9.0 ("Added a new setting, dangerouslyAllowAllBuilds, for automatically running any scripts of dependencies without the need to approve any builds", pnpm/CHANGELOG.md at v10.26.0). Packages set to false in allowBuilds (or build: false in permissions) stay blocked only from pnpm 12.12.0 (release notes at https://github.com/pnpm/pnpm/releases/tag/v12.12.0: "A package set to false in allowBuilds no longer runs its build scripts when dangerouslyAllowAllBuilds is true", "Previously, dangerouslyAllowAllBuilds ignored the denials"). pnpm 10, 11 and 12.0.0-12.11.x run them too: createAllowBuildFunction returns before it reads the lists ("if (opts.dangerouslyAllowAllBuilds) return () => true" in building/policy at 11.28.10 and builder/policy/src/index.ts at 10.34.9; allow_build_policy.rs at 12.0.0). ↗
• extra.excludeWildcards: Globs such as @myorg/* in minimumReleaseAgeExclude since 10.17.0. ↗
• extra.onlyBuiltDependencies: The allow-list before allowBuilds: package.json pnpm.onlyBuiltDependencies, added in 6.32.0 ("If this field exists, only mentioned packages will be able to run install scripts") and working since 6.32.1 ("released with a bug in v6.32.0"); also pnpm-workspace.yaml since 10.5.0 (10.5.0 changelog); removed in 11.0.0 (settings/build.md, see legacyAllowList). Before pnpm 10 any list, even an empty one, lets only the listed packages build (createAllowBuildFunction in @pnpm/builder.policy 3.0.0, which pnpm 9.15.0 uses). ↗
• extra.ignoredBuiltDependencies: The record of denied builds before allowBuilds (denyList): package.json pnpm.ignoredBuiltDependencies since 10.1.0 ("for explicitly listing packages that should not be built. When a package is in the list, pnpm will not print an info message about that package not being built"), and pnpm-workspace.yaml since 10.5.0 ("Allow to set the "pnpm" settings from package.json via the pnpm-workspace.yaml file"). The 10.26.0 entry for allowBuilds says that allowBuilds: { core-js: false } "achieves the same result as" ignoredBuiltDependencies: [core-js]. It only silences the report: createAllowBuildFunction (builder/policy/src/index.ts at v10.25.0) does not read it, so a package onlyBuiltDependencies names still builds. Deprecated in 10.26.0 and removed in 11.0.0 (see legacyAllowList). ↗
• extra.npmrcBuildSettings: pnpm 10 reads dangerously-allow-all-builds from the project .npmrc as from every .npmrc, with parseField of @pnpm/npm-conf, so every value but false, null and undefined is on (user.weakening). From 10.13.0 config/config/src/index.ts takes the build settings of all .npmrc files and npm_config_* variables aside (extractAndRemoveDependencyBuildOptions) and applies them only when pnpm-workspace.yaml and the "pnpm" field of package.json (from which getOptionsFromRootManifest takes onlyBuiltDependencies, onlyBuiltDependenciesFile and neverBuiltDependencies) set none of projectKeys (hasDependencyBuildOptions: a key that is not null or undefined); the list gained allowBuilds in 10.26.0 (dependencyBuildOptions.ts at 10.13.0, 10.25.0, 10.26.0 and 10.28.0; the file does not exist in 10.12.1). Before 10.13.0 the .npmrc value applies unless pnpm-workspace.yaml sets dangerouslyAllowAllBuilds itself (npmrcPrecedence). pnpm 11 reads only auth and registry settings from .npmrc (ignoredSince). ↗
• extra.yamlMergeKeys: pnpm-workspace.yaml and the global config.yaml (readWorkspaceManifest with cfgFileName) are read with read-yaml-file, which calls load of js-yaml with its default schema, and that schema has the merge type: read-yaml-file 3.0.0 with @zkochan/js-yaml 0.0.11 in 11.28.10, read-yaml-file 2.1.0 with @zkochan/js-yaml 0.0.9 in 10.28.0 and 0.0.11 in 10.34.9 (workspace/read-manifest/src/index.ts and pnpm-lock.yaml at those tags; lib/schema/default.js of the packages). pnpm 12 reads both files with serde_saphyr::from_str (pnpm/crates/config/src/workspace_yaml/parse_settings.rs at 12.16.1), whose default MergeKeyPolicy is Merge (serde-saphyr 0.0.29). So <<: *defaults brings the keys of the anchored map into the map, and settings set that way apply (a review run with pnpm 10.28.0: pnpm config get dangerouslyAllowAllBuilds gave true and installs ran scripts). A key written in the map itself wins over a merged one whatever their order (mergeMappings of js-yaml adds only missing keys; serde-saphyr adds merged entries whose key is not seen), and earlier maps of <<: [*a, *b] win over later ones; a quoted "<<" is an ordinary key. ↗
• extra.latestVersion: pnpm 12.0.0 shipped on 26 Aug and 11.0.0 on 28 Apr (GitHub shows no year; 2026 inferred from release order). 11.x and 10.x still receive patches. ↗
• extra.buildPermissions: permissions.<package>.build in pnpm-workspace.yaml: true lets the package run its build scripts, false denies them; the keys take the same forms as those of allowBuilds, and the entry outranks the package's allowBuilds entry (decided_build_approvals and apply_permissions in pnpm/crates/config/src/workspace_yaml/permissions.rs at v12.16.1, which warns when a package is in both). A string is an undecided placeholder (AllowBuild::Undecided in sections.rs). Added in 12.11.0 (docs/settings/build.md and docs/cli/permissions.md); pnpm approve writes a build decision there only when the file already has permissions. ↗
• extra.strictDepBuilds: When true, an unreviewed dependency build script fails the install. ↗
• extra.strictMode: In non-strict mode pnpm silently writes immature picks into minimumReleaseAgeExclude. Strict mode fails CI installs with ERR_PNPM_NO_MATURE_MATCHING_VERSION. ↗

Yarn (Berry)

• cooldown.configFiles: Also YARN_NPM_MINIMAL_AGE_GATE (general YARN_ env rule) and, since 4.17.0, npmScopes.<scope>.npmMinimalAgeGate. package.json cannot set it. ↗
• cooldown.unit: Bare numbers are minutes. Since 4.11.0 duration strings with ms, s, m, h, d or w (e.g. 3d, 1w) also work; on 4.10.x a string such as 7d silently had no effect. ↗
• cooldown.availableSince: The setting arrived in 4.10.0 (release notes, pull request and source; the security docs page at https://yarnpkg.com/features/security says 4.12). 4.10.2 fixed it: "Bust the metadata cache" (#6908) and "support registries without publish times using minimalAgeGate" (#6907). On 2026-10-29 Yarn 4.10.1 with npmMinimalAgeGate: 4320 refused zod@3.23.8 and esbuild@0.25.0, both over a year old ("No candidates found"), while 4.10.2, 4.10.3, 4.11.0 and 4.12.0 installed them and refused a version 4 hours old. depcurfew writes the setting from 4.10.2 on. ↗
• installScripts.defaultPolicy: Workspace scripts still run. Upgraded projects with an old lockfile get enableScripts: true written to .yarnrc.yml. Yarn 1 runs scripts unless --ignore-scripts is passed. ↗
• installScripts.allowList.file: Root package.json only; ignored inside workspaces. ↗
• installScripts.disableAll: Set in .yarnrc.yml; the default since 4.14.0. yarn install --mode=skip-build skips builds for one run. Berry ignores YARN_IGNORE_SCRIPTS. ↗
• sources.git.default: Upgraded projects with an old lockfile get ["**"] written to .yarnrc.yml. ↗
• project.lockfiles: Yarn Classic uses the same name; see berryLockfileMarker and classicLockfileHeader to tell them apart. ↗
• project.workspaces: Array of folder glob patterns. ↗
• user.files: Configuration.find adds .yarnrc.yml from the home folder (folderUtils.getHomeFolder: os.homedir(), else /usr/local/share) with the lowest priority, also for projects outside the home folder; the name stays .yarnrc.yml even when YARN_RC_FILENAME is set. The yarnrc page does not describe it; yarn config set -H writes the home file (https://yarnpkg.com/cli/config/set). The lookup is the same in 4.0.0, and the 2.2.0 changelog already speaks of the home configuration file; the first version was not tracked. ↗
• user.settings: Configuration.use knows no project-only settings, so the home file sets these wherever the version has them; the first versions are those of cooldown, cooldown.exclude and sources.git, and enableScripts is checked in 4.0.0. enableScripts: false denies every dependency build script (scriptsSwitch); buildsDeny is the closest purpose, since Yarn has no strict mode. The allow-list dependenciesMeta.<package>.built is read from the root package.json only (Project.getDependencyMeta), so Yarn has no user-level allow-list. depcurfew does not write npmScopes.<scope>.npmMinimalAgeGate. ↗
• user.unknownKeys: Configuration.use sets a key it does not know aside without an error when it comes from the home file, even with enableStrictSettings; other files throw. The 2.2.0 changelog: "Unsupported options will simply be silently ignored." ↗
• extra.yamlMergeKeys: parseSyml reads .yarnrc.yml with load of js-yaml and FAILSAFE_SCHEMA, which has no merge type (only strings, sequences and maps), so <<: *defaults is an ordinary key named <<: Configuration.use rejects it as an unrecognized setting in a project .yarnrc.yml (enableStrictSettings, default true) and sets it aside in the home file, so merged values never apply. Every scalar is a string to Yarn, which parses it per setting (parseValue in packages/yarnpkg-core/sources/Configuration.ts). ↗
• extra.classicUserFile: Yarn Classic (1.x, last release 1.22.22) reads .yarnrc and .npmrc from the project, its parent folders, the home folder (homeConfigLoc = ~/.yarnrc) and the global prefix (getPossibleConfigLocations in src/registries/npm-registry.js), never .yarnrc.yml, which only Yarn 2 and later read. depcurfew does not configure Yarn Classic. ↗
• extra.denyList: With built: false in the root package.json, Yarn reports that the build "has been explicitly disabled through configuration" as an info message instead of the warning that all build scripts are disabled; built: false also wins over enableScripts: true. Only the top-level manifest counts (CHANGELOG 2.0.0). ↗
• extra.commandLine: dlx.ts (documented at https://yarnpkg.com/cli/dlx) downloads the package named by the command, or the ones given with -p/--package, into a temporary environment and runs it. create.ts (yarn create, not on yarnpkg.com) takes -p/--package as well and runs create-<name>: @foo becomes @foo/create, @foo/app becomes @foo/create-app, foo becomes create-foo, and a name that already matches ^create(-|$) is kept (so is create alone). yarn add (https://yarnpkg.com/cli/add) takes packages as arguments; of its options only --mode takes a value. yarn workspace <workspaceName> <commandName> … runs a command within that workspace, e.g. yarn workspace components add -D react (https://yarnpkg.com/cli/workspace). ↗
• extra.packageSpecs: Protocols besides npm: and git: exec:, file:, jsr:, link:, patch:, portal: and workspace:. link: connects an external directory (https://yarnpkg.com/protocol/link), portal: a relative path to a package folder (https://yarnpkg.com/protocol/portal) and file: copies a folder or tarball. ↗
• extra.registryOverrides: Environment variables that start with yarn_ (any case) set the setting named by the camel-cased rest, so YARN_NPM_REGISTRY_SERVER sets npmRegistryServer, the registry packages are fetched from (https://yarnpkg.com/configuration/yarnrc#npmRegistryServer). getRcFilename reads yarn_rc_filename (any case) as the name of the configuration file instead of .yarnrc.yml. npmScopes, an object, cannot be set this way. ↗
• extra.lockfileFormat: Each entry has resolution: name@<locator>: npm:<version> for the registry, <repository>#commit=<sha> for git (GitHub shortcuts become https://github.com/<owner>/<repo>.git), an http(s) URL for tarballs, file:<path> (a .tgz or .tar.gz path is a tarball, anything else a directory), portal: and link: for directories, workspace: for workspace packages, and patch: around the URL-encoded original locator. No field records install scripts; dependenciesMeta.built: false is a user opt-out. ↗
• extra.durationStrings: npmMinimalAgeGate accepts a number followed by ms, s, m, h, d or w (e.g. 3d, 1w) since 4.11.0; on 4.10.x such a string silently had no effect. ↗
• extra.excludeWildcards: Name globs such as @scope/* or package* in npmPreapprovedPackages. ↗
• extra.classicLockfileHeader: Written as # yarn lockfile v${LOCKFILE_VERSION} with LOCKFILE_VERSION = 1 (src/constants.js). ↗
• extra.latestVersion: Yarn 6 is still in preview. ↗
• extra.perScopeGate: getMinimalAgeGate: for a scoped package, a number in npmScopes.<scope>.npmMinimalAgeGate (the scope name without @) replaces the global gate, longer or shorter, and 0 turns the gate off for that scope (acceptance tests "npmScopes override" in features/npmMinimalAgeGate.test.ts at 4.18.1; the code is the same in 4.17.0 and absent in 4.16.0). Each npmScopes entry is a shape whose unset properties get their defaults (parseShape and getDefaultValue in yarnpkg-core Configuration.ts), so a scope listed only for its registry gets the default of 1d (scopablePackageGateSettings in plugin-npm index.ts) instead of the global gate; read from the code, no test covers that case. ↗
• extra.upgradeMigration: Explicit values written by depcurfew prevent the migration. ↗

Bun

• cooldown.configFiles: Also the global $HOME/.bunfig.toml or $XDG_CONFIG_HOME/.bunfig.toml; local keys override global ones. Bun's .npmrc support has no min-release-age key. ↗
• cooldown.cliFlag: bun install, add and update; bunx honors it only since 1.4.4. ↗
• cooldown.unit: Plain numbers are seconds; 0 turns it off. Since 1.4.4 duration strings such as 90m, 12 hours, 3d or 2 weeks also work (the bunfig reference still documents seconds only). ↗
• cooldown.exclude.patternSyntax: Since 1.4.4 --minimum-release-age-excludes replaces the bunfig list for one command. ↗
• installScripts.defaultPolicy: Dependency scripts run only for Bun's built-in trusted list (npm-registry packages only since 1.4) or trustedDependencies; the root project's scripts run. First version of this policy not tracked. ↗
• installScripts.allowList.setting: Replaces the built-in default list rather than extending it. bun pm trust and bun add --trust write it. ↗
• installScripts.disableAll: Default false. Also --ignore-scripts or ignore-scripts=true in .npmrc. Skips the project's own scripts and trustedDependencies too. ↗
• project.workspaces: Full glob syntax, including ! patterns. ↗
• project.workspacesObjectKey: The object form also holds catalog and catalogs. ↗
• user.files: "When XDG_CONFIG_HOME is set to an absolute path, Bun reads the file there and not the one in $HOME"; HOME is USERPROFILE on Windows (src/bun_core/env_var.rs). Only one file is read, with no fallback when the XDG one is missing (get_home_config_path in src/bunfig/arguments.rs). Only package manager commands read it (bun install, add, remove, update, pm, bunx and so on), before the project bunfig.toml, whose keys win. 1.2.0 already reads it, and the first version was not tracked; 1.2.0 and 1.3.0 used XDG_CONFIG_HOME whenever it was set, and the version that started requiring an absolute path was not pinned. ↗
• user.settings: parse_install reads both from the user file as from bunfig.toml (only globalDir and globalBinDir are user-only), as in 1.3.0 (bunfig.zig). trustedDependencies exists only in package.json and bunfig has no such key, so Bun has no user-level allow-list; install.ignoreScripts only turns scripts off. Write whole seconds: duration strings need 1.4.4. ↗
• user.unknownKeys: The parser looks up only the keys it knows (install_obj.get), so another key, such as install.minimumReleaseAge before 1.3.0, is neither read nor reported. ↗
• user.invalidValueFails: load_global_bunfig ends the process through report_bunfig_load_failure when the user file has a value Bun cannot read, e.g. minimumReleaseAge = "3d" before 1.4.4 ("Expected number of seconds for minimumReleaseAge"), so every package manager command fails; 1.3.0 crashed the same way. A file Bun cannot read at all is skipped. ↗
• user.weakening: Both files fill one set of options, the user file first, so a key in the project bunfig.toml replaces the user value; an empty minimumReleaseAgeExcludes list is skipped, so a project's [] does not clear the user list. 0 turns the delay off (src/install/PackageManager/PackageManagerOptions.rs keeps only values above 0). The command line beats both files. ↗
• extra.commandLine: Options of bun add (snippets/cli/add.mdx) and bunx (snippets/cli/bunx.mdx) typed string or number; --catalog takes its name only after =. -p is --package for bunx but the flag --production for bun add, so it is listed with bunx only. The short forms -F (--filter) and -c (--config) of bun add are left out because bunx does not document them, and an option wrongly read as taking a value would hide the package after it. bunx is an alias for bun x (docs/pm/bunx.mdx). bun create <template> runs the create-<template> package from npm unless a local template has that name; it also takes GitHub repositories and local paths (docs/runtime/templating/create.mdx). ↗
• extra.packageSpecs: Git dependencies: "Bun supports a variety of protocols, including github, git, git+ssh, and git+https", with the examples git@github.com:moment/moment.git and github:colinhacks/zod. Tarball URLs, local folders and local .tgz files are accepted too. ↗
• extra.registryOverrides: bun add takes --registry and --config (-c), a configuration file (snippets/cli/add.mdx). BUN_CONFIG_REGISTRY sets the npm registry and environment variables take priority over bunfig.toml (pm/cli/install.mdx). ↗
• extra.lockfileFormat: bun.lock (text, the default since 1.2) maps each package to a tuple starting with name@<spec>: name@<version> followed by the registry for npm, name@git+<repo>#<sha> and name@github:<owner>/<repo>#<sha> for git, name@https://… for tarball URLs, name@./x.tgz (without file:) for local tarballs, name@file:<dir> and name@link:<dir> for directories, name@workspace:<dir> for workspace packages. The info object carries hasInstallScript: true only since 1.4.4, with no lockfileVersion change, so a missing flag proves nothing for older files. bun.lockb is an undocumented binary format. ↗
• extra.durationStrings: Since 1.4.4 minimumReleaseAge also takes duration strings such as 90m, 12 hours, 3d or 2 weeks; plain numbers stay seconds. ↗
• extra.excludeWildcards: minimumReleaseAgeExcludes takes exact package names (and name@version since 1.4.4), no wildcards. ↗
• extra.trustedDependenciesReplacesDefaults: So an empty list trusts no package: without the field Bun 1.4.4 ran esbuild's postinstall (esbuild is on the built-in list); with "trustedDependencies": [] it blocked it (bun pm untrusted listed it), tested on 2026-10-29. ↗

Deno

• cooldown.setting: A number or string, or the object form { "age": ..., "exclude": [...] }. Covers npm and JSR packages. ↗
• cooldown.configFiles: min-release-age in .npmrc since 2.8; also NPM_CONFIG_MIN_RELEASE_AGE. This page does not state precedence; denoland/deno#35458 gives CLI flag, deno.json, .npmrc, environment, built-in default. ↗
• cooldown.cliFlag: Alias --min-dep-age since 2.9.3. deno install honors it since 2.5.5; deno add, deno remove and deno x since 2.9.4. ↗
• cooldown.unit: Numbers are minutes; strings may be an ISO-8601 duration (P3D, PT72H), an absolute date or an RFC3339 timestamp; 0 turns it off. The .npmrc format differs (see npmrcFormat). ↗
• cooldown.default: Since 2.9 a 24-hour minimum applies when nothing is configured; set 0 to turn it off. Whether the default covers JSR is not stated. ↗
• cooldown.exclude.patternSyntax: Before 2.9.2 wildcard entries were stored literally and never matched. No CLI flag or .npmrc key for exclusions. ↗
• installScripts.defaultPolicy: npm lifecycle scripts run only when approved, and only with a node_modules directory. deno x / dx runs them after its download prompt is accepted. ↗
• installScripts.allowList.setting: deno approve-scripts writes it. --allow-scripts=npm:pkg on the CLI exists since 1.45. ↗
• installScripts.allowList.file: Must be set at the workspace root. ↗
• sources.git.setting: git+https: and git+ssh: dependencies are not supported in package.json. ↗
• sources.remoteTarball.setting: Tarball URL dependencies are not supported in package.json. ↗
• sources.file.setting: No setting. Since 2.8 file: and link: entries are silently skipped (scope disputed, see fileLinkSkipped); deno.json "links" overrides dependencies with local packages. ↗
• sources.directory.setting: No setting; local directories behave like file: and link: entries (see fileLinkSkipped). ↗
• project.lockfiles: The default location; lock.path in deno.json can move it and "lock": false turns it off. ↗
• project.workspaces: Paths of members; globs and ! exclusions since Deno 2.1. ↗
• user.files: Deno has no user configuration file of its own (deno.json is looked up from the working directory upwards). It reads .npmrc next to package.json or deno.json and in the home directory (HOME, USERPROFILE on Windows), not the file named by NPM_CONFIG_USERCONFIG and not under XDG_CONFIG_HOME. Home discovery arrived in 1.45.0 (#24021); since 2.1.8 (#27119) the project and home files are merged key by key, before that a project .npmrc hid the home one (Releases.md). This is the ~/.npmrc that npm reads. A home .npmrc Deno may not read is skipped; one that does not parse stops the command. ↗
• user.settings: 2.8.0: "feat(npmrc): support min-release-age (#33983)". A whole number of days (npmrcFormat); the same line sets npm's min-release-age, also in days. minimumDependencyAge.exclude and allowScripts exist only in deno.json (allowScripts at the workspace root), so Deno has no user-level exclusions or script settings. ↗
• user.unknownKeys: NpmRc::parse reads registry, auth, replace-registry-host, min-release-age and trust-policy keys and skips every other key without a message. ↗
• user.invalidValueFails: A min-release-age that is not a whole number of days, such as 72h, is ignored without a message (test "invalid value is ignored"), so the age silently comes from the next source. A home .npmrc that does not parse at all stops the command (libs/resolver/npmrc.rs). ↗
• user.weakening: The age comes from the command line, then minimumDependencyAge in deno.json, then .npmrc (the project file over the home file), then NPM_CONFIG_MIN_RELEASE_AGE, then the built-in 1440 minutes; 0 from .npmrc turns it off (apply_minimum_dependency_age_fallbacks). The same line turns npm's delay off too. ↗
• extra.denyList: The object form "allowScripts": { "allow": [...], "deny": ["npm:pkg"] } (schema since 2.6.0: "List of npm package constraints to deny running lifecycle scripts for"); deny beats allow, and a denied package is not added to the packages whose scripts were not run, so Deno does not warn about it. ↗
• extra.commandLine: install.md: deno install [PACKAGES] installs packages and adds them to deno.json or package.json, deno add is its alias, deno install --global installs a package or script as a binary, and deno install --entrypoint (-e) [FILES] installs what the files use. -n/--name, --root, --os and --arch take a value; --allow-scripts and --node-modules-dir are shown with =. Since Deno 2.8 a name without a prefix is an npm package; JSR packages need jsr: (add.md). x.md: deno x runs a package from npm or JSR without installing it, like npx (deno x npm:create-vite my-app); --package (-p) names the package when the binary differs (deno x -p typescript tsc), and npm:<package>/<binary> picks one binary; deno x --install-alias creates the dx alias. In Deno 2.9.8 (github.com/denoland/deno, cli/args/flags.rs) an executable whose name ends in dx, denox or dnx runs as deno x, and libs/cli_parser/src/defs.rs (X_SUBCOMMAND with COMPILE_ARGS, PERMISSION_ARGS, RUNTIME_MISC_ARGS and INSPECT_ARGS) gives the options of deno x that take a separate value; the permission flags take theirs after =. -L/--log-level is a global option with a value. ↗
• extra.lockfileFormat: deno.lock version 5 (the default since Deno 2.3) marks npm packages with lifecycle scripts as scripts: true (hasInstallScript from the registry or a preinstall, install or postinstall script, libs/npm/resolution/graph.rs); version 4 has no such field. tarball is written only for registries other than the default one. Deno rejects git and http(s) dependencies in package.json and keeps file: dependencies out of the lockfile. ↗
• extra.durationStrings: Strings are ISO-8601 durations (P3D, PT72H), an absolute date or an RFC3339 timestamp; the last two set a fixed cut-off instead of a delay. ↗
• extra.ageObjectKey: In the object form of minimumDependencyAge, age holds the delay and exclude the exemptions. ↗
• extra.excludeWildcards: A trailing * matches by prefix (npm:@scope/*) since 2.9.2; earlier wildcard entries never matched. ↗
• extra.npmSpecifierPrefix: Exclusions and allowScripts entries name npm packages as npm:<name>. ↗
• extra.allowAllScripts: allowScripts: true allows every npm lifecycle script. Only the JSON value true does: to_allow_scripts_config (libs/config/deno_json/mod.rs at v2.9.8) gives every package for true, none for false and null, and stops with "expected string array, boolean, or object" for a string or a number, so "true" or 1 cannot turn it on silently. ↗

uv

• cooldown.setting: Limits candidate packages to those uploaded before a date or, since 0.9.17, a duration ago. Compared with the upload time of each file, not the release date. false turns off a value from a lower-priority source (since 0.11.24). ↗
• cooldown.configFiles: Top level of uv.toml or the [tool.uv] table of pyproject.toml. uv searches the current directory and its parents and uses the first directory with uv.toml or a pyproject.toml that has [tool.uv]; uv.toml wins over [tool.uv] in the same directory, with a warning. In a workspace only the root is read. User (~/.config/uv/uv.toml) and system (/etc/uv/uv.toml) files are merged below the project file; uv tool and uvx read only those. UV_EXCLUDE_NEWER overrides the files. ↗
• cooldown.cliFlag: Also the UV_EXCLUDE_NEWER environment variable. ↗
• cooldown.unit: A "friendly" duration such as 24 hours, 1 week or 30 days, or an ISO 8601 duration such as P7D; months and years are rejected, a day is always 24 hours. An RFC 3339 timestamp is a fixed cutoff instead of a rolling delay. ↗
• cooldown.availableSince: Durations ("dependency cooldowns") since 0.9.17; before that exclude-newer took only dates, which do not move with time. Tested on 2026-10-30: uv 0.9.16 printed a warning that "100000 days" is not a date and resolved with no delay at all; 0.9.17 and later held back every version. ↗
• cooldown.default: No default: without a value every upload time is accepted. ↗
• cooldown.exclude.setting: A table mapping package names to false (exempt), a date or a duration; package values take precedence over the global and index values. ↗
• cooldown.exclude.availableSince: The table exists since 0.8.4 (dates); false, which exempts a package, since 0.9.25. Tested on 2026-10-30: with a false entry, uv 0.9.17 warned "data did not match any variant of untagged enum" and ignored the whole [tool.uv] table, the delay included; 0.9.25 and 0.13.6 exempted the package. ↗
• cooldown.exclude.patternSyntax: Keys are package names, compared after name normalization. ↗
• installScripts.defaultPolicy: no-build defaults to false: source distributions, git and directory dependencies are built, which runs their build backend. Installing a wheel runs no package code. ↗
• installScripts.allowList.setting: With no-build = true, the packages in no-binary-package are the only ones built from source ("Allow all to be overridden by specific binary exclusions"). Their wheels are not used, so they are always built. ↗
• installScripts.allowList.file: Or uv.toml; the same table as exclude-newer. ↗
• installScripts.allowList.availableSince: Project settings no-build, no-build-package, no-binary and no-binary-package; uv sync and related commands respect them since 0.4.6. ↗
• installScripts.disableAll: Operations that need to build a source distribution fail. Workspace members, editable requirements and wheels built earlier and kept in the cache are still used. With uv 0.13.6 on 2026-10-30, uv sync refused a git dependency and a non-editable local directory dependency as well ("marked as --no-build but has no binary distribution"), so those need an exception too. An explicit no-build = false in a higher-priority file makes uv ignore no-build-package. ↗
• project.lockfiles: Created next to pyproject.toml. ↗
• project.workspaces: The [tool.uv.workspace] table of the root pyproject.toml lists members and exclude (globs or paths); exclude wins over members, and the root is a member too. ↗
• project.workspacesObjectKey: The workspace guide calls members required, while the settings reference (crates/uv-workspace/src/pyproject.rs) gives it a default of []. ↗
• user.files: User-level configuration is <config dir>/uv/uv.toml: $XDG_CONFIG_HOME/uv, else ~/.config/uv on Linux and macOS (not ~/Library), %APPDATA%\uv, else uv in the Roaming AppData known folder, on Windows (FilesystemOptions::user in crates/uv-settings/src/lib.rs). The directory comes from the etcetera crate (crates/uv-dirs/src/lib.rs), which uses XDG_CONFIG_HOME only when it is an absolute path. Keys sit at the top level, as in [tool.uv] without the prefix; "User- and system-level configuration files cannot use the pyproject.toml format" (docs/concepts/configuration-files.md). The system file (/etc/uv/uv.toml, %PROGRAMDATA%\uv\uv.toml) is merged below it. Same path code at 0.9.0, 0.9.16 and 0.13.6; earlier versions are not tracked. ↗
• user.settings: Settings of uv.toml are merged with project-level configuration taking precedence over the user-level configuration: a project exclude-newer or no-build wins, exclude-newer-package tables are merged with the project keys winning, and lists such as no-build-package and no-binary-package are concatenated (crates/uv-settings/src/combine.rs). uv tool and uvx read only the user and system files, so the user file is the only file that gives them these settings; uv pip applies the top-level keys unless its [pip] table overrides them. The versions are those of the values depcurfew writes: a duration in exclude-newer since 0.9.17, package = false in exclude-newer-package since 0.9.25. no-build-package takes effect only while no-build is unset. ↗
• user.unknownKeys: uv.toml is parsed with deny_unknown_fields (OptionsWire), and fields allowed only in pyproject.toml (workspace, sources, dev-dependencies, conflicts, managed, package and others) are rejected by validate_uv_toml (crates/uv-settings/src/lib.rs, Error::PyprojectOnlyField); both are errors of the user file (see invalidValueFails). ↗
• user.invalidValueFails: FilesystemOptions::user() returns nothing only for a missing, not-a-directory or unreadable file; a TOML or schema error (Error::UvToml) is passed on, and crates/uv/src/lib.rs stops every command that reads configuration with it, unlike an invalid pyproject.toml, which is only warned about. So a value the installed uv does not know (a duration before 0.9.17, package = false before 0.9.25, exclude-newer = false before 0.11.24) breaks every uv command instead of being dropped. A required-version mismatch is reported before a schema error. ↗
• user.weakening: Tables are merged with the project keys winning, lists are extended and scalars come from the project when it sets them (combine.rs); with no-build = false, NoBuild::from_args ignores the package list (crates/uv-configuration/src/build_options.rs). exclude-newer = false (since 0.11.24) turns off a value from a lower-priority source, the system file included. Read from the code, not run: a [pip] exclude-newer in the user file is combined above the top-level keys for uv pip, so it can override a project exclude-newer there, and a user [[index]] with exclude-newer = false (preview, 0.11.5) exempts the packages of that index. The [pip] table configures "just the uv pip command line interface", and its settings win over the top-level ones there ("many of the settings in this section have corollaries in the top-level namespace which do apply to the uv pip interface unless they are overridden by a value in the uv.pip section", docs/concepts/configuration-files.md); PipOptions has exclude-newer (false disables it), exclude-newer-package, no-build and no-binary (a list, :all: for every package), and the top level no-binary = true builds every package from source (settings.rs). [pip] no-build = false weakens nothing: PipSettings::combine passes it to NoBuild::from_pip_args, which gives NoBuild::None (or the [pip] only-binary list) for false, and combines that with the top-level no-build and no-build-package (NoBuild::combine: All wins, None gives the other side), so it cannot turn the top-level no-build or no-build-package off; a project [tool.uv.pip] no-build wins over the user value anyway (crates/uv-cli/src/settings.rs and crates/uv-configuration/src/build_options.rs at 0.13.6, the same in crates/uv/src/settings.rs at 0.9.17). ↗
• user.variables: "Settings provided via environment variables take precedence over persistent configuration, and settings provided via the command line take precedence over both" (docs/concepts/configuration-files.md). UV_NO_BUILD_PACKAGE since 0.6.5, UV_NO_BINARY and UV_NO_BINARY_PACKAGE since 0.5.30 (lists separated by spaces), UV_NO_CONFIG since 0.2.30, UV_CONFIG_FILE since 0.1.34. UV_NO_BUILD, UV_NO_BINARY and UV_NO_CONFIG are flags parsed with the BoolishValueParser of clap (crates/uv-cli/src/lib.rs), whose true values are y, yes, t, true, on and 1 and false values n, no, f, false, off and 0, in any case (https://github.com/clap-rs/clap/blob/v4.6.7/clap_builder/src/util/str_to_bool.rs, the clap_builder version in the Cargo.lock of uv); a false value leaves the flag unset (flag() in crates/uv-cli/src/options.rs gives None), so the files decide (with UV_NO_BUILD=0 uv 0.11.32 still refused to build in a review test on 2026-10-31). XDG_CONFIG_HOME and APPDATA move the user directory (see files). ↗
• extra.pylockCreatedBy: uv export --format pylock.toml (and uv pip compile to pylock.toml) writes created-by = "uv". The project itself and workspace members are written as directory = { path = …, editable = true }, with the path relative to the lock file, "." for the project. ↗
• extra.configTables: Settings sit in [tool.uv] in pyproject.toml and at the top level of uv.toml. uv.toml cannot hold workspace, sources and a few other project fields. ↗
• extra.pyprojectTable: A pyproject.toml without a [tool.uv] table is ignored when uv searches for configuration. ↗
• extra.configPrecedence: A nested pyproject.toml with any [tool.uv] table hides the configuration of its parent directories. ↗
• extra.configFileOrder: "configuration will be read from uv.toml, and the [tool.uv] section in the accompanying pyproject.toml will be ignored"; uv prints a warning listing the ignored fields. ↗
• extra.workspaceRootOnly: "In workspaces, uv will begin its search at the workspace root, ignoring any configuration defined in workspace members." Project fields such as tool.uv.sources of a member still apply. ↗
• extra.buildSwitch: The project setting that forbids building source distributions. It also stops git and local directory dependencies (uv sync with uv 0.13.6 on 2026-10-30) and source archives, which also need a build; workspace members and editable requirements are still built. ↗
• extra.durationStrings: Either a "friendly" duration (24 hours, 1 week, 30 days) or an ISO 8601 duration (PT24H, P7D, P30D). ↗
• extra.durationUnits: Units in the documented examples: 24 hours, 1 week, 30 days. ↗
• extra.excludeWildcards: exclude-newer-package keys are exact package names. ↗
• extra.excludeValue: exclude-newer-package = { name = false } exempts the package from the delay. ↗
• extra.missingUploadTime: Unless the package is exempt, or the index has its own exclude-newer value or is exempt with [[tool.uv.index]] exclude-newer = false. ↗
• extra.requiredVersion: A PEP 440 specifier; uv exits with an error when its version does not match. Also at the top level of uv.toml. ↗
• extra.lockedSettings: uv.lock records these in [options] (a relative exclude-newer as exclude-newer-span); after a change uv lock --check and uv sync --locked fail until uv lock runs again ("Resolving despite existing lockfile due to addition of global exclude newer", seen with uv 0.13.6 on 2026-10-30). no-build and no-binary-package are not recorded. ↗
• extra.commandLine: clap arguments of uv add, uv pip install, uv tool install, uv run and uv tool run (uvx), with the global options, IndexArgs, ResolverInstallerArgs, BuildOptionsArgs and DependencyConstraintsArgs they share. --opt value, --opt=value, -o value and -ovalue all work; long options cannot be shortened. Options of uv run, uv tool run and uvx come before the command. --with, --with-editable and --with-executables-from add packages, as a list split at commas outside [...] that are not followed by !, =, <, > or ~ (comma.rs). uvx and uv tool run take the package from the first argument (name@version is ==version, name@latest the newest) unless --from names it; a first argument such as python, python3.12, pypy@3.8 or graalpy runs an interpreter (PythonRequest::try_from_tool_name in uv-python-types, implementation names cpython, pypy, graalpy and pyodide). uv run runs a command and downloads only what --with names, or a script given as an http or https URL. -e takes a path in uv pip install but is a flag in uv tool install, and --editable a flag in uv add; --no-binary and --only-binary take values in uv pip install only, -m is --marker in uv add and --module in uv run. ↗
• extra.registryOverrides: IndexArgs (lib.rs): --index adds an index (name=url allowed), --default-index replaces PyPI, --index-url and --extra-index-url are their deprecated forms, --find-links adds a page or directory of archives; each has the variable named here. --config-file and UV_CONFIG_FILE name a uv.toml that may set any index. uv does not read pip.conf or PIP_INDEX_URL (docs/pip/compatibility.md). ↗
• extra.selection: VersionSelectionArgs: --prerelease takes disallow, allow, if-necessary, explicit or if-necessary-or-explicit (UV_PRERELEASE); allow considers pre-releases of every package and disallow none (docs/concepts/resolution.md); --prerelease-package takes PACKAGE=MODE; the hidden --pre means allow. BuildOptionsArgs of uv add, uv run, uv tool install and uv tool run (uvx): --no-binary (UV_NO_BINARY, a boolean) installs every package from source, --binary turns it off, --no-binary-package names one package (UV_NO_BINARY_PACKAGE, separated by spaces). uv pip install takes --no-binary and --only-binary as lists separated by commas with :all: and :none:, as pip does (PipInstallArgs). ↗
• extra.latestVersion: Released on 2026-10-26. ↗
• extra.pipTable: For uv pip commands, PipSettings::combine merges the [pip] table of a configuration file above its top-level keys ("Merge the top-level options (tool.uv) with the pip-specific options (tool.uv.pip), preferring the latter"): [pip] exclude-newer replaces the top-level value (false turns the delay off), [pip] exclude-newer-package entries win over top-level entries for the same package, and [pip] no-binary (package names, or :all:) is added to the top-level no-binary-package (NoBinary::combine in crates/uv-configuration/src/build_options.rs). [pip] no-build and only-binary are joined with the top-level no-build, so they cannot turn it off. Commands outside uv pip ignore [pip] ("These values will be ignored when running commands outside the uv pip namespace", PipOptions in crates/uv-settings/src/settings.rs). keys maps each top-level key depcurfew writes to the [pip] key that overrides or extends it. The same code in 0.11.32 (crates/uv/src/settings.rs). ↗

pip

• cooldown.setting: Only files uploaded before the given time are considered; applies to packages from remote indexes, not to local files, find-links directories or VCS requirements. Isolated build environments get the same cutoff. ↗
• cooldown.configFiles: pip reads no configuration from the project: only the global, user and site (virtual environment) pip.conf, the file named by PIP_CONFIG_FILE and PIP_* environment variables. --uploaded-prior-to is not allowed in requirements files, so a project sets it through PIP_UPLOADED_PRIOR_TO or the command line, e.g. in CI. ↗
• cooldown.cliFlag: pip install, download, wheel, lock, index and list; environment variable PIP_UPLOADED_PRIOR_TO. ↗
• cooldown.unit: A duration is written PnD, a whole number of days (P3D, matched by ^P(\d+)D$); P1W, PT24H and "7 days" are rejected. An ISO 8601 date or time is a fixed cutoff instead. A day is always 24 hours. ↗
• cooldown.availableSince: pip 26.1 accepts a duration in days ("P3D for 3 days ago"); the option itself exists since 26.0 with dates only. ↗
• cooldown.default: Off unless given. ↗
• installScripts.defaultPolicy: pip builds a source distribution when no wheel fits, which runs its build backend; the secure-installs guide recommends --only-binary :all:. Installing a wheel runs no package code. ↗
• installScripts.allowList.setting: After --only-binary=:all:, a package named in --no-binary may only be installed from source: a name wins over :all:, so its wheels are not used. --only-binary=:all: given after it clears the exception. ↗
• installScripts.allowList.file: --only-binary and --no-binary are among the options a requirements file may contain. ↗
• installScripts.allowList.format: Each use adds to the set; :all: and :none: are special values. ↗
• installScripts.disableAll: Allowed in requirements files and pip.conf (only-binary). Enforced only for packages from indexes and find-links: VCS, local directory and direct URL source requirements are still built. ↗
• project.lockfiles: pip lock (experimental since 25.1) writes pylock.toml; pip install -r pylock.toml is experimental since 26.1. The specification also allows pylock.<name>.toml (extra.lockfilePattern). ↗
• project.manifests: "requirements.txt is usually what these files are named (although, that is not a requirement)"; the format is meant only for pip. ↗
• user.files: The user file is pip.conf (pip.ini on Windows) in appdirs.user_config_dir("pip") (configuration.py), written in INI with [global] and per-command sections. Linux: $HOME/.config/pip/pip.conf, "which respects the XDG_CONFIG_HOME environment variable" (used when it is not empty after stripping spaces, vendored platformdirs _xdg.py). A relative XDG_CONFIG_HOME is used as it is, so pip reads <value>/pip/pip.conf relative to the directory each command runs in: XDGMixin.user_config_dir in src/pip/_vendor/platformdirs/_xdg.py at 26.2.2 returns the stripped value with no absolute-path check, _append_app_name_and_version (api.py) only joins the app name, and utils/appdirs.py and configuration.py (os.path.join, then os.path.exists and parser.read) make nothing absolute; 26.1.1 (platformdirs 4.5.1, Unix.user_config_dir in unix.py) does the same without stripping the value. macOS: ~/Library/Application Support/pip when that directory exists, else ~/.config/pip, where XDG_CONFIG_HOME is not used (utils/appdirs.py: _macos_user_config_dir takes platformdirs user_data_dir when os.path.isdir); since 26.2 that user_data_dir is $XDG_DATA_HOME/pip when XDG_DATA_HOME is not empty after stripping spaces, so with XDG_DATA_HOME set the Library directory is skipped and ~/.config/pip is used unless $XDG_DATA_HOME/pip exists (XDGMixin in src/pip/_vendor/platformdirs/_xdg.py at 26.2.2; src/pip/_vendor/vendor.txt names platformdirs 4.10.0 in 26.2 and 4.5.1 in 26.1.1, whose macos.py has no XDG handling). Windows: %APPDATA%\pip\pip.ini; platformdirs asks Windows for the Roaming AppData known folder, which APPDATA normally names. The legacy ~/.pip/pip.conf (%HOME%\pip\pip.ini) is loaded as well, below this file. Same path code in 25.0; earlier versions are not tracked. A command reads [global] and the section named after itself, which wins key by key (override_order ["global", self.name, ":env:"] in cli/parser.py); the options doctor --user checks (index_group and package_selection_group in cli/cmdoptions.py) belong to install, download, wheel, lock, index and list (src/pip/_internal/commands at 26.2.2). Keys are read without regard to case and with underscores as dashes, so only_binary in a file is the same setting as only-binary, and the later one wins (_normalize_name in src/pip/_internal/configuration.py at 26.2.2: name.lower().replace("_", "-"), applied to every key of every file). ↗
• user.settings: depcurfew writes them in [global], which reaches every command that has the option (install, download, wheel, lock, index, list) and the resolver of pipenv lock; [install] reaches only pip install. "Accept --no-binary and --only-binary via pip.conf" (7.1.0); uploaded-prior-to is read from pip.conf like every long option ("To override a duration set in configuration, pass P0D on the command line", user_guide.rst). 26.1.0 because depcurfew writes a PnD duration: pip 26.0 takes dates only and aborts on P7D, and 25.x ignores the key. uv does not read pip.conf. ↗
• user.unknownKeys: "Ignore options not present in this parser": a key that is not an option of the command is skipped without a word (same code in 25.0), so pip before 26.0 ignores uploaded-prior-to. ↗
• user.invalidValueFails: A pip.conf that is not valid INI stops pip (ConfigurationFileCouldNotBeLoaded, configuration.py), and a value an option rejects ends the command with a usage error: pip 26.0 aborts on uploaded-prior-to = P7D in every command that has the option, as it rejected PIP_UPLOADED_PRIOR_TO=P100000D in a test on 2026-10-30 (configuration values and PIP_* variables go through the same parsing). Commands without the option ignore the key. ↗
• user.weakening: In any section of any pip.conf: [install] beats [global], and a later file (a virtual environment pip.conf, PIP_CONFIG_FILE) beats the user file per key, an empty value removing it (cli/parser.py). :all: in one of the lists clears the other and :none: clears its own (handle_mutual_excludes). P0D overrides a configured duration, and "Local package files are allowed regardless of the --uploaded-prior-to setting", find-links directories included (user_guide.rst). A requirements file can also pass --no-binary or --only-binary, but not --uploaded-prior-to. ↗
• user.variables: "Note that if a file exists at the location that this is set to, the user config file will not be loaded." PIP_<NAME> variables are applied after the [global] and command sections of all files, and the command line beats them (cli/parser.py, override_order). --isolated, a flag, ignores environment variables and user configuration. XDG_CONFIG_HOME (Linux) and XDG_DATA_HOME (macOS, 26.2) move the user directory (see files). ↗
• extra.configSections: "Each subcommand can be configured optionally in its own section. This overrides the global setting with the same name", and "A command specific section in the config file [<command>] host = bar overrides the option with same name in the [global] config file section" (Precedence / Override order). pip reads only [global], the section of the running command and :env: (override_order = ["global", self.name, ":env:"] in cli/parser.py), so a managed key in [install] wins over [global] for pip install; depcurfew comments such keys out in every section other than [global]. ↗
• extra.pylockCreatedBy: pip lock writes created-by = "pip". ↗
• extra.requirementsOptions: SUPPORTED_OPTIONS in pip 26.2.2 (--pypi-url is a second name of --index-url in cmdoptions.py); per requirement also --hash and -C/--config-settings (extra.requirementsParser). Any other option, --uploaded-prior-to included, makes the file fail to parse. ↗
• extra.requirementsParser: build_parser reads each line with optparse.OptionParser(add_help_option=False) holding SUPPORTED_OPTIONS and SUPPORTED_OPTIONS_REQ (--hash, -C/--config-settings), with the names from cmdoptions.py in pip 26.2.2. optparse takes a long option shortened to a prefix that names exactly one of them (_match_abbrev; an exact name wins), so --no-bin :all: is --no-binary :all:, and an ambiguous prefix such as --no is an error. --hash and --config-settings belong to the requirement on their line; on a line of their own they are accepted and ignored. ↗
• extra.configFileNames: CONFIG_BASENAME is pip.ini on Windows and pip.conf elsewhere; pip looks for it only in the global, user and site locations, never in the project. ↗
• extra.configFileVariable: Names a configuration file pip loads last; set to os.devnull it turns all configuration files off. ↗
• extra.environmentVariable: Every long option has a PIP_<UPPER_LONG_NAME> variable with dashes replaced by underscores. Tested on 2026-10-30: pip 25.3 ignored PIP_UPLOADED_PRIOR_TO=P100000D without a word, 26.0 rejected the duration (dates only), 26.1 and 26.2.2 found no version. ↗
• extra.durationStrings: Only whole days, written PnD, are accepted. ↗
• extra.missingUploadTime: Upload times exist only in the JSON form of the simple repository API (PEP 700); indexes that serve only HTML have none. ↗
• extra.lockfileFormat: Each [[packages]] entry has exactly one of vcs (always built), directory (always built), archive (a source tree or wheel at a URL or path) or sdist and wheels from an index. A package with an sdist and no wheels is built when installed. A relative directory path is relative to the lock file. The required top-level created-by records the name of the tool that wrote the file, preferably its normalized Python package name. ↗
• extra.requirementsFormat: VCS requirements start with git+, hg+, svn+ or bzr+, alone or after "name @"; a direct reference is "name @ URL" (PEP 508); -e installs a project path or VCS URL in editable mode. The legacy #egg= fragment names the project of a VCS URL. Lines ending with a backslash continue on the next line, and # starts a comment (requirements-file-format.md). ↗
• extra.requirementsIncludes: Option names from cli/cmdoptions.py. A relative path is relative to the directory of the file that includes it, and a file given as an http, https or file URL is downloaded (req_file.py, _parse_and_recurse); a file that includes itself is an error. ↗
• extra.requirementsPaths: A requirement that contains a path separator (/, and \ on Windows) or starts with . looks like a path (_looks_like_path): a directory there is a project built from source. A name with an archive extension (utils/filetypes.py) is a local archive, even when the file does not exist. http, https, ftp and file URLs are links (utils/urls.py, is_url). ↗
• extra.lockfilePattern: A named lock file, next to or instead of pylock.toml; pip lock -o writes any name. ↗
• extra.commandLine: pip and pip3 are the console scripts of the package (pyproject.toml). The options of pip install (install.py) and the general options of every command (cmdoptions.py, general_group), which may also come before install. pip reads them with optparse: --opt value and --opt=value, -rFILE and -r FILE, grouped short flags, and a long option shortened to any prefix that names one option (cli/parser.py keeps optparse's matching), so --extra means --extra-index-url. -e takes a local project path or a VCS URL to install in editable mode. -r, -c, --requirements-from-script and --group read requirements from files of the project. ↗
• extra.registryOverrides: index_group: --index-url (alias -i, --pypi-url) is the base URL of the package index, --extra-index-url adds indexes, --find-links (-f) adds an HTML page or a directory of archives. Every long option can be set as PIP_<UPPER_LONG_NAME>, dashes replaced by underscores (docs/html/topics/configuration.md); PIP_CONFIG_FILE names a configuration file loaded last, which may set any index. Requirements files may set --index-url, --extra-index-url and --find-links too (req/req_file.py). ↗
• extra.selection: --pre includes pre-release and development versions (pip only finds stable versions by default) and stands for --all-releases :all:; --all-releases and --only-final take :all:, :none: or package names separated by commas and allow or forbid pre-releases of those packages (models/release_control.py, allows_prereleases: a named package first, then :all:). --no-binary and --only-binary take the same lists: --no-binary keeps pip from using wheels, so the package is built from source, --only-binary from using source distributions (models/format_control.py, handle_mutual_excludes and get_allowed_formats). Each long option can also be set as PIP_<NAME> (docs/html/topics/configuration.md), which the command line overrides. ↗
• extra.pipxSelection: pipx forwards the standard PIP_* variables to pip (except PIP_USER, PIP_DISABLE_PIP_VERSION_CHECK, PIP_TARGET and PIP_KEYRING_PROVIDER); the uv backend ignores them (docs/how-to/use-private-index.rst). pipx has no option of its own for pre-releases or source builds; --pip-args may carry them. ↗
• extra.pipxCommandLine: pipx installs applications from PyPI with pip (or uv) in environments of their own. pipx install takes one or more package specs, a VCS URL, a local path or archive, or a script (--preinstall adds packages to the environment; -f is --force, not find-links). pipx run takes the app first (argparse REMAINDER, so its options come before it), --spec names the package to install and run, --with adds packages; a first argument ending in .py is a local script, or a script to download when it is a URL (docs/how-to/run-scripts.rst). argparse accepts abbreviated long options. ↗
• extra.pipxRegistryOverrides: --index-url is the base URL of the index; --pip-args is split and handed to pip, so it may carry --extra-index-url, --find-links or --no-index. With the pip backend pipx passes the PIP_* variables on to pip; with the uv backend it ignores them and uv reads its own (docs/how-to/use-uv-backend.rst); both kinds are registry variables of pip and uv. ↗
• extra.latestVersion: Released on 2026-10-20. ↗

Poetry

• cooldown.setting: A version is ignored while any of its files was uploaded less than the given number of days ago. Applies when dependencies are resolved (poetry lock, add, update); poetry install installs the locked versions without checking. ↗
• cooldown.configFiles: The local configuration next to pyproject.toml (poetry config --local), not pyproject.toml itself. Environment variables (POETRY_SOLVER_MIN_RELEASE_AGE) win over poetry.toml, which wins over the user config.toml. ↗
• cooldown.unit: An integer; 0 (the default) turns it off. ↗
• cooldown.availableSince: "Introduced in 2.4.0"; announced as dependency cooldowns. Tested on 2026-10-30: Poetry 2.3.4 locked with min-release-age = 100000 in poetry.toml without a word, while 2.4.0 and 2.5.1 found no version. ↗
• cooldown.default: Default 0: all versions are considered. ↗
• installScripts.defaultPolicy: Without installer.only-binary, packages are built from source distributions when no wheel fits, which runs their build backend. Git and directory dependencies are always built. Installing a wheel runs no package code. ↗
• installScripts.allowList.setting: With installer.only-binary = [":all:"], the packages named in installer.no-binary are the only ones built from source; explicit names take precedence over :all: since 2.2.0. Their wheels are rejected, so they are always built. ↗
• installScripts.allowList.file: The docs recommend configuring it with --local for a project. ↗
• installScripts.allowList.availableSince: "explicit package names will take precedence over :all:" (#10278). Before 2.2.0 a package listed in both settings has no file left to install. ↗
• installScripts.allowList.format: poetry config stores the value as a list; written by hand, a boolean is not normalized. ↗
• installScripts.disableAll: Since 2.0.0; the value [":all:"] forbids source distributions for every package. Applied only when installing: resolving dependencies may still build source distributions without static metadata, and git, path and url dependencies are built regardless. ↗
• project.lockfiles: Next to pyproject.toml. ↗
• user.settings: Every setting of Config.default_config is read from the user config.toml ("As with all configurations described here, this is a user specific configuration", docs/configuration.md); dotted names are nested tables. A project poetry.toml replaces a user value, lists included (merge_dicts in src/poetry/utils/helpers.py), and POETRY_* variables beat both. Names in installer.no-binary win over installer.only-binary = :all: only since 2.2.0. solver.min-release-age-exclude is written as a TOML array (see extra.excludeFormat). ↗
• user.weakening: Precedence: environment variables, then the local poetry.toml, then the global config.toml, then the default; a poetry.toml key replaces the user value, lists included. solver.min-release-age-exclude-source (2.4.0) takes source names from pyproject.toml or URLs. A source that gives no upload times is not filtered at all. ↗
• user.variables: Any setting can be set as POETRY_ plus its name in capitals with dots and dashes replaced by underscores, and environment variables come first in the precedence ("Configuration sources"). POETRY_CONFIG_DIR replaces the platform directory (src/poetry/locations.py). ↗
• extra.pylockCreatedBy: Poetry exports pylock.toml with its export plugin (poetry export --format pylock.toml), which writes created-by = "poetry-plugin-export". ↗
• extra.configTable: poetry config writes dotted settings as nested tables, e.g. [solver] min-release-age = 7. ↗
• extra.pyprojectTable: A [tool.poetry] table marks a Poetry project; Poetry also accepts a [project] table with a static name and version, which other tools use as well. ↗
• extra.buildSwitch: installer.only-binary was added in 2.0.0; [":all:"] forbids source distributions of index packages when installing. Git and directory dependencies, and source archives from a URL or path, are built regardless (src/poetry/installation/executor.py at 2.5.1). ↗
• extra.excludeWildcards: Package names only. ↗
• extra.requiredVersion: A version constraint in pyproject.toml; a Poetry version outside it raises an error. Poetry 1.x does not know the key. ↗
• extra.commandLine: poetry add takes package specs: a name, name@constraint, a PEP 508 requirement, a git URL, a path or an archive URL. Options with a value: --group (-G), --extras (-E), --optional, --python, --platform, --markers and --source of add, and the global --directory (-C) and --project (-P); -e/--editable, -D/--dev, --allow-prereleases, --dry-run and --lock are flags (src/poetry/console/commands/add.py). cleo reads -Gdocs and -G docs; long options cannot be shortened. poetry install takes no package specs. ↗
• extra.registryOverrides: --source names a package source of [[tool.poetry.source]] in pyproject.toml (or pypi) to take the package from. The POETRY_REPOSITORIES_<NAME>_URL variables are for publishing only; no variable sets a package source. ↗
• extra.versionConstraints: poetry add name@constraint takes any constraint valid in pyproject.toml, and name@latest the newest release; extras go before the @ (name[extra]@^4.0.0). ^ keeps the left-most non-zero part of major.minor.patch: ^1.2.3 is >=1.2.3 <2.0.0, ^1.2 is >=1.2.0 <2.0.0, ^1 is >=1.0.0 <2.0.0, ^0.2.3 is >=0.2.3 <0.3.0, ^0.0.3 is >=0.0.3 <0.0.4, ^0.0 is >=0.0.0 <0.1.0, ^0 is >=0.0.0 <1.0.0. ~ allows patch changes, or minor changes when only a major version is given: ~1.2.3 is >=1.2.3 <1.3.0, ~1.2 is >=1.2.0 <1.3.0, ~1 is >=1.0.0 <2.0.0. * is any version, 1.* is >=1.0.0 <2.0.0, 1.2.* is >=1.2.0 <1.3.0. ~=, inequalities and == as in PEP 440, several separated by commas; a bare version (1.2.3) is that version only. Poetry prefers stable releases and takes a pre-release only when no stable release satisfies the constraint. ↗
• extra.selection: installer.no-binary (POETRY_INSTALLER_NO_BINARY) disallows wheels for :all: or true, none for :none: or false, or the named packages separated by commas; installer.only-binary (POETRY_INSTALLER_ONLY_BINARY, since 2.0.0) takes the same values; explicit package names win over :all:. poetry add --allow-prereleases accepts pre-releases (src/poetry/console/commands/add.py). ↗
• extra.latestVersion: Released on 2026-09-20. ↗

PDM

• cooldown.setting: In the [tool.pdm.resolution] table of pyproject.toml: distributions uploaded after the cutoff are left out when dependencies are resolved (pdm lock, add, update). The --exclude-newer option of pdm lock wins over it, and it wins over strategy.exclude-newer in the PDM configuration. ↗
• cooldown.configFiles: The [tool.pdm.resolution] table. ↗
• cooldown.cliFlag: pdm lock --exclude-newer, since 2.13.0. ↗
• cooldown.unit: An RFC 3339 timestamp, a UTC date or a relative duration N{d|h|w} such as 7d, 12h or 3w, counted from the current UTC time. ↗
• cooldown.availableSince: "Support exclude-newer in pyproject.toml in the [tool.pdm.resolution] table" (#3776); the pdm lock option exists since 2.13.0. ↗
• cooldown.default: No default: without a value every upload time is accepted. ↗
• cooldown.exclude.setting: A table [tool.pdm.resolution.exclude-newer-override] of package = false (no cutoff) or package = another date or duration; package-specific values win over the global cutoff. ↗
• cooldown.exclude.availableSince: "Allow package-specific overrides for exclude-newer resolution limits" (#3809). ↗
• installScripts.defaultPolicy: Without only-binary, PDM locks and installs source distributions when they fit, which builds them and runs their build backend. Installing a wheel runs no package code. ↗
• installScripts.allowList.setting: The packages in no-binary are locked and installed from source distributions only. A name in no-binary wins over only-binary = ":all:" (FormatControl of unearth, which PDM uses), so with both the named packages are the only ones built, and always from source. ↗
• installScripts.allowList.file: The [tool.pdm.resolution] table. ↗
• installScripts.allowList.availableSince: no-binary, only-binary and prefer-binary keys in [tool.pdm.resolution] (#2656). ↗
• installScripts.disableAll: only-binary = ":all:" locks and installs only wheels. The variables PDM_ONLY_BINARY and PDM_NO_BINARY win over pyproject.toml. ↗
• project.lockfiles: pdm.lock next to pyproject.toml; pdm lock --lockfile writes another name. ↗
• user.settings: "Allow configuring the default lock --exclude-newer value with strategy.exclude-newer" (2.27.0, #3795): a TOML string such as "7d", a date or an RFC 3339 time. It applies where neither [tool.pdm.resolution] exclude-newer in pyproject.toml nor a project pdm.toml sets it (docs/usage/lockfile.md), and with it in effect pdm lock resolves every package again (src/pdm/cli/commands/lock.py). only-binary, no-binary and exclude-newer-override cannot be set in any PDM configuration file: PDM reads them from [tool.pdm.resolution] in pyproject.toml, only-binary and no-binary also from PDM_ONLY_BINARY and PDM_NO_BINARY (environments/base.py, Project.env_or_setting), so at user level they can be set only through those variables. ↗
• user.weakening: use_uv (experimental since 2.19.0, PDM_USE_UV) can be set in config.toml and in a project pdm.toml, which wins. PDM passes the cutoff and the build settings to uv lock but not to uv sync --frozen (src/pdm/installers/uv.py), and passes no --no-config, so uv also reads the user uv.toml. A home strategy.exclude-newer cannot weaken a project that sets [tool.pdm.resolution] exclude-newer. use_uv is a switch that turns a protection off and is read with ensure_boolean (src/pdm/project/config.py at 2.29.5): a TOML boolean or number is kept, and a string is false only when empty or false, no or 0 in any case; depcurfew counts every other value as on (other spellings of false too, which errs towards a warning). ↗
• user.variables: env_or_setting returns os.getenv(var) or the pyproject.toml setting, so a non-empty PDM_ONLY_BINARY or PDM_NO_BINARY wins (environments/base.py). -c/--config and PDM_CONFIG_FILE name the home config file (src/pdm/core.py). PDM_USE_UV is the variable of use_uv, and variables beat pdm.toml and config.toml (src/pdm/project/config.py). ↗
• extra.pylockCreatedBy: PDM's pylock.toml export writes created-by = "pdm". ↗
• extra.configTables: exclude-newer, its overrides, only-binary and no-binary share the table. ↗
• extra.pyprojectTable: PDM keeps its settings in [tool.pdm] of pyproject.toml. ↗
• extra.buildSwitch: only-binary in [tool.pdm.resolution] since 2.15.0 (#2656). It covers packages from an index: git, URL and path requirements already name their source and are built regardless (candidates.py). ↗
• extra.durationStrings: "pdm lock --exclude-newer now accepts relative durations in the format N{d|h|w}" (#3760). ↗
• extra.durationUnits: Written as Nh, Nd and Nw. ↗
• extra.excludeWildcards: Override keys are package names. ↗
• extra.excludeValue: package = false disables the cutoff for that package. ↗
• extra.missingUploadTime: The index must give upload-time (PEP 700); an override of false lifts it for the package. ↗
• extra.lockedSettings: pdm.lock keeps a content_hash of the whole [tool.pdm.resolution] table (PyProject.content_hash), or with canonical lock inputs (lock_inputs = true, since 2.28.1) the table itself (src/pdm/project/lockfile/freshness.py), so a change to any key in it, exclude-newer and only-binary included, makes the lockfile out of date. pdm lock --check and pdm install --check then exit with 1 ("Lockfile doesn't satisfy the project requirements"), pdm install without --check locks again first and pdm sync only warns (check_lockfile in src/pdm/cli/actions.py) until pdm lock runs again; with exclude-newer set, pdm lock resolves every package again (src/pdm/cli/commands/lock.py). ↗
• extra.commandLine: pdm add takes requirements as arguments and editable ones with -e; its options come from cli/options.py and the global ones (-c/--config, --pep582, -I, -n, --no-cache) from core.py. --venv and --pep582 take an optional value, so argparse takes the next word for it. PDM parses with argparse, which accepts abbreviated long options. ↗
• extra.registryOverrides: pypi.url, the index PDM uses when pyproject.toml names no source called pypi, can be set with PDM_PYPI_URL (docs/usage/config.md); -c/--config and PDM_CONFIG_FILE name another configuration file, which may set any index. ↗
• extra.selection: pdm add --pre/--prerelease allows pre-releases of the added packages to be pinned and --stable only stable versions (prerelease_option; commands/add.py sets req.prerelease). PDM_NO_BINARY and PDM_ONLY_BINARY are lists of packages separated by commas, :all: for every package, of which no wheel, or only wheels, are locked and installed (docs/usage/lockfile.md; environments/base.py, _setting_list). ↗
• extra.latestVersion: Released on 2026-10-30. ↗

Pipenv

• cooldown.setting: In the [pipenv] section of the Pipfile: the resolver considers only versions uploaded at least that many days ago. Pipenv computes a cutoff (now minus N days, UTC) and hands it to pip as uploaded-prior-to. ↗
• cooldown.configFiles: The [pipenv] section. ↗
• cooldown.unit: A string in <int>d format, e.g. "30d"; any other form is rejected (pipenv/vendor/plette/models/sections.py). ↗
• cooldown.availableSince: "Added support for cool-down-period in the [pipenv] section of the Pipfile" under 2026.6.2 (repeated under 2026.7.0 and 2026.7.1). Checked against the wheels on 2026-10-30: missing in 2026.6.1, present in 2026.6.2. ↗
• cooldown.default: Off unless set. ↗
• installScripts.defaultPolicy: Pipenv installs with pip, which builds source distributions when no wheel fits. Pipenv honors pip configuration and PIP_* variables, which may forbid building (PIP_ONLY_BINARY=:all:), but the Pipfile has no setting for it. ↗
• project.lockfiles: JSON, generated next to the Pipfile. ↗
• project.manifests: TOML. ↗
• user.files: Pipenv has no user configuration file of its own: it reads environment variables (set in a shell profile), the project .env file and pip configuration; pipenv/environments.py looks up no file. Since 2026.3.0 the pip install step runs with PIP_CONFIG_FILE=/dev/null (pipenv/utils/pip.py; CHANGELOG.md, #6066), so a user pip.conf no longer protects pipenv install and sync. The lock resolver still reads pip.conf, but only [global], because its pip command is named InstallCommand (pipenv/utils/resolver.py), and a Pipfile cool-down-period replaces its uploaded-prior-to. ↗
• user.settings: No user file to write to; at user level only PIP_* variables reach the pip install step (see variables). ↗
• user.unknownKeys: No user file. ↗
• user.invalidValueFails: No user file. ↗
• user.weakening: No user file; see variables. ↗
• extra.pylockCreatedBy: Pipenv writes created-by = "pipenv" in the pylock.toml it generates (docs/pylock.md). pipenv install -e . writes the project itself as { path = ".", editable = true } (docs/pipfile.md), and Pipfile.lock keeps it as "path": ".". ↗
• extra.configTables: Directives such as cool-down-period and allow_prereleases live in [pipenv]. ↗
• extra.durationStrings: Only whole days (<int>d) are accepted. ↗
• extra.durationUnits: Whole days only. ↗
• extra.missingUploadTime: "When the index does not provide upload-time metadata (e.g. most private mirrors) the setting is accepted but has no filtering effect." ↗
• extra.lockfileFormat: Every key but _meta is a category (default, develop and custom ones) mapping names to entries: index packages have version, hashes and index; git entries git and ref; remote archives file; local projects path, and editable = true for editable installs (Pipfile "Packages Section"). The hashes of wheels and source distributions are listed together, so the lockfile does not show which packages are built. ↗
• extra.commandLine: pipenv install takes packages as arguments (without any it installs the Pipfile) and editable ones with -e; -r imports a requirements file. The options of install and the global flags of pipenv, read with argparse, which accepts abbreviated long options. ↗
• extra.registryOverrides: --index names a package index by URL or by a source name of the Pipfile; --pypi-mirror and PIPENV_PYPI_MIRROR replace PyPI. --extra-pip-args hands arguments to pip, which may name another index, and Pipenv loads PIP_* variables from the .env file that PIPENV_DOTENV_LOCATION names (options.py). ↗
• extra.selection: pipenv install --pre allows pre-releases (and records allow_prereleases in the Pipfile, routines/install.py). Pipenv installs with pip, which reads PIP_NO_BINARY and PIP_ONLY_BINARY like --no-binary and --only-binary (see buildSwitch). ↗
• extra.latestVersion: Released on 2026-10-28. ↗

Renovate

• cooldown.setting: Formerly stabilityDays; old configs are migrated to "N days". Can be scoped with packageRules, vulnerabilityAlerts and update types. ↗
• cooldown.configFiles: Searched in this order. The "renovate" key in package.json still works but is deprecated. Shared presets (extends) can also set it. ↗
• cooldown.cliFlag: Self-hosted CLI only; environment variable RENOVATE_MINIMUM_RELEASE_AGE. ↗
• cooldown.unit: For example "3 days" or "14 days". Since 42.19.5 "0 days" is treated like null. ↗
• cooldown.availableSince: Earlier versions had the same feature as stabilityDays (first version not tracked). ↗
• cooldown.default: Off unless configured; the docs table shows no default. config:best-practices adds "3 days" for npm (see presets). Since 44.96.0 minimumReleaseAgeBuffer adds 30 minutes once a delay is set. ↗
• cooldown.exclude.setting: No dedicated exclusion list. ↗
• cooldown.exclude.patternSyntax: Glob and regex patterns since 38.0.0. ↗
• cooldown.securityUpdates: The vulnerabilityAlerts defaults set minimumReleaseAge to null; a delay can still be set inside vulnerabilityAlerts. ↗
• installScripts.defaultPolicy: Renovate disables package manager scripts when it updates lockfiles; the Mend-hosted app never runs them. ↗
• installScripts.disableAll: The default; the self-hosted global allowScripts also defaults to false. ↗
• extra.durationStrings: Values such as "3 days" or "1 hour", parsed by toMs (lib/util/pretty-time.ts). ↗
• extra.minimumReleaseAgePresets: config:best-practices extends security:minimumReleaseAgeNpm, which sets minimumReleaseAge "3 days" for the npm datasource (see presets). ↗
• extra.excludeRule: The documented opt-out: a packageRules entry with matchPackageNames and minimumReleaseAge: null. ↗
• extra.securityUpdatesSetting: The vulnerabilityAlerts default sets minimumReleaseAge to null, so security updates skip the delay unless a value is set there. ↗
• extra.excludeWildcards: matchPackageNames accepts globs (and regex) since 38.0.0. ↗
• extra.ruleDescription: A human-readable description allowed inside any configuration object; depcurfew uses it to recognize the packageRules entry it manages. ↗
• extra.packageJsonConfig: Deprecated: the configuration options page warns that support may be removed, and Renovate logs that using package.json is deprecated. ↗
• extra.durationUnits: Units shown in the docs: minimumReleaseAge=1 hour on this page and "3 days" in the configuration options. The value is parsed by toMs (lib/util/pretty-time.ts), whose tests also accept 1 day, 1 week and combined values. ↗
• extra.datasources: Datasource ids for matchDatasources: npm packages come from the npm datasource and Python packages from pypi, whose release timestamp is the earliest upload_time of the version's files. ↗
• extra.negativeMatch: Patterns starting with ! are negative matches, and none of them may match; matchDatasources is matched this way (matchRegexOrGlobList in lib/util/package-rules/datasources.ts at 44.198.0), so ["!pypi"] covers every datasource but PyPI. ↗
• extra.packageRuleMatching: A packageRules entry applies to a dependency when all of its matchers match. Within one matcher, at least one positive pattern must match when there are any, and no negative pattern (starting with !) may match, so a list of only negative patterns matches every name it does not exclude (docs/usage/string-pattern-matching.md and matchRegexOrGlobList in lib/util/string-match.ts). matchPackageNames, matchDepNames, matchDatasources and matchUpdateTypes all match this way; "*" alone matches everything. ↗
• extra.packageRulesOrder: All packageRules are evaluated and later rules override options set by earlier ones; a matching rule overrides the top-level configuration ("Package rule config overrides any existing config", lib/util/package-rules/index.ts). Presets in extends are merged before the repository configuration, and packageRules is mergeable, so the rules of presets come first and the repository's rules after them, while a top-level option of the repository replaces the same option of a preset (resolveConfigPresets in lib/config/presets/index.ts and mergeChildConfig in lib/config/utils.ts). ↗
• extra.delayedUpdateTypes: The update types that take minimumReleaseAge into account; digest and pinDigest only for some datasources, and pin, lockFileMaintenance, lockfileUpdate, rollback, bump and replacement not at all. ↗
• extra.internalPresets: The built-in preset groups; a default preset is written :name or default:name. Other presets (github>, gitlab>, local>, npm packages and so on) are fetched from elsewhere. Among the built-in presets only the security:minimumReleaseAge* presets set minimumReleaseAge, each in a packageRules entry with matchDatasources for its datasource, and config:best-practices extends security:minimumReleaseAgeNpm (security.preset.ts and config.preset.ts in the same directory). ↗
• extra.pypiPresets: Added in 44.8.0; config:best-practices does not include it (it includes only security:minimumReleaseAgeNpm). ↗
• extra.pythonManagers: pep621 updates pyproject.toml with uv.lock (there is no uv manager) or pdm.lock; poetry updates pyproject.toml with poetry.lock; pipenv updates the Pipfile with Pipfile.lock; pip_requirements updates requirements files. pip-compile is off by default (lib/modules/manager/pep621/readme.md and pipenv/index.ts at 44.198.1). ↗
• extra.passesDelayToManager: Since 44.34.0 Renovate passes POETRY_SOLVER_MIN_RELEASE_AGE (rounded up to whole days) to Poetry 2.4.0 and later. It does not pass the delay to uv or read exclude-newer. ↗
• extra.missingTimestamp: minimumReleaseAgeBehaviour was added in 41.150.0; timestamp-optional still fails open. ↗
• extra.independentOfPackageManager: Source code passes --before to npm only; pnpm, Yarn and Bun gates are not read. ↗

Dependabot

• cooldown.setting: Per updates entry: default-days, semver-major-days, semver-minor-days, semver-patch-days, include, exclude. The semver-* keys apply only to SemVer ecosystems. ↗
• cooldown.configFiles: On the default branch. ↗
• cooldown.unit: Integer days; the allowed range is disputed (see dayRange). ↗
• cooldown.availableSince: GA date on github.com; NuGet and Helm since 2025-07-29. ↗
• cooldown.default: Version updates wait 3 days even without a cooldown block (GHES from 3.23); default-days is also 3 when cooldown is set without it. ↗
• cooldown.securityUpdates: Cooldown exists only for version updates. dependabot-core also passes a zero age to npm, pnpm and Yarn for security updates, overriding repository gates. ↗
• installScripts.allowList.setting: insecure-external-code-execution: allow exists only for bundler, mix and pip; nothing allows npm, pnpm, Yarn or Bun scripts. ↗
• extra.cooldownKeys: Keys inside the cooldown block of an updates entry; the semver-* keys override default-days for that kind of update. ↗
• extra.excludeWildcards: cooldown.exclude accepts * wildcards. ↗
• extra.cooldownInclude: An include list in the cooldown block limits the cooldown to the dependencies it names (* wildcards, up to 150 entries): the example applies the cooldown to requests, numpy and names starting with pandas or django, and to cover all dependencies one omits include or uses "*". The other dependencies get no cooldown at all, not even the default 3 days: dependabot-core skips the cooldown for a dependency that the include list does not match (ReleaseCooldownOptions#included? with File.fnmatch? and CooldownCalculation.skip_cooldown? in common/lib/dependabot, commit 03892a3e8ee26d43eb96f31c5136c98a85d63b14). exclude wins over include. ↗
• extra.ecosystems: The npm ecosystem covers npm, pnpm and Yarn; bun needs Bun 1.1.39 or later and deno needs Deno 2. pip covers pip, pip-compile, pipenv and Poetry (v2); uv has its own ecosystem (the table lists uv v0.11). Cooldown, including the semver-* keys, is supported for all of them. PDM is not listed: dependabot-core skips the dependencies of pyproject.toml when pdm.lock exists (python/lib/dependabot/python/file_parser/pyproject_files_parser.rb at v0.402.0). ↗
• extra.maximumDays: The page says the number of cooldown days must be between 1 and 90; whether 0 is accepted is disputed (see dayRange). ↗

Environment

• corepack.packageManagerField: Format name@x.y.z, optionally followed by +<hash algorithm>.<hash>; a URL to a .js or .tgz file is also allowed. setup-bun also reads bun@x from this key. ↗
• corepack.devEnginesSince: Limited support at first; since 0.36.0 Corepack uses the devEngines.packageManager range when packageManager is missing. ↗
• corepack.envFileSince: Corepack reads COREPACK_* keys from .corepack.env; since 0.36.0 only the closest file. COREPACK_ENV_FILE=0 turns it off. ↗
• corepack.bundledWithNode: Node.js 25.0.0 stopped distributing Corepack; the Corepack README says it ships with Node.js from 14.19.0 up to (but not including) 25.0.0. ↗
• devEngines: Each entry is an object or a list of objects with name (required), version and onFail (warn, error by default, or ignore). Corepack and the setup actions read it too. ↗
• devEnginesSince: npm version that introduced devEngines. ↗
• volta.manifest: Also extends: a path to another JSON file with a volta key. pnpm support is experimental and needs VOLTA_FEATURE_PNPM=1. ↗
• volta.maintained: The README says Volta is unmaintained and recommends migrating to mise. ↗
• asdf.toolVersionsFile: One tool per line followed by one or more versions separated by spaces (fallbacks); # starts a comment. ↗
• asdf.plugins: Short names in the asdf plugin index; there is no plugin named node. python, uv and poetry checked on 2026-10-30 (danhper/asdf-python, asdf-community/asdf-uv, asdf-community/asdf-poetry). ↗
• githubActions.setupNode: Current major v7. node-version-file reads package.json, .nvmrc, .node-version, .tool-versions or mise.toml; node-version wins when both are set. ↗
• githubActions.pnpmActionSetup: Current major v6. Without version the action reads devEngines.packageManager or packageManager from package.json (package_json_file). ↗
• githubActions.pnpmSetup: For pnpm 11 and later. Without version it reads devEngines.packageManager or packageManager; runtime takes <name>@<version> for node, bun or deno. ↗
• githubActions.setupBun: Current major v2. Without bun-version it reads packageManager (bun@x), then engines.bun, then installs latest. ↗
• githubActions.setupDeno: Current major v2. deno-version defaults to 2.x; deno-version-file reads .dvmrc or .tool-versions. ↗
• githubActions.setupPython: Current version v7.1.0. Without python-version it reads .python-version; python-version wins over python-version-file. pip-version (major[.minor][.patch], CPython only) since v6.0.0. Python comes with pip, but the step alone does not show that pip installs the project. ↗
• githubActions.setupUv: Current version v10.3.3, with no moving v10 tag. Without version or version-file it reads required-version from uv.toml, then pyproject.toml, in the working directory, and installs the latest uv when neither has one. ↗
• githubActions.installPoetry: A third-party action (current v1.4.2); version defaults to latest, so without it the Poetry version is not pinned. ↗
• githubActions.actionsPoetry: A third-party action (current v4.0.0); poetry-version defaults to latest. ↗
• githubActions.codeScanningUpload: The example workflow on this page needs security-events: write in every repository and actions: read with contents: read only in private ones. The inputs come from upload-sarif/action.yml in github/codeql-action (current major v4, v4.39.1 checked); category tells analyses of the same tool and commit apart. ↗
• githubActions.stopCommands: Lines between the two are logged without being processed as workflow commands. The token must be randomly generated and unique for each run. Read from the page source in github/docs. ↗
• githubActions.annotations: escapeData and escapeProperty in @actions/core: the message and property values replace %, CR and LF; property values also replace : and , because properties are separated by commas. The commands and their file, line and title parameters are on https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands (line counts from 1). ↗
• githubActions.annotationLimits: 10 error, 10 warning and 10 notice annotations per step; 50 annotations per job, summed over all steps. Annotations over the limit are not shown. ↗
• githubActions.checkRuns: Read from the sources of this page, the REST description github/rest-api-description (descriptions/api.github.com/api.github.com.json) and github/docs. POST /repos/{owner}/{repo}/check-runs ("Create a check run") needs name and head_sha; status completed needs a conclusion (success, neutral, failure and others); output.title and output.summary (Markdown, maxLength 65535) show in the Checks tab; only GitHub Apps can create check runs, which the workflow token is. checks: write "permits an action to create a check run" (data/reusables/actions/github-token-scope-descriptions.md in github/docs, which links the permissions with apiVersion=2022-11-28); a pull request from a fork gets a read-only token unless the repository sends write tokens to such workflows (workflow-syntax.md, How permissions are calculated). For pull_request, GITHUB_SHA is the "Last merge commit on the GITHUB_REF branch" (events-that-trigger-workflows.md), so the check goes on pull_request.head.sha from the payload file GITHUB_EVENT_PATH names (webhook-pull-request-opened schema; variables.md for GITHUB_API_URL, GITHUB_REPOSITORY and GITHUB_EVENT_PATH). ↗
• githubActions.stepSummary: GitHub flavored Markdown appended to the file named by the variable; at most 1 MiB per step (over that the upload fails with an error annotation), and at most 20 step summaries are shown per job. ↗
• npmRegistry.api: GET /{package} returns the full document by default: dist-tags maps tags to versions (every package has latest), versions maps versions to version objects, time maps every version to its publish time, and a version object carries scripts (from its package.json) and deprecated. The abbreviated document (Accept: application/vnd.npm.install-v1+json) has no time field and adds hasInstallScript. Scoped names are escaped with %2f (escapedName in github.com/npm/npm-package-arg); the registry answered the same document for @types/node and @types%2fnode on 2026-10-29. Install scripts: preinstall, install and postinstall run for a dependency, and npm runs node-gyp rebuild as install when the package has binding.gyp and no install or preinstall script (github.com/npm/cli/blob/v12.2.1/docs/lib/content/using-npm/scripts.md); binding.gyp is not visible in the document. ↗
• pypiIndex.api: GET /simple/<project>/ with Accept: application/vnd.pypi.simple.v1+json returns name, files, meta, versions and project-status; the project is matched case-insensitively with _, - and . considered equal (index-api.md in pypi/warehouse, the source of docs.pypi.org/api/index-api/, which recommends the JSON form for new integrations; the JSON API of /pypi/<project>/json marks its releases key deprecated). A file has filename, url, hashes, size, an optional upload-time (yyyy-mm-ddThh:mm:ss.ffffffZ, UTC) and an optional yanked (true or a reason string). Every file belongs to a version listed in versions, but the response does not say which: the version is part of the file name. On 2026-10-30 pypi.org answered api-version 1.4 for requests and 404 for a name it does not know. ↗
• pypiIndex.projectStatus: A project has exactly one status, active when none is given. quarantined: considered generally unsafe (for example malware), and the index must not offer any of its files. archived: no new uploads, existing files stay; installers may warn. deprecated: obsolete, perhaps superseded by another project; installers may warn. ↗
• claudeCode.hooks: A PreToolUse command hook gets the event as JSON on stdin and decides by printing one JSON object and exiting 0: deny prevents the call and shows the reason to Claude, ask prompts the user (also in auto mode), deny wins over ask. The PowerShell tool passes its command in tool_input.command with the same fields as the Bash tool. A matcher of names separated by | matches each of them exactly. With args set, command runs as an executable without a shell; on Windows it must resolve to a real executable such as a .exe, not a .cmd or .bat shim from node_modules/.bin. Without onFailure, a hook that fails to start, crashes or times out lets the call through. The if filter is best-effort; the docs recommend the permission system for hard allow or deny rules. ↗
• claudeCode.shellTools: Tool names are the exact strings of hook matchers. Bash executes shell commands. PowerShell executes PowerShell commands natively; hooks get its command in tool_input.command with the same fields as Bash, and the docs say to match Bash|PowerShell in hooks that inspect shell commands: on Windows, wherever the PowerShell tool is enabled, Claude treats PowerShell as the primary shell, and without Git Bash it is enabled automatically and the Bash tool is not registered at all (also https://code.claude.com/docs/en/hooks#powershell). On Windows with Git Bash it is on by default for claude.ai and Console accounts, CLAUDE_CODE_USE_POWERSHELL_TOOL=0 turns it off, and Claude Code runs pwsh.exe or else powershell.exe 5.1. Monitor runs a command in the background and feeds its output lines back to Claude, with the same permission rules as Bash; on Windows it is available only with Git Bash; a WebSocket watch takes a ws input in place of command. ↗
• git.ignore: git status and git add skip untracked files that match a pattern from a .gitignore in the same directory or a parent (deeper files override higher ones, and within one file the last matching pattern decides), then from $GIT_COMMON_DIR/info/exclude (.git/info/exclude outside linked worktrees), then from core.excludesFile. Files already tracked are not affected. Patterns: # comments, ! negation, a leading or middle / anchors the pattern to the directory of its .gitignore, a trailing / matches directories only, * and ? do not match /, **/, /** and /**/ match any number of directories; a file below an ignored directory cannot be re-included. The tracked files are the entries of $GIT_DIR/index (Documentation/gitformat-index.adoc at v2.56.0: versions 2, 3 and 4). ↗
• git.ignoreCase: core.ignoreCase turns on workarounds for file systems that are not case sensitive (APFS, HFS+, FAT, NTFS); it defaults to false, but git clone and git init probe the file system and set it to true when appropriate, so a repository cloned on Windows or macOS has it. With it, git matches .gitignore patterns and looks up the index without regard to case: match_basename and match_pathname in dir.c compare with fspathncmp and fnmatch_icase_mem, which fold case (strncasecmp, WM_CASEFOLD) when repo_ignore_case is set, and environment.c reads core.ignorecase (both at v2.56.0). Section and variable names are case-insensitive, true is yes, on, true or 1 in any case, and a variable without = <value> is true (Documentation/config.adoc at v2.56.0). ↗
• windows.commandShims: cmd-shim is "the cmd-shim used in npm to create executable scripts on Windows" (README): for each program of a package it writes <name>.cmd, which runs the program with %* (so cmd.exe reads the arguments again), <name>.ps1 for PowerShell and a sh script. npm ships the same files for itself: bin/npm.cmd, bin/npm.ps1, bin/npx.cmd and bin/npx.ps1 in github.com/npm/cli at v12.2.1, the .cmd files ending in "%NODE_EXE%" "%NPM_CLI_JS%" %*. ↗
• windows.batchArguments: about_Parsing (the source of https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_parsing): on Windows, arguments for batch files are passed as raw command-line strings to cmd.exe, and untrusted input should be passed another way. In the Windows mode of $PSNativeCommandArgumentPassing, the default on Windows since PowerShell 7.3, files ending in .bat or .cmd (also cmd.exe, cscript.exe, wscript.exe, .js, .vbs and .wsf) keep the legacy argument passing of Windows PowerShell 5.1. ↗
• python.nameNormalization: Names are lowercased and every run of ., - or _ becomes a single -, before lookups and comparisons (PEP 503): Friendly.Bard and friendly_bard are the same package. Read from the page source in pypa/packaging.python.org. ↗
• python.namePattern: The specification gives ^([A-Z0-9]|[A-Z0-9][A-Z0-9._-]*[A-Z0-9])\Z run with re.IGNORECASE (PEP 508). ↗
• python.projectFile: The configuration file of a Python project, in the project root; tools keep their own settings in its [tool.<name>] tables. ↗
• python.wheelExtension: A wheel is a ZIP archive with the .whl extension; installing it unpacks files and runs no build code. Read from the page source in pypa/packaging.python.org. ↗
• python.sourceDistributionExtensions: ARCHIVE_EXTENSIONS of pip without .whl: the archives pip accepts from an index besides wheels (index/package_finder.py rejects any other extension), all of them built when installed. A standard sdist is named {name}-{version}.tar.gz with the name normalized (PEP 625, source-distribution-format.rst); older uploads use the other extensions and names that are not normalized. ↗
• python.hatch: Hatch reads its project configuration from [tool.hatch] of pyproject.toml or from hatch.toml. It has no setting of its own for a release-age delay, building from source or dependency sources; its environments install with uv (installer = "uv", the default of its internal environments) or pip (docs/how-to/environment/select-installer.md), and uv reads [tool.uv] of the project under Hatch too (tested on 2026-10-30 with Hatch 1.18.2 and uv 0.13.6). ↗
• python.interpreter: python [-bBdEhiIOPqRsSuvVWx?] [-c command | -m module-name | script | - ] [args]: -m and -c end the interpreter options, and what follows goes to the module or the command; -W arg, -X option and --check-hash-based-pycs mode take a value, the other options are flags. One-letter options may be grouped after one dash: _PyOS_GetOpt in Python/getopt.c (v3.14.0, SHORT_OPTS "bBc:dEhiIm:OPqRsStuvVW:xX:?") reads them one by one, and c, m, W and X take the rest of the word or the next word, so python3 -Im pip runs pip. pip documents running itself as python -m pip, and as py -m pip with the Windows launcher (github.com/pypa/pip/blob/26.2.2/docs/html/cli/pip_install.rst). ↗

To review

Uncertain facts rest on incomplete official sources; disputed facts have official sources that disagree.

npm · installScripts.allowList.format ❓ uncertain

The exact entry grammar (no semver ranges) is stated in accepted RFC 0054; the shipped docs describe entries only in prose.

• Object keyed by name, name@version or name@v1 || v2 with true (allow) or false (deny); npm install-scripts approve writes pinned name@version entries · source, verified 2026-10-28.

npm · sources.git.availableSince ⚠️ disputed

The release notes add --allow-git in 11.9.0; the GitHub changelog says it was introduced in 11.10.0.

• Variant 1: 11.9.0 · source, verified 2026-10-28.
• Variant 2: 11.10.0 · source, verified 2026-10-28.

npm · sources.remoteTarball.availableSince ⚠️ disputed

The 11.14.0 release notes add the flag; the GitHub changelog dates it to 11.15.0, which also moved enforcement into the resolver. Treat 11.15.0 as the safe minimum.

• Variant 1: 11.14.0 · source, verified 2026-10-28.
• Variant 2: 11.15.0 · source, verified 2026-10-28.

npm · sources.file.availableSince ⚠️ disputed

The 11.14.0 release notes add the flag; the GitHub changelog dates it to 11.15.0, which also moved enforcement into the resolver. Treat 11.15.0 as the safe minimum.

• Variant 1: 11.14.0 · source, verified 2026-10-28.
• Variant 2: 11.15.0 · source, verified 2026-10-28.

npm · sources.directory.availableSince ⚠️ disputed

The 11.14.0 release notes add the flag; the GitHub changelog dates it to 11.15.0, which also moved enforcement into the resolver. Treat 11.15.0 as the safe minimum.

• Variant 1: 11.14.0 · source, verified 2026-10-28.
• Variant 2: 11.15.0 · source, verified 2026-10-28.

npm · project.workspacesObjectKey ❓ uncertain

Not documented; npm's map-workspaces also accepts { "packages": [...] } and negated patterns.

• packages · source, verified 2026-10-28.

npm · extra.lockfileInstalls ❓ uncertain

Inferred: npm ci does not list min-release-age or before among its options, and a user report (npm/cli#9277) describes it installing a version younger than the window.

• npm ci installs versions pinned in package-lock.json without applying min-release-age · source, verified 2026-10-28.

pnpm · cooldown.cliFlag ❓ uncertain

No dedicated flag is documented for install or add; release notes mention "a CLI flag" without syntax. Environment variable: PNPM_CONFIG_MINIMUM_RELEASE_AGE (pnpm 11+), npm_config_minimum_release_age (pnpm 10).

• null · source, verified 2026-10-28.

pnpm · sources.file.setting ❓ uncertain

No setting restricts file: or link: dependencies (concluded from the full settings list); blockExoticSubdeps treats local paths and workspace links as trusted.

• null · source, verified 2026-10-28.

pnpm · sources.directory.setting ❓ uncertain

No setting restricts file: or link: dependencies (concluded from the full settings list); blockExoticSubdeps treats local paths and workspace links as trusted.

• null · source, verified 2026-10-28.

pnpm · project.workspacesObjectKey ❓ uncertain

The docs show packages only as a list; concluded from the absence of an object form.

• null · source, verified 2026-10-28.

pnpm · user.unknownKeys ❓ uncertain

pnpm 11 drops config.yaml keys it does not accept (unknown, project-only or not camelCase) and prints a warning that names them; pnpm 12 warns about keys its port of isConfigFileKey rejects, but drops blockExoticSubdeps without a word. What pnpm 10 does with an unknown key in rc was not checked.

• warn · source, verified 2026-10-31.

pnpm · user.invalidValueFails ❓ uncertain

Read from code: pnpm 11.28.10 stops when the global config.yaml cannot be read (readGlobalYamlConfig) or applied (applyGlobalYamlConfig), except in commands that skip unreadable settings. Which values fail, and what pnpm 10 (rc) and pnpm 12 do, was not checked; true is the safe assumption.

• true · source, verified 2026-10-31.

pnpm · extra.perProjectNpmrc ❓ uncertain

Without a shared lockfile, pnpm 10 installs every workspace project with its own .npmrc layered over the workspace settings, without filtering keys, so a package .npmrc can change minimum-release-age for that project. Read from code; no documentation or test covers it. No official source says this combination turns minimumReleaseAge off.

• {"sharedWorkspaceLockfile":false,"until":"11.0.0"} · source, verified 2026-10-29.

pnpm · extra.lockfileRecheck ❓ uncertain

Structured form of lockfileVerification: whether a frozen-lockfile install re-checks the age of versions already in the lockfile. trustLockfile: true (11.3.0) turns the check off.

• 10.16.0+: false
  11.1.3+: true · source, verified 2026-10-28.

pnpm · extra.lockfileVerification ❓ uncertain

The 11.1.3 release notes confirm re-validation (ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION). The pnpm 10 behavior rests on maintainer comments in pnpm/pnpm#12450 (a Dependabot lockfile passed --frozen-lockfile on 10.34.5), not on docs.

• 10.16.0+: frozen-lockfile installs do not re-check versions already in the lockfile
  11.1.3+: lockfile entries are re-checked; trustLockfile: true (11.3.0) turns this off · source, verified 2026-10-28.

Yarn (Berry) · cooldown.cliFlag ❓ uncertain

No flag sets the gate. --no-time-gate on yarn add and yarn up (4.15.0+) disables it for one command; yarn install has no such flag.

• null · source, verified 2026-10-28.

Yarn (Berry) · cooldown.default ⚠️ disputed

The code is unambiguous: off until 4.14.x, 1d from 4.15.0. The published settings schema claimed 3d for 4.11.0-4.14.x and 0m in 4.16.0; the live yarnrc page shows "1w", which is an example value. Upgraded projects with an old lockfile get npmMinimalAgeGate: 0 written to .yarnrc.yml (see upgradeMigration).

• Variant 1: 4.10.0+: 0
  4.15.0+: 1d · source, verified 2026-10-28.
• Variant 2: 4.10.0+: 0
  4.11.0+: 3d
  4.15.0+: 1d · source, verified 2026-10-28.

Yarn (Berry) · cooldown.securityUpdates ❓ uncertain

No automatic bypass is documented and yarn npm audit only reports. Options: --no-time-gate on yarn add/up, a pinned npmPreapprovedPackages entry, or a per-scope gate of 0.

• applies · source, verified 2026-10-28.

Yarn (Berry) · installScripts.allowList.availableSince ❓ uncertain

dependenciesMeta is documented in the changelog from the 2.x line; the exact first version was not pinned down.

• 2.0.0 · source, verified 2026-10-28.

Yarn (Berry) · sources.remoteTarball.setting ❓ uncertain

No setting restricts http(s) tarball dependencies (concluded from the full settings list); the closest are enableNetwork, networkSettings.<host>.enableNetwork and unsafeHttpWhitelist for plain http.

• null · source, verified 2026-10-28.

Yarn (Berry) · sources.file.setting ❓ uncertain

No setting restricts file:, link: or portal: dependencies (concluded from the settings list and plugin sources); only exec: is gated by enableScripts (4.14.0+).

• null · source, verified 2026-10-28.

Yarn (Berry) · sources.directory.setting ❓ uncertain

No setting restricts local directory dependencies (file:, link:, portal:), as for local tarballs.

• null · source, verified 2026-10-28.

Yarn (Berry) · project.workspacesObjectKey ❓ uncertain

Not documented; the manifest parser also accepts { "packages": [...] }.

• packages · source, verified 2026-10-28.

Yarn (Berry) · user.invalidValueFails ❓ uncertain

Read from code at 4.18.1: parseValue errors are rethrown with the file name while the configuration loads, so a value Yarn cannot parse, such as enableScripts: maybe or a malformed duration, stops every command, also from the home file. On 4.10.x a duration string such as 7d silently had no effect instead (durationStrings). Not tested.

• true · source, verified 2026-10-31.

Yarn (Berry) · user.weakening ❓ uncertain

Read from code (resolveRcFiles, the same since 4.0.0; not on yarnpkg.com, and no test was read): lists from every .yarnrc.yml are joined, so home entries add to a project's list unless the project uses the undocumented { onConflict: reset } form; objects such as npmScopes merge key by key; for single values the file closest to the project wins. Since 4.17.0 a scope listed in the home npmScopes only for its registry gets the default gate of 1d instead of the project's gate (perScopeGate). A .yarnrc.yml in any folder between the root and the project merges the same way. enableScripts is a switch that turns a protection off: Yarn reads every value as text (FAILSAFE_SCHEMA, see extra.yamlMergeKeys) and parseBoolean of miscUtils.ts takes true and 1 as true and false and 0 as false and stops on any other value, after replacing ${VARIABLE} references; depcurfew counts every value but false and 0 as on.

• {"key":"approvedGitRepositories","values":"any","effect":"approves these git repositories in every project, on top of the project's own list"}, {"key":"npmPreapprovedPackages","values":"any","effect":"exempts these packages from the age gate in every project, on top of the project's own list"}, {"key":"enableScripts","values":{"except":[false,0,"false","0"]},"effect":"runs dependency build scripts in every project whose .yarnrc.yml does not set enableScripts"}, {"key":"npmMinimalAgeGate","values":[0],"effect":"turns the age gate off in every project whose .yarnrc.yml does not set it"}, {"key":"npmScopes.*.npmMinimalAgeGate","values":[0],"effect":"turns the age gate off for that scope in every project"} · source, verified 2026-10-31.

Yarn (Berry) · user.variables ⚠️ disputed

The yarnrc docs say environment variables cannot set lists, but parseValue splits a string on commas for list settings, so by the code YARN_APPROVED_GIT_REPOSITORIES and YARN_NPM_PREAPPROVED_PACKAGES work. The safe choice is to treat both as effective.

• Variant 1: {"name":"YARN_ENABLE_SCRIPTS","anyCase":true,"values":{"except":["false","0"]},"effect":"runs dependency build scripts, whatever any .yarnrc.yml says"}, {"name":"YARN_NPM_MINIMAL_AGE_GATE","anyCase":true,"values":"any","effect":"replaces npmMinimalAgeGate from every .yarnrc.yml"}, {"name":"YARN_APPROVED_GIT_REPOSITORIES","anyCase":true,"values":"any","effect":"replaces approvedGitRepositories from every .yarnrc.yml (a comma-separated list)"}, {"name":"YARN_NPM_PREAPPROVED_PACKAGES","anyCase":true,"values":"any","effect":"replaces npmPreapprovedPackages from every .yarnrc.yml (a comma-separated list)"} · source, verified 2026-10-31. A variable starting with yarn_ in any case sets the camel-cased setting before the rc files are read, and they cannot change it (Configuration.find and use; YARN_IGNORE_SCRIPTS is ignored); a list setting takes a comma-separated string (parseValue); enableScripts accepts true or 1 (parseBoolean), false or 0 turn it off, and any other value stops Yarn, so every value but false and 0 counts as on.
• Variant 2: {"name":"YARN_ENABLE_SCRIPTS","anyCase":true,"values":{"except":["false","0"]},"effect":"runs dependency build scripts, whatever any .yarnrc.yml says"}, {"name":"YARN_NPM_MINIMAL_AGE_GATE","anyCase":true,"values":"any","effect":"replaces npmMinimalAgeGate from every .yarnrc.yml"} · source, verified 2026-10-31. Most settings "can also be defined through environment variables (at least for the simpler ones; arrays and objects aren't supported yet)", and such values "will overwrite any that might have been defined in the RC files".

Yarn (Berry) · extra.berryLockfileMarker ❓ uncertain

Read from code: Yarn 2+ writes a __metadata key into yarn.lock and treats a lockfile without it but with "yarn lockfile v1" as Yarn Classic.

• __metadata · source, verified 2026-10-28.

Yarn (Berry) · extra.unknownSettings ❓ uncertain

Read from the current source code; older releases were not checked.

• Unknown keys in the project .yarnrc.yml throw (unless enableStrictSettings is false), so settings newer than the pinned Yarn break installs · source, verified 2026-10-28.

Bun · cooldown.default ⚠️ disputed

The bunfig reference says the default is null (off) and an open docs pull request (oven-sh/bun#41545) says the feature is off by default; the install page lists 259200 (3 days) under "These are the default values".

• Variant 1: 1.3.0+: null · source, verified 2026-10-28.
• Variant 2: 1.3.0+: 259200 · source, verified 2026-10-28.

Bun · cooldown.securityUpdates ❓ uncertain

No automatic bypass is documented; exempt the fixed release with name@version in minimumReleaseAgeExcludes (1.4.4+). Exact version requests still go through the gate.

• applies · source, verified 2026-10-28.

Bun · installScripts.allowList.availableSince ❓ uncertain

Upper bound: 1.0.5 already persists trustedDependencies in bun.lockb; the first version was not pinned down. bun pm trust and bun add --trust arrived in 1.0.31.

• 1.0.5 · source, verified 2026-10-28.

Bun · sources.git.setting ❓ uncertain

Git dependencies are supported with no setting to allow or forbid them (concluded from the full bunfig [install] list); install.blockExoticSubdeps is proposed in oven-sh/bun#30340 but not shipped.

• null · source, verified 2026-10-28.

Bun · sources.remoteTarball.setting ❓ uncertain

Tarball URL dependencies are supported with no setting to allow or forbid them (concluded from the full bunfig [install] list); install.blockExoticSubdeps is proposed in oven-sh/bun#30340 but not shipped.

• null · source, verified 2026-10-28.

Bun · sources.file.setting ❓ uncertain

Local tarball dependencies are supported with no setting to allow or forbid them (concluded from the full bunfig [install] list); install.blockExoticSubdeps is proposed in oven-sh/bun#30340 but not shipped.

• null · source, verified 2026-10-28.

Bun · sources.directory.setting ❓ uncertain

Local directory dependencies are supported with no setting to allow or forbid them (concluded from the full bunfig [install] list); install.blockExoticSubdeps is proposed in oven-sh/bun#30340 but not shipped.

• null · source, verified 2026-10-28.

Bun · project.lockfiles ❓ uncertain

Bun 1.2 made the text bun.lock the default (verified). That bun.lockb is still read afterwards is inferred from the documented migration command and from saveTextLockfile = false, which writes bun.lockb.

• earlier: bun.lockb
  1.2.0+: bun.lock, bun.lockb · source, verified 2026-10-28.

Bun · user.variables ❓ uncertain

No environment variable sets minimumReleaseAge or its exclusions: concluded from the install page, which lists registry, token, lockfile and retry variables only. NPM_CONFIG_IGNORE_SCRIPTS only turns scripts off. XDG_CONFIG_HOME moves the user file (user.files).

• [] · source, verified 2026-10-31.

Deno · cooldown.availableSince ⚠️ disputed

The 2.5.5 release notes ship the flag, the deno.json key and exclude as unstable; the release blog says the feature was introduced in 2.6.

• Variant 1: 2.5.5 · source, verified 2026-10-28.
• Variant 2: 2.6.0 · source, verified 2026-10-28.

Deno · cooldown.securityUpdates ❓ uncertain

No security bypass is documented; only per-package exclude or an age of 0.

• applies · source, verified 2026-10-28.

Deno · installScripts.disableAll ❓ uncertain

Scripts do not run by default. The schema accepts a boolean allowScripts, but no page states that false turns all scripts off. deno x has --ignore-scripts.

• allowScripts: false · source, verified 2026-10-28.

Deno · user.variables ❓ uncertain

Only these two spellings are read (min_release_age_days_from_env); 0 turns the default 24 hours off. Read from code: every parsed .npmrc starts from the variable and its own key overrides it (test ".npmrc value takes precedence over the environment fallback"), and the project file wins over the home file, so a project .npmrc without the key puts the variable above the home value. The first version is from denoland/deno#35458, which shipped in 2.9.0.

• {"name":"NPM_CONFIG_MIN_RELEASE_AGE","values":"any","effect":"sets min-release-age where no .npmrc has the key, and hides the home value in projects whose .npmrc lacks it (2.9.0+)"}, {"name":"npm_config_min_release_age","values":"any","effect":"sets min-release-age where no .npmrc has the key, and hides the home value in projects whose .npmrc lacks it (2.9.0+)"} · source, verified 2026-10-31.

Deno · extra.npmrcFormat ⚠️ disputed

The safe choice is an integer number of days, which also matches npm.

• Variant 1: whole days only, e.g. min-release-age=3 · source, verified 2026-10-28.
• Variant 2: a duration with a unit, e.g. min-release-age=72h · source, verified 2026-10-28.

Deno · extra.fileLinkSkipped ⚠️ disputed

Official pages disagree on whether the project's own file: and link: dependencies are skipped, or only those in published packages' metadata.

• Variant 1: file: and link: dependencies in the project package.json are silently skipped · source, verified 2026-10-28.
• Variant 2: file: and link: specifiers in registry metadata of npm packages are skipped · source, verified 2026-10-28.

uv · cooldown.securityUpdates ❓ uncertain

uv does not know which versions fix vulnerabilities; the delay holds back every new upload unless the package is listed in exclude-newer-package.

• applies · source, verified 2026-10-30.

uv · sources.git.setting ❓ uncertain

No setting allows or forbids git dependencies (concluded from the list of settings). no-sources only ignores the tool.uv.sources table; a URL dependency introduced by a registry package is rejected during resolution (docs/pip/compatibility.md).

• null · source, verified 2026-10-30.

uv · sources.remoteTarball.setting ❓ uncertain

No setting allows or forbids URL dependencies (concluded from the list of settings). no-sources only ignores the tool.uv.sources table; a URL dependency introduced by a registry package is rejected during resolution (docs/pip/compatibility.md).

• null · source, verified 2026-10-30.

uv · sources.file.setting ❓ uncertain

No setting allows or forbids local archive dependencies (concluded from the list of settings). no-sources only ignores the tool.uv.sources table; a URL dependency introduced by a registry package is rejected during resolution (docs/pip/compatibility.md).

• null · source, verified 2026-10-30.

uv · sources.directory.setting ❓ uncertain

No setting allows or forbids local directory dependencies (concluded from the list of settings). no-sources only ignores the tool.uv.sources table; a URL dependency introduced by a registry package is rejected during resolution (docs/pip/compatibility.md).

• null · source, verified 2026-10-30.

uv · extra.lockfileFormat ❓ uncertain

uv.lock has no documented format (the docs say only that it is managed by uv). Each [[package]] has source = { registry = URL } for an index, { git = URL?rev#commit }, { url = URL }, { path = archive }, { directory = dir }, { editable = dir } or { virtual = dir } (a directory that is not built). Index packages list sdist and wheels; a package without wheels, or from git, a directory or a source archive, is built when installed.

• {"sources":{"registry":"registry","git":"git","remoteTarball":"url","file":"path","directory":"directory","editable":"editable","virtual":"virtual"},"sdist":"sdist","wheels":"wheels","packages":"package"} · source, verified 2026-10-30.

pip · cooldown.exclude.setting ❓ uncertain

No per-package exception (concluded from the list of options).

• null · source, verified 2026-10-30.

pip · cooldown.securityUpdates ❓ uncertain

pip does not know which versions fix vulnerabilities; the cutoff holds back every new upload.

• applies · source, verified 2026-10-30.

pip · installScripts.allowList.availableSince ❓ uncertain

--no-binary and --only-binary exist since 7.0.0 and are read from pip.conf since 7.1.0; when requirements files started to accept them is not recorded.

• 7.0.0 · source, verified 2026-10-30.

pip · sources.git.setting ❓ uncertain

No option allows or forbids VCS requirements (concluded from the list of options). Hash-checking mode (--require-hashes, or any --hash) rejects VCS and local directory requirements, unless --no-require-hashes (26.2) turns the automatic mode off.

• null · source, verified 2026-10-30.

pip · sources.remoteTarball.setting ❓ uncertain

No option allows or forbids direct URL requirements (concluded from the list of options). Hash-checking mode (--require-hashes, or any --hash) rejects VCS and local directory requirements, unless --no-require-hashes (26.2) turns the automatic mode off.

• null · source, verified 2026-10-30.

pip · sources.file.setting ❓ uncertain

No option allows or forbids local archive requirements (concluded from the list of options). Hash-checking mode (--require-hashes, or any --hash) rejects VCS and local directory requirements, unless --no-require-hashes (26.2) turns the automatic mode off.

• null · source, verified 2026-10-30.

pip · sources.directory.setting ❓ uncertain

No option allows or forbids local directory requirements (concluded from the list of options). Hash-checking mode (--require-hashes, or any --hash) rejects VCS and local directory requirements, unless --no-require-hashes (26.2) turns the automatic mode off.

• null · source, verified 2026-10-30.

pip · project.workspaces ❓ uncertain

pip has no workspaces.

• null · source, verified 2026-10-30.

pip · project.workspacesObjectKey ❓ uncertain

No workspaces.

• null · source, verified 2026-10-30.

pip · extra.buildSwitch ❓ uncertain

The option exists since 7.0.0; when requirements files started to accept it is not recorded. pip applies it only to packages found on indexes and find-links (format_control is used only by the package finder), so VCS, local directory and direct URL source requirements are still built.

• {"setting":"--only-binary","value":":all:","since":"7.0.0","covers":["registry"]} · source, verified 2026-10-30.

Poetry · cooldown.cliFlag ❓ uncertain

No command-line option; the environment variable POETRY_SOLVER_MIN_RELEASE_AGE sets it for one command.

• null · source, verified 2026-10-30.

Poetry · cooldown.securityUpdates ❓ uncertain

Poetry does not know which versions fix vulnerabilities; the delay holds back every new version of a package not listed in solver.min-release-age-exclude.

• applies · source, verified 2026-10-30.

Poetry · sources.git.setting ❓ uncertain

No setting allows or forbids git dependencies (concluded from the list of settings and Config.default_config); dependencies of dependencies may come from such sources too.

• null · source, verified 2026-10-30.

Poetry · sources.remoteTarball.setting ❓ uncertain

No setting allows or forbids url dependencies (concluded from the list of settings and Config.default_config); dependencies of dependencies may come from such sources too.

• null · source, verified 2026-10-30.

Poetry · sources.file.setting ❓ uncertain

No setting allows or forbids local file dependencies (concluded from the list of settings and Config.default_config); dependencies of dependencies may come from such sources too.

• null · source, verified 2026-10-30.

Poetry · sources.directory.setting ❓ uncertain

No setting allows or forbids local directory dependencies (concluded from the list of settings and Config.default_config); dependencies of dependencies may come from such sources too.

• null · source, verified 2026-10-30.

Poetry · project.workspaces ❓ uncertain

Poetry has no workspaces: the 2.5.1 docs do not mention them and the request for subprojects is open.

• null · source, verified 2026-10-30.

Poetry · project.workspacesObjectKey ❓ uncertain

No workspaces.

• null · source, verified 2026-10-30.

Poetry · user.files ⚠️ disputed

The docs give ~/Library/Application Support/pypoetry on macOS. The code asks the installed platformdirs (pyproject.toml allows >=3.0.0,<5), and platformdirs 4.6.0 (2026-02-12) added the XDG variables on macOS, so with XDG_CONFIG_HOME set (not empty) Poetry reads $XDG_CONFIG_HOME/pypoetry/config.toml instead (https://github.com/tox-dev/platformdirs/blob/4.6.0/src/platformdirs/_xdg.py); which one applies depends on the platformdirs version in Poetry's environment. Linux and Windows agree. config.toml holds the settings as nested tables ([solver] min-release-age = 7); auth.toml next to it holds credentials. POETRY_CONFIG_DIR replaces the directory. Checked at 2.4.0 and 2.5.1; 2.0.0 removed the special handling of the platformdirs 2 macOS directory (#8916, CHANGELOG.md), and older versions are not tracked.

• Variant 1: 2.0.0+: {"format":"toml","locations":[{"platforms":["linux"],"directories":[{"from":{"env":"XDG_CONFIG_HOME"},"path":"pypoetry"},{"from":"home","path":".config/pypoetry"}],"file":"config.toml"},{"platforms":["darwin"],"directories":[{"from":"home","path":"Library/Application Support/pypoetry"}],"file":"config.toml"},{"platforms":["win32"],"directories":[{"from":{"env":"APPDATA"},"path":"pypoetry"},{"from":"home","path":"AppData/Roaming/pypoetry"}],"file":"config.toml"}]} · source, verified 2026-10-31. "Linux: $XDG_CONFIG_HOME/pypoetry or ~/.config/pypoetry - Windows: %APPDATA%\pypoetry - macOS: ~/Library/Application Support/pypoetry".
• Variant 2: 2.0.0+: {"format":"toml","locations":[{"platforms":["linux"],"directories":[{"from":{"env":"XDG_CONFIG_HOME"},"path":"pypoetry"},{"from":"home","path":".config/pypoetry"}],"file":"config.toml"},{"platforms":["darwin"],"directories":[{"from":{"env":"XDG_CONFIG_HOME"},"path":"pypoetry"},{"from":"home","path":"Library/Application Support/pypoetry"}],"file":"config.toml"},{"platforms":["win32"],"directories":[{"from":{"env":"APPDATA"},"path":"pypoetry"},{"from":"home","path":"AppData/Roaming/pypoetry"}],"file":"config.toml"}]} · source, verified 2026-10-31. CONFIG_DIR = POETRY_CONFIG_DIR or user_config_path("pypoetry", appauthor=False, roaming=True) from platformdirs, which on macOS honors XDG_CONFIG_HOME since platformdirs 4.6.0. On Windows platformdirs asks for the Roaming AppData known folder, which APPDATA normally names.

Poetry · user.unknownKeys ❓ uncertain

Config.merge keeps every key of config.toml and only known settings are read, so a version that does not know a key ignores it without a word. Read from the code; tested only with poetry.toml, which goes through the same merge (2.3.4 ignored solver.min-release-age there on 2026-10-30).

• ignore · source, verified 2026-10-31.

Poetry · user.invalidValueFails ❓ uncertain

A config.toml that is not valid TOML stops every command (TOMLError "Invalid TOML file"). Values are not checked when the file is loaded (only POETRY_* variables go through the normalizers of config.py), and a key an older version does not know is never read, so the keys depcurfew writes need no exact version. Read from the code.

• false · source, verified 2026-10-31.

Poetry · extra.excludeFormat ⚠️ disputed

The 2.5.1 docs give the type string, a comma-separated list; the docs on main (pull request #11087, not released) give array and say to use a TOML array in poetry.toml. The 2.5.1 code iterates the value as it is, so a string would be read letter by letter. Tested on 2026-10-30: a TOML array exempted the package in Poetry 2.4.0 and 2.5.1.

• Variant 1: comma-separated string · source, verified 2026-10-30.
• Variant 2: TOML array · source, verified 2026-10-30.

Poetry · extra.lockedVersionsKept ❓ uncertain

Read from the solver code, which takes the locked package without asking the repository; the docs do not say it.

• poetry lock and poetry add keep versions already in poetry.lock even when they are newer than the delay allows; poetry update and poetry lock --regenerate resolve them again · source, verified 2026-10-30.

Poetry · extra.lockfileFormat ❓ uncertain

poetry.lock has no documented format. Each [[package]] from PyPI has no [package.source]; others have type git, url, file, directory or legacy (a named index). files lists {file, hash} for every distribution, empty for git and directory packages; a package from an index without a .whl file is built when installed.

• {"sources":{"git":"git","remoteTarball":"url","file":"file","directory":"directory","registry":"legacy"},"packages":"package","source":"source","files":"files"} · source, verified 2026-10-30.

PDM · cooldown.securityUpdates ❓ uncertain

PDM does not know which versions fix vulnerabilities; the cutoff holds back every newer distribution of a package without an override.

• applies · source, verified 2026-10-30.

PDM · sources.git.setting ❓ uncertain

No setting allows or forbids git dependencies (concluded from the documented [tool.pdm] settings); only-binary does not stop them from being built.

• null · source, verified 2026-10-30.

PDM · sources.remoteTarball.setting ❓ uncertain

No setting allows or forbids URL dependencies (concluded from the documented [tool.pdm] settings); only-binary does not stop them from being built.

• null · source, verified 2026-10-30.

PDM · sources.file.setting ❓ uncertain

No setting allows or forbids local archive dependencies (concluded from the documented [tool.pdm] settings); only-binary does not stop them from being built.

• null · source, verified 2026-10-30.

PDM · sources.directory.setting ❓ uncertain

No setting allows or forbids local directory dependencies (concluded from the documented [tool.pdm] settings); only-binary does not stop them from being built.

• null · source, verified 2026-10-30.

PDM · project.workspaces ❓ uncertain

Workspaces ([tool.pdm.workspace] members) are experimental since 2.28.0 and are locked and installed from the root only, so depcurfew configures the root and reads no members.

• null · source, verified 2026-10-30.

PDM · project.workspacesObjectKey ❓ uncertain

Not read; see workspaces.

• null · source, verified 2026-10-30.

PDM · user.files ⚠️ disputed

The docs give ~/Library/Application Support/pdm on macOS. The code asks the installed platformdirs (not pinned in pyproject.toml), and platformdirs 4.6.0 (2026-02-12) added the XDG variables on macOS, so with XDG_CONFIG_HOME set (not empty) PDM reads $XDG_CONFIG_HOME/pdm/config.toml instead (https://github.com/tox-dev/platformdirs/blob/4.6.0/src/platformdirs/_xdg.py); which one applies depends on the platformdirs version in PDM's environment. Linux and Windows agree. The home configuration is TOML whose nested tables are read as dotted keys ([strategy] exclude-newer is strategy.exclude-newer, load_config in src/pdm/project/config.py). -c/--config and PDM_CONFIG_FILE replace it; the site configuration is merged below it. Checked at 2.29.5; earlier versions are not tracked.

• Variant 1: all versions: {"format":"toml","locations":[{"platforms":["linux"],"directories":[{"from":{"env":"XDG_CONFIG_HOME"},"path":"pdm"},{"from":"home","path":".config/pdm"}],"file":"config.toml"},{"platforms":["darwin"],"directories":[{"from":"home","path":"Library/Application Support/pdm"}],"file":"config.toml"},{"platforms":["win32"],"directories":[{"from":"home","path":"AppData/Local/pdm/pdm"}],"file":"config.toml"}]} · source, verified 2026-10-31. <CONFIG_ROOT> is "$XDG_CONFIG_HOME/pdm (~/.config/pdm in most cases) on Linux", "~/Library/Application Support/pdm on macOS" and "%USERPROFILE%\AppData\Local\pdm\pdm on Windows".
• Variant 2: all versions: {"format":"toml","locations":[{"platforms":["linux"],"directories":[{"from":{"env":"XDG_CONFIG_HOME"},"path":"pdm"},{"from":"home","path":".config/pdm"}],"file":"config.toml"},{"platforms":["darwin"],"directories":[{"from":{"env":"XDG_CONFIG_HOME"},"path":"pdm"},{"from":"home","path":"Library/Application Support/pdm"}],"file":"config.toml"},{"platforms":["win32"],"directories":[{"from":"home","path":"AppData/Local/pdm/pdm"}],"file":"config.toml"}]} · source, verified 2026-10-31. global_config = platformdirs.user_config_path("pdm") / "config.toml", which on macOS honors XDG_CONFIG_HOME since platformdirs 4.6.0. On Windows the default appauthor repeats the name (pdm\pdm) and roaming is off, so platformdirs asks for the Local AppData known folder.

PDM · user.unknownKeys ❓ uncertain

load_config keeps every key of config.toml without checking it, and only registered config items are ever read, so PDM before 2.27.0 ignores strategy.exclude-newer. Read from the code.

• ignore · source, verified 2026-10-31.

PDM · user.invalidValueFails ❓ uncertain

A config.toml that is not valid TOML stops every command (load_config catches only FileNotFoundError). Values are coerced when read, and src/pdm/core.py reads strategy.exclude-newer before every command, so a value convert_to_datetime cannot parse (anything but Nd, Nh, Nw, a date or an RFC 3339 time) fails every command. Read from the code.

• true · source, verified 2026-10-31.

PDM · extra.lockfileFormat ❓ uncertain

pdm.lock (lock_version 4.5) has no documented format beyond the docs examples. Each [[package]] has name, version and files ({file, hash} for every distribution); a VCS package has its repository under the key of its VCS (git = "…") with ref and revision; a local archive or directory has path, a remote archive url, and editable packages editable = true (as_lockfile_entry). A package from an index without a .whl file is built when installed.

• {"packages":"package","files":"files","file":"file","vcs":["git","hg","svn","bzr"],"url":"url","path":"path","editable":"editable"} · source, verified 2026-10-30.

PDM · extra.uvMode ❓ uncertain

Experimental since 2.19.0: PDM resolves and installs with uv. It passes the cutoff and the build settings to uv lock, but runs uv sync --frozen without the build settings (src/pdm/installers/uv.py), and pdm.lock then lists source distributions even with only-binary.

• {"file":"pdm.toml","key":"use_uv"} · source, verified 2026-10-30.

Pipenv · cooldown.cliFlag ❓ uncertain

No command-line option.

• null · source, verified 2026-10-30.

Pipenv · cooldown.exclude.setting ❓ uncertain

No per-package exception: the cutoff applies to every package.

• null · source, verified 2026-10-30.

Pipenv · cooldown.securityUpdates ❓ uncertain

The cutoff holds back every newer version, security fixes included.

• applies · source, verified 2026-10-30.

Pipenv · installScripts.allowList.setting ❓ uncertain

No documented setting; a per-package no_binary = true exists in the code (pipenv/routines/install.py) but forces building rather than allowing it.

• null · source, verified 2026-10-30.

Pipenv · installScripts.disableAll ❓ uncertain

No Pipfile setting. Only pip configuration or PIP_ONLY_BINARY=:all: in the environment (Pipenv loads the project .env for every command) forbids building.

• null · source, verified 2026-10-30.

Pipenv · sources.git.setting ❓ uncertain

No Pipfile setting allows or forbids git dependencies (concluded from the documented [pipenv] directives).

• null · source, verified 2026-10-30.

Pipenv · sources.remoteTarball.setting ❓ uncertain

No Pipfile setting allows or forbids URL dependencies (concluded from the documented [pipenv] directives).

• null · source, verified 2026-10-30.

Pipenv · sources.file.setting ❓ uncertain

No Pipfile setting allows or forbids local archive dependencies (concluded from the documented [pipenv] directives).

• null · source, verified 2026-10-30.

Pipenv · sources.directory.setting ❓ uncertain

No Pipfile setting allows or forbids local directory dependencies (concluded from the documented [pipenv] directives).

• null · source, verified 2026-10-30.

Pipenv · project.workspaces ❓ uncertain

Pipenv has no workspaces.

• null · source, verified 2026-10-30.

Pipenv · project.workspacesObjectKey ❓ uncertain

No workspaces.

• null · source, verified 2026-10-30.

Pipenv · user.variables ❓ uncertain

PIPENV_RESOLVER is not documented. The code ranks it above the resolver key of the Pipfile ("CLI/caller > env > current project's Pipfile > default"), and the pure-python backend locked the newest versions despite cool-down-period when chosen in the Pipfile (extra.resolverBypass, tested on 2026-10-30); the variable itself was not tested. PIPENV_PYPI_MIRROR: "When the index does not provide upload-time metadata (e.g. most private mirrors) the setting is accepted but has no filtering effect" (docs/pipfile.md). PIP_* variables are merged over the environment of the pip subprocess (pipenv/utils/processes.py), so they still reach it while pip.conf does not; pipenv/routines/install.py also reads PIP_NO_BINARY.

• {"name":"PIPENV_RESOLVER","values":["pure-python"],"effect":"selects the pure-python resolver, which ignores cool-down-period"}, {"name":"PIPENV_PYPI_MIRROR","values":"any","effect":"replaces PyPI; on a mirror without upload times cool-down-period has no effect"}, {"name":"PIP_ONLY_BINARY","values":"any","effect":"sets only-binary of the pip Pipenv installs with, which no pip.conf reaches since 2026.3.0"}, {"name":"PIP_NO_BINARY","values":"any","effect":"builds these packages from source when installing, and pipenv install records no_binary for a named package in the Pipfile"} · source, verified 2026-10-31.

Pipenv · extra.resolverBypass ❓ uncertain

Not documented. Tested on 2026-10-30 with 2026.10.4: with resolver_backend = "pure-python" in [pipenv], pipenv lock locked the newest versions despite cool-down-period = "100000d"; resolver is the older name of the key.

• {"table":"pipenv","keys":["resolver_backend","resolver"],"value":"pure-python"} · source, verified 2026-10-30.

Renovate · cooldown.exclude.availableSince ❓ uncertain

Assumed to work since the option exists with packageRule scope; not stated by a release note.

• 35.46.0 · source, verified 2026-10-28.

Renovate · installScripts.allowList.setting ❓ uncertain

No per-package allow-list was found: scripts are all or nothing, via allowScripts: true (self-hosted global config) plus ignoreScripts: false.

• null · source, verified 2026-10-28.

Renovate · extra.pnpmSecurityExclusions ❓ uncertain

updatePnpmWorkspace: when a security update (vulnerability alert) changes a project with a pnpm lockfile whose pnpm-workspace.yaml sets minimumReleaseAge, Renovate adds the entry <name>@<version> to minimumReleaseAgeExclude with the comment "# Renovate security update: <name>@<version>" on the line above it; a later fix of the same package appends " || <version>" to the entry (and to the comment), and an entry for the package that has no comment gets one. The tests next to it (artifacts.spec.ts) show the written file. No other package manager (npm, Yarn, Bun, Deno) has such code at this tag; read from the code.

• {"managers":["pnpm"],"file":"pnpm-workspace.yaml","setting":"minimumReleaseAgeExclude","comment":"# Renovate security update: ","versionSeparator":" || "} · source, verified 2026-10-30.

Renovate · extra.digestBypassFixed ⚠️ disputed

Digest updates could bypass minimumReleaseAge; the advisory and a maintainer comment give different fixed versions. Rebase requests could bypass strict checks before 44.61.3 (GHSA-2frq-pm48-6j4h).

• Variant 1: 44.3.1 · source, verified 2026-10-28.
• Variant 2: 44.10.0 · source, verified 2026-10-28.

Dependabot · cooldown.cliFlag ❓ uncertain

Cooldown is configured only in dependabot.yml; the Dependabot CLI README mentions no such flag.

• null · source, verified 2026-10-28.

Dependabot · cooldown.exclude.availableSince ❓ uncertain

Presumably shipped with cooldown GA; not confirmed separately.

• 2025-07-01 · source, verified 2026-10-28.

Dependabot · installScripts.defaultPolicy ❓ uncertain

From dependabot-core source, not the docs: npm, Yarn and Bun lockfile updates run with scripts disabled; for pnpm only --lockfile-only was found. bundler, mix and pip may execute external code.

• all versions: deny · source, verified 2026-10-28.

Dependabot · installScripts.disableAll ❓ uncertain

Nothing to configure for JavaScript ecosystems: scripts are always disabled (source code). For bundler, mix and pip, external code execution is disabled automatically when registries are configured.

• null · source, verified 2026-10-28.

Dependabot · extra.yamlMergeKeys ❓ uncertain

Not known. The options reference does not mention YAML anchors or merge keys, GitHub parses dependabot.yml in its own service, and the dependabot-core pull request that would allow aliases ("we can't use the YAML anchor (aliases) feature in dependabot.yml file") is still open and marked stale (read 2026-10-31). depcurfew reads dependabot.yml without merge keys: a cooldown that an entry would get only through <<: *defaults counts as missing, which bot-cooldown reports, and depcurfew apply writes the cooldown into the entry itself, which wins over merged keys where they apply.

• false · source, verified 2026-10-31.

Dependabot · extra.dayRange ⚠️ disputed

Matters for opting out of the default cooldown; cooldown.exclude: ["*"] works under the documented precedence rule either way. The announcement does not state its author's role.

• Variant 1: 1 to 90 days · source, verified 2026-10-28.
• Variant 2: 0 removes the cooldown · source, verified 2026-10-28.

Dependabot · extra.transitiveGating ❓ uncertain

Read from dependabot-core source.

• Regular updates pass the cooldown to npm (11.10+), pnpm (10.16+) and Yarn Berry to hold back transitive dependencies; the Bun updater passes none · source, verified 2026-10-28.

Environment · npmRegistry.notFoundStatus ❓ uncertain

The API description leaves its Errors section empty; a name that does not exist answered 404 with {"error":"Not found"} on 2026-10-29.

• 404 · source, verified 2026-10-29.

Environment · npmRegistry.search ❓ uncertain

The description documents text, size (at most 250) and from. Results carried downloads.weekly on 2026-10-29, which the description does not list, and from was ignored, so one query returns at most 250 packages.

• {"path":"/-/v1/search","maxSize":250,"weeklyDownloadsField":"downloads.weekly"} · source, verified 2026-10-29.