fix(plugin-npm): bypass npmMinimalAgeGate when publishTimes metadata …

.yarn/versions/b7fac98a.yml

@@ -0,0 +1,36 @@
+releases:
+  "@yarnpkg/plugin-npm": patch
+  "@yarnpkg/core": patch
+
+declined:
+  - "@yarnpkg/plugin-catalog"
+  - "@yarnpkg/plugin-compat"
+  - "@yarnpkg/plugin-constraints"
+  - "@yarnpkg/plugin-dlx"
+  - "@yarnpkg/plugin-essentials"
+  - "@yarnpkg/plugin-exec"
+  - "@yarnpkg/plugin-file"
+  - "@yarnpkg/plugin-git"
+  - "@yarnpkg/plugin-github"
+  - "@yarnpkg/plugin-http"
+  - "@yarnpkg/plugin-init"
+  - "@yarnpkg/plugin-interactive-tools"
+  - "@yarnpkg/plugin-jsr"
+  - "@yarnpkg/plugin-link"
+  - "@yarnpkg/plugin-nm"
+  - "@yarnpkg/plugin-npm-cli"
+  - "@yarnpkg/plugin-pack"
+  - "@yarnpkg/plugin-patch"
+  - "@yarnpkg/plugin-pnp"
+  - "@yarnpkg/plugin-pnpm"
+  - "@yarnpkg/plugin-stage"
+  - "@yarnpkg/plugin-typescript"
+  - "@yarnpkg/plugin-version"
+  - "@yarnpkg/plugin-workspace-tools"
+  - "@yarnpkg/builder"
+  - "@yarnpkg/cli"
+  - "@yarnpkg/doctor"
+  - "@yarnpkg/extensions"
+  - "@yarnpkg/nm"
+  - "@yarnpkg/pnpify"
+  - "@yarnpkg/sdks"

packages/acceptance-tests/pkg-tests-core/sources/utils/tests.ts

@@ -486,9 +486,11 @@ export const startPackageServer = ({type}: {type: keyof typeof packageServerUrls
             }),
           )),
         ),
-        time: name in RELEASE_DATE_PACKAGES
-          ? RELEASE_DATE_PACKAGES[name]
-          : Object.fromEntries(versions.map(version => [version, OLD_RELEASE_DATE])),
+        ...(!name.startsWith(`no-time-`) ? {
+          time: name in RELEASE_DATE_PACKAGES
+            ? RELEASE_DATE_PACKAGES[name]
+            : Object.fromEntries(versions.map(version => [version, OLD_RELEASE_DATE])),
+        } : {}),
         [`dist-tags`]: {
           latest: semver.maxSatisfying(versions, `*`),
           ...distTags,

packages/acceptance-tests/pkg-tests-fixtures/packages/no-time-deps-1.0.0/index.js

@@ -0,0 +1,7 @@
+module.exports = require(`./package.json`);
+
+for (const key of [`dependencies`, `devDependencies`, `peerDependencies`]) {
+  for (const dep of Object.keys(module.exports[key] || {})) {
+    module.exports[key][dep] = require(dep);
+  }
+}

packages/acceptance-tests/pkg-tests-fixtures/packages/no-time-deps-1.0.0/package.json

@@ -0,0 +1,4 @@
+{
+    "name": "no-time-deps",
+    "version": "1.0.0"
+}

packages/acceptance-tests/pkg-tests-specs/sources/features/npmMinimalAgeGate.test.ts

@@ -573,5 +573,21 @@ describe(`Features`, () => {
         }),
       );
     });
+
+    describe(`packages with no release time metadata (e.g. GitHub Packages)`, () => {
+      test(
+        `it should install a package with no release time even if npmMinimalAgeGate is set`,
+        makeTemporaryEnv({}, {
+          npmMinimalAgeGate: `1d`,
+        }, async ({run, source}) => {
+          await run(`add`, `no-time-deps`);
+
+          await expect(source(`require('no-time-deps/package.json')`)).resolves.toMatchObject({
+            name: `no-time-deps`,
+            version: `1.0.0`,
+          });
+        }),
+      );
+    });
   });
 });

packages/plugin-npm/sources/npmConfigUtils.ts

@@ -111,8 +111,8 @@ export function getMinimalAgeGate(ident: Ident | null, {configuration}: {configu
 function shouldBeQuarantined({configuration, ident, version, publishTimes}: IsPackageApprovedOptions) {
   const minimalAgeGate = getMinimalAgeGate(ident, {configuration});
 
-  if (minimalAgeGate) {
-    const versionTime = publishTimes?.[version];
+  if (minimalAgeGate && publishTimes) {
+    const versionTime = publishTimes[version];
     if (typeof versionTime === `undefined`)
       return true;