Package-age controls

Minimum package age controls how old an upstream release must be before Ravenstash can serve it. An optional maximum age can bound which older releases remain eligible. These controls reduce immediate exposure to newly published dependencies; they do not inspect code or decide whether a release is safe.

Default behavior

Default minimum age: 3 days.
Supported range: 0–180 days.
A value of 0 allows new releases immediately without disabling the upstream.

PyPI and npm decisions use upstream release metadata. Maven uses Maven Central Last-Modified information when available.

Per-connection values

Every upstream attached to a PyPI, npm, or Maven repository lane stores its own explicit age bounds. When you create a connection, Ravenstash copies the remote cache’s current defaults into that connection. Later changes to the remote cache defaults do not rewrite existing connections.

Direct access to a remote cache uses that cache’s own defaults, independently from repositories that consume it.

Change one or several connections

Open a repository’s Upstreams settings to edit the selected connection. Repository-level bulk controls may apply the same new value to several selected connections, but this is an explicit fan-out: the connections still retain separate values afterward.

Allowing new releases immediately affects only the connections you update; it does not remove an upstream.

Choosing a value

Consider release cadence, lockfile practices, emergency update needs, and your tolerance for newly published dependencies. Test the resulting resolver behavior in CI before increasing or decreasing the delay for production builds.