jdx/mise · error

packslip release was recorded by the {source} at {time}, aft

Error message

packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age

What it means

mise's `minimum_release_age` grace period protects against freshly published (possibly compromised) releases. `check_verified_age` compares the release's recording time — transparency-log time when logged, publication time otherwise — against the allowed cutoff and refuses to install a release that was recorded after the cutoff, so users can't bypass the age requirement.

Source

Thrown at src/backend/packslip.rs:542

}

/// The headers a download from GitHub needs; nothing for anywhere else.
/// Listing timestamps only filter candidates. The authenticated log time
/// decides whether a selected release is old enough to install.
fn check_verified_age(
    logged_at: Option<&str>,
    published_at: &str,
    before: Option<jiff::Timestamp>,
) -> Result<()> {
    let Some(before) = before else {
        return Ok(());
    };
    let (time, source) = match logged_at {
        Some(time) => (time, "transparency log"),
        None => (published_at, "unlogged manifest"),
    };
    if !verified_age_allowed(logged_at, published_at, Some(before))? {
        bail!(
            "packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age"
        );
    }
    Ok(())
}

/// A withdrawal in the vendor's signed list is the end of the matter: no
/// stamp, mirror, or cached manifest reinstates the version.
fn refuse_if_withdrawn(project: &str, version: &str, entry: &ReleaseRef) -> Result<()> {
    if entry.is_yanked() {
        bail!(
            "packslip:{project}@{version} was withdrawn by the vendor{}",
            entry
                .status_reason
                .as_deref()
                .map(|r| format!(": {r}"))
                .unwrap_or_default()
        );

View on GitHub (pinned to afd2eddd3a)

Solutions

1. Pick an older version that predates the `minimum_release_age` cutoff
2. Lower or remove `minimum_release_age` in settings if you accept the risk of very fresh releases
3. Wait until the release is older than the configured age and retry

Example fix

// before (mise.toml)
[settings]
minimum_release_age = 30
// after
[settings]
minimum_release_age = 1

const cutoff = Date.now() - minReleaseAgeDays * 86400_000;
if (new Date(release.published_at).getTime() > cutoff) {
  throw new Error(`release ${release.version} is newer than minimum_release_age allows`);
}

When it happens

Trigger: Calling `install_payload` for a packslip release when `verified_age_allowed(logged_at, published_at, Some(before))` returns false: the release's transparency-log record time (or published_at for unlogged manifests) is newer than the configured `minimum_release_age` cutoff.

Common situations: A user sets `minimum_release_age` (e.g. 7 days for supply-chain safety) and tries to install a version released minutes ago; a brand-new tool release is requested on day zero; a backdated re-publication triggers on the unlogged path.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• the release list expired at {}; the vendor has not published
• packslip:{project}@{version} was withdrawn by the vendor{}
• packslip:{project}: this release {}. If the vendor announce
• must not record a pin before replacement succeeds
• backend {backend_type} is disabled by disable_backends

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/38aa0ea05fe049b1. Report an issue: GitHub.