packslip release was recorded by the

Error message

packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age

What it means

mise's minimum_release_age policy delays installing very fresh releases to let supply-chain attacks surface. For a packslip release, the effective timestamp is the transparency-log inclusion time (or the manifest publish time if unlogged). If that timestamp is after the allowed cutoff, mise refuses to install even if every signature verifies.

Solutions

Wait until the release is older than the configured minimum_release_age, then retry.
Pin an older version that predates the cutoff instead of latest.
Lower or unset minimum_release_age (e.g. mise settings or per-tool option) if your risk tolerance allows.
Ensure releases are logged to the transparency log promptly; unlogged manifests fall back to publish time which may be later.

Example fix

// before (mise.toml)
[settings]
minimum_release_age = "7d"

// after — if the delay is too strict for this tool
[settings]
minimum_release_age = "1d"

Defensive patterns

Strategy: try-catch

Validate before calling

// Skip a release younger than the policy cutoff.
const cutoff = Date.now() - minReleaseAgeMs;
if (new Date(release.loggedAt ?? release.publishedAt) > cutoff) {
  console.warn('release is newer than minimum_release_age; pick an older version');
}

Try / catch

try {
  await miseInstall(tool, { version: 'latest' });
} catch (e) {
  if (String(e).includes('minimum_release_age')) {
    const older = await listVersions(tool); // pick the newest version older than cutoff
    await miseInstall(tool, { version: older });
  } else throw e;
}

Prevention

In CI, never resolve `latest` for age-restricted tools immediately after a vendor release.
Pin exact versions in mise.lock so the age check passes deterministically.
Set minimum_release_age deliberately per environment, not org-wide by accident.
Prefer transparency-log-backed vendors so inclusion time (not publish time) drives the check.

When it happens

Trigger: install_payload or resolve_lock_info calling check_verified_age when verified_age_allowed(logged_at, published_at, before) returns false — i.e. the release was recorded/published more recently than now - minimum_release_age.

Common situations: Installing a tool seconds/minutes after the vendor cut a release while minimum_release_age is set (e.g. in an air-gapped or security-hardened org config); CI pinning "latest" right after a vendor release.

Related errors

AI-assisted analysis of jdx/mise@533346cc37 (2026-09-17). Data as JSON: /api/errors/38aa0ea05fe049b1. Report an issue: GitHub.

Appendix: source

Thrown at src/backend/packslip.rs:656

/// itself resolved — `minimum_release_age` documents both as unfiltered.
fn selection_already_made(tv: &ToolVersion) -> bool {
    tv.resolved_from_lockfile() || tv.request_pinned_this_version()
}

fn check_verified_age(
    logged_at: Option<&str>,
    published_at: &str,
    before: Option<jiff::Timestamp>,
) -> Result<()> {
    let Some(before) = before else {
        return Ok(());
    };
    let (time, source) = match logged_at {
        Some(time) => (time, "transparency log"),
        None => (published_at, "unlogged manifest"),
    };
    if !verified_age_allowed(logged_at, published_at, Some(before))? {
        bail!(
            "packslip release was recorded by the {source} at {time}, after the allowed cutoff {before}; refusing to bypass minimum_release_age"
        );
    }
    Ok(())
}

/// A withdrawal in the vendor's signed list is the end of the matter: no
/// stamp, mirror, or cached manifest reinstates the version.
fn refuse_if_withdrawn(project: &str, version: &str, entry: &ReleaseRef) -> Result<()> {
    if entry.is_yanked() {
        bail!(
            "packslip:{project}@{version} was withdrawn by the vendor{}",
            entry
                .status_reason
                .as_deref()
                .map(|r| format!(": {r}"))
                .unwrap_or_default()
        );

View on GitHub (pinned to 533346cc37)