[FEATURE REQUEST] Add a minimum age setting for releases

[gtflip]

Please confirm these before moving forward.

• I have searched for my feature proposal and have not found a work-in-progress/duplicate/resolved/discarded issue.
• This proposal is a completely new feature. If you want to suggest an improvement or an enhancement, please use this template.

Describe the new feature

Like pnpm's minimumReleaseAge feature, I think it would be useful to set a minimum time since release for new versions.

User overrides for individual packages could also be useful.

Something on the back end to mark a version as compromised would be useful as well.

Describe how this new feature could help users

I usually don't need the absolute latest version of everything, and it would further lower the risk of installing a compromised program.

[rnett]

+1, supply chain attacks are becoming more and more common. I almost got hit by the LiteLLM compromise - the only reason I didn't is because I saw the blog post before the update check ran.

Something on the back end to mark a version as compromised would be useful as well.

Perhaps checking https://osv.dev/?

[nbreslow]

THIS. I came here to make this same request. In light of the Axios NPM compromise today I'd say this is something you should look into ASAP. I basically disabled npm updates because of it. I think that there is a min release age in npmrc, something like "min-release-age" - exposing that and letting the user set a value in days would be great.

[topokel]

This feature would really help improve the security of the application. Since I see the Devolutions (@Devolutions) team are aiming to promote UniGetUI as Enterprise-ready, this would absolutely fit the mold. I would be happy to volunteer myself to work on the change for this and submit it as a PR if the team sees it as a change they'd like to incorporate.

[GabrielDuf]

This makes sense.
having a configurable minimum release age would help reduce exposure to potentially compromised updates. Per-package overrides and a way to flag known bad versions also sound like useful additions.
We’ll take this into consideration.