Say when a package version was published and whether it is old enough under the project's minimum age. Leave version out to list recent releases and get the newest version that is old enough: use that version when adding or upgrading a dependency. A version that is too new comes with the newest older version that passes.

Check every lockfile under a directory (package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, deno.lock, uv.lock, poetry.lock, requirements.txt, Cargo.lock, go.mod, composer.lock, Gemfile.lock, packages.lock.json, gradle.lockfile, pubspec.lock, Podfile.lock, Package.resolved, .terraform.lock.hcl, conan.lock, renv.lock, mix.lock, flake.lock, MODULE.bazel.lock, vcpkg.json and more) and report every locked version that is younger than the minimum age or whose age is unknown. Set since to a git ref, like origin/main, to check only what changed since then.

Show the unripe policy for a directory, the minimum release age settings its package managers and update bots already have (npm, pnpm, yarn, bun, uv, Poetry, Deno, Cargo, Bundler, Dependabot, Renovate), where they disagree, and the lines that would add the missing ones.