[BUG] min-release-age-exclude is not honored by npm pack #9759

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

When min-release-age is configured alongside min-release-age-exclude in a .npmrc, packages whose name matches an exclude glob should be exempt from the release-age cutoff.
However, npm pack still enforces the cutoff for packages that match the exclude pattern, rejecting them with ETARGET

Expected Behavior

npm pack should exclude packages from the min-release-age if the package follows the min-release-age-exclude in the .npmrc

Steps To Reproduce

1. In this environment:

• npm: 12.0.1
• Node: v26.3.1
• OS: Linux
• Registry: private (self-hosted, non-npmjs)

2. With this config in ~/.npmrc:
   min-release-age=7
   min-release-age-exclude=@myscope/*

3. Run:
   npm pack @myscope/[email protected] --registry https://my-private-registry.example.com --pack-destination=.

4. See error:
   npm error code ETARGET
   npm error notarget No matching version found for @myscope/[email protected] with a date before .
   npm error notarget In most cases you or one of your dependencies are requesting a package version that doesn't exist.

5. Workaround:
   Explicitly passing --min-release-age=0 on the CLI does bypass the restriction:
   npm pack @myscope/[email protected] --registry https://my-private-registry.example.com --pack-destination=. --min-release-age=0

Environment

• npm: 12.0.1
• Node: v26.3.1
• OS: Linux
• Registry: private (self-hosted, non-npmjs)
• npm config:
  ; "user" config from /home/me/.npmrc

@Myscope:registry = "https://my-private-registry.example.com/api/v4/packages/npm/"
//my-private-registry.example.com/api/v4/packages/npm/:_authToken = (protected)
allow-remote = "all"
min-release-age = 7
min-release-age-exclude = ["@myscope/*"]

; node bin location = /usr/bin/node
; node version = v26.3.1
; npm version = 12.0.1