Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

11.10.0

Which area(s) of pnpm are affected? (leave empty if unsure)

No response

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

With trustPolicy: "no-downgrade" set in the global pnpm config, global installs fail with ERR_PNPM_MISSING_TIME for a package whose time field is present in the registry's full metadata.

1. Install pnpm 11.10.0.

2. Add to the global config file ~/AppData/Local/pnpm/config/config.yaml (Windows) — equivalently pnpm config set --global:

   trustPolicy: "no-downgrade"
   trustPolicyExclude:
     - semver@6.3.1

3. Run a global install, e.g. pnpm add -g ripencli@1.2.4 (or pnpm setup).

Result:

[ERR_PNPM_MISSING_TIME] The metadata of ink-scroll-view is missing the "time" field
This error happened while installing the dependencies of ripencli@1.2.4
If you cannot fix this registry issue, then set "resolution-mode" to "highest".

pnpm setup fails the same way on a different dependency:

[ERR_PNPM_MISSING_TIME] The metadata of detect-libc is missing the "time" field
This error happened while installing the dependencies of @pnpm/exe@11.10.0

Removing trustPolicy from the global config makes the error go away. The same setting placed in a local project's pnpm-workspace.yaml does not trigger it — only the global config does.

Proof the registry actually provides time (so this is not the "registry omits the time field" case, e.g. #10610):

$ curl -s -H "Accept: application/json" https://registry.npmjs.org/ink-scroll-view \
    | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{const t=JSON.parse(s).time;console.log("0.3.7:",t["0.3.7"]);})'
0.3.7: 2026-05-08T10:01:42.429Z

The full time object contains created, modified, and a timestamp for every published version. The affected packages (ink-scroll-view, detect-libc) are not in trustPolicyExclude.

Describe the Bug

Setting trustPolicy: "no-downgrade" in the global pnpm config causes global installs (pnpm add -g, pnpm setup, pnpm self-update) to abort with ERR_PNPM_MISSING_TIME, claiming a dependency's metadata is missing the time field — even though the official npm registry serves a complete time field in full metadata. pnpm appears to evaluate the trust policy against abbreviated metadata (which never contains time) instead of fetching the full metadata that has it. The same policy in a local pnpm-workspace.yaml does not fail. Removing trustPolicy resolves the error. Neither resolution-mode=highest (as the error suggests) nor resolution-mode=time-based works around it. Related: #9963 (the error is not actionable).

Expected Behavior

With trustPolicy: "no-downgrade" in the global config, pnpm should fetch the full metadata (which contains time) and install successfully, instead of failing with ERR_PNPM_MISSING_TIME.

Which Node.js version are you using?

24.15.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response