diff --git a/.npmrc b/.npmrc
new file mode 100644
index 0000000000000..d95ac8986d9f0
--- /dev/null
+++ b/.npmrc
@@ -0,0 +1,32 @@
+min-release-age=14
+# allow assistant-ui packages & a couple specific deps since they update a LOT.
+# remove this when we stabilize (or we haven't updated in 2 wks)
+min-release-age-exclude[]=@assistant-ui/*
+min-release-age-exclude[]=assistant-cloud
+min-release-age-exclude[]=assistant-stream
+min-release-age-exclude[]=@radix-ui/*
+min-release-age-exclude[]=radix-ui
+min-release-age-exclude[]=safe-content-frame
+
+# react-router 8.3.0 includes fixes for vulns. remove this when 8.3.0 is > 2wks old.
+min-release-age-exclude[]=react-router
+
+# eslint 10.8.0 includes fixes for vulns. remove this when 10.8.0 is > 2wks old.
+min-release-age-exclude[]=eslint
+min-release-age-exclude[]=@eslint/*
+
+# tar 7.5.21 includes fixes for vulns. remove this when 7.5.21 is > 2wks  old
+min-release-age-exclude[]=tar
+
+# concurrently 10.0.4 includes fixes for vulns. remove this when 10.0.4 is > 2wks  old
+min-release-age-exclude[]=concurrently
+
+# fast-uri 3.1.4 includes fixes for vulns. remove this when 3.1.4 is > 2wks  old
+min-release-age-exclude[]=fast-uri
+
+# minimatch 10.2.6 includes fixes for vulns. remove this when 10.2.6 is > 2wks  old
+min-release-age-exclude[]=minimatch
+
+
+# brace-expansion 5.0.8 includes fixes for vulns. remove this when 5.0.8 is > 2wks  old
+min-release-age-exclude[]=brace-expansion
\ No newline at end of file