docs: explain how the minimum frontend package age is resolved

articles/flow/configuration/development-mode/npm-pnpm-bun.adoc

@@ -33,19 +33,32 @@ Vaadin uses the `npm` https://docs.npmjs.com/cli/v8/configuring-npm/package-json
 
 This default changes the behavior of installing frontend dependencies: if your project depends on a package version that was published less than a day ago, the installation fails or resolves to an older version until the package version is old enough.
 
-The minimum age is configured with the `npm.minimumFrontendPackageAgeDays` property. For example, to require package versions to be at least three days old, set the following system property:
+The minimum age is configured with the `npm.minimumFrontendPackageAgeDays` property, which takes precedence over the minimum release age setting of the package manager itself -- see <<minimum-age-precedence,Where the Minimum Age Comes From>>. For example, to require package versions to be at least three days old, set the following system property:
 
 [source,terminal]
 ----
 -Dvaadin.npm.minimumFrontendPackageAgeDays=3
 ----
 
-To disable the check and install packages regardless of their publication date, set the value to `0`.
+To let Vaadin add no restriction of its own, set the value to `0`. A minimum release age configured for the package manager itself then decides whether recently published versions are installed.
 
 [NOTE]
 When pnpm or bun is used as the package manager, this feature requires pnpm 10.16.0 or later, or bun 1.3.0 or later.
 
 
+[#minimum-age-precedence]
+[role="since:com.vaadin:vaadin@V25.3"]
+=== Where the Minimum Age Comes From
+
+npm, pnpm, and bun each have a minimum release age setting of their own, which a project may already configure in an [filename]`.npmrc` or a [filename]`pnpm-workspace.yaml`. Vaadin decides which value applies in this order:
+
+. A value set through `npm.minimumFrontendPackageAgeDays` is used as it stands. Vaadin passes it to the package manager on the command line, which takes precedence over every configuration file the package manager reads. A value of `0` adds no restriction of Vaadin's own, and a minimum release age the package manager is configured with then applies instead.
+. Where nothing is set through Vaadin, the configuration of the package manager decides. Vaadin asks npm or pnpm what it resolves for its `min-release-age` or `minimumReleaseAge` setting and, where a value is configured, passes no argument at all. The build logs which value it kept, and the parameter to set to override it.
+. Where neither is configured, package versions have to be at least one day old.
+
+Vaadin can't ask bun what it resolves, because bun has no command for printing its configuration. A `minimumReleaseAge` in a [filename]`bunfig.toml` is therefore not detected, and the one-day default is passed on the command line instead. Set `npm.minimumFrontendPackageAgeDays` to `0` to let the bun configuration decide.
+
+
 [role="since:com.vaadin:vaadin@V25.3"]
 === Vaadin Packages Are Exempt
 

articles/flow/configuration/maven.adoc

@@ -260,6 +260,6 @@ Defines whether `npm ci` is run instead of `npm i` in production frontend builds
 Forces Vaadin to create a new production bundle even if a pre-compiled one can be used. Usually needed to create an optimized production bundle and to load components sources to the browser on demand, i.e. once one opens a route where these components are used. Defaults to `false`. Settable as the `-Dvaadin.force.production.build` system property.
 
 `minimumFrontendPackageAgeDays`::
-Minimum age, in days, that a frontend (npm) package version must have before npm, pnpm, or bun is allowed to install it. This mitigates supply-chain attacks where a compromised version is briefly available on the registry. Defaults to `1`; set it to `0` to disable. Requires pnpm `>= 10.16.0` or bun `>= 1.3.0` when those tools are used. Settable as the `-Dvaadin.npm.minimumFrontendPackageAgeDays` system property.
+Minimum age, in days, that a frontend (npm) package version must have before npm, pnpm, or bun is allowed to install it. This mitigates supply-chain attacks where a compromised version is briefly available on the registry. Unset by default: a value set here overrides the minimum release age the package manager is configured with, and where neither is set, package versions have to be at least one day old. Set it to `0` to add no restriction of Vaadin's own. Requires pnpm `>= 10.16.0` or bun `>= 1.3.0` when those tools are used. Settable as the `-Dvaadin.npm.minimumFrontendPackageAgeDays` system property.
 
 [discussion-id]`CD6D2FC7-ED44-442C-B32F-FABA5AF7294F`

articles/flow/configuration/properties.adoc

@@ -278,8 +278,8 @@ Default: +
 Mode: Build
 
 `**npm.minimumFrontendPackageAgeDays**`::
-[since:com.vaadin:vaadin@V25.2]#Defines the minimum age, in days, that a frontend (npm) package version must have before npm, pnpm, or bun is allowed to install it.# Package versions published more recently than the configured number of days aren't installed. This protects against supply-chain attacks where a compromised package version is briefly available on the registry. By default, only package versions published more than one day ago are installed, which is a change in behavior for projects that depend on freshly released packages. Set to `0` to disable the check. Requires pnpm 10.16.0 or later, or bun 1.3.0 or later, when those package managers are used. +
-Default: `1` +
+[since:com.vaadin:vaadin@V25.2]#Defines the minimum age, in days, that a frontend (npm) package version must have before npm, pnpm, or bun is allowed to install it.# Package versions published more recently than the configured number of days aren't installed. This protects against supply-chain attacks where a compromised package version is briefly available on the registry. A value set here overrides the minimum release age the package manager is configured with; where nothing is set here, that configuration applies, and package versions have to be at least one day old where it's unset as well. Set to `0` to add no restriction of Vaadin's own. Requires pnpm 10.16.0 or later, or bun 1.3.0 or later, when those package managers are used. +
+Default: +
 Mode: Build
 
 `**npm.postinstallPackages**`::