Supply chain and setup Recommended

Wait a few days before taking new releases

Install a new version of a dependency only after it has been public for at least 7 days. Security fixes you need now may skip the wait.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Hijacked packages are usually found and pulled within days. Set a minimum release age in your update bot or package manager. Keep the lock file, so nothing newer sneaks in between updates. Approve a fresh release by hand only when it fixes a hole that affects you.

Example

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule: { interval: weekly }
    cooldown: { default-days: 7 }

{ "minimumReleaseAge": "7 days" }

How to check

The update bot's settings hold a cooldown of 7 days or more. No version in the lock file was released less than 7 days before it was added, unless the change names the hole it fixes.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/release-cooldown.