---
title: "Wait a few days before taking new releases · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/release-cooldown
updated: 2026-10-20
licence: "All rights reserved"
---

# Wait a few days before taking new releases

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Recommended
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Install a new version of a dependency only after it has been public for at least 7 days. Security fixes you need now may skip the wait.
- How: Hijacked packages are usually found and pulled within days. Set a minimum release age in your update bot or package manager. Keep the lock file, so nothing newer sneaks in between updates. Approve a fresh release by hand only when it fixes a hole that affects you.
- Check: The update bot's settings hold a cooldown of 7 days or more. No version in the lock file was released less than 7 days before it was added, unless the change names the hole it fixes.

Example:

```yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule: { interval: weekly }
    cooldown: { default-days: 7 }
```

```json
{ "minimumReleaseAge": "7 days" }
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/release-cooldown`.

- Previous: [Publish what is in each release](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance)
- Next: [Remove DNS records you no longer use](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/dangling-dns)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)