APS-72Recommended

Wait a few days before taking new releases

Install a new version of a dependency only after it has been public for at least 7 days. Security fixes you need now may skip the wait.

By Agent Wranglers. Updated 27 October 2026.

How to do it

Hijacked packages are usually found and pulled within days. Set a minimum release age in your update bot or package manager. Keep the lock file, so nothing newer sneaks in between updates. Approve a fresh release by hand only when it fixes a hole that affects you.

Examples

YAML example

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule: { interval: weekly }
    cooldown: { default-days: 7 }

JSON example

{ "minimumReleaseAge": "7 days" }

How to check

The update bot's settings hold a cooldown of 7 days or more. No version in the lock file was released less than 7 days before it was added, unless the change names the hole it fixes.

Sources

ENG-18 Update dependencies in small automatic steps in Engineering
ENG-55 Lock every CI action and its dependencies to a reviewed commit in Engineering
STK-12 Use npm with a lock file for JavaScript packages in Software choices
STK-110 Use LiteLLM as the gateway when you call several model providers in Software choices
APS-70 Review every new package in Application security

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/supply-chain/release-cooldown">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.