---
title: "Wait a few days before taking new releases · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/supply-chain/release-cooldown
id: APS-72
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 864
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Wait a few days before taking new releases

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-72
- Level: Recommended
- Chapter: [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)
- Rule: Install a new version of a dependency only after it has been public for at least 7 days. Security fixes you need now may skip the wait.
- Check: The update bot's settings hold a cooldown of 7 days or more. No version in the lock file was released less than 7 days before it was added, unless the change names the hole it fixes.
- How: Hijacked packages are usually found and pulled within days. Set a minimum release age in your update bot or package manager. Keep the lock file, so nothing newer sneaks in between updates. Approve a fresh release by hand only when it fixes a hole that affects you.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule: { interval: weekly }
    cooldown: { default-days: 7 }
```

### JSON example

```json
{ "minimumReleaseAge": "7 days" }
```

## Sources

- [Dependabot cooldown option](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown-)
- [Renovate minimumReleaseAge option](https://docs.renovatebot.com/configuration-options/#minimumreleaseage)

## Related rules

- ENG-18 [Update dependencies in small automatic steps](https://agentwranglers.se/playbook/engineering/version-control-and-review/automated-dependency-updates.md) in Engineering
- ENG-55 [Lock every CI action and its dependencies to a reviewed commit](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/ci-dependency-lock.md) in Engineering
- STK-12 [Use npm with a lock file for JavaScript packages](https://agentwranglers.se/playbook/stack/languages-and-runtimes/npm.md) in Software choices
- STK-110 [Use LiteLLM as the gateway when you call several model providers](https://agentwranglers.se/playbook/stack/ai-software/llm-gateway.md) in Software choices
- APS-70 [Review every new package](https://agentwranglers.se/playbook/application-security/supply-chain/review-new-packages.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/supply-chain/release-cooldown">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep the dependency tree small](https://agentwranglers.se/playbook/application-security/supply-chain/small-dependency-tree.md)
- Next: [Fetch private packages only from your own registry](https://agentwranglers.se/playbook/application-security/supply-chain/dependency-confusion.md)
- [Supply chain](https://agentwranglers.se/playbook/application-security/supply-chain.md)