corpus.blog
56,966 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a08756-5f5c-7015-9825-387a5ab45504

We should all be using dependency cooldowns

woodruffw · published 21 November 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at blog.yossarian.net Wayback capture
29blogs citing
First cited
2 Mar 2021
Most recent
21 Sept 2026
Rank this month
not ranked
Links from this post
18
Words captured
1,169

Cited by

Blog
In the post
Date
bubbles.town
Looking back at my first year as the Renovate Project Lead Read at the source ↗
21 Sept 2026
Jamie Tanna
Looking back at my first year as the Renovate Project Lead Read at the source ↗
21 Sept 2026
Simon Willison
Be alert: targeted attacks on prominent Rustaceans Read at the source ↗
17 Sept 2026
Flux Blog
Blog: Introducing Flux Mirror Read at the source ↗
12 Aug 2026
PyPI Blog
The HTML representation of the index API is now frozen Read at the source ↗
11 Aug 2026
schalkneethling.com
Do We No Longer Care About the Code? Read at the source ↗
28 Jul 2026
Thoughts and stuff | A collection of thoughts and stuff, primarily about programming and technology.
Cool down your dependencies Read at the source ↗
19 Jun 2026
captn3m0
Package Managers need global hooks Read at the source ↗
17 Jun 2026
Determinate Systems Blog
Introducing Nixpkgs cooldowns Read at the source ↗
15 Jun 2026
shippingbytes.com
Your Dependency Graph Is a Liability You Haven’t Priced Yet Read at the source ↗
9 Jun 2026
astral.sh
Vulnerability and malware checks in uv Read at the source ↗
8 Jun 2026
antolinez.ch
We Should All Be Using Dependency Cooldowns Read at the source ↗
27 May 2026
voidst.one
Defending Your IDE — Protecting Against Malicious or Compromised Visual Studio Extensions Read at the source ↗
25 May 2026
agateau.com
Preparing support for cooldown in Clyde Read at the source ↗
3 May 2026
muddy.jprs.me
Dependency cooldowns are now supported in the latest version of pip Read at the source ↗
30 Apr 2026
Snyk
"A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages Read at the source ↗
29 Apr 2026
sichard.ca
What's new in pip 26.1 - lockfiles and dependency cooldowns! Read at the source ↗
26 Apr 2026
anaconda.com
The Python Packages You Didn’t Install Are Now Your Biggest Security Risk Read at the source ↗
16 Apr 2026
neilmadden.blog
Mythos and its impact on security Read at the source ↗
14 Apr 2026
Cal Paterson
Dependency cooldowns turn you into a free-rider Read at the source ↗
14 Apr 2026
astral.sh
Open source security at Astral Read at the source ↗
8 Apr 2026
mareksuppa.com
Cooldown periods for package updates Read at the source ↗
31 Mar 2026
neilmadden.blog
Maybe version ranges are a good idea after all? Read at the source ↗
19 Mar 2026
tedivm
Beyond the Vibes: A Rigorous Guide to AI Coding Assistants and Agents Read at the source ↗
2 Mar 2026
thecandidstartup.org
Securing my NPM Supply Chain Read at the source ↗
23 Feb 2026
rrees.me
December 2025 month notes Read at the source ↗
6 Jan 2026
matheusrich.com
Your legacy software is a ticking bomb Read at the source ↗
29 Dec 2025
writing.peercy.net
links (95) Read at the source ↗
22 Dec 2025
skagedal.tech
Lifecycle script permissions in pnpm Read at the source ↗
6 Dec 2025
loumf
Dependency Maintenance vs. Supply Chain Attacks Read at the source ↗
28 Nov 2025
Hynek Schlawack
Semantic Versioning Will Not Save You Read at the source ↗
2 Mar 2021

Links from this post

Link
Host
https://cooldowns.dev
cooldowns.dev
https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
docs.github.com
https://docs.renovatebot.com/key-concepts/minimum-release-age/
docs.renovatebot.com
https://docs.zizmor.sh/audits/
docs.zizmor.sh
https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
securitylab.github.com
Timeline of the xz open source attack Read at the source ↗
research.swtch.com
https://www.legitsecurity.com/blog/github-actions-tj-actions-changed-files-attack
legitsecurity.com
https://cycode.com/blog/npm-debug-chalk-supply-chain-attack-the-complete-guide/
cycode.com
https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware
stepsecurity.io
https://github.com/web-infra-dev/rspack/releases/tag/v1.1.8
github.com
PyPI Phishing Attack: Incident Report Read at the source ↗
blog.pypi.org
https://konghq.com/blog/product-releases/december-2024-unauthorized-kong-ingress-controller-3-4-0-build
konghq.com
https://threats.wiz.io/all-incidents/solana-web3js-supply-chain-attack
threats.wiz.io
https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
wiz.io
https://docs.pypi.org/trusted-publishers/
docs.pypi.org
https://words.filippo.io/compromise-survey/
words.filippo.io
https://pnpm.io/settings
pnpm.io
https://docs.astral.sh/uv/guides/scripts/
docs.astral.sh