Dependency Cooldowns Spread From pnpm and pip to Bundler, Dependabot and GitHub's Package Firewall While Critics Question the Approach

Background

A dependency cooldown is a delay between the day a package version is published and the day a build tool or update bot will use it. The idea is to give security researchers and maintainers time to spot a malicious release before it reaches developer machines and CI pipelines. As LWN.net described it in an April 22, 2026 article, one method of avoiding supply-chain attacks is to add a delay of a few days before pulling updates, in what is known as a “dependency cooldown”.

LWN traces the current wave of interest to a November 2025 blog post by William Woodruff. According to LWN.net, Woodruff examined ten prominent supply-chain attacks from 2024 and 2025 and observed that, once an attacker reached the exploitation phase, the window of opportunity was usually less than a week before detection. He concluded that a seven-day cooldown on dependencies could avoid the bulk of such attacks. InfoQ, in a May 2026 report, quotes the same analysis as finding that 8 of 10 attacks had windows of less than a week, and that a 14-day cooldown would have prevented all but one.

Separately, The Register reported on April 11, 2026 on a run of open-source compromises that included Trivy and Axios. In that report, Ben Read of Wiz, who leads a cyber threat intelligence team, said of four open-source compromises attributed to the group TeamPCP: “In all of the cases, they were found in less than 12 hours.”

Current situation

Between April and October 2026 the sources reviewed here describe cooldown features appearing in several tools, with differing defaults.

• pnpm. InfoQ reported that the pnpm 11 release candidate sets minimumReleaseAge to 1 day by default, meaning newly published versions are not resolved for 24 hours. The report adds that the default drew debate on Hacker News over whether a grace period would meaningfully help detection. The Herald covered the release candidate previously.
• pip. InfoQ’s pip 26.1 report says the release added an option, --uploaded-prior-to=P7D in its example, under which pip only pulls versions that have been on PyPI for at least seven days. In the report’s example the developer supplies the option explicitly.
• Bundler. LWN.net noted on June 5, 2026 that Bundler 4.0.13 added dependency cooldowns, a filter that refuses to resolve to a version until it has been public for at least a set number of days. LWN describes the feature as opt-in. The Herald covered it separately.
• Dependabot. A GitHub changelog entry dated July 14, 2026 says Dependabot now waits until a release has been available on its registry for at least three days before opening a version-update pull request. GitHub states that this is the default across supported ecosystems on github.com, that security updates still open immediately, and that users can change the window or opt out through the cooldown option in dependabot.yml. It says the default takes effect in GitHub Enterprise Server 3.23. The Herald’s earlier report covers the change.
• GitHub package firewall. A GitHub changelog entry dated October 20, 2026 describes a package firewall in public preview for GitHub Enterprise Cloud customers. It sits between endpoints or internal registries and upstream package repositories, and its administrator-set policy controls include a configurable cooldown period. As read on October 24, 2026, the entry says it supports only npm packages, is free during the preview, and will be charged by metered usage at general availability. GitHub names coding agents and CI/CD hosts as the endpoints that should route requests through it. See the Herald’s earlier coverage.

LWN also reports on the fragmentation of the feature. Citing a March round-up by Andrew Nesbitt, LWN.net says cooldowns are called “at least ten different configuration names across the tools that do support it”.

Disagreement over the approach

The sources record objections as well as adoption. According to LWN.net, Cal Paterson argued on April 13, 2026 against dependency cooldowns becoming community best practice. His objections, as LWN summarises them, were that cooldowns work by free-riding on those who install updates immediately, and that every package manager and project would need to implement and configure them. He proposed an alternative, the upload queue: “Make new packages wait some period of time after they are published, before they are distributed.” He also said, in LWN’s quotation, “I don’t want my security to depend on someone else getting hacked first”.

LWN reports that Woodruff replied that Paterson was “directionally accurate” but missed a key point, and that the delay relies on security companies financially incentivised to find malware quickly rather than on other maintainers. Woodruff also agreed that upload queues were more desirable, but said instant distribution was hard to take away once established as the norm. LWN adds that PyPI had not announced plans for upload queues as of its article.

The InfoQ reports record a related tension about security fixes. Commenters on Hacker News, as InfoQ reports, warned that publishing delays also slow critical security patches. InfoQ’s pip report likewise notes that cooldowns hold back legitimate security fixes and says teams should pair them with Dependabot or pip-audit. It also states that a seven-day cooldown would not have caught the XZ Utils backdoor or the Essential Plugin attack, which sat dormant for eight months before activating.

Implications

The following points are drawn from what the cited sources report, not from independent forecasting.

Defaults differ by tool and by setting. The sources describe a 24-hour default in the pnpm release candidate, a three-day default for Dependabot version updates, a configurable period in GitHub’s firewall, an opt-in setting in Bundler, and a user-specified option in pip. A developer whose project uses several of these tools would, on the sources’ description, be subject to different windows and different on-by-default behaviour in each. LWN’s note about ten configuration names suggests that the settings are also named differently.

The reported detection times and the configured delays are separate figures. Woodruff’s analysis, as cited by LWN and InfoQ, concerns windows of under a week for historical attacks. Wiz’s Ben Read, in The Register, describes four specific compromises that were found in under 12 hours. None of the cited sources compares those figures against particular tool defaults, so how a given default would have fared against a given attack is not established by them.

Security updates are treated differently from version updates in at least one tool. GitHub says Dependabot security updates open immediately while version updates wait three days. That is the one documented answer, among the sources reviewed, to the patch-delay concern raised in the InfoQ reports. The sources do not say how pnpm or pip distinguish urgent fixes.

The coverage of install paths is uneven. GitHub’s firewall is aimed at coding agents and CI hosts, which GitHub says install dependencies without a human in the loop, but the preview covers npm only and Enterprise Cloud only. The other tools above apply cooldowns at the point where a particular package manager or update bot resolves a version.

The structural debate is unresolved in the sources. Paterson’s upload-queue proposal would shift the delay to the registry, while the tools described above place it on the client side. As of LWN’s April article, package indexes such as PyPI had not announced plans to implement upload queues.

Sources were read on October 24, 2026. The pnpm and pip reports are from April and May 2026 and the Bundler item is from June 2026; defaults may have changed since.