A cooldown policy now filters non-compliant package versions from the repository index before package managers ever see them. This provides both security control and a better developer experience: clean resolution to the next compliant version, no build failures, and no waiting.

Why this matters

Malicious packages typically live in public registries for hours before detection. In that window, automated CI/CD pipelines can pull them straight into customer builds. A package cooldown policy closes that gap by enforcing a minimum age requirement on packages before they're available to install.

Previously, cooldowns were enforced at the point of download, meaning a build requesting a version still within the cooldown window would fail to resolve. Now, we’ve moved enforcement to the repository index, filtering out non-compliant versions before package managers see them. Builds resolve cleanly to the first available compliant version, with no iterative build failures.

With Cloudsmith’s cooldown policies:

• Non-compliant package versions are filtered automatically: Package managers only ever see versions that meet your policy requirements.
• Builds just work: Builds succeed without retries, failures, or workarounds. Developers don't need to worry about the impact of having a cooldown policy in effect.
• Enforcement is server side and enterprise wide: Security teams configure one policy at the repository level, applied consistently across every consumer of the registry.

How it works

1. Define a cooldown period (for example, 3 days) for the repositories and formats you want to protect.
2. When a package manager requests the index, Cloudsmith evaluates every version against the policy in real time.
3. Versions that do not meet the age requirement are filtered from the index, and the package manager automatically resolves to the first available compliant version.

Supported package formats

• Python
• npm

Getting started

This feature is available in Early Access for Ultra and Enterprise customers.

Check out our documentation to learn more, or contact us to request early access or register interest in additional format support.