Cooldown policy
What Is a Cooldown Policy?
A cooldown policy is a rule that holds newly published packages for a set period before they can be installed. It gives the community and security researchers time to spot problems first.
Think of it as a waiting room for new releases: a version only reaches your builds once it has aged past a threshold you choose.
Why Cooldown Policies Matter
Many malicious releases are found and pulled within hours or days of publication. Builds that fetch the latest version immediately are the most exposed. A cooldown policy reduces that exposure by:
- Delaying brand new versions from entering builds
- Allowing time for advisories and takedowns to appear
- Limiting the blast radius of compromised maintainer accounts
The delay trades a small amount of freshness for a large gain in trust.
How Cooldown Policies Work
| Step | What happens |
|---|---|
| Package published | A new version appears in a public registry |
| Cooldown applied | The version is withheld until the configured age is reached |
| Checks run | Vulnerability and malware checks evaluate the version |
| Release or resolve | Clean versions are released, or builds resolve to the latest compliant version |
Cooldown Policy Challenges
Teams need to balance protection against speed. Urgent security patches may need an exemption path, and the window should differ by ecosystem and risk. Enforcing the rule centrally at the package source is more reliable than relying on each client or pipeline.
Final Thought
A cooldown policy turns time into a security control. It lets teams keep using fast-moving open source while giving new releases a chance to prove themselves.
Frequently asked questions
Does a cooldown policy block all new packages?
No. It only delays them for a configured period, after which they can be used if they pass other checks.
How long should a cooldown period be?
There is no standard value. Many teams choose from a few days to a couple of weeks, depending on risk tolerance and ecosystem.
Can security patches bypass a cooldown?
Yes, if the policy supports exemptions. Teams typically approve urgent fixes explicitly so they can ship without waiting.
Is a cooldown policy the same as version pinning?
No. Pinning fixes a version manually, while a cooldown automatically controls when new versions become eligible.
Does a cooldown policy replace vulnerability scanning?
No. It complements scanning by buying time for threats to be discovered before packages are installed.