Dependency Cooldowns: A Practical Security Measure for Open Source Software
By
todsacerdoti
A baker's-dozen of insight crammed into one ring.
Summary
The article advocates for the use of dependency cooldowns as a security measure in open source software development. Dependency cooldowns involve delaying automatic updates to new package versions for a set period (typically 30-90 days) to allow time for security vulnerabilities and bugs to be discovered and reported. The author argues this approach is a free, easy, and highly effective way to mitigate the majority of open source supply chain attacks. The article explains how cooldowns work, their benefits for security and stability, and calls for wider adoption by individual projects and better ecosystem support through package managers.
Key quotes
· 4 pulledDependency cooldowns are a free, easy, and incredibly effective way to mitigate the large majority of open source supply chain attacks.
The core idea is simple: when a new version of a dependency is released, don't update to it immediately. Instead, wait for a cooldown period (typically 30-90 days) before allowing the update to proceed.
Cooldowns work because they exploit the natural lifecycle of vulnerabilities: most security issues are discovered and reported within the first few weeks after a release.
More individual projects should apply cooldowns (via tools like Dependabot and Renovate) to their dependencies, and packaging ecosystems should invest in first-class support for cooldowns directly in their package managers.
You might also wanna read
Package Manager Lockfiles as Software Bill of Materials (SBOMs)
The article argues that package manager lockfiles (like Gemfile.lock, package-lock.json, etc.) are essentially Software Bill of Materials (S
Netflix engineer's open-source tool cuts AI token usage by up to 90%
Netflix senior engineer Tejas Chopra created software called "Project Headroom" that prunes redundant tokens from AI agent instructions befo
theregister.com·6h ago
Copyparty: A Lightweight File Server That Runs as a Single Python Script
Copyparty is a lightweight, full-featured file server that runs as a single Python script, making it extremely easy to set up without needin
hackaday.com·8h ago
Researcher's "ADHD" tool for Claude Code claims 2x improvement; experts call for more evidence
Solo researcher Udit Akhouri released a third-party Agent SDK tool called "ADHD" for Claude Code on Reddit, claiming it makes the coding age
bit.ly·1d ago
ReactOS open-source Windows NT clone reaches ARM64 boot milestone on Raspberry Pi 5
ReactOS, the open-source project aiming to recreate Windows NT, has achieved a new milestone by booting on ARM64 architecture. The experimen
theregister.com·1d ago
Zig Devlog: Build System Rework Separates Maker and Configurer Processes
This devlog entry from the Zig programming language project announces a major rework of the build system, separating the maker process from
ziglang.org·1d ago