# Supabase Edge Functions Skip Your Package Cooldown

> Deno resolves version ranges at deploy time with no lockfile. Pin exact versions in your imports and check their publish dates.

- Author: Curtis Miller
- Published: 2026-11-03
- Categories: security, supabase
- Canonical URL: https://millarian.com/posts/deno-supabase-edge-functions-skip-package-cooldown/

[The first post in this series](https://millarian.com/posts/why-i-wait-two-weeks-to-install-packages/) covers why I wait two weeks before installing any new release. My npm projects had a cooldown set in `.npmrc`, but my Supabase Edge Functions run on Deno, and Deno doesn't read `.npmrc`.

## Version ranges resolve at deploy time

An import like this resolves to the newest 2.x at deploy time. Supabase bundles it on its servers, and there is no lockfile:

```typescript
// Before: floats to whatever 2.x is newest when you deploy
import { createClient } from "jsr:@supabase/supabase-js@2";

// After: exact version, at least 14 days old
import { createClient } from "jsr:@supabase/supabase-js@2.117.2";
```

When I checked, supabase-js 2.118.0 had been published that morning, and that day's deploys had most likely picked it up. I also found my Anthropic SDK pin was only six days old, so I moved it from 0.133.0 back to 0.131.0, the newest version at least 14 days old, and redeployed every function.

## Find a version old enough

Check the publish dates on the registry the import comes from:

```shell
# npm: specifiers
npm view @anthropic-ai/sdk time --json

# jsr: specifiers (look at versions[].createdAt)
curl -s https://jsr.io/@supabase/supabase-js/meta.json
```

If the same packages are also in a Node `package.json`, keep those pins identical to the Edge Function imports so your tests exercise the same code.

## Use Deno's cooldown locally

For the local test cache, [Deno](https://docs.deno.com/runtime/reference/cli/) has its own flag (unstable in Deno 2.x) that accepts minutes, an ISO-8601 duration, or a date:

```shell
deno cache --min-dep-age=P14D supabase/functions/*/index.ts
deno test --cached-only
```

That only covers your machine. The deploy still resolves whatever the imports say, so the exact pins are what actually hold the cooldown in production.