The first post in this series covers why I wait two weeks before installing any new release. My npm projects had a cooldown set in .npmrc, but my Supabase Edge Functions run on Deno, and Deno doesn't read .npmrc.

Version ranges resolve at deploy time

An import like this resolves to the newest 2.x at deploy time. Supabase bundles it on its servers, and there is no lockfile:

// Before: floats to whatever 2.x is newest when you deploy
import { createClient } from "jsr:@supabase/supabase-js@2";

// After: exact version, at least 14 days old
import { createClient } from "jsr:@supabase/supabase-js@2.117.2";

When I checked, supabase-js 2.118.0 had been published that morning, and that day's deploys had most likely picked it up. I also found my Anthropic SDK pin was only six days old, so I moved it from 0.133.0 back to 0.131.0, the newest version at least 14 days old, and redeployed every function.

Find a version old enough

Check the publish dates on the registry the import comes from:

# npm: specifiers
npm view @anthropic-ai/sdk time --json

# jsr: specifiers (look at versions[].createdAt)
curl -s https://jsr.io/@supabase/supabase-js/meta.json

If the same packages are also in a Node package.json, keep those pins identical to the Edge Function imports so your tests exercise the same code.

Use Deno's cooldown locally

For the local test cache, Deno has its own flag (unstable in Deno 2.x) that accepts minutes, an ISO-8601 duration, or a date:

deno cache --min-dep-age=P14D supabase/functions/*/index.ts
deno test --cached-only

That only covers your machine. The deploy still resolves whatever the imports say, so the exact pins are what actually hold the cooldown in production.