Security
Supply-chain attacks, package cooldowns, and keeping dependencies from becoming the way in.
Supabase Edge Functions Skip Your Package Cooldown
Deno resolves version ranges at deploy time with no lockfile. Pin exact versions in your imports and check their publish dates.
A Two-Week Gem Cooldown for Ruby Projects
Bundler has no minimum release age setting. Here's how to hold your gems 14 days back and verify every locked version against RubyGems.
A Two-Week npm Cooldown with min-release-age
How to protect a Next.js and Expo repo from Shai-Hulud style npm attacks with min-release-age, blocked install scripts, and exact lockfile installs.
Homebrew Release Cooldown Without Third-Party Tools
Homebrew has no minimum release age setting. Here is how I keep Homebrew and its taps 14 days behind upstream with git, brew.env, and a small script.
Why I Wait Two Weeks Before Installing Any Package
Supply-chain attacks like Shai-Hulud get caught within days. A 14-day cooldown on every package manager keeps those releases off my machine.