Package Cooldowns
Holding back new releases for 14 days across npm, Bundler, and Homebrew, so supply-chain attacks get caught before they reach my machine.
Why I Wait Two Weeks Before Installing Any Package
Supply-chain attacks like Shai-Hulud get caught within days. A 14-day cooldown on every package manager keeps those releases off my machine.
Homebrew Release Cooldown Without Third-Party Tools
Homebrew has no minimum release age setting. Here is how I keep Homebrew and its taps 14 days behind upstream with git, brew.env, and a small script.
A Two-Week npm Cooldown with min-release-age
How to protect a Next.js and Expo repo from Shai-Hulud style npm attacks with min-release-age, blocked install scripts, and exact lockfile installs.
A Two-Week Gem Cooldown for Ruby Projects
Bundler has no minimum release age setting. Here's how to hold your gems 14 days back and verify every locked version against RubyGems.
Supabase Edge Functions Skip Your Package Cooldown
Deno resolves version ranges at deploy time with no lockfile. Pin exact versions in your imports and check their publish dates.