AI Navigate
インサイト最新記事一覧AI大全

Package Managers Need to Cool Down

Simon Willison's Blog / 3/25/2026

💬 OpinionDeveloper Stack & InfrastructureSignals & Early TrendsIdeas & Deep AnalysisTools & Practical Usage
Read original →
共有:

Key Points

  • The article revisits the idea of “dependency cooldowns,” delaying dependency updates for a few days so the community can detect malicious or compromised releases before they spread widely.
  • It is motivated by a recent LiteLLM supply-chain attack, which highlights the ongoing risk of dependency tampering even when upstream tooling is secure.
  • The post notes that multiple major package managers have added or expanded “minimum release age” or similar age-gating features, indicating strong ecosystem momentum toward safer update workflows.
  • Examples include pnpm’s minimumReleaseAge settings, Yarn’s npmMinimalAgeGate and preapproved package exemptions, Bun’s minimumReleaseAge config, Deno’s minimum-dependency-age flag, and uv’s improved duration and per-package override options.
  • The discussion also mentions pip 26.0 adding an --uploaded-prior-to option, while relative time support is still being requested, suggesting cooldown mechanisms are still evolving.
Sponsored by: WorkOS — The infrastructure fast-growing B2B companies use to sell to Enterprise.

24th March 2026 - Link Blog

Package Managers Need to Cool Down. Today's LiteLLM supply chain attack inspired me to revisit the idea of dependency cooldowns, the practice of only installing updated dependencies once they've been out in the wild for a few days to give the community a chance to spot if they've been subverted in some way.

This recent piece (March 4th) piece by Andrew Nesbitt reviews the current state of dependency cooldown mechanisms across different packaging tools. It's surprisingly well supported! There's been a flurry of activity across major packaging tools, including:

  • pnpm 10.16 (September 2025) — minimumReleaseAge with minimumReleaseAgeExclude for trusted packages
  • Yarn 4.10.0 (September 2025) — npmMinimalAgeGate (in minutes) with npmPreapprovedPackages for exemptions
  • Bun 1.3 (October 2025) — minimumReleaseAge via bunfig.toml
  • Deno 2.6 (December 2025) — --minimum-dependency-age for deno update and deno outdated
  • uv 0.9.17 (December 2025) — added relative duration support to existing --exclude-newer, plus per-package overrides via exclude-newer-package
  • pip 26.0 (January 2026) — --uploaded-prior-to (absolute timestamps only; relative duration support requested)
  • npm 11.10.0 (February 2026) — min-release-age

pip currently only supports absolute rather than relative dates but Seth Larson has a workaround for that using a scheduled cron to update the absolute date in the pip.conf config file.

Posted 24th March 2026 at 9:11 pm

This is a link post by Simon Willison, posted on 24th March 2026.

javascript 747 packaging 45 pip 16 pypi 44 python 1237 security 583 npm 22 deno 27 supply-chain 12 uv 90

Monthly briefing

Sponsor me for $10/month and get a curated email digest of the month's most important LLM developments.

Pay me to send you less!

Sponsor & subscribe

関連おすすめサービス

※当サイトはアフィリエイト広告を利用しています
🎧

Notta搭載AI議事録イヤホン ZENCHORD1

AI時代の仕事術。Notta搭載で会議の議事録を自動生成するスマートイヤホン。

🎙️

AI搭載ボイスレコーダー Plaud

世界100万人が愛用。AIで文字起こし・要約を自動化するボイスレコーダー。

🖼️

画像高画質化AIツール Aiarty Image Enhancer

AIで画像を高画質化。写真・イラストを簡単にアップスケール。