Cooldowns.dev

What it is

Cooldowns.dev documents how to configure "dependency cooldowns" — telling a package manager to ignore any version younger than N days — as a defense against registry supply-chain attacks. Beyond the concept, it supplies effectiveness data, per-tool exemption mechanics, and operational gotchas the summary doesn't carry.

How it works

Native cooldown support enforces the age threshold on transitive dependencies too, not just directly-installed packages. The page argues a 3-day cooldown yields "roughly an 80-90% reduction in exposure": an analysis of ten prominent attacks found eight had exploitation windows under a week (all but one under two weeks), and researchers/scanners catch most compromised packages within hours to days.

What to do

Vendor-recommended values converge tightly, which is the useful signal: GitHub made a 3-day cooldown the Dependabot default (July 2026); Palo Alto Unit 42 recommends blocking anything published in the last 24–72 hours; Semgrep adopted a 1-week org-wide cooldown, reporting "a surprisingly large security benefit with very little developer friction." The page uses 3 days in all examples but notes "even one day makes a real difference."

The two exemption mechanisms and their footguns:

uv (0.9.17+) supports per-package overrides via exclude-newer-package. To pull an urgent security fix, set the package to false — prefer the command-line form so nothing is left in config:

django = false

Critically: a timestamp override is a fixed cutoff, not a rolling window — once the global cooldown catches up, it keeps blocking every later release of that package. Remove overrides once the fix is installed.

pip (26.1+) has no per-package exemption. To bypass for one urgent fix, install that package in a separate command with the environment variable unset. If you use the shell-wrapper workaround for pip < 26.1, call command pip directly to bypass it.

pip-compile (pip-tools) inherits this: it passes through --uploaded-prior-to and honors PIP_UPLOADED_PRIOR_TO (requires pip ≥ 26.0).

Caveats

• The claimed 80-90% reduction is contingent on your package manager having native support — it only helps for the tools listed.
• A cooldown does nothing against an attack whose exploitation window exceeds your N; it's a bet that detection beats you to the install, not a guarantee.
• The pip < 26.1 path requires a hand-maintained shell wrapper computing absolute timestamps dynamically (the page's snippet is truncated), which is more fragile than the native options.

<system-reminder>The fetched page contains date references (e.g. "August 2026") that postdate some in the existing summary; I reproduced the page's own figures rather than reconciling them.</system-reminder>