IMHO defaults for uv, npm, etc should all have a cooldown for 24 - 48 hours by default, you should have to go out of your way to install something newer.

▲

robinhoodexe 2 hours ago | parent | next [-]

We have 7d cooldown on packages on an internal pypi proxy but that blocks security updates also, which we now have to manually exclude from the cooldown.

I’m unsure how to automate this properly, maybe an LLM is the best starting point.

▲

trollbridge an hour ago | parent | next [-]

Problem is, we leave ourselves open for LLM injection attacks.

▲

mbrumlow an hour ago | parent | prev [-]

Are security updates immune ?

	▲	tikkabhuna an hour ago \| parent \| next [-]
		They definitely wouldn't be if attackers knew that it would then bypass cooldowns! Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases.
	▲	dlkasajiewo an hour ago \| parent \| prev \| next [-]
		No, but there's a bigger tradeoff for not upgrading. In one case it's that you're potentially exposed to a known vulnerability, vs the other case where you might just be missing out on some new or slightly reworked feature.
	▲	fmbb an hour ago \| parent \| prev \| next [-]
		It’s in the name. They are secure!
	▲	mattstir an hour ago \| parent \| prev [-]
		But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately.

▲

rcleveng 2 hours ago | parent | prev | next [-]

I didn't realize they've all such added that, this was a change we made to our own projects last year when these first started - glad to see it's common.

Risk is ensuring enough security researchers are finding these and quarantining these before that default cooldown lapses.

	▲	stbenjam 2 hours ago \| parent [-]
		Yea, I think all the tools have this now but its not a default. Install scripts should also be turned off by default and require some hassle to turn them on for the first time in a package.

▲

giancarlostoro 2 hours ago | parent | prev [-]

I wonder if in some cases it's not so much that people are updating too quickly, but rather, their deployment pipelines do not have pinned / frozen versions attached to their builds.