We have 7d cooldown on packages on an internal pypi proxy but that blocks security updates also, which we now have to manually exclude from the cooldown.

I’m unsure how to automate this properly, maybe an LLM is the best starting point.

▲

trollbridge 2 hours ago | parent | next [-]

Problem is, we leave ourselves open for LLM injection attacks.

▲

mbrumlow 3 hours ago | parent | prev [-]

Are security updates immune ?

	▲	tikkabhuna 2 hours ago \| parent \| next [-]
		They definitely wouldn't be if attackers knew that it would then bypass cooldowns! Ultimately, you need someone to verify releases and that probably means paying for it. I know Sonatype paid solutions utilise their own internal research to allow/block new releases.
	▲	fmbb 3 hours ago \| parent \| prev \| next [-]
		It’s in the name. They are secure!
	▲	dlkasajiewo 2 hours ago \| parent \| prev \| next [-]
		No, but there's a bigger tradeoff for not upgrading. In one case it's that you're potentially exposed to a known vulnerability, vs the other case where you might just be missing out on some new or slightly reworked feature.
	▲	mattstir 2 hours ago \| parent \| prev [-]
		But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately.