Harden-CI recommends that newly introduced dependency versions should be at least seven days old before being adopted, in order to mitigate the risk of publish-time poisoning attacks.