Conceptdependency cooldowns / 依赖更新冷却
Dependency Cool-Down Period
A software supply chain security defense strategy in which dependency package upgrades are intentionally delayed by a set number of days after a new version is published. This delay leverages community scrutiny time to detect potentially malicious package versions before adoption.
Timeline (last 90 days)
Sep 18
The dependency cooling period strategy involves not upgrading to a new version of a package immediately upon release, but instead delaying by a few days to allow the community to discover potentially malicious releases.
Unverified50%