Color me curmudgeon, but automated dependency updates should never be a consideration.

Also, one thing I do like that Github does is that it can be configured to send you a report of dependency changes (in yarn, for example).

Pinned (major.minor.patch) versions and ignore-scripts should be the default. It's insane that the default is to execute untrusted code from the Internet.

It reminds me of back when IE would let me download a bat file and execute it

/Getoffmylawn

“cooldown” is exactly what it sounds like: a window of time between when a dependency is published and when it’s considered suitable for use. The dependency is public during this window, meaning that “supply chain security” vendors can work their magic while the rest of us wait any problems out.

pnpm has minimumReleaseAge https://pnpm.io/settings#minimumreleaseage

Been using renovate a while, 42 added this as a default!

minimumReleaseAge: 3 dayswill now be set by default for npm in config:best-practices

No no no, I should be using dependency cooldowns. You all should be finding the vulnerabilities and getting them fixed before they reach me.

If we all use them, won't attackers switch to waiting an extra week before attempting to activate their attacks? This feels similar to antibiotics resistance in bacteria coming from over use of antibiotics.