#dependencycooldowns — Public Fediverse posts

" #Dependencycooldowns are a free, easy, and incredibly effective way to mitigate the large majority of open source #supplychain attacks. More individual projects should apply cooldowns (via tools like Dependabot and Renovate) to their dependencies, and packaging ecosystems should invest in first-class support for cooldowns directly in their #packagemanagers "

https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

I got too excited about "set-and-forget" relative dependency cooldowns coming to #pip that I hacked them together using cron and a script that calculates uploaded-prior-to in pip.conf 👀

https://sethmlarson.dev/pip-relative-dependency-cooling-with-crontab

#python #pypi #dependencycooldowns #security

🚨 Alert: Another self-proclaimed tech guru has discovered the magical elixir of "dependency cooldowns" that apparently solves all #open-source #security woes. 💡 Spoiler: It's just another buzzword for "delay your updates" — because clearly, the best way to secure your software is to procrastinate. 😏
https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns #techbuzzwords #procrastination #softwareupdates #dependencycooldowns #HackerNews #ngated

We should all be using dependency cooldowns

https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns

#HackerNews #dependencycooldowns #softwaredevelopment #coding #bestpractices #techinnovation