Willison (March 24): 'Package Managers Need to Cool Down' — Dependency Cooldown Support Now Shipping in 7 Major Package Managers
simonwillison.net·medium signal
Simon Willison highlighted that dependency cooldowns — only installing updated packages after they've been live for a few days so the community can spot supply chain compromises — are now supported across pnpm, Yarn, Bun, Deno, uv, pip, and npm. The post, published in the wake of the LiteLLM attack, references Andrew Nesbitt's survey of cooldown mechanisms and notes that pip users can work around its current absolute-date limitation using cron jobs to auto-update config values.