<![CDATA[I'm delighted to discover:]]>I'm delighted to discover:

https://cooldowns.dev/

... listing how you can set dependency cooldowns across various package ecosystems.

If you're the sort of person who's less interested in fixing individual problems than in causing entire classes of problem to not exist, a seven-day cooldown default will do that for you.

https://social.rust-lang.org/@rust/117127494219189731

]]>https://forum.fedi.dk/topic/b9583521-01af-473d-ae43-304f9b0dac53/i-m-delighted-to-discoverRSS for NodeThu, 20 Aug 2026 23:53:59 GMTThu, 20 Aug 2026 12:57:23 GMT60<![CDATA[Reply to I'm delighted to discover: on Thu, 20 Aug 2026 15:01:52 GMT]]>@mhoye how do you handle security updates with a cooldown? It seems to get quite complicated with dependency chains needlessly getting updated by some tools doing audit fixes.

]]>https://forum.fedi.dk/post/https://mastodon.online/users/drewdaniels/statuses/117128436908100755https://forum.fedi.dk/post/https://mastodon.online/users/drewdaniels/statuses/117128436908100755Thu, 20 Aug 2026 15:01:52 GMT<![CDATA[Reply to I'm delighted to discover: on Thu, 20 Aug 2026 14:17:39 GMT]]>@evan correct.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/mhoye/statuses/117128263090476330https://forum.fedi.dk/post/https://cosocial.ca/users/mhoye/statuses/117128263090476330Thu, 20 Aug 2026 14:17:39 GMT<![CDATA[Reply to I'm delighted to discover: on Thu, 20 Aug 2026 14:16:31 GMT]]>@mhoye Related: https://mastodon.functional.computer/@samir/117127992264971173

]]>https://forum.fedi.dk/post/https://zeroes.ca/users/datum/statuses/117128258602889389https://forum.fedi.dk/post/https://zeroes.ca/users/datum/statuses/117128258602889389Thu, 20 Aug 2026 14:16:31 GMT<![CDATA[Reply to I'm delighted to discover: on Thu, 20 Aug 2026 14:14:08 GMT]]>@mhoye

https://youtu.be/d82V_iVnH9Y

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117128249271655881https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117128249271655881Thu, 20 Aug 2026 14:14:08 GMT<![CDATA[Reply to I'm delighted to discover: on Thu, 20 Aug 2026 13:14:15 GMT]]>Can't emphasize this enough, dependency cooldowns are the "wash your hands" of supply chain security, unreasonably effective and basically free.

Wash your hands.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/mhoye/statuses/117128013778871216https://forum.fedi.dk/post/https://cosocial.ca/users/mhoye/statuses/117128013778871216Thu, 20 Aug 2026 13:14:15 GMT