Dependabot version updates introduce default package cooldown

Overall concern: software supply chain risk

• Many commenters see modern package ecosystems (especially npm) as inherently risky: frequent compromises, huge transitive dependency graphs, and weak tooling.
• There is debate over whether “supply chain” is even the right term when there are no contracts or payments, but most agree the ecosystem is a “hot mess” regardless of terminology.

Proposed solutions beyond cooldowns

• Some argue for sandboxing and auditing as first-class design features (browser extension model).
• Others propose economic/contractual solutions: copyleft licenses like AGPL plus built-in payments and license tracking in future languages/repositories so vendors can be compensated and enterprises have contractual relationships.
• Skeptics counter that most developers will avoid paid libraries, build equivalents themselves (especially with AI assistance), and that extra procurement friction is a strong deterrent.

Arguments for cooldowns

• Cooldowns are framed as time for automated and human security analysis before mass adoption.
• Commenters say most recent supply-chain attacks were found by maintainers or third parties, not victims, so a delay increases the chance of detection.
• Even if attackers adapt (e.g., time bombs), raising the bar and increasing the malware surface for scanners is seen as beneficial.
• Some point out this is effectively turning “publish to registry” into a soft pre-release stage.

Critiques of cooldowns

• Concerns that attackers will simply delay malicious behavior and we’ll be “back to square one.”
• Worry that longer delays force users to stretch their own cooldowns further, increasing exposure to real vulnerabilities.
• Some argue it just shifts risk in time (e.g., trojans triggering over weekends).
• Question raised about dependence on GitHub’s security advisory pipeline for fast security fixes.

Registry and ecosystem-level ideas

• Suggested measures for high-impact packages: stricter 2FA, blocking typo-squats, mandatory scanning, alerts on new dependencies, and pre-publish audits by independent orgs.
• Proposals for “stable/verified” channels or curated lists layered on top of open registries; debate over who would verify and how trust in verifiers is managed.

Dependency update culture and Dependabot

• Several commenters complain Dependabot drives noisy, context-free “update everything” pressure from security teams, often for low-relevance issues (e.g., build-time-only, internal-only).
• Arguments:
  • Frequent small updates reduce debugging pain and prevent falling hopelessly behind.
  • Others insist fewer, batched updates mean fewer total risky changes and report success with that strategy.
• Minimizing dependencies and avoiding large, transitively heavy packages is widely endorsed as a way to cut both churn and supply-chain attack surface, though it shifts risk to in-house code quality.

Language vs distro package managers

• Comparison drawn between curated distro package managers and open language registries.
• Some say they solve the same fundamental problem (“safe software distribution”), differing mainly in policy and curation.
• Others argue they are fundamentally different: distros are top-down and curated; language registries are open indexes by design. Curated overlays on language registries are suggested but not yet mainstream.