Wait a minimum age before installing a new package version

Description

A package version can only be resolved once it has been public for at least {{ min_release_age_hours }} hours. The rule applies to direct and transitive dependencies, on workstations, in pipelines and in automated update proposals. Older versions stay selectable.

Enforce the rule where it cannot be bypassed: in the registry proxy if possible, otherwise in the package manager configuration. A rule that only applies to update proposals does not protect against a developer adding a fresh release by hand, nor against transitive dependencies.

Rationale

Most malicious releases, including those pushed from hijacked maintainer accounts, are detected and removed within hours to a few days. A short quarantine turns most of these attacks into a non-event for the organization, at almost no cost.

Impact

New features and fixes arrive a few days later. Urgent security fixes need the exception process in CB-DEP-AGE-003. Some package managers resolve to an older version or fail when only a too-recent version satisfies the constraints.

Setting

Parameters

The value used is your override, else the profile's, else the default. Bounds limit what an override may set.

Audit

1. Find where the release-age rule is enforced (proxy, package manager, both).
2. Check that the configured age is at least {{ min_release_age_hours }} hours and that it covers transitive dependencies.
3. Try to install a version published less than {{ min_release_age_hours }} hours ago: it must be refused.

Automated: every check must pass. Scanners report each check by its id.

postmortem

release-age setting per package manager; --online: installed versions younger than the window

command: postmortem harden --json
control: CB-DEP-AGE-001
coverage: auto

Remediation

1. Configure a minimum release age of {{ min_release_age_hours }} hours in the registry proxy, or in committed package manager configuration for each ecosystem.
2. Apply the same delay to automated update proposals.

References

• Secure Supply Chain Consumption Framework (S2C2F) OpenSSF, guide, accessed 2026-10-16
• Package Manager Best Practices OpenSSF, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-AGE-002 Wait a minimum age before adopting a new package
• related CB-DEP-AGE-003 Grant release-age exceptions explicitly and for a limited time
• related CB-DEP-UPD-001 Propose dependency updates automatically

People and lifecycle