I don't know when this was added but if you use Bun in your TypeScript project, you might be familiar with bun upgrade which is a CLI tool for upgrading the packages you pin and depend on. You can now pass it a "cool down period" which means a certain package update doesn't count unless it's been published for at least X hours.
This is critical for avoiding installing compromised NPM packages. Sometimes a package gets hacked. If you were to be unlucky and upgrade to it at that window of time, you can have pinned an insecure/compromised version into your lock file.
When the Axios supply chain attack happened, there was a 39 minute window when installing the latest version of axios would (potentially) sneak in the bad package version.
Now, this is how I use bun update:
bun update --interactive --minimum-release-age=86400
That means, it won't upgrade anything that hasn't sat for at least 1 day.
Comments