Dependency Firewall early access: 50% off the base fee. See pricing

Hold new releases until they have aged

A new malicious version has no CVE and no malware report yet. A delay rule keeps versions younger than a window you set out of your builds, and installs carry on with the newest version that has aged.

Start 14-day free trialBook a demo

How release delay works

  1. 1Set the window once

    Add a delay rule to the baseline firewall, for example 7 days. Every team, pipeline and agent that installs through it is covered.

  2. 2Builds get the newest version that has aged

    A version inside the window is left out of the version list. A range resolves to an older one and the install succeeds.

  3. 3Security fixes still arrive

    A version published as a fix for a known vulnerability can skip the delay. For anything else you need early, add an exception with an expiry date.

What a release delay changes for your builds

Installs keep working
A version range resolves to the newest version outside the window. Developers do nothing differently.
A pinned new version fails with a reason
An exact pin or a lockfile entry for a held version is not served. The log names the delay rule, so nobody has to guess.
Covers what nobody has reported yet
The rule needs no advisory and no tuning. It holds every new version, including the one that is found to be malicious a day later.
Container images too
The same rule holds a newly published image tag, read from the build date in the image.
Delay rule for 7 days
{  "id": "delay-new-versions",  "executionPhase": "versions",  "selector": { "maxAgeHours": 168 },  "ruleEffect": { "block": true, "log": true }}

Questions

How long should the window be?

You set it per firewall. 7 days is a common starting point, and 1 day still stops an install made seconds after a publish. Presets run from 1 to 90 days, and a custom value is possible.

What if we need a new version today?

Add an exception for that package and version with an expiry date. It is recorded in the audit log.

What if the only matching version is inside the delay window?

Then no version is old enough to serve, and the install fails with the delay rule in the log. Add an exception if you need that version before the window ends.

Does the delay apply to internal packages too?

You choose which upstreams it applies to. It is typically set on public registry upstreams only.

Are security fixes held too?

Add an exception with the Vulnerability Fixes condition and versions published as a fix for a known vulnerability skip the delay. It is available for npm, Go, Maven, PyPI, NuGet, Composer, Cargo and RubyGems.

More features

Also in the Bytesafe platform

Try it on one registry

Point one package manager at Dependency Firewall and check the log after the next install. The trial runs 14 days.

Start free trialBook a demo