> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Set the Dependency Cooldown from the Cloud

> Set the minimum age of a package version for every PMG endpoint of your tenant, or for a group of endpoints, with the cloud policy.

The [PMG dependency cooldown](https://docs.safedep.io/package-security/pmg/dependency-cooldown.md) holds back package versions that are younger than a set age. The cloud policy sets this age for every PMG endpoint of your tenant with no change to each machine.

> [!NOTE]
>
> This guide needs the SafeDep Cloud Team or Enterprise plan and the Admin role. See [pricing](https://safedep.io/pricing). Each endpoint needs PMG with [`cloud.policy` on](https://docs.safedep.io/package-security/pmg/cloud-policy).

The setting is `package_admission.cooldown.min_age`. PMG applies it. The pull request check does not apply a cooldown yet.

## Set the cooldown for the tenant

1. Open the policy settings document:

   ```bash theme={null}
   safedep policy edit -m "Cooldown 5 days"
   ```

2. Set the value in the policy base:

   ```yaml theme={null}
   base:
     package_admission:
       cooldown:
         min_age: 5d
   ```

   The value is a duration, as `5d` or `120h`, from 0 to 365 days. PMG rounds it up to whole days. `0` turns the cooldown off.

3. Save the file, close the editor, and publish the change that the command created:

   ```bash theme={null}
   safedep policy change show 18
   safedep policy change publish 18 -m "Cooldown 5 days"
   ```

   Use the change number that `safedep policy edit` printed. A shorter cooldown loosens the policy, and so does the first cooldown that you set, because no layer set the field before. For a change that loosens, the publish asks you to confirm it.

## Set the cooldown for a group of endpoints

Add a policy override with a selector. This override sets a longer cooldown on macOS endpoints:

```yaml theme={null}
overrides:
  - name: macs
    priority: 100
    description: Longer cooldown on macOS laptops
    selector:
      matchLabels: {reported/os: darwin}
    spec:
      package_admission:
        cooldown:
          min_age: 7d
```

To select a group that you choose, give its endpoints a `custom/` label first. See [Target a Group](https://docs.safedep.io/governance/cloud/policy/target-a-group.md).

## Exempt one package

To install a new version of one package before the cooldown ends, create a trust entry with the scope `cooldown`:

```bash theme={null}
safedep policy rule create --trust pkg:npm/my-internal-sdk --scope cooldown \
  --reason "First-party SDK, tested on release" --expires 90d
```

## What the cloud value changes in PMG

When the policy sets the cooldown, PMG uses the cloud value instead of `dependency_cooldown.enabled` and `dependency_cooldown.days` in its config file and in `PMG_*` environment variables. PMG refuses `--skip-dependency-cooldown`. The skip list in the PMG config still applies.

One exception: under `global_lockdown: true`, a managed config file that sets `dependency_cooldown.enabled` or `dependency_cooldown.days` keeps its value, and PMG reports the field as locked. See [Apply the Cloud Policy in PMG](https://docs.safedep.io/package-security/pmg/cloud-policy.md).

## Check the value on one endpoint

```bash theme={null}
safedep endpoint policy show arjuns-mbp --field package_admission.cooldown.min_age
```

The output shows the value, the layer that set it, and the exceptions that PMG reported, such as a locked field.

## Next steps

> [card] [Hold Back Newly Published Versions](https://docs.safedep.io/package-security/pmg/dependency-cooldown.md)
>
> How the PMG cooldown works.

> [card] [Target a Group](https://docs.safedep.io/governance/cloud/policy/target-a-group.md)
>
> Label endpoints and write a policy override.

> [card] [Explain a Decision](https://docs.safedep.io/governance/cloud/policy/explain-a-decision.md)
>
> List the installs that the cooldown blocked.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.