> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Hold Back Newly Published Package Versions

> Set how many days PMG waits before it installs a newly published package version, and exempt the packages you trust.

An attacker who takes over a maintainer account publishes a malicious version. The registry often removes the version within days. The PMG dependency cooldown hides each version that is younger than a set number of days, so the package manager installs an older version.

The cooldown is on by default with a window of 2 days. It applies to npm, PyPI, Go, and Cargo packages.

## Set the window

```bash theme={null}
pmg config set dependency_cooldown.days 7
```

To turn the cooldown off, set `dependency_cooldown.enabled` to `false`.

## Read the result

For npm, PyPI, and Cargo, PMG removes each version inside the window from the version list that the registry sends. When the version range allows an older version, the package manager installs it and PMG shows no message. PMG blocks the install in these cases:

* Every version of the package is inside the window.
* You asked for an exact version, such as `pmg npm install pkg@1.2.3`, and that version is inside the window.

The report starts with `Dependency cooldown` and names each blocked package. When a dependency asks for an exact version inside the window, the package manager fails, and PMG lists the held-back versions after the error. Add `--verbose` to see the held-back versions on every install.

For npm and PyPI, the cooldown does not apply when the package manager downloads a locked version directly, such as `npm ci` with a lockfile.

For Go and Cargo, PMG also checks each download against the window, so a version from `go.mod` or `Cargo.lock` is checked too. PMG does not change the version list for Go. The `go` command picks the version, and PMG blocks the download when that version is inside the window.

## Exempt a package

For a package that you must install as soon as it is published, such as your own SDK, add it to the skip list. Open the config file with `pmg config edit` and add an entry:

```yaml theme={null}
dependency_cooldown:
  enabled: true
  days: 7
  skip:
    - purl: pkg:npm/my-internal-sdk
      reason: "First-party SDK, tested on release"
    - purl: pkg:npm/another-internal-pkg@1.2.3
      reason: "One build we must test now"
```

A package URL (PURL) without a version exempts all versions. A PURL with a version exempts only that version. PMG still checks an exempt package for malware.

## Skip the cooldown for one install

```bash theme={null}
pmg --skip-dependency-cooldown npm install express
```

## With SafeDep Cloud

The cooldown is free in PMG. With SafeDep Cloud, you see every cooldown hold on the endpoints and CI runners of your team. This query lists them:

```sql theme={null}
SELECT endpoints.identifier,
       package_guard_events.package_name,
       package_guard_events.package_version,
       package_guard_events.timestamp
FROM package_guard_events
JOIN endpoints ON endpoints.id = package_guard_events.invocation_id
WHERE package_guard_events.package_action = 'PMG_PACKAGE_ACTION_COOLDOWN_BLOCKED'
ORDER BY package_guard_events.timestamp DESC
```

A package that the cooldown holds back on many endpoints can be one of your own packages. To exempt it, see [Exempt a package](#exempt-a-package).

> [!NOTE]
>
> This section needs the SafeDep Cloud Team or Enterprise plan, with PMG [connected to your tenant](/governance/cloud/endpoint-hub/package-guard). See [pricing](https://safedep.io/pricing).

## Next steps

For pip version requirements and the `trusted_packages` list, see the [dependency cooldown documentation](https://github.com/safedep/pmg/blob/main/docs/dependency-cooldown.md) in the PMG repository.

> **[Alert on PMG blocks](/governance/cloud/alerts)**
>
> With SafeDep Cloud, send malicious and cooldown blocks to Slack or a webhook.

> **[Use PMG with a Private Registry or Mirror](/package-security/pmg/private-registries)**
>
> Check packages from an internal registry.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.