Release Cooldown Awareness
Modern package managers added a "release cooldown" to defend against a specific supply-chain risk: the short window after a version is published, when a hijacked or malicious release is live on the registry but has not yet been caught and pulled. The September 2025 chalk and debug compromise sat live for roughly two hours before it was reverted. A cooldown tells the package manager to refuse any version published within the last N days or minutes, so your install skips that danger window entirely.
CVE Lite CLI is cooldown-aware. When it recommends a fix version, it checks that version against the cooldown your project already configures, and warns you when the fix is newer than the window you trust. It will not quietly push you onto a version your own package manager would refuse to install.
This is part of what makes CVE Lite CLI distinct among free scanners: lockfile scanning across npm, pnpm, Yarn, and Bun, parent-aware transitive remediation, fix-version validation, an offline advisory database, and cooldown-aware fix guidance, together in one OWASP Lab Project.
What it does
When a project has a release cooldown configured, and CVE Lite CLI's recommended fix version was published inside that window, the scan surfaces a warning next to the fix command:
High severity fix commands
⚠ Published 2026-07-01, newer than your configured 365 day release cooldown (.npmrc); your package manager would hold this version - validate before overriding.
> npm install [email protected] (published 2026-07-01)
The warning is advisory. It is on by default, needs no flag, and never changes the exit code. It tells you that the fix exists but is fresh enough that your own cooldown policy would hold it back, so you can decide whether to validate the release and proceed, or wait for it to age past the window.
The warning appears everywhere the fix plan is shown: the default terminal output, --verbose, the JSON output (as a structured cooldownWarning object), and the HTML report.
Configure a cooldown
CVE Lite CLI never invents a cooldown. It only reads a window you have already set for your package manager. If no cooldown is configured, nothing changes and no warning is shown.
| Package manager | File | Setting | Unit |
|---|---|---|---|
| npm | .npmrc | min-release-age | days |
| pnpm | pnpm-workspace.yaml | minimumReleaseAge | minutes |
| Yarn | .yarnrc.yml | npmMinimalAgeGate | minutes |
Examples:
# .npmrc (npm) - hold versions published in the last 7 days
min-release-age=7
# pnpm-workspace.yaml (pnpm) - 7 days, expressed in minutes
minimumReleaseAge: 10080
# .yarnrc.yml (Yarn) - 7 days, expressed in minutes
npmMinimalAgeGate: 10080
The window is read from the project root next to your lockfile. The windowLabel shown in the warning echoes the value and unit exactly as you configured it, so the warning always reflects your own policy.
How it works
- CVE Lite CLI resolves the lowest known non-vulnerable version above your installed version, exactly as it does for every fix recommendation.
- It reads the cooldown configured for the detected package manager and normalizes the window (npm days or pnpm/Yarn minutes) to a single duration.
- It compares the fix version's live npm publish date against that window. If the version was published inside the window, the warning is attached to that fix target.
A version whose age exactly equals the window is treated as outside it, matching how a package manager releases a version the moment it clears the gate.
The check is safe by construction. It reads only configuration you already set, and it never throws: a missing or malformed config file, a zero or negative value, or an unreadable publish date all result in no warning rather than an error. If a fix version's publish date cannot be resolved (for example when offline), no warning is shown.
Current limitation
The warning covers npm, pnpm, and Yarn projects. Bun also supports a release cooldown (minimumReleaseAge in bunfig.toml, in seconds), but CVE Lite CLI does not yet read it, so Bun projects will not show the cooldown warning even when one is configured. Bun lockfile scanning and remediation are otherwise fully supported.
Why this matters
Dependency security is decided at install time, when you choose to trust a package, its maintainer, and everything it pulls in. A scanner that recommends the newest possible fix without regard for freshness can walk you straight into the danger window a cooldown exists to avoid. By reading the policy your team already set and surfacing the tension honestly, CVE Lite CLI keeps the fix guidance aligned with your own supply-chain posture instead of overriding it silently.
CVE Lite CLI is an OWASP Lab Project. Cooldown-aware fix guidance is one more way it turns a raw list of vulnerabilities into remediation you can act on with confidence.
See also the Remediation Strategy guide for how CVE Lite CLI chooses upgrade targets in the first place.