Package Cooldown Monitoring

Arnica now lets security teams enforce a package cooldown on pull requests, elevating any dependency version released within a configurable number of days to Critical so fresh, unvetted releases are blocked before supply-chain risk has had time to surface.

Description:

Package Cooldown Monitoring lets your AppSec team track the use of freshly published dependencies, preventing them from being merged to production code until a configurable period has passed. Built on Arnica’s package reputation system, any package which has been published too recently to be considered vetted can be treated as a PR blocking risk. This check can be processed at every stage in the CICD pipeline as it extends existing package reputation alerting. When running within pull requests, the developer sees a pull request comment that names the Package Cooldown policy, explains that the version is too new, and tells them how to rerun Arnica checks once the window closes. If the organization’s PR policies enforce status check outcomes, the PR will remain blocked until the package version age passes the cooldown period.  

Why should this be configured?

A freshly published package version can carry supply-chain risk before community and reputation signals catch up. Package cooldown gives your security team a self-service, time-based control for that gap, and gives developers a clear, non-judgmental reason for the block and a path to unblock themselves.

Configuration Tip:  

Package Cooldown Monitoring can be paired with Arnica’s Snooze feature to ensure that emergency patches are not delayed. Dismissing a finding with the snooze feature will allow the patch version to be merged without permanently dismissing the finding. The package's reputation finding will be reviewed and updated at the end of the snooze period.  

‍