---
title: "PMG dependency cooldown: wait on fresh npm versions"
description: "Package Manager Guard (PMG) blocks malicious installs and now supports dependency cooldown, a configurable window that hides brand-new npm versions during resolution so installs prefer older, already-visible releases."
url: "https://safedep.io/blog/pmg-dependency-cooldown"
author: "SafeDep Team"
published: "2026-04-16"
---

# PMG dependency cooldown: wait on fresh npm versions

**PMG** ([Package Manager Guard](https://github.com/safedep/pmg)) wraps `npm`, `pnpm`, `pip`, and other package managers so installs are checked against [SafeDep](https://safedep.io) threat intelligence and run in OS sandboxes before arbitrary install scripts touch your machine. For background, see [Introducing Package Manager Guard (PMG)](https://safedep.io/blog/introducing-package-manager-guard).

**Dependency cooldown** is a separate control: it trims registry metadata so version resolution normally ignores releases that are too new. That reduces the window where a compromised or rushed publish is the only version a semver range can pick.

## How cooldown works

When cooldown is on, PMG filters **npm** package metadata and drops versions published inside the configured window (for example, the last `5` days). If the range still matches an older release, the resolver uses it. If nothing outside the window satisfies the range, the install fails until you widen the range, wait, or bypass cooldown (see below).

Cooldown applies to metadata-driven resolution. It does **not** apply to flows that already use a fixed tarball URL (direct tarball installs, some lockfile or cache cases). See the upstream [dependency cooldown](https://github.com/safedep/pmg/blob/main/docs/dependency-cooldown.md) notes for details.

**Requirement:** cooldown needs [proxy mode](https://github.com/safedep/pmg/blob/main/docs/proxy-mode.md) enabled. It is **npm-only** in the current release.

## Install and shell setup

```bash
brew install safedep/tap/pmg
```

or:

```bash
npm install -g @safedep/pmg
```

Wire the shell once (restart the terminal after):

```bash
pmg setup install
```

Re-run `pmg setup install` after upgrades so new options land in your environment.

## Enable dependency cooldown

Configuration lives in `config.yml` (create it via `pmg setup install` if needed). Example:

```yaml
dependency_cooldown:
  enabled: true
  days: 5
```

Adjust `days` to your risk tolerance: longer windows mean more installs fall back to older versions; shorter windows allow newer releases sooner.

One-off install without changing the file:

```bash
pmg --skip-dependency-cooldown npm install express
```

## Docs and source

- [PMG quickstart](https://docs.safedep.io/pmg/quickstart)
- [dependency-cooldown.md](https://github.com/safedep/pmg/blob/main/docs/dependency-cooldown.md)
- [Repository](https://github.com/safedep/pmg)