Buying Time: Package Managers Are Adding Delay as a Security Control

Composer 2.11 shipped a cooldown that refuses to install a version until it has aged. vlt now holds npm publishes until their dependencies actually exist, because 22% of new npm versions land broken. And Ruby Central's reviewers threw out 90% of what an AI scanner flagged.

Read the full article →

Discussion thread — share findings, corrections and follow-ups below.