Definition. A cooldown means that new versions of packages or images are only adopted after a minimum time has passed since their release. Renovate implements this with minimumReleaseAge, uv with exclude-newer, and pip since version 26.1 with --uploaded-prior-to.

Why it matters. Compromised releases are often spotted and removed within minutes or hours. A cooldown of a few days keeps them out of your own environment without blocking updates. Security updates are exempt, and according to its documentation Renovate lets them through without waiting.

Example. The tampered LiteLLM 1.107.0 wheels were on PyPI for almost two hours on 21 October 2026. With a cooldown of one day, they would never have been installed.

Related. Lockfile, Image digest, Supply chain attack