Admittedly, dependency cooldowns are a good idea, generally, to help prevent supply chain attacks.