NuGet Can Now Make New Package Versions Wait. I Don’t Need to Be the First to Install Them.

.NET 11 RC2 adds a minimum publish age for package sources. How I combine it with lock files, Central Package Management, source mapping, and a faster path for security fixes.

A new version of a NuGet package is out. Dependabot has opened a PR, the release notes look reasonable, and the build is green. The change is small:

English isn't my first language, so I used AI to help translate, organize, and write the English sentences in this piece. The experiences and opinions are my own.

8.4.1 → 8.5.0

8.4.1 → 8.5.0

I used to be more inclined to merge a PR like this without waiting long. Now I first look at when the version was published and what it actually changes.

Because a new package doesn't have to be malicious to cause problems. A regression, a changed default value, or a new transitive dependency is enough. Sometimes the problem is more serious: the publisher's account is taken over, and the new version of a package we consider trustworthy arrives with malicious code.

Some of these get noticed in the first hours. Issues are opened, the version is unlisted, or a fix is published right after. My application doesn't need to be in that first group with every update.

A minimum publish age for a…