@erwinrossen@mas.to good point. I think the cooldown period works for regular updates but not for security updates. If you are impacted by a security vuln you should upgrade immediately. That's not something you can easily automate though... What you can do is set a lower cooldown period for packages you trust more. E.g. we have a general 3 day cooldown for all packages but 1 day for Django so that we bring in security updates the same week. We would patch immediately if the CVE was impacting us.