“cooldown” is exactly what it sounds like: a window of time between when a dependency is published and when it’s considered suitable for use. The dependency is public during this window, meaning that “supply chain security” vendors can work their magic while the rest of us wait any problems out.

Been using renovate a while, 42 added this as a default!

minimumReleaseAge: 3 dayswill now be set by default for npm in config:best-practices

pnpm has minimumReleaseAge https://pnpm.io/settings#minimumreleaseage