Setting a minimum release age (a "cooldown") on dependencies is a cheap, high-leverage defense against supply-chain attacks. Most malicious package versions are detected and yanked within hours, so a 24-hour delay filters out the smash-and-grab incidents (axios 1.14.1, ua-parser-js, Solana web3.js, etc.).
All three major Node.js package managers now support this, but each one used a different name and a different unit. Here is what you need.
| Tool | Setting | Unit | Introduced in |
|---|
| YTABConfig version: 1.7.2 | |
| Included classes: YTGlobalConfig, YTColdConfig, YTHotConfig | |
| Excluded settings: android*, amsterdam*, musicClient* and unplugged* | |
| App version: 19.16.3 | |
| Device model: iPad12,1 | |
| YTColdConfig.accountClientDisableIdentityRestorationLogging: 0 | |
| YTColdConfig.accountClientDismissChannelCreationPageFirst: 0 | |
| YTColdConfig.accountClientEnableCapabilitiesErrorExtraLogging: 0 | |
| YTColdConfig.accountClientEnableDirectSigninIdHandling: 0 | |
| YTColdConfig.accountClientEnableDynamicHandleDirection: 0 |