Dependency Cooldowns: Make Your Package Manager Wait Before It Trusts New Code

npm, pnpm, Yarn, and Bun can all refuse package versions that are only hours old. Here's how each one's release-age gate works, why the units don't match, and where it bites in CI.