--- title: Introducing Nixpkgs cooldowns | daily.dev description: Determinate Systems is introducing a seven-day cooldown period for their nixpkgs-weekly mirror in response to the recent mass compromise of Arch Linux AUR... canonical: https://daily.dev/posts/introducing-nixpkgs-cooldowns-70caiarp1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing Nixpkgs cooldowns | daily.dev og:description: Determinate Systems is introducing a seven-day cooldown period for their nixpkgs-weekly mirror in response to the recent mass compromise of Arch Linux AUR... og:url: https://daily.dev/posts/introducing-nixpkgs-cooldowns-70caiarp1 og:image: https://api.daily.dev/og/posts/70CAiArp1.png og:image:alt: Introducing Nixpkgs cooldowns og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing Nixpkgs cooldowns **[Determinate Systems](https://daily.dev/sources/determinate-systems)** · 4 min read · 0 upvotes · 0 comments ## Summary Determinate Systems is introducing a seven-day cooldown period for their nixpkgs-weekly mirror in response to the recent mass compromise of Arch Linux AUR packages. The cooldown delays adoption of new Nixpkgs revisions by one week, providing a buffer for supply chain attacks to be detected before reaching users. Analysis of recent supply chain incidents shows attackers' windows of opportunity are typically hours to days, making a week-long delay highly effective. The feature is live and enabled by default for all Determinate Nix users. The post also calls on the NixOS project to require peer review for merges, noting that hundreds of maintainers can currently merge their own PRs without review — a significant security risk. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [We should all be using dependency cooldowns](https://daily.dev/posts/we-should-all-be-using-dependency-cooldowns-8o7pte603) · Lobsters · 0 upvotes · 0 comments - [Dependency cooldowns turn you into a free-rider](https://daily.dev/posts/dependency-cooldowns-turn-you-into-a-free-rider-xqq71wkpm) · Cal Paterson · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/introducing-nixpkgs-cooldowns-70caiarp1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing Nixpkgs cooldowns","url":"https://daily.dev/posts/introducing-nixpkgs-cooldowns-70caiarp1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-nixpkgs-cooldowns-70caiarp1"},"datePublished":"2026-07-26T07:48:32.849Z","dateModified":"2026-07-26T07:52:21.181Z","description":"Determinate Systems is introducing a seven-day cooldown period for their nixpkgs-weekly mirror in response to the recent mass compromise of Arch Linux AUR...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/de1807d6d22611bf1173b6d36209236d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/de1807d6d22611bf1173b6d36209236d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Determinate Systems","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Determinate Systems","logo":"https://media.daily.dev/image/upload/s--E2qrkc9w--/c_limit,w_256/f_auto,q_auto/v1785052094/logos/determinate-systems?_a=BAMAMicg0","url":"https://daily.dev/sources/determinate-systems"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-nixpkgs-cooldowns-70caiarp1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Determinate Systems","item":"https://daily.dev/sources/determinate-systems"},{"@type":"ListItem","position":3,"name":"Introducing Nixpkgs cooldowns"}]} ```