Dependency cooldowns were the first thing we instituted after tj-actions forced us to hash-pin all the GitHub actions we pulled in. Glad the industry has now also caught up.
https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
