Delay upstream policy

The delay upstream policy prevents newly published packages from being added to a Bytesafe registry until a set delay (in days) has passed. Until then such a new version will not be allowed from an external upstream.

Many critical vulnerabilities and malicious packages are found and fixed quickly. Yet it’s common to regularly pull the latest versions from public upstreams, regardless of package version maturity.

The policy protects registries from new package versions that have not yet reached the desired maturity since release.

If a package has multiple versions available in an upstream, Bytesafe will fetch the most recent allowed version within the requested version range.

The delay time for a registry is configurable in the policy settings, up to a maximum of 90 days delay.

Example

A new version of a dependency, 1.3.0, is released to the public npm registry. For current time < publish time + delay time a previous version 1.2.3 will be selected by Bytesafe, as the new version does not qualify.

flowchart LR
  A{Bytesafe} <--- B[/Dependency v.1.2.3/] <---  C[fab:fa-npm registry.npmjs.org]

When current time >= publish time + delay time the new version 1.3.0 will be allowed and any subsequent fetches will use that version instead.

flowchart LR
  A{Bytesafe} <--- B[/Dependency v.1.3.0/]  <---  C[fab:fa-npm registry.npmjs.org]

Balance security needs and flexible access to new versions, by setting the desired delay time for your organization. This applies both for developers and for CI/CD pipelines, where you may not always control when builds are triggered.