@emdash-ie & myself (@rtyley) are co-authors of this work.

This PR adds a new updates.cooldown config option to allow configuring Scala Steward to defer suggesting an update to a new version of a dependency, until that version has survived a 'cooldown' period (eg 7 days).

This intended to be useful to users who want to reduce the risk of updating to a malicious new version of a dependency before it's been examined by their supply-chain security vendor, addressing:

• Support dependency-cooldowns / minimum-artifact-age to mitigate short-lived supply chain attacks #3757

Note that applying a cooldown does not necessarily mean that you will get fewer updates - just that any update offered will be at least as old as specified.

Artifacts that are too recent will get rejected with a TooRecentForCooldown rejection reason.

Internal changes

• VersionsCache now persists VersionWithFirstSeen rather than Version, allowing us to record when a new version was first seen by this Scala Steward instance (the only simple & reliable way to find out how old a Maven artifact is!). We've added VersionsCacheTest to ensure we can still decode both old and new versions of the cache data.
• ArtifactUpdateCandidates
  • now stores newerVersionsWithFirstSeen: Nel[VersionWithFirstSeen], so that the candidate versions can be evaluated by age.
  • gains two convenience methods, filterVersions() & filterVersionsWithFirstSeen(), which filter the versions of the update and return an Option[ArtifactUpdateCandidates], with a value of None if no versions are left - this extracts that logic from several places in the Scala Steward codebase (isAllowed, isPinned, isIgnored & scalaLTSFilter)

Config

Right now there's a simple single value that can be configured - this is the cooldown period for all artifacts:

updates.cooldown = {
  minimumAge: "7 days"
}

Future config

Later on, in a subsequent PR, we might allow syntax like this, for example stating that we want all Guardian updates promptly, but all other artifacts only once they're 7 days old:

updates.cooldown = {
  minimumAge: "7 days",
  overrides: [
    { minimumAge: "1 day", [{groupId = "com.gu"}] }
  ]
}