Promote a package out of quarantine only when written criteria are all satisfied: it has aged past your holding period, scans are clean, its source and publisher check out, its install behaviour is understood, and a named person has signed off. If any item is unknown, the package stays where it is.
What quarantine is for
Quarantine is a holding area between "fetched from upstream" and "available to builds". New versions land there first. The holding area buys time for advisories to appear, scans to run and humans to look. It only works if leaving it requires a decision.
The promotion checklist
- Holding period elapsed. The version has been public for at least the period you set. Time is a cheap control, because it gives advisories and scanners a chance to catch up with a new release.
- Malware and vulnerability scans passed. Both ran on the exact files, and the results are stored.
- Source consistency. The publisher and repository match the previous approved version. A changed maintainer or a new repository link needs a review.
- Install behaviour unchanged. No new install scripts, no new network calls at install, no new binary downloads.
- Dependency delta reviewed. New transitive packages are listed and each one passes its own checks.
- License still allowed. No change that conflicts with policy.
- Integrity recorded. The hash of the file you promoted is stored, so you can show later that it was the same file.
- Approver named. For auto-approved lanes, the rule version stands in for the approver.
Make unknown mean no
Each item should return yes, no or unknown. Treat unknown as no. A scan that timed out or an advisory source that was unreachable must not count as clean.
| Check result | Action |
|---|---|
| All yes | Promote |
| Any no | Hold, open a review |
| Any unknown | Hold, rerun the check |
| Malware flagged | Reject and block the name and version |
Decide how long to hold
There is no universal period. A longer period catches more but slows the arrival of fixes. Many teams use a shorter hold for patch releases of trusted packages and a longer one for new packages and major versions, with a bypass path for security fixes. See the guide on dependency cooldown periods for the trade-offs.
Handle a hold that never ends
Set a maximum age for items in quarantine. After that, either reject the item or escalate it. Otherwise the area fills with versions nobody decided on.
Record the decision
Keep the checklist result with each promotion: timestamp, hashes, scan versions and approver. That record is useful when a package turns out to be bad months later, because you can show exactly what you checked and when.
Where Safeguard fits
Safeguard's gates and policies can enforce release criteria like these, and its dependency scanning supplies the scan results. Autonomous remediation, when enabled, opens fix pull requests but is off by default with every category on Manual. Try the free scan.
Quick check
Can a package be promoted early for a security fix?
Yes, through the emergency lane with a named approver, while keeping the scan and source checks.
Is a clean scan enough to promote?
No. Scans miss new threats, which is why age, source and behaviour checks sit beside them.
Last reviewed: 19 October 2026.
