From 1b967b15edec274ab465ad43bc4ddf6026cbed44 Mon Sep 17 00:00:00 2001
From: Simon Cropp <simon.cropp@gmail.com>
Date: Wed, 14 Oct 2026 23:00:46 +1100
Subject: [PATCH 1/3] Support minPublishAgeHours source setting

---
 claude.md                                |  1 +
 readme.md                                | 19 +++++-
 readme.source.md                         | 19 +++++-
 src/PackageUpdate/GlobalUsings.cs        |  4 +-
 src/PackageUpdate/PackageSourceReader.cs | 84 +++++++++++++++++++++++-
 src/PackageUpdate/Updater.cs             | 22 +++++++
 src/Tests/PackageSourceReaderTests.cs    | 47 +++++++++++++
 7 files changed, 190 insertions(+), 6 deletions(-)
 create mode 100644 src/Tests/PackageSourceReaderTests.cs

diff --git a/claude.md b/claude.md
index 80e11111..fd391cb1 100644
--- a/claude.md
+++ b/claude.md
@@ -237,6 +237,7 @@ Package WindowsAzure.Storage is deprecated with alternative Azure.Storage.Common
 - Respects pre-release semantics (stable → stable, pre-release → any)
 - Queries all configured NuGet sources and selects highest version
 - Skips unlisted packages
+- Respects the `minPublishAgeHours` attribute on a `packageSources` entry in nuget.config (set via `dotnet nuget add/update source --min-publish-age-hours`): versions published more recently than that are skipped for that source. `PackageSourceReader` reads the attribute from the config files directly, since `SourceItem` drops unknown attributes
 
 ### File Format Preservation
 
diff --git a/readme.md b/readme.md
index 16b2aedd..838ce287 100644
--- a/readme.md
+++ b/readme.md
@@ -1,4 +1,4 @@
-<!--
+<!--
 GENERATED FILE - DO NOT EDIT
 This file was generated by [MarkdownSnippets](https://github.com/SimonCropp/MarkdownSnippets).
 Source File: /readme.source.md
@@ -176,6 +176,23 @@ To use authenticated feed, add the [packageSourceCredentials](https://docs.micro
 ```
 
 
+## Minimum package publication age
+
+Sources can define a cooldown via the `minPublishAgeHours` attribute in `nuget.config`. Versions published more recently than that are not selected from that source.
+
+```xml
+<packageSources>
+  <add key="nuget.org" value="https://api.nuget.org/v3/index.json" minPublishAgeHours="24" />
+</packageSources>
+```
+
+This can be set via the CLI (.NET 11 SDK):
+
+```
+dotnet nuget update source nuget.org --min-publish-age-hours 24
+```
+
+
 ## Package Version Pinning
 
 
diff --git a/readme.source.md b/readme.source.md
index 51e4c999..8e0e1bb2 100644
--- a/readme.source.md
+++ b/readme.source.md
@@ -1,4 +1,4 @@
-# <img src="/src/icon.png" height="30px"> PackageUpdate
+# <img src="/src/icon.png" height="30px"> PackageUpdate
 
 [![Build status](https://github.com/SimonCropp/PackageUpdate/actions/workflows/build.yml/badge.svg)](https://github.com/SimonCropp/PackageUpdate/actions/workflows/build.yml)
 [![NuGet Status](https://img.shields.io/nuget/v/PackageUpdate.svg)](https://www.nuget.org/packages/PackageUpdate/)
@@ -151,6 +151,23 @@ To use authenticated feed, add the [packageSourceCredentials](https://docs.micro
 ```
 
 
+## Minimum package publication age
+
+Sources can define a cooldown via the `minPublishAgeHours` attribute in `nuget.config`. Versions published more recently than that are not selected from that source.
+
+```xml
+<packageSources>
+  <add key="nuget.org" value="https://api.nuget.org/v3/index.json" minPublishAgeHours="24" />
+</packageSources>
+```
+
+This can be set via the CLI (.NET 11 SDK):
+
+```
+dotnet nuget update source nuget.org --min-publish-age-hours 24
+```
+
+
 ## Package Version Pinning
 
 
diff --git a/src/PackageUpdate/GlobalUsings.cs b/src/PackageUpdate/GlobalUsings.cs
index c010bede..4ea1184b 100644
--- a/src/PackageUpdate/GlobalUsings.cs
+++ b/src/PackageUpdate/GlobalUsings.cs
@@ -13,4 +13,6 @@
 global using NuGet.Versioning;
 global using Serilog;
 global using Serilog.Events;
-global using Serilog.Parsing;
\ No newline at end of file
+global using Serilog.Parsing;
+global using System.Globalization;
+global using System.Runtime.CompilerServices;
diff --git a/src/PackageUpdate/PackageSourceReader.cs b/src/PackageUpdate/PackageSourceReader.cs
index eace1263..4b7e4b8d 100644
--- a/src/PackageUpdate/PackageSourceReader.cs
+++ b/src/PackageUpdate/PackageSourceReader.cs
@@ -1,6 +1,7 @@
-public static class PackageSourceReader
+public static class PackageSourceReader
 {
     static XPlatMachineWideSetting machineSettings = new();
+    static ConditionalWeakTable<PackageSource, StrongBox<TimeSpan>> minPublishAges = new();
 
     public static List<PackageSource> Read(string directory)
     {
@@ -11,8 +12,85 @@ public static List<PackageSource> Read(string directory)
             machineWideSettings: machineSettings);
 
         var provider = new PackageSourceProvider(settings);
-        return provider.LoadPackageSources()
+        var sources = provider.LoadPackageSources()
             .Where(_ => _.IsEnabled)
             .ToList();
+
+        var ages = ReadMinPublishAges(settings);
+        foreach (var source in sources)
+        {
+            if (ages.TryGetValue(source.Name, out var age))
+            {
+                minPublishAges.AddOrUpdate(source, new(age));
+            }
+        }
+
+        return sources;
+    }
+
+    // Reads the minPublishAgeHours attribute from packageSources entries.
+    // https://github.com/dotnet/core/blob/main/release-notes/11.0/preview/rc2/nuget.md#configure-minimum-package-publication-age-from-the-cli
+    // NuGet.Configuration drops unknown attributes from SourceItem, so the config files are read directly.
+    // GetConfigFilePaths is ordered closest first, so apply in reverse so closer files win.
+    static Dictionary<string, TimeSpan> ReadMinPublishAges(ISettings settings)
+    {
+        var ages = new Dictionary<string, TimeSpan>(StringComparer.OrdinalIgnoreCase);
+        foreach (var path in settings.GetConfigFilePaths().Reverse())
+        {
+            XElement? section;
+            try
+            {
+                section = XDocument.Load(path).Root?.Element("packageSources");
+            }
+            catch (Exception exception) when (exception is IOException or XmlException or UnauthorizedAccessException)
+            {
+                continue;
+            }
+
+            if (section == null)
+            {
+                continue;
+            }
+
+            foreach (var element in section.Elements())
+            {
+                if (element.Name.LocalName == "clear")
+                {
+                    ages.Clear();
+                    continue;
+                }
+
+                var key = element.Attribute("key")?.Value;
+                if (element.Name.LocalName != "add" || key == null)
+                {
+                    continue;
+                }
+
+                var value = element.Attribute("minPublishAgeHours")?.Value;
+                if (double.TryParse(value, NumberStyles.Float, CultureInfo.InvariantCulture, out var hours) &&
+                    hours > 0)
+                {
+                    ages[key] = TimeSpan.FromHours(hours);
+                    continue;
+                }
+
+                ages.Remove(key);
+            }
+        }
+
+        return ages;
+    }
+
+    public static void SetMinPublishAge(PackageSource source, TimeSpan age) =>
+        minPublishAges.AddOrUpdate(source, new(age));
+
+    public static TimeSpan? GetMinPublishAge(PackageSource source)
+    {
+        if (minPublishAges.TryGetValue(source, out var age))
+        {
+            return age.Value;
+        }
+
+        return null;
     }
-}
\ No newline at end of file
+}
diff --git a/src/PackageUpdate/Updater.cs b/src/PackageUpdate/Updater.cs
index c5770da5..3480f466 100644
--- a/src/PackageUpdate/Updater.cs
+++ b/src/PackageUpdate/Updater.cs
@@ -141,6 +141,7 @@ public static async Task Update(
             var (repository, metadataResource) = await RepositoryReader.Read(source);
 
             var condidates = await GetCondidates(package, currentVersion, cache, repository);
+            var minPublishAge = PackageSourceReader.GetMinPublishAge(source);
 
             foreach (var candidate in condidates)
             {
@@ -156,6 +157,17 @@ public static async Task Update(
                     continue;
                 }
 
+                // Skip versions newer than the source's minPublishAgeHours cooldown
+                if (!IsOldEnough(metadata, minPublishAge))
+                {
+                    Log.Information(
+                        "Skipped {Package} {Version} from {Source}: published within minPublishAgeHours",
+                        package,
+                        candidate,
+                        source.Name);
+                    continue;
+                }
+
                 // Found a listed version - check if it's better than what we have
                 if (latestMetadata == null ||
                     candidate > latestMetadata.Identity.Version)
@@ -171,6 +183,16 @@ public static async Task Update(
         return latestMetadata;
     }
 
+    static bool IsOldEnough(IPackageSearchMetadata metadata, TimeSpan? minPublishAge)
+    {
+        if (minPublishAge == null || metadata.Published == null)
+        {
+            return true;
+        }
+
+        return DateTimeOffset.UtcNow - metadata.Published.Value >= minPublishAge.Value;
+    }
+
     static async Task<IPackageSearchMetadata?> GetPackageMetadata(
         string package,
         NuGetVersion version,
diff --git a/src/Tests/PackageSourceReaderTests.cs b/src/Tests/PackageSourceReaderTests.cs
new file mode 100644
index 00000000..d579b456
--- /dev/null
+++ b/src/Tests/PackageSourceReaderTests.cs
@@ -0,0 +1,47 @@
+public class PackageSourceReaderTests
+{
+    [Test]
+    public async Task ReadsMinPublishAgeHours()
+    {
+        using var temp = new TempDirectory();
+        await File.WriteAllTextAsync(
+            Path.Combine(temp, "nuget.config"),
+            """
+            <?xml version="1.0" encoding="utf-8"?>
+            <configuration>
+              <packageSources>
+                <clear />
+                <add key="public" value="https://api.nuget.org/v3/index.json" minPublishAgeHours="24" />
+                <add key="other" value="https://example.com/v3/index.json" />
+              </packageSources>
+            </configuration>
+            """);
+
+        var sources = PackageSourceReader.Read(temp);
+
+        var publicSource = sources.Single(_ => _.Name == "public");
+        var otherSource = sources.Single(_ => _.Name == "other");
+        await Assert.That(PackageSourceReader.GetMinPublishAge(publicSource)).IsEqualTo(TimeSpan.FromHours(24));
+        await Assert.That(PackageSourceReader.GetMinPublishAge(otherSource)).IsNull();
+    }
+
+    [Test]
+    public async Task GetLatestVersion_SkipsVersionsWithinMinPublishAge()
+    {
+        using var cache = new SourceCacheContext
+        {
+            RefreshMemoryCache = true
+        };
+        var source = new PackageSource("https://api.nuget.org/v3/index.json");
+        // Larger than the age of any published version
+        PackageSourceReader.SetMinPublishAge(source, TimeSpan.FromDays(365 * 100));
+
+        var result = await Updater.GetLatestVersion(
+            "Newtonsoft.Json",
+            NuGetVersion.Parse("12.0.2"),
+            [source],
+            cache);
+
+        await Assert.That(result).IsNull();
+    }
+}

From 9f1139b3de8dc89d5b1a0babdbaf7917ebf1bf51 Mon Sep 17 00:00:00 2001
From: Simon Cropp <simon.cropp@gmail.com>
Date: Wed, 14 Oct 2026 23:04:39 +1100
Subject: [PATCH 2/3] Pin System.Security.Cryptography.Pkcs to 10.0.13 to fix
 vulnerability

---
 readme.md                    | 2 +-
 src/Directory.Packages.props | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/readme.md b/readme.md
index 838ce287..660edb99 100644
--- a/readme.md
+++ b/readme.md
@@ -1,4 +1,4 @@
-<!--
+<!--
 GENERATED FILE - DO NOT EDIT
 This file was generated by [MarkdownSnippets](https://github.com/SimonCropp/MarkdownSnippets).
 Source File: /readme.source.md
diff --git a/src/Directory.Packages.props b/src/Directory.Packages.props
index 5bfb4f02..f835db05 100644
--- a/src/Directory.Packages.props
+++ b/src/Directory.Packages.props
@@ -19,5 +19,6 @@
     <PackageVersion Include="EmptyFiles" Version="8.20.1" />
     <PackageVersion Include="SimpleInfoName" Version="3.2.1" />
     <PackageVersion Include="Verify" Version="33.3.3" />
+    <PackageVersion Include="System.Security.Cryptography.Pkcs" Version="10.0.13" />
   </ItemGroup>
 </Project>

From 72c7cc12e60cfb9058c382fb595a1e6608bd9da6 Mon Sep 17 00:00:00 2001
From: Simon Cropp <simon.cropp@gmail.com>
Date: Thu, 15 Oct 2026 19:08:35 +1100
Subject: [PATCH 3/3] Link to official minimum package publication age feature

---
 readme.md        | 4 +++-
 readme.source.md | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/readme.md b/readme.md
index 660edb99..55f9d9f7 100644
--- a/readme.md
+++ b/readme.md
@@ -1,4 +1,4 @@
-<!--
+<!--
 GENERATED FILE - DO NOT EDIT
 This file was generated by [MarkdownSnippets](https://github.com/SimonCropp/MarkdownSnippets).
 Source File: /readme.source.md
@@ -180,6 +180,8 @@ To use authenticated feed, add the [packageSourceCredentials](https://docs.micro
 
 Sources can define a cooldown via the `minPublishAgeHours` attribute in `nuget.config`. Versions published more recently than that are not selected from that source.
 
+This mirrors the NuGet [minimum package publication age](https://github.com/dotnet/core/blob/main/release-notes/11.0/preview/rc2/nuget.md#configure-minimum-package-publication-age-from-the-cli) feature.
+
 ```xml
 <packageSources>
   <add key="nuget.org" value="https://api.nuget.org/v3/index.json" minPublishAgeHours="24" />
diff --git a/readme.source.md b/readme.source.md
index 8e0e1bb2..aafa3bf2 100644
--- a/readme.source.md
+++ b/readme.source.md
@@ -155,6 +155,8 @@ To use authenticated feed, add the [packageSourceCredentials](https://docs.micro
 
 Sources can define a cooldown via the `minPublishAgeHours` attribute in `nuget.config`. Versions published more recently than that are not selected from that source.
 
+This mirrors the NuGet [minimum package publication age](https://github.com/dotnet/core/blob/main/release-notes/11.0/preview/rc2/nuget.md#configure-minimum-package-publication-age-from-the-cli) feature.
+
 ```xml
 <packageSources>
   <add key="nuget.org" value="https://api.nuget.org/v3/index.json" minPublishAgeHours="24" />