Release immutability is the practice of treating a published software release as fixed: once it is public, its files, metadata, and checksums should not be changed. This matters because many security controls assume that a version number uniquely identifies the code a user will download and run.
In supply-chain security, immutability helps defend against post-publication tampering. If an attacker compromises a maintainer account or build pipeline, they may try to replace artifacts in an older release while keeping the same version label, tricking users and automation into trusting altered content. Registries and package managers can reduce this risk by blocking late uploads, enforcing signed artifacts, and verifying hashes or provenance. For defenders, immutable releases make audits, rollback, and incident response more reliable because the published package stays consistent over time.