An immutable release is a published software release whose assets and tags cannot be changed afterward. This helps preserve the link between a version label and the files users receive, reducing the risk that an attacker or mistake silently replaces a trusted download.
In software supply-chain security, immutability is a useful control against post-publication tampering, including changes made through a compromised maintainer account. It does not prove that the original files are safe or that the build process was trustworthy. Publishers should restrict release permissions and pair immutable releases with hashes or provenance attestations; users should verify these signals before installing software.