● Covered by 7 sources · 9 reportsMedium impact8 neutral
Dependabot introduces default three-day cooldown for version updates
Key points
- Default three-day cooldown applies to version updates
- Security updates still open without delay
- Change affects all supported ecosystems on GitHub
- The cooldown can be configured or opted out using the 'cooldown' option in .github/dependabot.yml.
- The change will take effect in GitHub Enterprise Server (GHES) 3.23.
- In September 2025, an attacker published booby-trapped versions of chalk, debug, and other packages.
- The poisoned versions were live for roughly two hours before the community caught them.
- PyPI blocks new file uploads to releases older than 14 days.
- The cooldown delays the package update process for 72 hours.
- Malicious npm packages were detected within minutes in many recent cases.
Dependabot Introduces Cooldown Period
Dependabot has implemented a default cooldown period of three days for version updates. This means that once a new version is released in its registry, Dependabot will wait for three days before generating a pull request for the update.
Rationale Behind the Change
This cooldown period is introduced to mitigate risks associated with supply chain attacks. New releases can sometimes contain vulnerabilities that may not be immediately recognized by maintainers. By delaying the update process, users have time to evaluate new versions for potential issues.
Configuration and Control
While the cooldown is set as a default, developers have the option to configure their own settings. Users can modify this behavior in their dependabot.yml file to set a different window or to opt out of the cooldown altogether.
Impact on Security Updates
It is important to note that this default cooldown applies only to version updates. Security updates remain unaffected and will open immediately, ensuring that critical fixes are integrated without delay.
Future Availability
The three-day cooldown will be applied across all supported ecosystems on GitHub and will also take effect in GitHub Enterprise Server version 3.23.
Updates
- PyPI blocks new file uploads to releases older than 14 days.
- The cooldown delays the package update process for 72 hours.
- Malicious npm packages were detected within minutes in many recent cases.
- The cooldown can be configured or opted out using the 'cooldown' option in .github/dependabot.yml.
- The change will take effect in GitHub Enterprise Server (GHES) 3.23.
- In September 2025, an attacker published booby-trapped versions of chalk, debug, and other packages.
- The poisoned versions were live for roughly two hours before the community caught them.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub newrelic/newrelic-browser-agent GitHub code-security/dependabot GitHub en/github GitHub en/get-started GitHub software-development/innersource GitHub en/code-securityHow outlets covered it
GitHub implemented several default security changes across npm and GitHub Actions between March and July 2026 to disrupt software supply chain attacks. These changes include read-only modes for high-impact npm accounts, altered default behavior for actions/checkout, and disabled install scripts in npm v12, aiming to mitigate initial compromise, escalation, credential exfiltration, and propagation vectors.
Dependabot can be configured to group dependency updates and reduce the frequency of pull requests, addressing the issue of numerous individual updates creating noise in repositories. By adjusting the `schedule.interval` and implementing groups in the `dependabot.yml` file, developers can consolidate updates into predictable, monthly batches per ecosystem. This change helps manage maintenance overhead and ensures important updates are not overlooked due to excessive notifications.
Amazon Linux provides a one-line configuration for npm and pip to implement a 24-hour dependency cooldown, preventing immediate installation of newly published packages. This delay allows the security community time to detect and remove malicious packages, mitigating supply chain risks in open-source software dependencies.
GitHub's Dependabot now implements a default three-day cooldown period before opening pull requests for non-security dependency version updates. This change aims to mitigate supply chain attacks by allowing time for malicious releases to be identified and removed before integration into projects.
GitHub introduced a three-day Dependabot cooldown for non-security version updates, delaying pull requests to allow time for detecting malicious code. PyPI implemented a policy preventing new file uploads to releases older than 14 days to protect against poisoning stable versions.
GitHub's Dependabot now includes a default three-day cooldown period for version updates before opening a pull request, aiming to mitigate supply chain attacks by preventing the rapid adoption of malicious package versions. This change allows time for poisoned packages to be identified and removed from registries before they are widely integrated into projects.
GitHub's Dependabot now includes a default three-day cooldown for package updates, and PyPI blocks new file uploads to releases older than 14 days. These measures aim to reduce the risk and impact of supply chain attacks by limiting the window for malicious package distribution and preventing the poisoning of old, trusted releases.
Dependabot now defaults to a three-day cooldown period before issuing version update pull requests, allowing maintainers and security researchers time to identify and address vulnerabilities in new releases. This change aims to mitigate supply chain attacks where malicious code is quickly integrated into build pipelines through automated updates.
Dependabot now includes a default three-day cooldown before opening version update pull requests. This change aims to reduce the risk of merging compromised versions immediately after their release, enhancing supply chain security for developers.