AppSec · 49 days ago
GitHub is trading update speed for a safer review window. The risk is not that Dependabot is broken; it is that an automated updater can surface a malicious release before anyone has a chance to notice it is bad.
For non-security version bumps, Dependabot now waits three days after a release publishes before opening a pull request. Security updates still open right away. GitHub made the change after poisoned npm packages like chalk and debug were live for only hours, which is still long enough for an auto-update tool to hand them to reviewers.
The new default slows down the path from registry to pull request, which fits the way short-lived supply-chain poisons actually behave. It also means teams that rely on fast dependency PRs are choosing a deliberate delay over instant freshness.
2 sources covering this story
GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption
GitHub gives Dependabot version updates a three-day cooldown to curb short-lived poisoned packages, while security fixes still ship immediately.
GitHub delays version updates so malware gets caught first - Help Net Security
The new Dependabot cooldown holds version update pull requests for three days, giving researchers time to catch malicious releases first.
Part of the PlainSec briefing for 2026-07-28