GitHub is trading update speed for a safer review window. The risk is not that Dependabot is broken; it is that an automated updater can surface a malicious release before anyone has a chance to notice it is bad. For non-security version bumps, Dependabot now waits three days after a release publishes before opening a pull request. Security updates still open right away. GitHub made the change after poisoned npm packages like chalk and debug were live for only hours, which is still long enough for an auto-update tool to hand them to reviewers. The new default slows down the path from registry to pull request, which fits the way short-lived supply-chain poisons actually behave. It also means teams that rely on fast dependency PRs are choosing a deliberate delay over instant freshness.
Part of the PlainSec briefing for 2026-07-28