"Three days as the default balances two goals: it pushes you past the window where most of these attacks live, and it doesn't hold your dependencies back longer than necessary," GitHub said.
GitHub's three-day cooldown for Dependabot
GitHub announced a new cooldown mechanism for Dependabot that introduces a minimum wait before the tool opens a pull request to update a dependency. By default, Dependabot will now wait at least three days after a release is published before creating a version-update pull request. The change is aimed at reducing the rapid adoption of poisoned or trojanized package releases that are published and then quickly pulled by downstream projects before the malicious version can be removed from a registry.
Configurability and the security-update exception
The cooldown is configurable: the cooldown configuration option in dependabot.yml continues to control Dependabot's behavior, so projects can set a different cooldown period if they choose. GitHub is clear that the three-day default applies only to version updates intended to keep dependencies up-to-date. Security updates are handled differently — Dependabot will still issue an alert and open a pull request immediately to move a project to a patched version.
Why time matters: the poisoned-release scenario
GitHub framed the change around a specific attack pattern: a malicious version that ships, spreads fast, and is then yanked from the registry. Even short-lived trojanized packages can expand the blast radius of a supply-chain attack when many downstream projects pull the poisoned release before maintainers realize and remove it. A time-based pause is intended to reduce that early surge of automatic upgrades, giving registry operators and maintainers more time to detect and remediate problematic releases before they propagate widely.
Limits of the cooldown: what this defense does not stop
"A cooldown is built for a specific pattern: a malicious version that ships, spreads, and gets caught quickly," GitHub warned. The company also said the cooldown "does little against attacks that play a longer game," explicitly naming backdoors planted in releases and left dormant, maintainer sabotage, and a compromised build system as threat patterns that this time-based control will not meaningfully defend against.
How developers, registries, and enterprises are responding
- Developers and maintainers: Projects can change the default via dependabot.yml to match their tolerance for delay versus risk, and should consider the cooldown as one configurable layer rather than a silver bullet.
- Package registries and ecosystem maintainers: Similar cooldown controls have been announced across several package ecosystems, including Microsoft Visual Studio Code (VS Code), Ruby, Bun, npm, pnpm, and Yarn, suggesting converging practices to slow rapid adoption of new releases.
- Registry operators (example — PyPI): The Python Package Index announced a complementary time-limiting measure: maintainers will be blocked from adding new files to a package release after 14 days have passed since publication. PyPI framed that move as intended "to prevent attackers who compromise publishing tokens or workflows from poisoning old, trusted releases."
- Enterprises and build-pipeline owners: GitHub emphasized that cooldowns should be combined with other controls — pinning dependencies with lockfiles, disabling install scripts in CI, scoping tokens in build pipelines, and reviewing updates before they merge — which are explicitly offered as additional layers of defense.
The three-day Dependabot cooldown joins a small but growing toolkit of time- and access-based mitigations deployed across package ecosystems. It is targeted: designed to blunt quick-hit poison-and-pull attacks without delaying the steady, routine work of dependency maintenance. At the same time, GitHub's own explanation highlights the gap this mechanism leaves — longer-term, stealthy compromises and supply-chain attacks that do not rely on a narrow window of availability continue to require different controls.
Original story: https://thehackernews.com/2026/07/github-adds-3-day-dependabot-cooldown.html
