← Back to Feed

GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

July 27, 2026 · The Hacker News · Severity: LOW

GitHub announced a new cooldown mechanism for Dependabot that waits at least three days after a package release before opening a pull request for version updates. This is designed to limit the blast radius of supply chain attacks where threat actors push poisoned versions of popular packages that get quickly pulled by downstream projects before being yanked. Security updates are exempted and continue to be pushed immediately. Users can configure custom cooldown periods in dependabot.yml.

Key Takeaways

  • GitHub Dependabot now defaults to a 3-day cooldown before opening version update PRs after a release.
  • Security updates are exempted and continue to be pushed immediately for patched versions.
  • Users can configure custom cooldown parameters in their dependabot.yml configuration file.
☕ Buy a Coffee