GitHub has switched on a three-day cooldown for Dependabot version updates. When a new version of a dependency is published to a package registry, Dependabot will now wait at least three days before opening a pull request to adopt it. Security updates — those triggered by a known CVE in a current dependency — are unaffected and will still land immediately. Teams that need a different cadence can override the default in their dependabot.yml configuration.
The change targets a specific attack pattern: a threat actor compromises a popular package, pushes a backdoored version, waits for downstream projects to automatically pull it, and then yanks the malicious release before security researchers catch on. The window between publication and removal is typically short — but short enough to reach hundreds or thousands of repositories before it closes. GitHub’s analysis found that a three-day buffer sits in what it calls the “goldilocks zone,” pushing past the window where most poisoning attacks live without holding back legitimate dependency updates longer than necessary. The company was careful to note that the cooldown is one layer of defense, not a complete solution — vetting package provenance, reviewing pull request diffs, and using lockfiles remain important complements.