GitHub Dependabot adds three-day cooldown for version updates to reduce supply chain risk

New Default Delays Automated Updates

GitHub has implemented a three-day cooldown period for Dependabot version updates as a new default behavior. The change affects automated pull requests that update dependencies to newer versions, creating a buffer between release publication and integration into downstream projects.

The cooldown applies specifically to version updates, not security updates. When a new package version becomes available, Dependabot will wait 72 hours before automatically creating a pull request to update that dependency in repositories using the tool.

Supply Chain Security Window

The cooldown period addresses a specific supply chain vulnerability: the narrow window between a malicious package release and its automated adoption. By introducing a mandatory delay, GitHub provides time for maintainers to identify and address issues—including compromised releases—before they propagate through the dependency tree.

Security researchers and package maintainers can use this window to detect anomalies, review unexpected releases, or pull problematic versions. The approach recognizes that immediate adoption of new releases carries risk, particularly in ecosystems where package compromise has become a documented threat vector.

Distinguishing Version and Security Updates

GitHub maintains separate handling for security-focused updates. Dependabot security updates—which address known vulnerabilities—continue to operate without the cooldown delay, preserving rapid response to disclosed threats.

The distinction reflects different risk profiles: security updates address known vulnerabilities with available patches, while version updates introduce new code that may contain undiscovered issues. The cooldown applies only to the latter category, where the primary concern is unvetted changes rather than unpatched vulnerabilities.