GitHub Dependabot Gets 3-Day Cooldown to Block Malicious Updates
New default delay creates detection window for supply chain attacks while keeping security patches immediate.
GitHub made a three-day cooldown period the default for Dependabot version updates, a move designed to stop automated tools from spreading malicious code during the critical hours after a compromised package release.
The change, which took effect July 14, 2026, means Dependabot now waits at least 72 hours before opening pull requests for ordinary package version updates. The feature has been generally available since July 2025, but the three-day window is now automatic for all repositories.
Security Updates Stay Immediate
The cooldown applies only to version updates. Dependabot continues to deliver security patches for known vulnerabilities immediately, without any delay. This distinction ensures that fixes for publicly disclosed flaws reach developers as quickly as possible.
Creating a Detection Window
The cooldown targets a specific attack pattern: compromised maintainer accounts or hijacked publishing tokens used to upload malicious versions of popular libraries. Without the delay, automated tools like Dependabot can propagate these malicious releases to thousands of repositories within minutes of publication.
The three-day window gives security researchers and the broader community time to identify and report suspicious releases before Dependabot automatically distributes them. This shifts the advantage away from attackers who depend on the speed of automated update systems to compromise systems before detection.
PyPI Adds Parallel Defense
In a separate but complementary move, PyPI implemented its own time-based defense in July 2026. The Python package registry now rejects new file uploads to releases older than 14 days, preventing attackers from retroactively adding malicious files to established package versions.
Together, these measures represent a growing recognition that speed alone cannot be the guiding principle for package security. Some delay, strategically applied, can provide crucial protection against supply chain attacks that have plagued the open source ecosystem.
GitHub's security team emphasized that the cooldown is specifically designed to create a detection window for malicious releases stemming from account compromises or token theft. While some observers note the change may also reduce notification fatigue for developers, GitHub's stated primary goal remains supply chain security rather than workflow optimization.