What happened
GitHub has introduced a default three-day cooldown period for Dependabot's version update feature. Rather than immediately opening a pull request the moment a new package version is published, Dependabot now waits 72 hours before acting. The pause is designed to give package maintainers and the security research community a window to identify and disclose any vulnerabilities or regressions in a freshly released version before it propagates into downstream codebases.
Why it matters for your business
Automated dependency updates have long been a double-edged sword: they reduce toil but can also pull in compromised or unstable releases before anyone has had a chance to sound the alarm. A three-day buffer meaningfully reduces the blast radius of supply-chain incidents, where a malicious or accidental bad release could otherwise reach thousands of repositories within hours. Engineering and security teams should treat this as a sensible default rather than a limitation — the marginal delay in receiving updates is a worthwhile trade-off for avoiding emergency rollbacks or incident response triggered by a poisoned dependency. Teams that require faster uptake for trusted internal packages can still override the cooldown in their Dependabot configuration.
What to watch next
Watch whether competing dependency management tools — such as Renovate — adopt similar cooldown mechanics, which could signal an industry-wide shift toward deliberate latency as a security primitive. GitHub may also extend the cooldown concept to security updates, where the calculus between speed and caution is more complex. Organizations running regulated workloads should document this default in their software supply-chain security policies, as it may satisfy or contribute to emerging compliance requirements around dependency vetting.