What happened
Vercel has launched a beta of its Web Application Firewall (WAF) for Blob storage, extending automated threat filtering to object storage workloads on its platform. Separately, GitHub has introduced a mandatory three-day cooldown period for Dependabot version update pull requests. Under the new behavior, Dependabot holds off on proposing a dependency upgrade until 72 hours after a package release, giving maintainers and security researchers a window to surface and address any vulnerabilities baked into that release before it propagates downstream.
Why it matters for your business
Unprotected blob and object storage has been a recurring vector for data exposure, and Vercel's WAF beta gives teams a layer of automated defense without requiring custom middleware. On the dependency side, the Dependabot cooldown directly targets a known supply-chain attack pattern: malicious or flawed packages that get swept into codebases within hours of publication. Engineering teams that rely on automated dependency management should expect fewer instances of pulling in a compromised release, but they should also review existing Dependabot configurations to confirm the cooldown aligns with their release cadence and compliance requirements.
What to watch next
Vercel has not yet disclosed a general availability timeline for the Blob WAF, so teams evaluating it for production workloads should monitor the changelog closely. On the GitHub side, it remains to be seen whether the three-day window will be configurable or extended as threat intelligence on new releases matures. Broader industry movement toward staged dependency adoption suggests this cooldown model could influence similar policies at other package management and CI/CD platforms.