# Why Dependabot Now Waits Before Issuing Version Updates The new cooldown period for software security in Dependabot. - **Source:** [The GitHub Blog](https://brifing.si/source/9783c41a-41dd-45e0-8c71-c0930937342d) - **Published:** 2026-07-23 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0c7aec09-9583-4332-8e54-c35abf218313 ## Risks of Automatic Updates Automatic update tools immediately fetch new versions, which can lead to the rapid spread of malicious code. Such attacks are becoming an increasing threat in the software supply chain. ## The Importance of a Cooldown Period Dependabot now waits at least three days before fetching new versions. This period provides enough time to detect and remove malicious releases. ## Security Updates vs Version Updates Dependabot applies security updates immediately but enforces a cooldown period for version updates. This ensures quick fixes for vulnerabilities while encouraging caution in version updates. ## Case Studies and Data According to GitHub Advisory Database data, malicious packages are usually detected within hours. The cooldown period is a crucial step in mitigating the impact of such attacks. ## The Three-Day Cooldown The three-day cooldown provides sufficient time to bypass the window where most attacks occur. This period ensures consistent behavior as developers switch between tools. ## Defense Strategies While the cooldown period is effective against fast-spreading attacks, it should be used alongside other defense strategies. Locking dependencies with lockfiles and reviewing updates before merging are important steps. ## Sources covering this story - https://github.blog/security/supply-chain-security/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._