Dependabot updates now feature default package cooldown
New package versions now undergo a 3-day waiting period.
1New Security Measure in Dependabot
GitHub's Dependabot will now automatically wait 3 days before updating to new package versions. This default behavior allows time to detect potential security vulnerabilities or bugs in new releases. Security updates remain exempt from this rule.
2Protection Against Supply Chain Attacks
Immediately released versions were often exploited by malicious actors. This cooldown period gives the community time to identify issues, preventing broken or harmful versions from automatically integrating into projects.
3Zero-Configuration Solution
This feature requires no additional setup. The system automatically applies to all Dependabot version updates. Developers can customize or disable this period through the .github/dependabot.yml file if needed.
4Applies Across All Ecosystems
The new policy will be effective for all supported package managers on GitHub.com. GitHub Enterprise Server (GHES) 3.23 will also include this feature for enterprise customers.
5Security Updates Exception
Critical security patches remain exempt from this rule. Dependabot will continue creating PRs immediately for packages with reported vulnerabilities, ensuring system security isn't compromised in emergencies.
6Enhancing Developer Experience
This change makes automated dependency management more secure while giving developers control. The approach that allows time for community feedback will help maintain the overall health of the software ecosystem.