# Dependabot updates now feature default package cooldown New package versions now undergo a 3-day waiting period. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-07-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/c75cb411-4c4e-43f6-90a1-89a24f02ab0a ## New Security Measure in Dependabot GitHub's Dependabot will now automatically wait 3 days before updating to new package versions. This default behavior allows time to detect potential security vulnerabilities or bugs in new releases. Security updates remain exempt from this rule. ## Protection Against Supply Chain Attacks Immediately released versions were often exploited by malicious actors. This cooldown period gives the community time to identify issues, preventing broken or harmful versions from automatically integrating into projects. ## Zero-Configuration Solution This feature requires no additional setup. The system automatically applies to all Dependabot version updates. Developers can customize or disable this period through the .github/dependabot.yml file if needed. ## Applies Across All Ecosystems The new policy will be effective for all supported package managers on GitHub.com. GitHub Enterprise Server (GHES) 3.23 will also include this feature for enterprise customers. ## Security Updates Exception Critical security patches remain exempt from this rule. Dependabot will continue creating PRs immediately for packages with reported vulnerabilities, ensuring system security isn't compromised in emergencies. ## Enhancing Developer Experience This change makes automated dependency management more secure while giving developers control. The approach that allows time for community feedback will help maintain the overall health of the software ecosystem. ## Sources covering this story - https://github.blog/changelog/2026-07-14-dependabot-version-updates-introduce-default-package-cooldown/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._