GitHub Dependabot Adds Three‑Day Cooldown for Non‑Security Updates
Verify Dependabot uses the default 3‑day cooldown; no action needed unless you want to override.
Verify Dependabot is using the default 3‑day cooldown; no action needed unless you want to override.
Summary
GitHub has rolled out a new default setting for its Dependabot service that introduces a three‑day waiting period before the tool opens pull requests for non‑security dependency updates. The change, which applies to all ecosystems supported on GitHub.com, is now enabled by default on GitHub Enterprise Server version 3.23. The cooldown is intended to give maintainers and the wider community a buffer to detect potential supply‑chain attacks that could arise from a compromised or buggy release.
The update does not affect the handling of security updates, which continue to be opened immediately to ensure that critical fixes are not delayed. Users can still customize the behavior by editing the cooldown option in a repository’s .github/dependabot.yml file, or by opting out entirely. The new feature is part of GitHub’s broader effort to reduce the risk of merging malicious releases into projects, a concern that has grown as supply‑chain attacks become more common in the software development world.
Dependabot has long been a popular tool for automating dependency management, and the introduction of a cooldown period reflects a shift toward greater security awareness. By giving teams a short window to review changes before they are merged, GitHub hopes to catch problematic updates that might otherwise slip through. The change also provides maintainers with more granular control over when non‑security updates are incorporated, balancing the need for timely upgrades with the imperative of safeguarding codebases.
Key changes
- Dependabot now waits 3 days after a new release before opening a PR
- Cooldown is default, no configuration needed
- Improves security by reducing premature dependency updates