Dependabot adds a 3-day cooldown before opening PRs on new releases

Intelligence Summary

GitHub introduced a new cooldown option for Dependabot to reduce the speed of dependency updates. After a release is published, Dependabot can wait at least three days before it opens an update pull request. The behavior is controlled via configuration in dependabot.yml, and teams can adjust the cooldown to match their risk tolerance. This change aims to limit the chance of adopting newly published packages that later turn out to be malicious or unsafe. Project owners should review their dependabot.yml settings to ensure the cooldown aligns with their supply-chain security needs.

Recommended Action

Review source details and prioritize according to asset exposure.

Topics