GitHub has introduced a default three-day cooldown period for Dependabot version update pull requests, delaying the tool from automatically proposing new dependency versions the moment they are published to a registry. The change is designed to address a well-documented pattern in software supply chain attacks, in which malicious code is embedded in a new package release and propagates into build pipelines within minutes through automated update tooling, often before any human reviewer or security scanner has had a chance to examine it. A September 2025 incident illustrated the problem clearly: an attacker phished the credentials of a single npm maintainer and published poisoned versions of chalk, debug, and around a dozen other widely used packages, collectively downloaded more than two billion times per week. The compromised versions rewrote cryptocurrency wallet addresses inside any browser application that loaded them and remained live for roughly two hours before being pulled, a window that is more than sufficient for automated tooling to open a pull request and surface the malicious update to a development team.
The cooldown applies exclusively to version updates, which keep dependencies current regardless of any known vulnerability, and not to security updates, which respond to published advisories and continue to open pull requests immediately. GitHub’s rationale for the three-day default is grounded in historical incident data: a review of 21 widely reported supply chain attacks between 2018 and 2026 found that malicious versions of packages including Axios, Solana web3.js, ua-parser-js, and Ledger Connect Kit were each detected and pulled within hours of publication. A three-day window would have filtered out the majority of these short-lived malicious publishes before they reached downstream projects. GitHub Advisory Database data adds further context, showing that more than 6,500 npm malware advisories were published in the year ending May 2026, equating to approximately 18 newly catalogued malicious npm packages per day.
The default cooldown period is configurable via the dependabot.yml file, allowing teams to set shorter or longer windows depending on their risk tolerance and operational requirements. GitHub notes that other tools in the dependency management ecosystem have independently converged on similar three-day defaults, making Dependabot’s new behaviour consistent with broader community practice. The feature is framed as one layer in a defence-in-depth approach rather than a comprehensive solution, targeting specifically the narrow window between a malicious publication and community detection that has repeatedly proven to be the most dangerous phase of supply chain attacks.