GitHub Adds 3-Day Dependabot Cooldown to Limit Poisoned Package Adoption

GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project," the Microsoft-owned subsidiary said. According to GitHub, the

GitHub says Dependabot version updates now wait at least three days after a release is published before opening a pull request, and that this cooldown is the default for version updates while security updates still open immediately[1][2]. The report is primarily about reducing the chance that newly published packages are adopted before malicious or buggy behavior is detected, which maps to software supply-chain risk rather than a direct model or agent attack[1][5]. RealGround analysis: this is relevant to AI supply chain controls because dependency intake policy, update timing, and package trust are part of securing AI-enabled software delivery pipelines, especially where rapid dependency adoption could expose downstream systems to poisoned packages[1][15].