GitHub's New 3-Day Delay Could Stop Poisoned Packages in Their Tracks

Michael Miller · 2026-07-27

GitHub just dropped a quiet but significant update for Dependabot, and it's one that developers should pay attention to. The Microsoft-owned platform is now letting its automated dependency tool wait at least three days after a new release hits the public before opening a pull request. Why? To give the community a chance to spot malicious packages before they sneak into your project. It's a smart move, honestly. The open-source ecosystem moves fast, and attackers know that. They've been known to publish poisoned updates, wait for automated bots to pull them in, and then watch the chaos unfold. With this new cooldown, Dependabot gives you a three-day buffer to let the dust settle. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project," a GitHub spokesperson said. In other words, you're not stuck with 72 hours if that doesn't work for your team. ### How the Cooldown Actually Works This isn't some rigid, one-size-fits-all change. You still have control. The cooldown parameter in your dependabot.yml file is where you set the pace. By default, it's now three days, but you can tweak it to whatever makes sense for your workflow. - **Default behavior**: Dependabot waits 3 days after a package release before creating a pull request. - **Customization**: You can set a different cooldown period in your config file. - **Flexibility**: Teams with tighter security needs can extend it; those moving fast can shorten it. This matters because not every project has the same risk tolerance. A small side project might not need the same scrutiny as a core library used by thousands. The beauty here is that you can dial it in. ### Why Three Days Is the Sweet Spot Three days might not sound like a lot, but in the world of supply chain attacks, it's a game changer. Most malicious packages are caught within the first 48 hours after release. The community, security researchers, and automated scanners usually flag suspicious code pretty quickly. By waiting 72 hours, Dependabot essentially lets the early warning systems do their job. If a package is compromised, there's a good chance someone will notice before your bot blindly merges it. > "This cooldown gives teams a fighting chance against supply chain attacks without slowing down development." ### What This Means for Your Workflow If you're using Dependabot already, this change is automatic. You don't need to do anything unless you want to override the default. But here's where it gets interesting: you can now balance speed with safety more intentionally. Here are a few things to think about: - **Security-first teams**: Set a longer cooldown, like 5 or 7 days, for extra caution. - **Fast-moving teams**: Stick with 3 days or even reduce it to 1 if you're in a controlled environment. - **Mixed projects**: Use different configs for different repos based on risk level. It's not just about stopping attacks, either. This cooldown also gives you time to review changelogs, test updates, and avoid breaking changes that slip through the cracks. ### The Bigger Picture on Supply Chain Security GitHub's move here is part of a larger trend. Supply chain attacks have been on the rise, and platforms are finally stepping up. From npm to PyPI to Maven, everyone's looking for ways to make automated dependency management safer. This cooldown isn't a silver bullet, but it's a practical layer of defense. It doesn't replace code reviews or vulnerability scanning. It just buys you time. And in the world of software security, time is often the only thing standing between a clean build and a compromised system. ### Final Thoughts Dependabot just got a little smarter. Whether you're a solo developer or part of a large enterprise, this update gives you more control over how and when new code enters your project. It's a small change with big implications for anyone who cares about keeping their supply chain clean. So go ahead, check your dependabot.yml file, and decide what cooldown works for you. Just remember: three days could be all it takes to dodge a bullet.