GitHub's New 3-Day Dependabot Cooldown Could Save Your Project from Poisoned Packages

Michael Miller · 2026-07-27

GitHub just dropped a quiet but significant update to Dependabot, and if you're serious about supply chain security, this one's worth your attention. Here's the deal: Dependabot now waits at least three days after a new package release before opening a pull request. That's right — a built-in cooldown period designed to give the community time to spot malicious code before it sneaks into your project. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project," the Microsoft-owned subsidiary said. So you're not locked in. You can tweak it to match your risk tolerance. ### Why the Three-Day Wait Matters If you've been following the news around software supply chain attacks, you know that "poisoned packages" are a growing threat. Bad actors release updates that look legitimate but contain hidden malware. Within hours, automated tools like Dependabot can pull those updates into thousands of projects before anyone realizes something's wrong. By adding a three-day cooldown, GitHub gives the community a window to detect and report suspicious activity. It's a simple but smart move that could prevent a lot of headaches. ### What This Means for Your Workflow - **More control**: You can adjust the cooldown period in your dependabot.yml file. If three days feels too long for critical security patches, you can shorten it. If you're extra cautious, you can extend it. - **Less risk**: The biggest win here is reducing the chance of automatically adopting a malicious update. Even a few days can make a huge difference. - **No extra work**: Dependabot still handles the heavy lifting. You just get a smarter, safer process. ### How to Configure the Cooldown Setting it up is straightforward. In your dependabot.yml file, add or modify the `cooldown` parameter: ```yaml version: 2 updates: - package-ecosystem: "npm" directory: "/" schedule: interval: "weekly" cooldown: 5 ``` This example sets a five-day cooldown for npm dependencies. You can choose any number of days that works for your team. ### A Quick Reality Check Look, no tool is perfect. A three-day cooldown won't catch every poisoned package, especially if the malicious code is well-hidden or the attacker has a long game. But it's a meaningful step in the right direction. Combined with other best practices like code reviews, dependency pinning, and regular audits, it adds another layer of protection. ### The Bottom Line GitHub's Dependabot cooldown is a welcome addition for anyone managing open-source dependencies. It's not flashy, but it's practical. And in a world where supply chain attacks are becoming more common, every bit of defense helps. If you haven't updated your dependabot.yml yet, now might be a good time to take a look. A few minutes of configuration could save you from a lot of pain down the road.