Instead of immediately opening pull requests when newer dependency versions are released, Dependabot now waits three days before suggesting upgrades, thus increasing the likelihood that malicious releases are identified and removed before they can be integrated.
GitHub product manager Carlin Cherry explains the new cooldown policy by pointing to a real dependency-poisoning incident from a few years ago, when several widely used packages, collectively downloaded more than 2 billion times a week, were replaced with compromised versions. Although these versions were quickly detected and removed from npm, the roughly two hours they remained available were "more than enough time for an automated update tool to see the new version, open a pull request, and put it in front of your team".
According to Cherry,
That pattern sits behind a growing share of supply chain attacks. The malicious code rides in on a brand-new release, is published to a public registry, and gets pulled into build pipelines within minutes, before a human or a scanner has even looked at it.
To help prevent these scenarios, Dependabot now waits at least three days before opening a pull request for a dependency update after a new non-security release is published. This behavior is configurable through the cooldown option in dependabot.yml, allowing teams to tailor it to their needs. The cooldown does not apply to security updates, ensuring that fixes for publicly known vulnerabilities are not delayed.
Cherry notes that a three-day delay is emerging as a community consensus, "so this default behavior keeps Dependabot consistent as developers move between tools". The cooldown, however, does not replace the rest of defenses against other kinds of supply chain attacks:
Because a cooldown only addresses the fast-moving case, it should be one layer among several. Some additional steps to take include pinning dependencies with lockfiles, disabling install scripts in CI where you can, scoping the tokens in your build pipelines, and reviewing updates before they merge.
Reddit user broaddiscovery_941 reinforced the idea that a three day cooldown is effective:
Three days feels about right for catching the worst breakage before it hits your CI. Most dodgy releases get flagged on GitHub or Reddit within a day or two anyway, so the wait gives you time to see the drama unfold before merging anything.
On Hacker News, commenter zihotki questioned whether cooldowns could eventually become less effective, noting that "if everyone will be delaying updates", there may be "less chances to catch it in time". In response, user woodruffw argued that that the security model behind cooldowns does not rely on end users encountering malicious packages, but on dedicated security scanning efforts: "the security assumption behind cooldowns rests on security scanning parties, not on innocent users being victimized". While acknowledging that three days is a relatively short delay, they added that it should still provide sufficient lead time for these scanning systems to identify and flag threats.