The case for a cooldown: Why Dependabot now waits before issuing version updates
Dependabot now waits at least three days after a release is published before opening a pull request to prevent supply chain attacks. This cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parame…
Intelligence analysis by Llama
Dependabot has introduced a cooldown feature to prevent supply chain attacks by waiting at least three days after a release is published before opening a pull request. This change aims to give maintainers, security researchers, and automated scanners time to spot a malicious version and get it pulled before it reaches your pull requests.
Imagine you have a new toy, and someone puts a bad sticker on it. If you get the toy right away, you might get the bad sticker too. But if you wait a few days, you can check the toy before you get it, and you'll be safe. Dependabot is like a toy checker. It waits a few days before getting new updates, so you can be sure they're safe.
Analysis
A Growing Share of Supply Chain Attacks
The malicious code rides in on a brand-new release, is published to a public registry, and gets pulled into build pipelines within minutes, before a human or a scanner has even looked at it. A cooldown changes that math. Waiting a few days before adopting a new release gives maintainers, security researchers, and automated scanners time to spot a malicious version and get it pulled before it ever reaches your pull requests.
Case Studies and GitHub Advisory Database Data
When attackers compromise a popular package, the poisoned version tends to have a short lifespan. It gets published, spreads through whatever installs it, and gets caught, usually within hours. The previous example was live for only two hours. Other widely used packages have followed the same arc, with compromised builds of Solana web3.js, Axios, and ua-parser-js each caught within a few hours of publication.
Why Three Days
Published malware targeting popular packages tends to get caught fast. A review of 21 widely reported supply chain incidents between 2018 and 2026 found the same pattern: malicious versions of axios, Solana web3.js, ua-parser-js, and Ledger Connect Kit were each pulled within hours of publication, and a cooldown could have filtered out the majority of these short-lived publishes before anyone installed them. Three days as the default balances two goals: it pushes you past the window where most of these attacks live, and it doesn’t hold your dependencies back longer than necessary.
Key points
- Dependabot now waits at least three days after a release is published before opening a pull request
- This cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project
- The cooldown feature aims to give maintainers, security researchers, and automated scanners time to spot a malicious version and get it pulled before it reaches your pull requests
- The cooldown is a crucial step in hardening the software supply chain for everyone who builds on GitHub
The cooldown feature will help prevent supply chain attacks and give maintainers and security researchers more time to spot and remove malicious versions. This will make the software supply chain safer for everyone who builds on GitHub.
While the cooldown feature is a step in the right direction, it may not be enough to prevent all supply chain attacks. Attackers may find ways to bypass the cooldown or use other tactics to compromise packages.
