--- title: Announcing Dependabot Configuration Enhancements:... description: StepSecurity has added cooldown and group configuration support for Dependabot, giving organizations control over how dependency update PRs are batched and how... canonical: https://daily.dev/posts/announcing-dependabot-configuration-enhancements-cooldown-and-group-support-6ungivtsj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Announcing Dependabot Configuration Enhancements: Cooldown and Group Support | daily.dev og:description: StepSecurity has added cooldown and group configuration support for Dependabot, giving organizations control over how dependency update PRs are batched and how... og:url: https://daily.dev/posts/announcing-dependabot-configuration-enhancements-cooldown-and-group-support-6ungivtsj og:image: https://api.daily.dev/og/posts/6uNGiVTsJ.png og:image:alt: Announcing Dependabot Configuration Enhancements: Cooldown and Group Support og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Announcing Dependabot Configuration Enhancements: Cooldown and Group Support **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 7 min read · 0 upvotes · 0 comments ## Summary StepSecurity has added cooldown and group configuration support for Dependabot, giving organizations control over how dependency update PRs are batched and how frequently they arrive. The group attribute lets teams combine related updates into a single PR (e.g., all minor/patch production deps in one weekly PR), while cooldown sets a minimum interval between new Dependabot PRs to prevent queue flooding. These features complement StepSecurity's existing npm Package Cooldown check, which blocks PRs introducing recently published packages. The announcement is framed against a wave of March 2026 supply chain attacks — including the axios compromise and CanisterWorm npm worm — arguing that teams with unmanageable Dependabot queues were most vulnerable. Both features are available through StepSecurity's centralized configuration and can be applied across all repositories in an organization. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Dependabot version updates introduce default package cooldown](https://daily.dev/posts/dependabot-version-updates-introduce-default-package-cooldown-lt7jppsaq) · GitHub Changelog · 1 upvotes · 1 comments - [Package Managers Need to Cool Down](https://daily.dev/posts/package-managers-need-to-cool-down-ee6vqq1u6) · Lobsters · 0 upvotes · 0 comments - [Dependency cooldowns turn you into a free-rider](https://daily.dev/posts/dependency-cooldowns-turn-you-into-a-free-rider-xqq71wkpm) · Cal Paterson · 0 upvotes · 0 comments - [Introducing Secure Registry: install-time defense for the npm supply chain](https://daily.dev/posts/introducing-secure-registry-install-time-defense-for-the-npm-supply-chain-whugo2iji) · StepSecurity · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github-actions](https://daily.dev/tags/github-actions), [#dependabot](https://daily.dev/tags/dependabot) [View this post on daily.dev](https://daily.dev/posts/announcing-dependabot-configuration-enhancements-cooldown-and-group-support-6ungivtsj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Announcing Dependabot Configuration Enhancements: Cooldown and Group Support","url":"https://daily.dev/posts/announcing-dependabot-configuration-enhancements-cooldown-and-group-support-6ungivtsj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/announcing-dependabot-configuration-enhancements-cooldown-and-group-support-6ungivtsj"},"datePublished":"2026-04-15T14:47:17.097Z","dateModified":"2026-04-15T14:48:00.941Z","description":"StepSecurity has added cooldown and group configuration support for Dependabot, giving organizations control over how dependency update PRs are batched and how...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4c12798b97d28c1dc6003d3615cdd646?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4c12798b97d28c1dc6003d3615cdd646?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/announcing-dependabot-configuration-enhancements-cooldown-and-group-support-6ungivtsj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github-actions,dependabot","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"Announcing Dependabot Configuration Enhancements: Cooldown and Group Support"}]} ```