--- title: The case for a cooldown: Why Dependabot now waits before... description: GitHub's Dependabot now applies a default three-day cooldown before opening version update pull requests. The change is motivated by supply chain attacks where... canonical: https://daily.dev/posts/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates-axdx2ksnf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The case for a cooldown: Why Dependabot now waits before issuing version updates | daily.dev og:description: GitHub's Dependabot now applies a default three-day cooldown before opening version update pull requests. The change is motivated by supply chain attacks where... og:url: https://daily.dev/posts/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates-axdx2ksnf og:image: https://api.daily.dev/og/posts/aXDX2KsNf.png og:image:alt: The case for a cooldown: Why Dependabot now waits before issuing version updates og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The case for a cooldown: Why Dependabot now waits before issuing version updates **[GitHub Blog](https://daily.dev/sources/ghblog)** · 5 min read · 4 upvotes · 0 comments ## Summary GitHub's Dependabot now applies a default three-day cooldown before opening version update pull requests. The change is motivated by supply chain attacks where malicious package versions are published and caught within hours — but fast enough for automated tools to pull them into pipelines first. Data from the GitHub Advisory Database shows ~18 new malicious npm packages cataloged daily. The three-day window is designed to let maintainers, security researchers, and scanners catch poisoned releases before they reach your codebase. The cooldown is on by default and configurable via dependabot.yml. It's positioned as one layer of defense, not a complete solution — it doesn't protect against long-lived backdoors or compromised build systems. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How long does Dependabot now wait before opening a pull request for a new package version? Dependabot now waits at least three days by default after a release is published before opening a pull request for non-security version bumps. This cooldown period is configurable through the dependabot.yml file's cooldown option, allowing teams to set a shorter or longer window. The default is on automatically and requires no configuration changes to activate. _Track dependency and supply chain security changes like this alongside your other developer news on daily.dev._ ### Why did GitHub add a cooldown period to Dependabot instead of just scanning packages immediately? Malicious npm packages are typically caught and pulled within hours of publication, but automated tools like Dependabot previously grabbed new releases the moment they landed, before anyone had reviewed them. A review of 21 supply chain incidents from 2018 to 2026, including compromised versions of axios, Solana web3.js, and ua-parser-js, found a cooldown would have filtered out most of these short-lived malicious publishes. _Developers weighing dependency automation trade-offs can follow supply chain security coverage on daily.dev._ ### How many malicious npm packages get published each year according to GitHub's Advisory Database? In the year ending May 2026, the GitHub Advisory Database cataloged more than 6,500 npm malware advisories, up from roughly 6,200 the prior year, averaging about 18 newly identified malicious npm packages per day. This data underpinned GitHub's decision to add a default three-day cooldown to Dependabot's version update pull requests. _Stay on top of npm ecosystem security trends and advisories via daily.dev._ ## Similar posts on daily.dev - [Dependabot version updates introduce default package cooldown](https://daily.dev/posts/dependabot-version-updates-introduce-default-package-cooldown-lt7jppsaq) · GitHub Changelog · 1 upvotes · 1 comments - [We should all be using dependency cooldowns](https://daily.dev/posts/we-should-all-be-using-dependency-cooldowns-8o7pte603) · Lobsters · 0 upvotes · 0 comments - [Dependency cooldowns turn you into a free-rider](https://daily.dev/posts/dependency-cooldowns-turn-you-into-a-free-rider-xqq71wkpm) · Cal Paterson · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#github](https://daily.dev/tags/github), [#npm](https://daily.dev/tags/npm), [#dependabot](https://daily.dev/tags/dependabot) [View this post on daily.dev](https://daily.dev/posts/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates-axdx2ksnf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The case for a cooldown: Why Dependabot now waits before issuing version updates","url":"https://daily.dev/posts/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates-axdx2ksnf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates-axdx2ksnf"},"datePublished":"2026-07-23T16:00:56.025Z","dateModified":"2026-09-14T08:03:21.372Z","description":"GitHub's Dependabot now applies a default three-day cooldown before opening version update pull requests. The change is motivated by supply chain attacks where...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6886f9dbace2935f00cfe86fa0d7fb2?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d6886f9dbace2935f00cfe86fa0d7fb2?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitHub Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitHub Blog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/106cf162b88840808484d4b5429b59b1","url":"https://daily.dev/sources/ghblog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates-axdx2ksnf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,github,npm,dependabot","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitHub Blog","item":"https://daily.dev/sources/ghblog"},{"@type":"ListItem","position":3,"name":"The case for a cooldown: Why Dependabot now waits before issuing version updates"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-case-for-a-cooldown-why-dependabot-now-waits-before-issuing-version-updates-axdx2ksnf#faq","mainEntity":[{"@type":"Question","name":"How long does Dependabot now wait before opening a pull request for a new package version?","acceptedAnswer":{"@type":"Answer","text":"Dependabot now waits at least three days by default after a release is published before opening a pull request for non-security version bumps. This cooldown period is configurable through the dependabot.yml file's cooldown option, allowing teams to set a shorter or longer window. The default is on automatically and requires no configuration changes to activate. Track dependency and supply chain security changes like this alongside your other developer news on daily.dev."}},{"@type":"Question","name":"Why did GitHub add a cooldown period to Dependabot instead of just scanning packages immediately?","acceptedAnswer":{"@type":"Answer","text":"Malicious npm packages are typically caught and pulled within hours of publication, but automated tools like Dependabot previously grabbed new releases the moment they landed, before anyone had reviewed them. A review of 21 supply chain incidents from 2018 to 2026, including compromised versions of axios, Solana web3.js, and ua-parser-js, found a cooldown would have filtered out most of these short-lived malicious publishes. Developers weighing dependency automation trade-offs can follow supply chain security coverage on daily.dev."}},{"@type":"Question","name":"How many malicious npm packages get published each year according to GitHub's Advisory Database?","acceptedAnswer":{"@type":"Answer","text":"In the year ending May 2026, the GitHub Advisory Database cataloged more than 6,500 npm malware advisories, up from roughly 6,200 the prior year, averaging about 18 newly identified malicious npm packages per day. This data underpinned GitHub's decision to add a default three-day cooldown to Dependabot's version update pull requests. Stay on top of npm ecosystem security trends and advisories via daily.dev."}}]} ```