The case for a cooldown: Why Dependabot now waits before issuing version updates

In September 2025, a phishing attack compromised the credentials of an npm maintainer, leading to the publication of malicious versions of popular packages like chalk and debug, which altered cryptocurrency wallet addresses in browser apps. These versions were quickly detected and removed within two hours, but this incident highlighted the vulnerability of automated update tools that immediately integrate new releases before they are vetted. To counter this risk, GitHub's Dependabot introduced a default three-day cooldown for version updates, allowing time for malicious releases to be identified and pulled before reaching project builds. This cooldown does not apply to security updates, which remain immediate to ensure prompt vulnerability fixes. The three-day period aims to mitigate the risk of adopting compromised versions, aligning with patterns observed in various supply chain attacks where malicious code is typically caught within hours. While the cooldown offers a layer of defense against fast-moving threats, it is part of a broader strategy to secure the software supply chain, complementing other measures like pinning dependencies and disabling install scripts in CI. GitHub encourages feedback on this feature to enhance its efficacy in maintaining secure dependencies.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.