The case for a cooldown: Why Dependabot now waits before issuing version updates

Last September, an attacker compromised popular npm packages downloaded more than two billion times a week, injecting code designed to steal cryptocurrency wallet addresses. The poisoned versions were live for roughly two hours before the community caught them—but that window is long enough for automated update tools to grab the new version and create a pull request. The GitHub Blog reports that Dependabot, GitHub's built-in dependency update tool, now adds a safeguard: for routine version updates, it waits at least three days after a release goes live before opening a pull request. Security patches skip this delay entirely. According to GitHub's review of over twenty supply chain incidents, three days is the right timing—most malicious releases are caught and removed within hours, so the cooldown filters them out before they reach developers. The feature is on by default and can be configured if your project needs a different window.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton