AATMAAATMA
Menu
Back to News
Technology

GitHub Dependabot Introduces Three-Day Cooldown for Version Updates

GitHub Dependabot now enforces a default three-day cooldown on version updates to protect repositories from fast-moving supply chain attacks and malware.

GitHub Dependabot now enforces a default three-day cooldown on version updates to protect repositories from fast-moving supply chain attacks. This delay allows security researchers time to identify and remove malicious packages before they reach developers. While effective against short-lived malware, this feature must be combined with other security practices like dependency pinning.

A New Defense Against Supply Chain Attacks

GitHub has implemented a significant change to Dependabot to combat a growing threat in the software supply chain. The automated tool will now wait at least three days after a package release before opening a version update pull request. This strategic delay is designed to protect developers from fast-moving malware campaigns.

The Mechanics of the Attack Vector

Recent security incidents highlight a dangerous pattern. Attackers compromise popular packages, publish a poisoned version, and watch as automated tools immediately pull the malicious code into build pipelines. A notable example occurred in September 2025, when an attacker phished an npm maintainer and published booby-trapped versions of widely used packages. The compromised code was live for only two hours before the community intervened.

Automated update tools, by design, grab the newest release the moment it lands. This speed, while convenient, becomes a critical vulnerability when the latest release is malicious.

How the Cooldown Mitigates Risk

The three-day default balances security with practicality. Published malware targeting popular packages tends to get caught quickly. Historical data from 2018 to 2026 shows that malicious versions of packages like axios and Solana web3.js were typically pulled within hours of publication.

By waiting three days, Dependabot allows maintainers, security researchers, and automated scanners time to identify and remove the malicious version. This simple delay filters out the majority of short-lived attacks before they ever reach a developer's pull request queue.

Layered Security Remains Essential

While the cooldown addresses the fast-moving attack pattern, it is not a silver bullet. It does little against long-game attacks, such as dormant backdoors or compromised build systems. Developers must continue to pin dependencies with lockfiles, disable install scripts in continuous integration environments, and review updates carefully before merging.

This default behavior is now active for all users. It represents a crucial step in hardening the software supply chain, proving that sometimes, slowing down is the most effective way to stay secure.