Dependabot Introduces Default Package Cooldown for Version Updates

GitHub has introduced a default package cooldown for Dependabot version updates. This change ensures that new releases are available on their respective registries for at least three days before Dependabot opens a pull request for a version update, reducing the risk of users automatically adopting compromised packages shortly after a malicious release.

Default Three-Day Cooldown for Version Updates

Dependabot now implements a mandatory three-day waiting period for standard version updates. This mechanism is designed to act as a buffer, allowing the community and security researchers to identify and report malicious packages before they are widely distributed via automated pull requests.

This cooldown applies exclusively to version updates. Security updates—those triggered by verified vulnerability reports—continue to open immediately to ensure that critical security patches are applied without delay.

Community Perspectives on Supply Chain Security

The introduction of the cooldown period has sparked a variety of technical and strategic discussions among developers regarding the efficacy of supply chain security.

Impact on Detection and Mitigation

Some developers argue that a universal delay may inadvertently postpone the discovery of malicious packages. If a large volume of users delays updates, the number of active installations of a new version may decrease, potentially reducing the likelihood that a security researcher or an automated scanner discovers the infection in a timely manner.

The "Three-Day Window" Risk

There is concern that a three-day delay does not eliminate the risk but merely shifts the timeline. One observer noted that if a malicious package is released on Tuesday, the PR would open on Friday, potentially leading to merges over a weekend when security teams are less active:

So you exploit on Tuesday 12pm, dependabot opens a PR on Friday 12pm, people merge it, and your trojan's timer is set to go off over the weekend when nobody is patching.

Tooling and Ecosystem Fragility

Critics of the current state of software supply chains suggest that relying on vendor-imposed delays is a symptom of a broader failure in package management tooling. Some argue that language-specific package managers are reinventing distribution patterns that have existed in OS-level package managers for decades, while others suggest that registries themselves should enforce stricter security requirements for high-impact packages with millions of downloads.

Operational Considerations for Teams

For engineering teams, the cooldown period addresses a common friction point: the pressure to merge updates immediately. Some developers have expressed frustration with "dogmatic" security policies that force churn through constant updates regardless of whether the specific changes are relevant to their project's codebase.

For those seeking to implement similar cooldown strategies outside of Dependabot, community members have pointed to existing configurations for npm, pnpm, and yarn to manage update cadences manually.